Robust digital image watermarking scheme using wave atoms with multiple description coding

In this article, a robust blind watermarking scheme using wave atoms with multiple descriptions is proposed. In the presented scheme, the watermark image is embedded in the wave atom transform domain. One of the sub-bands is used to carry watermark data. The experimental results indicate that superiority of the proposed method against common attacks such as JPEG compression, Gaussian noise addition, median filtering, salt and pepper noise, etc., compared with the existing watermarking schemes using multi-scale transformations.


Introduction
Along with the rapid development and widespread use of multimedia and computer network technologies, various multimedia products such as image, audio, video are increasingly exposed to illegal possession, reproduction, and dissemination. Unrestricted copying and convenient digital media manipulation cause considerable financial loss and show up an issue of intellectual property rights [1,2]. Digital watermarking provides a way to imperceptibly embed digital information into both digital (images, video, audio) and conventional (printed material) media contents. By extracting this secret digital data, the copyright of digital media can be protected and authentication to digital media can also be provided as well [3,4].
Robustness and imperceptibility are two fundamental but contradicting properties in robust digital watermarking. Robustness means that the watermarked data can withstand different image processing attacks and imperceptibility means that the watermark would not introduce any perceptible artifacts [1]. Watermarking systems can be classified to three main types which are non-blind, semi-blind, and blind according to whether the original media is required or not during the extracting processes [5]. Non-blind technique requires the original image; semi-blind technique only needs the watermark; and blind technique requires neither the original image nor the watermark.
Majority of watermarking schemes are implemented in spatial domain or in frequency domain. Large numbers of literatures show that the performance of watermarking schemes based on frequency domain is far better than those operating in the spatial domain. For this reason, large numbers of transformation-based watermarking algorithms are proposed using discrete cosine transform (DCT) [6], discrete Fourier transform [7], and wavelets [8] in the past few decades.
It is known that natural images do not simply include 1D piecewise scan-line, and have many discontinuity points. In fact, wavelet as a separable 2D multi-resolution transform does not possess directional property and simply follows the curves as horizontal-vertical lines and essentially cannot represent 2D directional discontinuity which is common in as image edges [9]. In 1999, Candes and Donoho [10] introduced a new multi-scale transform called the curvelet transform which can use a few samples to represent edges and other singularities along curves much more efficiently than traditional transforms like wavelet [11]. After this, certain watermarking schemes based on curvelet domain have been proposed [12,13].
In 2006, Demanet [14] introduced a generalization of curvelets called wave atoms and it can greatly be matched with warped oscillatory functions [15]. By using this specific transform, oriented textures have a significantly sparser expansion than in other fixed standard representations like Gabor filters, wavelets, and curvelets. In the area of image processing, there have been some preliminary studies done on image denoising using wave atom transform and the relative results have proved its great potential [16,17]. Due to its great performance in image denoising, one becomes naturally wondering if wave atom transform can be extended to the field of watermarking. Until now, there is little research exploring the applications of wave atom transform related to the watermarking aspect.
In [18], it is pointed out that senisitivity of human eye to noises is less in textured area and more in the smooth areas according to the HVS characteristics, litlle modification of textures area should be unrecognizable by human eye. From our point of view, most of the watermark energy can be kept if the watermark is embedded in the texture area rather than the smooth one after common image processing attacks. As the sparse property of wave atom coefficients is well suited for the texture area, we, therefore, try to embed the watermark into wave atoms domain to see whether a comprising result comes out.
In this article, we present a blind watermarking method using wave atom transform based on the multiple description coding (MDC) [19]. A number of experiments are conducted to investigate the feasibility of wave atom transform in the area of watermarking through capacity and robustness tests. Finally, the experimental results verify our assumption that the watermarking scheme based on wave atom domain can be robust against common signal processing attacks. The remainder of this article is organized as follows: In Section 2, wave atom transform is presented. In Section 3, MDC is described. The details of embedding and extracting approaches are given in Section 4. In Section 5, the robustness tests for the proposed method and comparisons with other watermarking schemes are presented. Besides, the capacity and security analyses of the proposed method are provided in Sections 6 and 7, respectively. The conclusion is addressed in Section 8.

Wave atom transform
Demanet and Ying [15] introduced wave atoms that can be seen as a variant of 2D wavelet packets and obey the parabolic scaling law, i.e., wavelength~(diameter) 2 . They proved that oscillatory functions or oriented textures (e.g., fingerprint, seismic profile, engineering surfaces) have a significantly sparser expansion in wave atoms than in other fixed standard representations like Gabor filters, wavelets, and curvelets.
Wave atoms have the ability to adapt to arbitrary local directions of a pattern, and to sparsely represent anisotropic patterns aligned with the axes. Wave atoms precisely interpolate between Gabor atoms and directional wavelets in the sense that the period of oscillations of each wave packet (wavelength) is related to the size of essential support via parabolic scaling, i.e., wavelength is directly proportional to the square of the diameter.

1D discrete wave atoms
Let ψ m,n j (x) represent a 1D family of wave packets, where j, m ≥ 0, n ∈ Z centered in frequency around ± w j,m = ± π2 j m with C 1 2 j ≤ m ≤ C 2 2 j and centered in space around x j,n = 2 − j n. Dyadic scaled and translated versions ofψ 0 m are combined in the frequency domain and the basis function can be written as For each wave number w j,m , the coefficient c j,m,n can be seen as a decimated convolution at scale 2 -j . Input sample u is discretized at . . . ; N and discrete coefficients C j,m,n D are computed using a reduced inverse FFT inside an interval of size 2 j + 1 π centered about the origin.
A simple wrapping technique is used for the implementation of discrete wavelet packets and the steps are shown as follows.
1. Perform an FFT of size N of the samples u(k). 2. For each pair (j,m), wrap the product ψ J m û by periodicity inside the interval [−2 j π, 2 j π] and perform an inverse FFT of size 2 j to obtain C j,m,n D 3. Repeat step 2 for all pairs (j,m).

2D discrete wave atoms
2D orthonormal basis functions with four bumps in the frequency plane can be formed by individually taking products of 1D wave packets. 2D wave atoms are indexed by u = (j,m,n), where m = (m1, m2) and n = (n1, n2). In 2D case, Equation (1) is modified as follows.
A dual orthonormal basis can be defined from the "Hilbert-transformed" wavelet packets The combination of Equations (3) and (4) provides basis functions with two bumps in the frequency domain, symmetric with respect to the origin and thus directional wave packets oscillate in one single direction.
φ u (1) and φ u (2) form the wave atom frame and are denoted jointly as ϕ u . The wave atom algorithm is based on the apparent generalization of the 1D wrapping strategy to two dimensions.

MDC
MDC can be applied to digital image watermarking as suggested by Chandramouli et al. [19] and has been worked with DCT and contourlet transform domain [19,20]. The idea of multiple descriptions (MD) is to divide the source information into various descriptions such that a receiver is able to reconstruct the original source by using one or more of these source descriptions within some prescribed distortion constraints [19]. For example, a host image is decomposed into two descriptions, i.e., odd and even pixel intensities (two descriptions). These descriptions are chosen in such a way that there are some correlations between them. One description can be used for watermark insertion, while the other one is taken as a reference for watermark extraction. After watermark embedding, two descriptions are combined to form the

Proposed method
Imperceptibility is one of the most important features to evaluate the performance of the watermarking algorithm. In this study, the fourth scale band is selected to be embedded instead of the lowest or the highest subbands. The multiplicative-based approach is adopted to embed data. The original image in which the watermark to be embedded is first decomposed into four subimage descriptions by MDC. The watermark can only be extracted by collecting all these descriptions. The main idea of the proposed method is to adjust the energy of certain squares within the wave atom tiling for different descriptions according to the watermark bit value. By comparing the energy differences between the square pairs in the wave atom tiling corresponding to odd and even descriptions, the embedded watermark can be extracted.
First, suppose that I denotes the host image of size N × N. The host image is then decomposed into four descriptions as follows.
where p = 1,2,. . .,N/2, q = 1,2,. . .,N/2. I 1 , I 2 , I 3 , and I 4 denote four descriptions, namely upper odd description, upper even description, lower odd description, and lower even description, respectively. As can be seen in Equation (6), the descriptions I 1 and I 3 are similar to I 2 and I 4 , respectively. After applying the wave atom transform to four descriptions, the wave atom coefficients corresponding to odd and even descriptions are approximately equal or similar.
In the embedding process, according to the value of tobe-embedded bit and the characteristic of descriptions, the means of certain squares in the wave atom tiling are adjusted to be larger or smaller. Similarly, in the extracting   procedure, the means of those squares are compared between the odd and the even descriptions corresponding to the same position to obtain the secret bits. The details of the proposed method are shown below.

The embedding procedure
The proposed embedding scheme is shown in Figure 2.
Let I denotes the original image and w c denotes the watermark message, where w c = (w 1 ,w 2 ,. . .,w p ) and p is the length of watermark. To enhance the security of watermark w c , Arnold transform is applied at first. The function of Arnold transform is given by Point (x, y) is shifted to another point x', y'. Thus, the origin watermark w c is permuted by this transform. The embedding procedure is described as follows.

Apply Arnold transforms to origin watermark w c for
H times, where k and H are used as secret keys. 2. Divide the original image I of size N × N to form four descriptions, I 1 , I 2 , I 3 , and I 4 , by MDC using Equation (6). 3. Wave atom transform is then applied to these four descriptions, namely upper odd description, upper even description, lower odd description, and lower even description. Four coefficient sets S 1 , S 2 , S 3 , and S 4 corresponding to these descriptions are then obtained. Five scale bands are generated for each description via wave atom transform. In this study, the fourth scale band is selected to embed the permuted watermark, since it is placed in the middle high-frequency band. 4. Among the sets S 1 , S 2 , S 3 , and S 4 , the coefficients C u in the fourth sub-band are selected to be modified provided that their absolute values are smaller than the threshold r, i.e., C u ≤|r|, where u = (j,m 1 ,m 2 ,n 1 ,n 2 ) of integer-valued quantities indexes a point (x u , ω u ) in phase space and r is to determine the number of coefficients for embedding. 5. Embed the first half of the permuted watermark in S 1 and S 2 , while S 3 and S 4 are used to embed the rest, each of length p/2 bits. In the fourth scale band, two blocks are selected as demonstrated in Figure 2, one from the odd description (S 1 or S 3 ) and the other from the even one (S 2 or S 4 ), to embed one secret bit, where the phase positions of these two squares are equal. If the bit to be embedded is "1", the coefficients in the odd description of the selected blocks will be enlarged while the coefficients in the even description of the corresponding block will be minimized. In case, the bit to be embedded is "0", the embedded process is   reversed, i.e., the coefficients in the odd descriptions are minimized and the ones in the even descriptions are enlarged. For all non-empty squares in S 1 and S 2 , where abs(.) is the absolute value of (.), u=(j,m 1 ,m 2 ,n 1 , n 2 ) of integer-valued quantities, α a , α b , α c , and α d are the strength factors used to control robustness and perceptual quality, and δ is the embedding threshold. Similarly, the modification of coefficients within S 3 and S 4 is as same as the above operation, in which S 1 and S 2 are replaced by S 3 and S 4 , respectively. Four altered wave atom coefficient sets are obtained at last.
6. Apply the inverse wave atom transform to the modified coefficient sets S 1 ' , S 2 ' , S 3 ' , and S 4 ' . 7. Obtain the output watermarked image I ' by collecting the four modified descriptions.

The extracting procedure
When extracting the watermarks, the original image I is not required. The proposed watermark extraction scheme is shown in Figure 3. Denote I ' as the watermarked image for watermark detection. The extracting process is described as follows.
1. Divide I ' to four descriptions, I 1 ' , I 2 ' , I 3 ' , and I 4 ' , by MDC using Equation (6). 2. Wave atom transform is then applied to these descriptions I 1 ' , I 2 ' , I 3 ' , and I 4 ' and form four coefficient Within the fourth scale band, a number of blocks are created by the wave atom transform. By comparing the means of these blocks between the odd and even descriptions at the corresponding position, the watermark sequence w is extracted. The squares of S 1 ' (odd description) and S 2 ' (even descriptions) are denoted as W 1 (j,m,n) and W 2 (j,m,n), respectively. It is described as follows: For all non-empty squares in S 1 ' and S 2 ' , where j is the scale, m, n represent the phase, and mean(.) represents the mean value of (.) and abs(.) is the absolute values of (.). Referring to Equation (9), half of the watermark w g is extracted first. Accordingly, the rest will be extracted by replacing S 1 ' and S 2 ' with S 3 ' and S 4 ' , respectively, in Equation (9). The watermark w' c can then be reconstructed by the merging of these two segments. 4. Use Arnold transform to the obtained watermark w c for (T-H) times, where T is the period of Arnold transform.

Experimental results
In this section, not only robustness test of the proposed scheme is investigated, analysis of various embedding parameters and comparisons with other novel conventional schemes are also made. First, we introduce the common quality metric used for evaluating the robustness of watermarking algorithm, namely normalized crosscorrelation (NC), usually representing the correlation between the embedded watermark W and the extracted watermark W ' . Its definition is shown as below.
NC ¼ where M W and N W denote the width and height of the watermark, respectively. In the following experiment, 512 × 512 gray-scale image, Lena as shown in Figure 4a, is served as a test image. The watermarked image for our scheme is illustrated in Figure 4b and the binary watermark of size 16 × 16 is shown in Figure 4c. The extracted watermark is shown in Figure 4d. The experimental system is composed of an Intel Core-Quad CPU with a 2.66 GHz core and 3 GB DDR2.
The watermarked image quality is represented by the peak-signal-to-noise ratio (PSNR) between the original and watermarked images, which is calculated by where the mean squared error (MSE) between the original and watermarked images is defined by where I(p, q) and I ' (p, q) denote the pixel value at position (p, q) of the original image I and the watermarked image I ' with size of N × N pixels, respectively.

Analysis of embedding parameter
In the proposed method, various embedding parameters α a , α b, α c , α d , and δ have critical role on the quality of watermarked image and the robustness of the watermark. In general, it is possible to obtain the best compromise between the robustness and invisibility with optimal parameters. However, it is rather difficult to determine a truly optimal parameter value, as these parameters are basically influenced to each other when we change one of them. In the rest of this section, evaluation tests are then carried out so as to determine the suitable values for each parameter used. An Image 'Lena' is used in this study as shown in Figure 4a. It is expected that using other images perform most likely the same as the presented one. Figure 5a-f shows the mutual relationships between the parameters α a , α b, α c , α d , r, and δ, respectively. Consider that they all are critical to determine the robustness for the watermark and the imperceptibility for the watermarked image, which are described as below.
We plot four graphs to show the performance of our scheme by choosing distinct parameter values α a , α b, α c , α d , and δ in terms of PSNR and NC values, as shown in Figure 5a-d. Notice that the optimal PSNR value can be identified with a particular combination of α a and α b , while δ represents a threshold for distinguishing the condition to use α a or α b . In Figure 5a,b, the parameters α c , α d , and r are fixed to 0.8, 0.8, and 60 separately, for   determination of the best parameter set for α a , α b , and δ. It can be seen from Figure 5a that our scheme can obtain the maximum PSNR value when α a and α b are set at 0.8 and 1.2, respectively. In addition, five irregular planes are demonstrated in Figure 5a, each with a unique δ ranging from 10 to 50. The shape of these planes looks like a series of mountains, each carrying distinct characteristic. Refer to the plane with respect to δ = 50, it is obvious that the corresponding PSNR values are mostly higher than those in other planes with respect to δ = {10. . .40}. Clearly, only when δ = 50, the maximum PSNR value can be determined. Figure 5b illustrates that NC values are equal to 1 only if α a and α b are larger than 1. Besides, NC values can also keep up 1 provided that α b is large enough such as α b ≥ 2. Considering these facts, we suggest to use 0.8 and 1.2 as the optimal values of α a and α b . In Figure 5c,d, we plot the NC and PSNR values as a function of parameters α c , α d , and δ while other parameters α a , α b , and r are fixed at 1.6, 2, and 60, respectively. As can be seen in Figure 5c, the maximum PSNR value can be obtained when α c and α d are both set at 0.9 and PSNR values start to decline sharply around this position. Figure 5a-d demonstrates that one of the planes with respect to δ = 50 and δ = 10, in turn, is to be the top layer. Note that the quality metric to evaluate the abilities of imperceptibility and robustness are referred to PSNR and NC values, respectively. Obviously, when δ is set at 50, the proposed algorithm performs the best imperceptibility as shown in Figure 5a. On the contrary, when δ = 10, it leads to the best robustness for the watermark as shown in Figure 5b,d. Note that there should be a trade-off between imperceptibility and robustness. We consider that the temporary best choice of δ would be the average of these two values, that is, δ = 30.
To the best of the authors' knowledge, the relationship between δ and r cannot simply be studied without adding noises. Hence, the best choice would be to introduce a distortion on the watermarked image to some extents. JPEG compression is taken into achieve this purpose. We plot two graphs to show the impact of PSNR and NC with respect to the change of r and δ as shown in Figure 5e,f. Clearly, they show that there are two inclined planes. As can be seen in Figure 5e, decreasing the parameter δ increases NC values while adjusting the parameter r does not cause the significant change of NC values in spite of several fluctuations. Figure 5f shows that the smaller r and δ are, the higher PSNR values are. Note that certain regions are of null values in these figures, as δ must be set smaller than r according to Equation (8). From Figure 5e,f, we prefer a small value of δ to a larger one, due to a better watermarked image's quality and better robustness. In this study, the parameter sets are fixed to α a = 1.6, α b = 2, α c = 0.7, and α d = 0.7, respectively.
To make a good balance between visibility and robustness, r should not be selected too small and be larger than 50 at least based on the facts of Figure 5e,f. It is known that δ = 50 can yield a great robustness as illustrated in Figure 5a and δ ≤ r. This suggests that the optimal value of r tends to be 60. As mentioned above, the temporary choice for δ is 30. However, it must be noted that a relative larger δ can lead to a worse NC and PSNR value as shown in Figure 5e,f. As for the optimal value of δ, it is suggested to make the previous choice smaller to yield a better performance. It appears that δ = 20 would be a promising choice.
For a compromise between robustness and invisibility, a little modification is made on those parameters based on the above result. Finally, the optimal values we considered for α a , α b , α c , α d , r, and δ are 1.6, 2.1, 0.8, 0.8, 60,  and 20, respectively. And these values are adopted in the following tests.

Robustness tests
In this section, we evaluate the proposed method against Gaussian low pass filtering, Gaussian additive noise, Laplacian image enhancement, JPEG compression, Salt and Pepper noises, etc. The simulation results are listed in Table 1. The performance of the proposed technique is evaluated in terms of NC and PSNR values. Table 1 demonstrates that the proposed method is robust against the Laplacian sharpening, Gaussian noise, Salt and Pepper noises, JPEG compression and histogram equalization, cropping attacks. In particular, it performs very well in histogram equalization and Laplacian sharpening and stays NC = 1 for all images, but exhibits weak robustness against low pass filtering. The reason why our scheme can resist most common signal processing attacks is that the energy of embedded watermark spreads all over the image via the wave atom transform. The watermark can be recovered only if the distorted watermarked image contains enough watermark information.
For JPEG compression attacks, Table 1 shows that our scheme can resist JPEG compression up to a quality factor of 25. However, it exhibits weak robustness under low pass filtering attacks, as this type of attacks like median filtering greatly reduces the difference of wave atom coefficient values between the odd and even descriptions, thereby weakening the watermark strength. Therefore, the watermark cannot survive basically.
On the other hand, the biggest weakness of our scheme is that it cannot resist against geometric manipulations as indicated in Table 1, where NC values are always below 0.6. Traditionally, most geometric-invariant watermarking algorithms use a synchronization technique to estimate the rotation angle, rotate back the image, and then detect the watermark. However, the proposed technique does not include such side information for the synchronization purpose. So, the rotation attacks can destroy the spatial correlation between odd and even descriptions. Lack of synchronization information causes the proposed method being unable to recover the angle change. As a result, the comparisons between the descriptions for watermark extraction become no longer meaningful. So, the watermark cannot survive under such attacks.
Besides, Table 2 shows that PSNRs between the original and the watermarked images are 35.96, 36.29, 36.18, 32.09 dB, respectively. Basically, the watermark invisibility is satisfied.

Comparisons with related watermarking methods
Besides, we have studied the performance of the proposed wave atom base method over similar DWT or curveletbased approaches to find the efficiency of implementation of wave atoms. These methods are proposed by Xiao et al. [21], Leung et al. [12], Tao and Eskicioglu [22], and Ni et al. [23], respectively. Table 3 shows that the watermarked image of our scheme has good visual fidelity but is slightly inferior to other watermarking schemes. Clearly, Ni et al.'s scheme preserves the best watermarked image's quality, while Tao and Eskicioglu's scheme is the worst one among these schemes.
We have tested the performance of these watermarking schemes against several common watermarking attacks. The simulation results are shown in Tables 4,5,6,7,8,9, Table 7. As shown in Table 8, our scheme provides excellent robustness against Laplacian sharpening, and is comparable to other schemes for low pass filtering as shown in Table 9. Tables 10 and 11 highlight the results achieved for luminance and contrast attacks. It can be seen that the proposed method outperforms other four watermarking schemes. Table 12 shows that our scheme provides great robustness for histogram equalization. Table 13 illustrates the comparison of processing time between the proposed scheme and other schemes [12,[21][22][23]. It shows that the processing time of ours can achieve 2.41 and 0.92 s with respect to embedding and extracting process, respectively, which is also the shortest one among these schemes.
In addition, the above comparisons may not completely reflect the robustness of proposed method, as only comparisons with spread spectrum-based methods are made. Since there are certain watermarking schemes different from spread spectrum-based methods such as content-based or quantization index modulation (QIM) watermarking algorithms, it is desirable to make a comparison with these kinds for us to draw a fair conclusion. Hence, two more watermarking techniques are suggested to be compared, which are proposed by Ramanjaneyulu and Rajarajeswari [24] and Tang and Hang [25]. As expected, one of them is content-based scheme, whereas the other is based on QIM method and MD. The simulation results are shown in Table 14. Overall, the performance of proposed scheme is comparable to Ramanjaneyulu and Rajarajeswari's scheme [24], but is rather better than Tang and Hang's scheme [25]. Specifically, Ramanjaneyulu and Rajarajeswari's scheme is too weak against histogram equalization, while Tang and Hang's scheme cannot fully resist median filtering. However, our scheme performs better than these schemes with respect to these attacks as shown in Table 14.
To conclude, we have made a complete robustness test and compared with a number of conventional schemes in this section. In a word, simulation results are satisfied, and it demonstrated that our scheme is more robust and has shorter computation time compared with other schemes.

Capacity
For certain watermarking schemes, we have to consider the trade-off between imperceptibility and robustness. Thus, estimating the watermark capacity inserted into the original media is an important issue. In this section, the capacity of proposed method is investigated.
Zhang and Zhang [26] suggest to use a traditional information theory to solve the capacity problem of watermarking scheme. They claim that a watermarked image Table 14 Comparison between our watermarking method Ramanjaneyulu and Rajarajeswari's scheme [24] and Tang and Hang's scheme [25] NC Ramanjaneyulu and Rajarajeswari [24] Tang and Hang [25] Proposed scheme  Figure 6 A "Fishing-boat" image.
can be viewed as an AWGN channel to transmit messages and the watermark is the message to be transmitted. By applying Shannon's well-known channel, the watermarking capacity in non-blind watermarking algorithm can be computed by where W is the bandwidth of channel. Assume the size of image is N × N, the number of pixels is M = N × N. According to Nyquist sampling theory, the bandwidth of an image is W = M/2. Zhang and Zhang [26] considered that the watermarking capacity should be associated with the image's content. Hence, they further developed a new equation with respect to the maximum watermark's amplitude. Assume σ w 2 denotes the variance of the MWI and σ w 2 denotes the variance of the noises, so the image watermarking capacity C can be defined as where W is the bandwidth of the image W = M/2. Costa [27] has studied the channel capacity problem of the so-called dirty paper communication in 1983. Zhang and Zhang [26] considered that the capacity problem of blind watermarking is the same as the problem described by Costa. Notice that our scheme is a blind watermarking scheme, no reference images are needed at the detector. To compare with Zhang's scheme in a fair manner, a Fishing-boat image of size 256 × 256 is used as well, as shown in Figure 6. Zhang and Zhang [26] used a biorthogonal 9/7 DWT for watermarking, whereas a wave atom transform domain is utilized in our case.
As can be seen in Figure 7, the theoretical watermarking capacity of wave atom domain is larger than that of wavelet domain. This is because more energy of image concentrates in low-frequency sub-bands in wavelet domain rather than in wave atom domain. In practice, for the proposed algorithm, 256 bits are embedded into the middle high-frequency component within wave atom transform domain, yielding an average PNSR value of watermarked image at 39 dB. In this study, the maximum watermark capacity can be up to 364 bits by using the fourth scale band only, for a host image of size 512 × 512. The size of watermark can be extended if more scale bands are included for embedding, but it would result in lowering the visual quality of the watermarked image.
It may not make a good sense as experimental results are inconsistent with the theoretical values, implying that wave atoms coefficients may not efficiently be used to hide secret data. It could be explained that each secret bit is associated with excessive wave atom coefficients for the proposed method, in which it requires nearly 493 wave atom coefficients, on average, to embed one bit. It could be optimized by employing less wave atom coefficients to represent one bit, but the complexity computation may be increased accordingly or may weaken the algorithm's robustness. To conclude, in term of the capacity, wave atom transform shows its superiority over the wavelet transform based on the simulation results.

Security analysis
Cayre et al. [28] proposed a definition of watermarking security and emphasized that the importance of watermarking security should be the same as robustness. They developed a method to measure the security level of spread-spectrum-based watermarking with the help of Fisher Information Matrix (FIM). By using the spread spectrum technique, their concept for the security analysis of spread-spectrum-based watermarking in [28] can also be applied to our case. Zhang et al. [29] mentioned that two statistical methods are commonly adopted to examine information leakage, one being based on the Shannon's information theory. Information leakage about secret carriers can be evaluated by the mutual information between carriers and watermarked image which also indicates the decrease of uncertainty of carriers due to watermarking communications. The other one uses FIM to measure information leakage, in particular, by measuring the accuracy of estimation of the carriers with the help of maximum likelihood. The security of the proposed scheme is described below.

Mathematical model
According to [29], the embedding model for spreadspectrum-based algorithms can be expressed in Equation (13).
where Y j ¼ y j 1 ; y j 2 ; . . . ; y j N v T is the watermarked signal from the jth observation.
as the host of the jth observation. The ith carrier vector is denoted as Z i . a i j is employed to denote the ith bit of embedding message in the jth observation. γ is denoted as the embedding strength. N c , N o , and N v denote the number of carriers, the number of observations, and the dimension of the host in each observation, respectively.

Perfect covering
The Bayes rule indicates that spread-spectrum-based watermarking does not provide perfect covering. If an attacker is able to access to the watermarked content, some information about the watermark signal may be leaked from these observations. As a result, our scheme cannot offer perfect covering. According to [28], three types of attacks are defined: watermarked only attack (WOA), Known Message Attack (KMA), and Known Original Attack (KOA).
In this study, MD are employed for embedding watermark. Note that it is not meaningful to analyze the KOA for this study, since the watermark extraction of the proposed method does not require the original image. Besides, the attacker can deduce more knowledge about the secret key from the watermarked content than from pairs of original and watermarked contents, so WOA context deserves much more attentions than the KOA. Thus, only the case of KMA and WOA are considered in this study. The following section will investigate if our scheme can withstand KMA and WOA.

Known message attack
Under KMA, the attacker knows which messages have been embedded into the watermarked content by observations. Assume that the distribution of the host x j k is N 0; σ 2 x I N v À Á . The attacker owns N 0 -independent observations and corresponding embedded messages. Mentioned in [28], the log-likelihood with sample set The attacker can estimate the private carriers Z N C with the help of FIM. The FIM can be calculated by Equation (17).

WOA
Cayre et al. [28] claimed that under WOA, the attacker is able to observe watermarked contents only. During the WOA, the carrier is the target of an attacker, but the embedded messages could influence the estimation of carriers. As mentioned in [28], the security level of spread-spectrum-based watermarking under WOA can be evaluated by the Cramér-Rao Bound (CRB) to find out the CRB of estimation of the carriers. It is expected that the attacker knows N m messages first. Otherwise, CRB cannot be found. Cayre et al.'s results show that when N m messages are known by an attacker, the security level of secret carriers is N 0 * = N c σ x 2 /(σ a 2 γ 2 ). Again, the security level can be computed as (131072 × 6303)/(1 × 1.325 2 ) ∼ 4.7 × 10 8 .
Based on the above result, it can be concluded that the proposed method is secure due to the high security level.

Conclusion
In this article, a robust watermarking scheme based on wave atom transform is presented. To determine the best compromise between robustness and imperceptibility, a number of experiments have been conducted. Overall, the experimental results demonstrate that our scheme provides excellent robustness against histogram equalization, Gaussian noises, cropping, luminance, and contrast attacks, but fails against rotation and low pass filtering attacks. Besides, the quality of the watermarked image is satisfactory in term of perceptibility (the PSNR per watermarked image is over 35 dB). The comparison results between the proposed method and the existing watermarking schemes show that the proposed method is comparable in terms of robustness and the processing time. And the security analysis result proved that the proposed method is secure. So far, a fixed model of the human visual system has not been developed, which would be studied in the future.

Consent
The 515x512 BMP grayscale image Lena and other images are obtained from http://sipi.usc.edu/database/. Written informed consent was obtained from the person for publication of the images.