2010 Fourth Pacific-Rim Symposium on Image and Video Technology
DWT and TSVQ-based semi-fragile watermarking scheme for tampering detection
in remote sensing images
Jordi Serra-Ruiz and David Megı́as
Estudis d’Informàtica, Multimèdia i Telecomunicació
Universitat Oberta de Catalunya
Barcelona, Spain
{jserrai,dmegias}@uoc.edu
Abstract—A semifragile watermarking scheme for remote
sensing images is presented. The suggested scheme uses the
signature of the multispectral or hyperspectral image to embed
the mark and detects a forgery of the marked image, e.g. a
tampered region. The original image is segmented in three-
dimensional blocks and, for each block, a discrete Wavelet
transform (DWT) and a tree structured vector quantizer is
built. These trees are manipulated using an iterative algorithm
until the resulting image satisfies some selected conditions.
Each tree is partially modified accordingly to a secret key
in order to avoid tampering attacks. This key determines the
internal structure of the tree and, also, the resulting distortion.
In order to make the marked image robust against near-
lossless compression, the trees are built using only the LL
sub-band of the DWT. The results show that the method
works correctly with remote sensing images and detects copy-
and-replace attacks from segments of the same image, whilst
allowing for JPEG2000 compression.
Keywords-Forensic Watermarking, tampering detection, re-
mote sensing images
I. I NTRODUCTION
To prevent the alteration of digital files and detect ma-
nipulations, watermarking schemes have been developed
in the last few years. The embedded watermarks must be
imperceptible and can used to determine the integrity of the
digital files.
Some watermarking schemes [1], [2] insert a watermark
into an image, such that the watermark is modified or
destroyed when the marked image is manipulated. In this
authentication process, two different approaches, namely
fragile watermarking and semi-fragile watermarking, can be
used. In fragile schemes, all modifications are detected as
tampering. Therefore any kind lossy compression or filters
can not be applied to the marked image without removing
the embedded mark. On the other hand, semi-fragile schemes
allow some degree of compression and small modifications
(or “attacks”) of the marked images. This makes it possible,
for example, to create a compressed version of the image
which can be distributed electronically (possibly with a
reduced price) but maintaining the original watermark. Both
fragile and semi-fragile watermarking schemes can be used
for tampering detection and localization.
978-0-7695-4285-0/10 $26.00 © 2010 IEEE 331
DOI 10.1109/PSIVT.2010.62
Some semi-fragile watermarking schemes of multiple
band images also consider only one band or process each
band separately [3], [4]. Note that, if the bands are marked
separately, the changes in the signature curves can be
uneven. Hence, the shapes of the signatures may vary, which
may lead to a misclassification of the image. Because of
this, a method which preserves the shapes of the signatures
is highly demanded.
There are different previous works dealing with satellite
image watermarking [5], [6], [7], [8], [9], [10], [11]. Ho
et al. [5] uses a satellite image and decomposes it into two
mutually orthogonal sub-fields, but only uses one band of the
satellite image and only one field for watermarking purposes.
Qin et al. [6] presents a semi-fragile watermarking scheme
based on wavelet transforms. The edge and texture of the
remote sensing image are extracted and the watermark is
embedded only in the edge character. In this case, once
again, only one band is marked. Wang et al. [7] presents
a watermarking scheme to preserve a digital content, but
only uses one band of the hyperspectral image of the Indian
Remote Sensing System. Sal and Graña [8] describes an
evolutionary algorithm which marks an image based on
the manipulation of the discrete cosine transform (DCT)
computed for each band of the image. Tamhankar et al. [9]
describes a method to embed one mark into the hyperspectral
image using the whole signature, but it does not allow
compression of the hyperspectral image. Finally, Serra et al.
[10] and Serra and Megı́as [11] use the whole signature to
embed a watermark, and Serra and Megı́as [11] implements
an LSB extraction in each pixel value, making the scheme
robust against near-lossless compression.
In this paper, a semi-fragile watermarking scheme specifi-
cally developed for remote sensing images is presented. The
method can be tuned to embed the mark according to band
relevance, depending on the content and the signatures (also
known as the spectral reflectance curve) to be protected.
The suggested method applies the discrete Wavelet transform
(DWT) and a vector quantization approach for a group of
selected bands. The image is segmented in three-dimensional
blocks of a given size which determines the spatial resolution
of the embedding and detection algorithm. For each block,

the integer DWT is applied to each selected spectral band
and the obtained LL sub-bands are used to build a Tree-
Structured Vector Quantization (TSVQ) tree. This TSVQ
tree is then modified using an iterative algorithm until it
satisfies some criterion. Once the target value (generated
with a secret key) is reached, the marked block is obtained
using the new LL sub-bands together with the original LH,
HL and HH DWT sub-bands of the block. The secret key
produces a different criterion for each block in order to avoid
copy-and-replace attacks. The use of the LL DWT sub-band
for each spectral band makes it possible to obtain robustness
against near-lossless compression attacks and, at the same
time, strong modifications are detected as tampering.
This paper is organized as follows. In Section 2, back-
ground about watermarking, remote sensing images, lossy
compression and vector quantization is provided. Section 3,
describes the watermarking strategy and the mark embed-
ding and mark retrieval processes. Section 4 presents the
results obtained with the suggested scheme and, finally, the
conclusions of this work are drawn in Section 5.
II. BACKGROUND
In this section, the basic concepts used in the method
presented in this paper, namely watermarking, remote sens-
ing images, lossy compression and vector quantization, are
shortly introduced.
A. Watermarking
Watermarking consists of imperceptibly embedding some
information into a cover object (e.g. a remote sensing
image) to produce a marked version of the same object.
The watermarking process alters the original data file by
modifying the content in order to embed the mark. Most
schemes require a common (secret) key both at the embedder
at the detector which is usually introduced to endorse the
system with security features. The detection process needs
the (secret) key to determine whether the mark is or not
embedded in the test object. With a blind detection method,
no further information is needed to detect the mark (i.e. the
original unmarked content is not required).
Semi-fragile schemes are able to overcome some minor
modifications, as those produced by near-lossless compres-
sion, but reveal the existence of strong manipulations (also
referred to as “attacks” in the watermarking literature), such
as copy-and-replace, or excessive information removal by
means of cropping or lossy compression. Semi-fragile wa-
termarking makes unnecessary to mark different compressed
versions of the same image independently and, thus, reduces
the cost required to distribute the same marked image with
different degrees of quality.
On the other hand, robust watermarking allows stronger
types of manipulations, including compression, filtering or
geometrical attacks. Usually, robustness requires significant
332
BLUE
RED
GRN
Near Infrared Middle Infrared
Reflected Infrared
60
Vegetation Dry soil
Reflectance(%)
(5% water)
40
Wet soil
(20% water)
20
Clear lake water
Turbid river water
0
0.4 0.6 0.8 1.0 1.2 1.4 1.6 1.8 2.0 2.2 2.4
Wavelength (micrometers)
Figure 1: Examples of signatures.
distortion in the marked image and a trade-off between
robustness and perceptual quality must be achieved.
In remote sensing imaging applications, the most useful
schemes aimed to detect changes in the image are semi-
fragile watermarking systems.
B. Remote sensing images
Remote sensing images contain information about an area
of the surface of the Earth. Each pixel is represented by an
endmember, which is a set of values obtained for different
frequencies of the light spectrum (bands) obtained by a
remote sensor. The signature of each pixel of the image is
related to the different materials in that area, such as water,
forest or minerals. Fig. 1 shows the different signatures for
a light reflectance for clear lake water, turbid river water,
vegetation, dry soil and wet soil [12].
Two of the most relevant problems with these images is
their huge size and the cost to obtain them. A typical hyper-
spectral image covering a small region of a few kilometres
contains millions of pixels. As an example, the Airbone
Visible / Infrared Imaging Spectrometer (AVIRIS) images
contain 224 bands and, usually, 16 bits are used for the
values in each band. Images with lower resolutions are often
referred to as “multispectral”. This is the case of Landsat
images, which use 8 bands for each pixel and 8 bits for the
values of each band.
C. Lossy compression of remote sensing images
Lossy compression methods remove information which
is not significant for image reconstruction. The amount of
removed information should depend on the user purposes.
Some experiments [13] carried out with remote sensing
images, show that it is possible to achieve relatively high
compression ratios without removing critical information.
The general coding scheme must be adapted to the particular
characteristics of the source, in order to maximize both the
compression ratio and the image fidelity. In this case, the
most important issue is that the remote sensing images are
3D, where two dimensions are spatial and one is spectral.
 Bands Selection
512
16
512
Hyperspectral image 512x512 reduced image
Figure 2: Generation of the signature vectors for TSVQ.
D. Vector Quantization
Vector Quantization [14] (VQ) makes it possible to com-
press an image in an optimal manner from the Shannon’s
rate-distortion theory point of view, i.e. applying VQ com-
pression systems, the resulting image minimizes (locally) the
distortion for a given compression ratio. However, VQ com-
pression can be computationally prohibitive. Tree Structured
Vector Quantizer (TSVQ) is a suboptimal strategy which
works starting with an initial centroid as the codebook, that
is, a tree with a single leaf, and then a quality criterion is
applied (Mean Square Error).
The number of possible subtrees is large enough to
explore the possibilities of finding feasible subtrees for
watermark embedding. Finally, the original image is coded
using the selected subtree, replacing each original vector by
the closest centroid, that is, by the centroid representing all
the elements in the leaf where the original vector falls into.
This selection is performed starting from the root of the tree,
and choosing the closest centroid until a leaf is reached.
III. M ULTIPLE BAND WATERMARKING SCHEME
The watermarking scheme is described in the following
sections. In Section III-A, the lossy compression and wa-
termarking are described, while Section III-B shows how to
detect tampered marked images.
A. Mark embedding process
Let us consider an original three-dimensional hyperspec-
tral image I of size M × N × b, where b stands for the
number of bands. This paper uses AVIRIS images, but the
same method can be applied to any kind of multi, hyper or
ultraspectral images. We propose to select a set of bands with
significant information to be processed, following the rec-
ommendations in [14]. After the band selection, the resulting
image has 16 bands with 2 bytes per pixel. The image I is
segmented in blocks W ×H×b0 , where W ≤ M and H ≤ N
are the size in pixels of each block, and b0 ≤ b is the number
of selected bands. This block division makes it possible
to detect specific tampered regions in the attacked images.
Block Construction
Vector Construction
16 bands
LL LH
32
32x32
64
16
HL HH
16
32
LL Block
64 TSVQ vectors
Wavelet
Then, to achieve robustness about near lossless compression,
the discrete Wavelet transform (DWT) is applied for each
block and TSVQ vectors are constructed using the LL band
of the DWT. Fig. 2 summarizes the embedding process. The
original 512 × 512 image is thus divided into 8 × 8 smaller
blocks which are marked separately.
The vectors formed with the LL DWT coefficients of
each block are replaced by very similar values obtained
from the leaves of a TSVQ tree, with minimal distortion
and enforcing a particular property which will be checked
at the detector side. Then, the Breiman, Friedman, Olshen
and Stone (BFOS) algorithm [15] prunes the generated tree
with the selected criterion to obtain all the subtrees in
the Compression ratio-Distortion curve. A parameter of the
resulting TSVQ tree, for example the entropy, determines the
subtree which is required to obtain the specific compressed
version of the image block. At this point, it is important to
note that the compression ratio does not take into account the
individual bands but the signatures as a whole, since we are
using a vector quantization approach. Hence, this proposal
is different from other semi-fragile watermarking methods
in the literature which process each band separately.
As manipulations to the marked image are concerned, a
large modification in any single band or small number of
bands is considered unacceptable in remote sensing images,
because these attacks introduce an uneven change in the
spectral signature. Only modifications affecting the whole
signature are accepted, such as lossy compression, but only
up to a certain degree. The LL sub-band of each block of the
original image is compressed with a different compression
ratio, according to the selected TSVQ criterion. This new
block is processed with the TSVQ process again, using the
same parameters as in the first iteration, and the iterative
process is repeated until the generated values satisfy the
desired properties. The secret key is used in this step, since
a different criterion is selected for each set of 32 × 32
LL DWT components. To detect possible tampering attacks,
such as copy-and-replace, or pasting one part of another
333

image into the marked image, a pseudo-random sequence
is chosen to determine the values used as criteria to select
the compression subtree in the pruning algorithm. Thus,
it is much more difficult to find a pattern revealing the
watermarking scheme properties, reducing the possibilities
of manipulating an image or modifying it using another
region of the same image. The secret key is the seed of
a Pseudo-Random Number Generator (PRNG) and will be
required in the detection process. In any case, the detection
method is blind since it does not need the original image.
HH, HL, LH
iDWT
I TSVQ Yes
Block DWT LL vectors Criterion
established
??
mark
Key PRNG
Figure 3: Embedding block diagram.
In the suggested scheme, shown in Fig. 3, the entropy
is the chosen parameter to select which particular tree is
used to build the marked block. For each block, the pseudo-
random sequence determines the entropy of the compression
tree. Finally, the BFOS algorithm generates a table with
all the possible subtrees which are in the convex hull,
minimizing distortion for a given compression ratio. Usually,
both compression ratio and MSE are used for generating the
convex hull, but the BFOS algorithm may be used with any
other criteria which might be more suitable for watermarking
purposes or for joint compression and watermarking [4].
Once it is determined which subtree is used to generate
the modified DWT values, the resulting marked content is
constructed with the centroids of the selected subtree which
represents the embedded mark. The result of TSVQ process,
the LL DWT sub-band modified with centroids, is then
combined with the LH, HL and HH DWT sub-bands (kept
in the first step) of the original block and the inverse DWT
is applied to generate the marked block. Finally, all blocks
are joined to construct the marked image.
B. Forgery detection
The mark detection process for a (possibly forged) image
is analogous to the mark embedding process and it only
requires the secret key. The scheme is depicted in Fig. 4.
First of all, the same bands must be extracted from the
test image. Then, the image must be divided into the same
blocks, and the integer DWT must be applied to each band of
each block. The detection of a modification of the image can
be performed by checking if the same criterion used in the
mark embedding scheme is satisfied. If the tree constructed
with the LL DWT sub-band of each block verifies the
Key PRNG
Block
TSVQ no
forged
Marked DWT vectors Criterion
block established
??
yes
Block OK
Figure 4: Detection block diagram.
criterion given by the secret key, then the area is assumed to
Marked
Î block be authenticated. Otherwise, the block is detected as forged.
Therefore, with this method it is possible to detect and locate
Pruning tampered regions in a marked image.
no
Block IV. E XPERIMENTAL RESULTS
Pruning
I* The experiments described in this section have been
performed for an AVIRIS image of a cuprite area of Nevada,
consisting of 224 different bands. A subset of 16 bands has
been chosen to embed the mark. These 16 bands can be
selected according to different criteria, such as random selec-
tion, equally spaced bands in the frequency axis, atmospheric
criteria (reflectance is different at difference frequencies due
to atmospheric reasons) or according to the composition of
the area (some frequencies provide better light reflectance
for some materials). In this paper, for simplicity, 16 equally
spaced values in the frequency axis have been chosen. We
have selected 1 out of each group of 16 bands in the original
hyperspectral image. In particular, the selected bands are
the following: 4, 18, 32, 46, 60, 74, 88, 102, 116, 130,
144, 151, 172, 186, 200 and 216. The bands 158 and 214
were discarded since they contained sensor errors (e.g. most
values fixed to zero) and have been substituted by 151 and
216 respectively.
The mark embedding process described in Section III-A
has been applied. The image has been divided into blocks
of 64 × 64 size, then the Daubechies 1 integer DWT has
been applied to each block and the TSVQ iterative process
has been applied. Fig. 5 shows the original (Figure 5a) and
the marked images (Figure 5b) obtained with a specific key
secret key. Notice that no artifacts are visually detectable.
The mark embedding process presented in this paper
affects the quality of the signature of the image of the
selected bands. The distortion introduced with the embed-
ding method has been evaluated using the Peak Signal-to-
Noise Ratio (PSNR) of the marked hyperspectral image with
respect to the original one. For this particular image, the
maximum value is 12, 500,
therefore the PSNR has been
as 10 log10 16, 3832 /MSE (instead of using 65, 5352 in
the numerator). The PSNR computed for all the 224 bands
is 72.61 dB. Another relevant distortion measure is the
percentage of modified pixels (PMP) with respect to the total
number (512×512×224). The PMP for this image is 2.30%:
only 1, 352, 324 out of the 58, 720, 256 pixels are modified
334
 Table I: PSNR of the marked image for each band.
Band PSNR PMP Adi Band PSNR PMP Adi Band PSNR PMP Adi
1 61.15 32.33 18.02 6 62.39 32.10 15.19 11 62.76 32.18 15.14
2 61.29 32.10 16.68 7 62.48 32.17 15.08 12 61.24 32.40 18.40
3 61.82 32.19 16.37 8 62.18 32.18 15.82 13 61.71 32.19 17.05
4 61.94 32.19 16.34 9 58.07 32.56 25.94 14 60.16 32.27 19.12
5 62.26 32.12 15.40 10 62.86 32.05 14.89 15 60.74 32.32 18.56
16 58.92 32.53 23.48

(a) (b) (c) (d)

Figure 5: Original (a), marked (b) and tampered (c) images and tamper location (d) for band 2.

by the embedding process, whereas the other 97.70% of the and 5d show a tampered image and the tamper location
pixels are identical to the original. as detected by the proposed scheme. A forest region was
The PSNR for each of the modified bands is shown in copied and replaced by a mineral region, next to the forest.
Table I, where “PMP” stands for “Percentage of Modified This forgery has been perfectly detected by the suggested
Pixels” and “Adi” stands for “Average difference” of the scheme. In addition, no false positive forgeries have been
modified pixels. Notice that the PSNR is quite high. On detected in the performed experiments.
average, the PSNR for the different modified bands is 61.37 Finally, the robustness of the scheme has been checked
dB. The number of modified pixels (PMP) is 32.24% with against compression attacks with the JPEG2000 algorithm.
an average difference of 17.59 (where the range of pixel Table II shows some compression attacks, in bits per pixel
values is from 1, 200 to 12, 500). (bpp), and the robustness of the scheme against them. Note
A comparison of different watermarking schemes for that the mark survives always, and therefore the scheme is
hyperspectral images is provided in [11]. Due to space robust against JPEG2000 compression.
limitations, such a comparative analysis (with the methods
introduced in Section I) is not included in this paper. How- V. C ONCLUSIONS
ever, the method presented here provides similar distortion A semi-fragile watermarking method for remote sensing
results compared to that of [11] (which overcomes the images based on TSVQ and DWT is presented. The method
results of the other schemes) and better robustness against uses the information in a set of bands at the same time,
JPEG2000 compression. and thus, it takes advantage of both spatial and spectral
redundancy for marking purposes. Basically, the original
Table II: Robustness against JPEG2000 compression attacks. image is segmented in three dimensional blocks and a tree
Compr. Mark Max structured vector quantizer is built for the LL DWT sub-
Adi PMP
(bpp) survival diff. band of each block. The original LL sub-band of each block
8 yes 1.12 5 50.45% is replaced by a new one generated by substituting each
7 yes 1.56 10 71.86% original vector by the closest centroid in the selected subtree.
6 yes 2.39 17 83.81%
5 yes 4.14 32 91.26% This process is repeated until a certain stopping criterion
is satisfied. Each block generates a different subtree and a
secret key is used to avoid copy-and-replace attacks between
A random block selection and replacement into the image blocks. The results show that copy-and-replace attack of a
has been performed into the marked image. Figures 5c region of the image is detected by the watermarking scheme.

335
The detection process is a simple one, since a tree is built
for each block and the selected tree property is tested.
If a block satisfies such a property, then it has not been
forged, otherwise the detection process reports tampering.
In addition, the use of the DWT in each band provides
robustness against JPEG2000 compression attacks.
Future research lines in this subject include the study
of optimal subtree selection criteria for pruning purposes,
the use of different Wavelet transforms and their effect on
distortion and robustness against compression and the use
of smaller block sizes to increase the resolution of the
tampering detection. The possibility of using different sizes
for different areas of the image can also be addressed. It
would be advisable to use smaller blocks in the region of
interest (ROI) and bigger blocks in other areas.
ACKNOWLEDGEMENTS
[8] D. Sal and M. Graña, Studies in Computational Intelligence.
Springer Berlin / Heidelberg, 2008, vol. 133/2008, ch. A Mul-
tiobjective Evolutionary Algorithm for Hyperspectral Image
Watermarking, pp. 63–78.
[9] H. Tamhankar, L. Bruce, and N. Younan, “Watermarking of
hyperspectral data,” Geoscience and Remote Sensing Sympo-
sium, 2003. IGARSS ’03. Proceedings. 2003 IEEE Interna-
tional, vol. 6, pp. 3574–3576 vol.6, July 2003.
[10] J. Serra, D. Megias, J.Herrera-Joancomartı́, and J. Minguillón,
“Multiband semigrafile watermarking for multi and hyper-
spectral images based on iterative tree structured vector quan-
tization,” in Proceedings of Image and signal processing for
remote sensing XII, L. Bruzzone, Ed., vol. 6365. Stockholm:
SPIE, September 2006, pp. 63 650O1–63 650O10.
[11] J. Serra-Ruiz and D. Megı́as, “A novel semifragile forensic
watermarking scheme for remote sensing images,” Interna-
tional Journal of Remote Sensing, 2010, in press.

This work is partially supported by the Spanish Ministry of [12] R. B. Smith, “Introduction to hyperspec-
Science and Innovation and the FEDER funds under the grants tral imaging,” Aug 2006, available at
TSI2007-65406-C03-03 E-AEGIS and CONSOLIDER-INGENIO http://www.microimages.com/getstart/hyprspec.htm.
2010 CSD2007-00004 ARES. [13] J. Minguillón, J. Pujol, J. Serra, and I. Ortuño, “Influence of
lossy compression on hyperspectral image classification,” in
R EFERENCES Proceedings of Data Mining’2000, Cambridge, UK, July 5-7
2000, pp. 545–554.
[1] M. Yeung and F. Mintzer, “An invisible watermarking tech-
nique for image verification,” in International Conference on [14] A. Gersho and R. M. Gray, Vector Quantization and Signal
Image Processing, IEEE, vol. 2, Santa Barbara, CA, Oct. Compression, ser. Communications and Information Theory.
1997, pp. 680–683. Norwell, MA, USA: Kluwer Academic Publishers, 1992.

[2] J. Fridrich, “Security of fragile authentication watermarks [15] L. Breiman, J. H. Friedman, R. A. Olshen, and C. J. Stone,
with localization,” in Security and Watermarking of Multi- Classification and Regression Trees. Wadsworth Interna-
media Contents, SPIE, Ed., vol. 4675. San Jose, CA: SPIE, tional Group, 1984.
January 2002, pp. 691–700.

[3] O. Ekici, B. Sankur, U. Naci, B. Coskun, and M. Akcay,

“Comparative assessment of semifragile watermarking meth-
ods,” Journal of Electronic Imaging, vol. 13, no. 1, pp. 209–
216, Jan. 2004.

[4] R. Caldelli, G. Macaluso, M. Barni, and E. Magli, “Joint near-

lossless watermarking and compression for the authentication
of remote sensing images,” in Proceedings of the 24th Inter-
national Geoscience and Remote Sensing Symposium, vol. 1,
Sep. 2004.

[5] A. T. S. Ho, X. Zhu, and W. Woon, “A semi-fragile pinned

sine transform watermarking system for content authentica-
tion of satellite images,” IEEE International Geoscience and
Remote Sensing Symposium, vol. 1-8, 2005.

[6] Q. Qin, W. Wang, and S. Chen, “Research of digital semi-

fragile watermarking of remote sensing image based on
wavelet analysis,” IEEE International Geoscience and Remote
Sensing Symposium, vol. 1-7, 2004.

[7] X. Wang, Z. Guan, and C. Wu, Advanced Data Mining and

Applications, ser. LNCS, 2005, vol. 3584/2005, ch. A Novel
Information Hiding Technique for Remote Sensing Image, pp.
423–430.

336