7.4 Surviving attacks on information hiding and audio watermarking

Noise addition

We added varying amounts of Gaussian noise to our marked test signals and attempted to retrieve the hidden message with varyingsuccess.

In order to account for the noise, we adjusted the threshold we used in the decoding algorithm. From Figures 10,12, and 14, it isclear that a threshold can be drawn between the higher observed differences (one-bits) and the lower observed differences. However, in the cases where toomuch noise was added (see Figures 11,13, and 15), this threshold is not so clearly defined. In fact, for the PSA and EA, any threshold value is difficultto determine whether by calculation or by “eyeing it.”

Based on studying these threshold values, we found maximum noise we could add to the marked signal for each algorithm. The minimumSNR for the FMA, PSA, and EA were 30 dB, 30 dProject! ElB, and 60 dB, respectively. At these SNR values and with an input of “Elec301 Project! ”, thealgorithms output as follows:

FMA

Elec301 Pro*ect! Elec301 Project! ElB, and 60 dB, respectively. At these SNR values and with an input of “Elec301 Project! ”, thealgorithms output as follows:

ec301 Project! Elec30ec301 Project! Elec30

PSA

Elec301Elec301Elec301ELec301Elec301EleC#01Elec301Elec300Elec301El ek30qElec301Elec301Elec301Elec301El El`c 1El

EA

Elec381 Pzg*ect!MleC343 RzebesT!eoec#p1 Psozec|#GleC#00 P2ojEct)Mmec301 QrozEkw Umea3p1'PRgbmct!Eleg:0qP2ojea4%D|

The FMA and PSA clearly outperformed the EA in the noise category. In fact, at the point that we begin to miss bits, we can alreadysignificantly hear the white noise. Because the FMA only looks at the difference between the frequencies of the original and marked signals for a small segmentof the frequency spectrum (in particular around the maximum frequency of the original signal), the noise power included in the difference is much smaller forthe FMA than for the PSA and the EA which both calculate the difference over the whole frequency range. The PSA is good because our ears cannot detectsignificant alterations in phase; in fact, the phase shift could go up to .1*pi without audible detection. This large phase shift power difference between a oneand zero is much more than the power added by the noise.

For all of our algorithms some genres of our test signals performed better in every case. We found that ‘pop’ and ‘techno’ bothfailed noise tests at least 20db SNR higher than any of the others. Examining the magnitude in the frequency domain for both of these signals (see Figure 8)shows us that the 90% power bandwidth is wider than in the others. I.e. there is significant information at higher frequencies, so more significant frequenciesare altered by the noise, which lessens the amount of tolerable SNR.

To defend against noise we encode the user-input phrase over and over as many times as will fit. This increases our chances ofgetting the phrase back since the probability of several bits being wrong is lower than the probability of one bit being judged incorrectly.

Another defense against noise was to raise our various predefined values closer to human-hearable level. For example we can increase the amount of phase shift in the PSA from .01*pi all the way to .1*pi.These increases mean that the value shifting caused by adding noise is not significant when compared to the value shifting created by encoding a one. Ingeneral, there is a balance between how much noise a marked signal can take and how audible the mark becomes. This balance is found by toying with thepredefined values for each algorithm.

Compression and decompression

We also tested an attack in which the wave file was compressed using MPEG-1 and AAC compression algorithms. In order to test whetherwe could still recover our encoded bits in MATLAB (MATLAB can only work with wave audio files), we then decompressed the files. We found that we werecompletely unable to recover our encoded message and received as output either nothing or complete garbage.

These results were not unexpected as audio compression algorithms take advantage of the same psycho-acoustical phenomenathat we used to

Cropping

Our encoding scheme can survive truncation on the back end. We simply lose any bits contained in the deleted data. While we didnot implement this process, we could implement a matched filter setup to survive truncation on the front end. We could take the marked audio file and attempt toplace it in the unmarked original file using convolution.

Remarking

We tested whether our algorithm could be marked with a second message and still recover either message. We provided our decoder withthe original signal and the signal that had been marked two different times. If we had provided the decoder with the once-marked signal and the original signal(cascading the decoder), we could have easily recovered our original signal; however, we felt this solution was trivial and against the point of theattack.

We found, as expected, that when encoding two different messages, we could not correctly recover either message. We, however,found that if two of the same letter were encoded in the same place, we could recover this particular letter. Remarking the signal with the same message doesnot affect our ability to decode the message, but remarking can affect the quality of the output.