*5.3. Watermark Extraction and Verification*

The extraction of the watermark starts with building the EU for every vertex. Using the KLT basis from the key generator module, 28 coefficients are extracted from every EU: from the subset of coefficients used for watermark embedding, the watermark bits are computed using Equation (7) and stored in a string *we*. Note that this operation requires the computation of a forward KLT; the inverse KLT is not used in the proposed algorithm.

After that, the watermark generator module is called for every EU, producing a watermark string *w* for each of them.

At this point, the verifier module compares the two strings *we* and *w* for every vertex: if the strings are equal, then the vertex is marked as authentic; otherwise, it is flagged as potentially forged.

The possible forging of a 3D model represented as a set of vertices connected to form polygons may be done by altering or modifying:


According to the integrity protection provided by the proposed algorithm, a vertex can be detected as tampered if:

	- one of its vertices has been modified in the higher part of the coordinates, or
	- at least one of its vertices has been substituted by another vertex, or
	- the order of the vertices on the perimeter has been changed (comprising the clockwise or anti-clockwise order), or
	- the number of vertices has been changed;

#### **6. Experimental Results**

This section summarizes the results of a number of experiments we executed to test the performance of the proposed algorithm. In order to measure the resulting quality, we considered four objective parameters, namely the sensitivity, the Mean Absolute Error (MAE), the Root Mean Squared Error (RMSE), and the Peak Signal-to-Noise Ratio (PSNR). Indeed, the sensitivity gives a measure of the capability of the algorithm to detect tampering attacks. Thus, the meanings of the parameters used to measure the performance of the proposed algorithm are:


$$\text{MAE} = \frac{\sum\_{\mathbf{v} \in Y} \sum\_{c \in \Omega} |\mathbf{v}\_c - \mathbf{v}\_{c'}|}{\text{card}(Y) \, \text{card}(\Omega)},\tag{8}$$

where **v** scans the set Υ of all vertices, *c* scans the set Ω of the attributes that can be modified by the embedder (i.e., in the present embodiment *x*, *y*, *z*), the symbol refers to the modified attribute in the watermarked model, and the function card() returns the cardinality of a set;

• Root Mean Squared Error (RMSE): measures the distortion between vertex coordinates of the host and the watermarked model,

$$\text{RMSE} = \sqrt{\frac{\sum\_{\mathbf{v} \in \mathbf{Y}} \|\mathbf{v} - \mathbf{v}\prime\|^2}{\text{card}(\mathbf{Y})}},\tag{9}$$

where **v**represent the modified vertices and the operator . computes the Euclidean distance;

• Peak Signal-to-Noise Ratio (PSNR): measures the distortion with respect to the maximum elongation of the vertices from the centroid of the model,

$$\text{PSNR} = 10 \log\_{10} \frac{\left(\max\_{\mathbf{v} \in \mathbf{Y}} \|\mathbf{v} - \mathbf{c}\|\right)^2}{\frac{1}{\text{card}(\mathbf{Y})} \sum\_{\mathbf{v} \in \mathbf{Y}} \|\mathbf{v} - \mathbf{v}'\|^2},\tag{10}$$

where **v** represent the modified vertices, **c** is the centroid of the host model, and the operator . computes the Euclidean distance.

We chose a setting for the genetic algorithm to be used in all experiments; in particular, we derived the setting values from many experiments devised to have fast convergence to a solution resulting in a high quality watermarked model. The settings were population size = 300, *pc* = 0.9, *pm* = 0.25, maximum generations = 2000.

We ran the embedding algorithm on ten 3D models (shown in Figure 3), and the objective results are reported in Table 3. The payload in all experiments was set to 5 bpv.

From Table 3, it can be seen that, given the very high values of sensitivity for small modifications (more than 99% of vertices detected when altering them by only ±2 in one of the bytes of their coordinates), the proposed algorithm is highly reliable in tampering detection, i.e., it is very fragile. Moreover, the very small values of MAE and RMSE and the very high values of PSNR proved that the 3D models underwent a negligible modification, which may be generally accepted apart from specific applications, in which case we think that a reversible algorithm should be applied (but this is not the objective of the present proposal).

As concerns the complexity of the proposed method, let us consider separately the preprocessing phase, the embedding phase, and the verification phase. During preprocessing, for every vertex, a signature of the polygons to which it belongs is computed. In the worst case scenario, a vertex is connected to all other vertices, so this computation would take *O*(*n*2) time, where *n* is the number of vertices. The embedding phase, instead, is linear in the number of vertices of the model, and it is upper bounded because the GA is run for a given predefined number of generations. Finally, the verification phase is very fast, and again, it is linear in the number of vertices (it usually takes a few hundreds of milliseconds on a standard laptop).

**Figure 3.** Original models used in the experiments along with [number of vertices]/[number of polygons]composing them: (**a**) lion, (**b**) cat, (**c**) dog, (**d**) fish, (**e**) horse, (**f**) raptor, (**g**) suit, (**h**) wolf, (**i**) AK, and (**j**) snake.


**Table 3.** Performance of the proposed algorithm on a set of ten publicly available 3D models.

One of the original models (lion) is shown in Figure 4a. To present how the algorithm operates on the model from a subjective point of view, in Figure 4b, the same model after the fragile watermark embedding is reported.

**Figure 4.** Application of the proposed algorithm to a model (lion).

An example of tampering is shown in Figure 4c, and the resulting tamper detection highlights the modified vertices in red color, as can be seen in Figure 4d.

To give more insights into how the algorithm detects tampering, we report a simple model in Figure 5a and show how the removal of a single vertex (Figure 5c) from the watermarked model (Figure 5b) results in a detection (Figure 5d) that highlights all the vertices contiguous to the removed one; these vertices are marked as forged because, as said in Item 2. of Section 5.3, the polygons containing them were altered: indeed, they were removed, deleting the vertex in the cone apex.

#### *Comparison with Related Works*

Among the related works, we selected for comparison the ones that reported numerical (objective) measures of distortion introduced by their algorithms, as there were no visible modifications to the model after watermark embedding. It should be pointed out that an exact comparison was not really possible as every paper used different sets of models with respect to one another, so we only compared with the best results they reported. Moreover, we emphasize that there were not many works on fragile watermarking reporting parameters to compare to in a fair way.

All in all, we can say that our proposed method was superior to all the compared methods in terms of quality (in many cases, more than two orders of magnitude of the considered measure) of the resulting models and the fragility of the watermark.

In [14], the authors reported the best PSNR value of 84.47 dB, which was far less than the smallest PSNR (>299 dB) our algorithm produced.

In [12], the authors reported distortion (the same as our MAE values) for various settings of their method's parameters; again, an exact comparison was difficult for two main reasons. First, the set of models they used was different from our set, and the model precision was 10−6, whereas the precision of our models was 10−4. Anyway, their best result was 1.3 <sup>×</sup> <sup>10</sup>−5, which was worse than our worst result (horse, 2.30 <sup>×</sup> <sup>10</sup>−6) by one order of magnitude. In [18], the same authors reported a distortion of 0.01, four orders of magnitude worse than our distortion results.

In [10], the authors reported a mean distance error (averaged over five models) of 2.33 <sup>×</sup> <sup>10</sup>−4, which was two orders of magnitude greater than the mean distance error (averaged over 10 models) computed by our models (1.92 <sup>×</sup> <sup>10</sup>−6).

In [15], the authors reported an average RMS error (3.74 <sup>×</sup> <sup>10</sup><sup>−</sup>4) that was two orders of magnitude greater than our reported RMSE (3.19 <sup>×</sup> <sup>10</sup><sup>−</sup>6), while our *RMSRatio* (1.07 <sup>×</sup> <sup>10</sup><sup>−</sup>7) was comparable with theirs. It should be pointed out, anyway, that our payload (five bits per vertex) was five times that of [15], but the distortion induced was the same. Moreover, the work in [15] had the disadvantage of requiring the centroid of the original model to perform the integrity verification, thus requiring out-of-band information to be kept per-model.

In [20], the authors reported an average (over five models) SNR of 124.24 dB that was far smaller than our average (over 10 models) SNR of 231.14 dB.

Finally, we performed several other experiments on the same models with different precisions, and in general, we could say that the proposed method resulted in a distortion that was in the order of 1/100th of the precision of the original model.

#### **7. Discussion**

The proposed fragile watermarking algorithm for 3D models performed a watermark bit string embedding by modifying the least significant part of some vertices' attributes (in the present embodiment, coordinates): the watermark was stored in a secret space defined by a secret KLT basis and protected the integrity of the structure of the 3D model, that is the polygon mesh and the vertices of these polygons. Thus, the security of the method lied in the secrecy of the vectors used to derive the KLT kernel.

The main advantages of the method were:


• affine transformations to the 3D models were allowed (no tampering was shown), as long as they were represented and stored as matrix operations to be applied to vertex coordinates (this is the default Blender behavior).

At the same time, the disadvantages of the method were:

