Computer-Aided Design 38 (2006) 1154–1165

www.elsevier.com/locate/cad

A public fragile watermarking scheme for 3D model authentication

Chang-Min Chou a,b,∗ , Din-Chang Tseng a
a Institute of Computer Science and Information Engineering, National Central University, No. 300, Jungda Road, Jhongli City, Taoyuan, 320, Taiwan
b Department of Electronic Engineering, Ching Yun University, No. 229, Cheng-Shing Road, Jhongli City, Taoyuan, 320, Taiwan

Received 14 October 2005; accepted 29 June 2006

Abstract

A public fragile watermarking scheme based on the sensitivity of vertex geometry is proposed for 3D model authentication. In the 3D fragile
watermarking embedding, slightly perturbing the positions of a subset of vertices is usually needed to keep them in some predefined relationship
with their neighboring vertices. Two problems frequently arise in the embedding stage: the causality problem and the convergence problem. The
causality problem arises while the neighboring relationship of a former processed vertex is influenced by the perturbing of its latter processed
neighboring vertices. The convergence problem means that the original model has been heavily distorted before some vertices reach the predefined
relationship. In this paper, we propose a multi-function vertex embedding method and an adjusting-vertex method to overcome these two problems.
The proposed method does not need the original model and watermarks for authentication; moreover, the key for extracting watermarks is relatively
smaller than that of previous works. For some artistic or technical models, sometimes it is very important to control the distortion ratio caused
by watermark embedding. Our method can control the average distortion by the keys used in watermark embedding. Experimental and analytic
results on various kinds of 3D models show the effectiveness of the scheme.
c 2006 Elsevier Ltd. All rights reserved.

Keywords: 3D authentication; Digital signature; Fragile watermarking; Tamper detection

1. Introduction and watermarking techniques is that the former attaches a small

With the explosive growth of the Internet and the
development of digital content designing and processing
techniques, many valuable materials can be represented in
digital form for exhibition and access via the Internet. Due
to the characteristic of easy duplication and modification of
digital content, it is necessary to develop a variety of digital
signature or watermarking techniques for various protection
purposes such as model authentication and ownership claiming.
Digital signatures are designed for the receiver of electronic
documents to verify the identity of the sender and to
check the originality of the documents. The watermarking
schemes are usually designed for the sender to check the
copyright ownership (robust watermarking) or for the receiver
to verify the authentication of the received media (fragile
watermarking). The main difference between digital signature
∗ Corresponding author at: Institute of Computer Science and Information
Engineering, National Central University, No. 300, Junda Road, Jhongli City,
Taoyuan, 320, Taiwan. Tel.: +886 3 4227151x35202; fax: +886 3 4222681.
E-mail address: changmin@cyu.edu.tw (C.-M. Chou).
piece of information (the digital signature) transmitted with
the original documents whereas the latter embeds invisible
information (the watermarks) in the original media.
Encryption techniques can be symmetric or asymmetric [1].
Generally speaking, asymmetric methods have better security
but are very computationally expensive when compared with
symmetric methods. A compensation scheme is to encrypt
the digital contents by a symmetric method and then encrypt
the “symmetric key” by an asymmetric method. A typical
digital signature scheme extracts a “message digest” from the
original document and then encrypts the message digest by
an asymmetric method. The message digest can represent the
original document in such a way that two different message
digests will be generated for two different documents even if
they have only one bit of difference. The encrypted message
digest is attached to the original document and transmitted to
the receiver. Although all data types can be treated as binary
data files and encrypted by digital signature schemes, directly
applying digital signatures for large multimedia data sets is
still costly and computationally expensive [1,2]. Instead of
using digital signatures for all kinds of electronic documents,

c 2006 Elsevier Ltd. All rights reserved.

0010-4485/$ - see front matter

doi:10.1016/j.cad.2006.06.009
 C.-M. Chou, D.-C. Tseng / Computer-Aided Design 38 (2006) 1154–1165
Table 1
A comparison of fragile watermarking and digital signature as applied to 3D
models
Functions Digital Fragile watermarking
signature
Verify the identity of the sender Yes No
Check the integrity of the Yes Yes
documents
Locate the changed regions No Yes
Implementation cost High Low
Computation speed Slow Fast
Application fields General Particular
researchers develop various watermarking schemes for various
multimedia data types such as video, audio, images, and
3D models. Watermarks can be invisibly/inaudibly embedded
in these media by altering some of their lower significant
bits. Watermarking schemes usually don’t need any complex
computation (at most a FFT or wavelet transform [3] is used);
thus they can be performed in a fast and low cost way compared
with digital signature schemes.
According to the application purpose, watermarking
techniques can be classified into robust and fragile schemes.
Robust watermarking is usually designed for ownership
claiming while fragile watermarking is used for digital content
authentication and verification. The design goal of robust
watermarking is to make the embedded watermarks remain
detectable after being attacked. In contrast, the requirements
of fragile watermarking are to detect the slightest unauthorized
modifications and locate the changed regions. According to the
extraction strategies of watermarks, watermarking schemes can
be classified into the private and the public approach. A private
watermarking scheme needs the original model and watermark
to extract the embedded watermarks while a public (or so-called
blind) scheme can extract watermarks in the absence of the
original model and watermark. On the other hand, a “semi-
public” watermarking scheme does not need the original model
in the watermark extraction stage, but the original watermark
is necessary for comparing with the extracted watermark.
The word “public” used in watermarking schemes is different
from that represented in cryptography schemes. All fragile
watermarking schemes are public, since it makes no sense
to use a private fragile watermark. Possible applications of
public fragile watermarking include demonstrating that digital
material has not been changed (or has been changed) in
an official situation (e.g., in a court) and to confirm the
received digital material has not been changed at the receiver
end. The functions of the 3D fragile watermarking scheme
are similar to that of a digital signature. Both schemes can
check the originality of the received 3D models. Digital
signatures can verify the identity of the sender while the 3D
fragile watermarking can locate the changed regions. Moreover,
for 3D models, the 3D fragile watermarking is superior to
the digital signature scheme in its easy implementation and
faster computation. A comparison of these two schemes is
summarized in Table 1.
In 3D fragile watermark embedding, slightly perturbing the
positions of a subset of vertices is usually needed to keep
1155
them in some predefined relationship with their neighboring
vertices. Two problems frequently arise in the embedding
stage: the causality problem and the convergence problem. The
causality problem arises when the neighboring relationship of
a former processed vertex is influenced by the perturbing of its
later processed neighboring vertices. The convergence problem
means that the original model has been heavily distorted before
some vertices reach the predefined relationship. In this paper,
we propose a multi-function vertex embedding method and
an adjusting-vertex method to overcome these two problems.
The proposed method does not need the original model and
watermarks for authentication; moreover, the key for extracting
watermarks is relatively smaller than that of previous works.
For some artistic or technical models, sometimes it is very
important to control the distortion ratio caused by watermark
embedding. Our method can control the average distortion by
the keys used in watermark embedding.
The remaining sections of this paper are organized as
follows. A brief review of the robust and fragile 3D
watermarking schemes is given in Section 2, where the
causality and convergence problems are also discussed. The
proposed watermarking embedding scheme is described in
Section 3; moreover, we illustrate how to examine the
originality of the received 3D model and how to locate the
changed regions by the proposed method. We discuss the
control of the distortion caused by the watermark embedding
in Section 4. In this section, a variant scheme which attaches
a “watermark digest” with the original model instead of
embedding watermarks in the original model is presented.
Finally, experimental results and concluding summaries are
provided in Section 5.
2. Previous work and problems
Watermarking techniques for still images have been
widely studied and investigated in recent years. On the
other hand, watermarking for 3D models gets relatively
less notice. Initially, Ohbuchi et al. [4–6] proposed a
large variety of techniques for embedding data into 3D
polygonal models. Benedens and Busch [7,8] embedded
private watermarks by altering 3D object with a normal
distribution. Their watermarking systems achieved robustness
against randomization of vertices, mesh altering (re-meshing),
and polygon simplification operations. Praun et al. [9] proposed
a sophisticated robust mesh watermarking scheme. They first
constructed a set of scalar basis functions over the mesh vertices
using multi-resolution analysis [10] and then perturbed vertices
along the direction of the surface normal weighted by the basis
functions. Their watermarking scheme is resistant to common
mesh attacks such as translation, rotation, scaling, cropping,
smoothing, simplification, and re-sampling operations. These
above researches concentrated on 3D robust watermarking
techniques.
Yeo and Yeung are the pioneers for discussing 3D fragile
watermarking [11]. They computed two indices for every
vertex: the location index and the value index. For each vertex
v, the location index is calculated by a hash function according
1156 C.-M. Chou, D.-C. Tseng / Computer-Aided Design 38 (2006) 1154–1165

to the coordinates of it and its neighboring vertices, while the

value index is calculated by another hash function based on
its coordinates. Then they slightly perturbed every vertex to
make these two indices equal. Unauthorized modifications will
be detected in the watermark extraction phase by checking the
difference between these two indices. The scheme is both public
and fragile, but there are two disadvantages:
(i) The causality problem: The location index of a former
processed vertex will be changed by the perturbing of
later processed neighboring vertices. As one example,
illustrated in Fig. 1, suppose we process vertices in the Fig. 1. An example of the causality problem.
order v0 , v1 , v2 , . . . , vn , we first process and perturb v0
to make its value index (calculated from its coordinates)
being equal to its location index (calculated from the
coordinates of it and its neighboring vertices). However,
the location index of v0 will be changed when we process
and perturb v1 to adjust its value index. The same situation
occurred when the following vertices are processed. To
avoid the causality problem, we need to perturb vertices
in a predefined order (v0 , v1 , v2 , . . . , vn ) and constrain the
calculation of the location index for each vertex only to
involve the vertices that have been processed. For example,
in Fig. 1, the calculation of the location index of v0 should Fig. 2. An example of the convergence problem.
only involve itself. The calculation of the location index
of v1 should only involve v0 and v1 . The calculation of Lin et al. [13] proposed a scheme similar to Yeo and Yeung’s
the location index of v2 can only involve v0 , v1 and v2 , method [11]. Their method eliminates the causality problem by
and so on. This constraint can avoid the causality problem. applying two different hash functions on the vertex coordinates,
A drawback of this constraint is that the capability for
without considering the neighboring vertices of a vertex. In the
detecting modification will be ruined if the predefined
embedding stage, they slightly perturbed every vertex making
traverse order has been changed or became untraceable. For
these two hash function values equal; however, the convergence
example, a simple model simplification (vertex decimation)
problem still occurs in this scheme. To avoid heavy distortion
or vertex re-numbering operation may totally disable the
due to vertex perturbing, they set a threshold and simply skip
capability of the scheme.
(ii) The convergence problem: In the vertex perturbing stage, the vertices that could not meet the requirement under the
it requires perturbing the vertices of the whole model to threshold. This causes some embedding “holes” which cause
make the value index and the location index of every vertex false-alarms in the watermark detection stage.
equal. In practice, some vertices may need to be perturbed Wu and Cheung [14] proposed a fragile watermarking
more and more to satisfy the requirement as in the example scheme for authenticating 3D mesh models. The watermark
illustrated in Fig. 2. In the figure, v0 has to be perturbed to a embedded by the method is invariant to translation, rotation,
position that heavily distorts the original structure to make and uniform scaling, but is sensitive to other operations.
its two indices equal. It is possible that the requirement The main idea of the method is to keep the ratio between
is met only when the model has been heavily distorted or the distance from the mesh center to each surface face
the requirement can never be met. Another disadvantage and a quantization step remaining the same after the model
coming from the convergence problem is that the user can is translated, rotated, or uniformly scaled. There are two
not control the distortion induced by the perturbing process. major drawbacks in this scheme. Firstly, it is a semi-public
Fornaro and Sanna [12] proposed a public key approach watermarking scheme since the original watermark is needed
for authentication of Constructive Solid Geometry (CSG) in the decoding stage to authenticate the watermarked model.
models. They computed watermarks from a model followed In fragile watermarking, a pure public watermarking scheme is
by a watermark encryption operation and then attached the preferred since we don’t want to pay extra cost for encrypting
encrypted watermarks to the solids or comments of the CSG the original watermark. Secondly, it fails in locating the
models. The advantage of the method is that no modification changed regions since the center position of the mesh will be
on the original 3D model is needed and this characteristic changed once any vertex has been changed. In our opinion, the
is sometimes very important to some “artistic” or “technical” ability of locating the changed region is important for fragile
models. The drawback of this scheme is that it can only tell watermarking. However, their concept of invariant geometry
if a model has been modified, but can not locate the modified transformation is worth further study since the transformation
regions. To locate modifications is an important issue in 3D does not affect the integrity of the mesh. No other paper
fragile watermarking. discussing the topic has been published as yet.
 C.-M. Chou, D.-C. Tseng / Computer-Aided Design 38 (2006) 1154–1165
Fig. 3. An overview of our watermark embedding and extraction schemes.
3. The proposed watermarking scheme
In the proposed watermarking scheme, two major methods,
the multi-function vertex embedding method and the adjusting-
vertex method, are proposed for 3D model authentication. An
overview of our watermark embedding and extraction schemes
is illustrated in Fig. 3.
The multi-function vertex embedding method means that the
three coordinates of a mark vertex are assigned and embedded
with different functions of watermark in the watermark
embedding stage. At first, we select a set of mark vertices from
the original mesh model. The union of the selected vertices and
their neighboring vertices should cover the whole model. Then
we modulate the x1 coordinate of each vertex to indicate if it
is a mark vertex. For mark vertices, we embed wi and h(wi )
into their x2 and x3 coordinates respectively. The embedding
needs to ensure all mark vertices satisfy the relationship of
h i = h(wi ) after watermark embedding, and this relationship
will be used for the authentication check in the extraction stage.
In the watermark extraction stage, we examine a mesh model
by first checking the x1 coordinate of every vertex to see if
it is a mark vertex. Then for each mark vertex, we extract
the possible embedded information w 0 and h 0 from its x2 and
x3 coordinates respectively and examine if it can satisfy the
relationship h(w0 ) = h 0 . For any mark vertex that can not hold
1157
this predefined relationship, we set it and all its neighboring
vertices as suspicious vertices.
3.1. The watermark embedding scheme
Given a mesh M(V, C), where V is the vertex set and
C is the connectivity relationship on M, a watermark W =
(w1 , w2 , . . . , wn ) is embedded by inducing each wi with a
small displacement in a subset of V . A vertex v is noted as
v(x1 , x2 , x3 ) or v 0 (x10 , x20 , x30 ) before or after embedding (or
say marking), respectively. The approach for embedding wi in
vertex v is as follows:
(i) The three coordinates of vertex v(x1 , x2 , x3 ) are defined
with different functions: x1 is used to indicate if v is a
mark vertex (i.e., v is a watermark embedded vertex), x2
is used for embedding watermark wi , and x3 is used for
embedding h(wi ), where h is a predefined hash function
and is used for checking modification.
(ii) For each vertex, its x1 value is divided by a factor k w to
generate an integer. If v is a mark vertex, the integer must
be odd; otherwise, x1 is changed to x1 + k w . If v is a
non-mark vertex, the integer must be even; otherwise, x1
is changed to x1 + k w . That is,
jx k
1
m= w
k
mod 2 (1)
1158 C.-M. Chou, D.-C. Tseng / Computer-Aided Design 38 (2006) 1154–1165

and them in some predefined relationship with their neighboring

x1 , if (m = 1 and v is a mark vertex) or vertices. The convergence problem arises when the original


x10 = (m = 0 and v is not a mark vertex). (2) model has been heavily distorted before some vertices reach
x1 + k w , otherwise. the predefined relationship. The use of the “adjusting vertex”

method guarantees that there is no endless perturbing while
(iii) For a mark vertex v, its barycenters of x2 and x3
embedding watermarks; thus there is no convergence problem
coordinates, x2c and x3c , are calculated by averaging the
in the proposed method. The detailed watermark embedding
coordinates of its neighboring vertices,
procedure is given in Algorithm 1.
1 X
x cj = x j , j = 2, 3, (3)
|N (v)| N (v) Algorithm 1 (The Watermark Embedding Algorithm).
where N (v) is the set of v’s neighboring vertices and
|N (v)| is the size of N (v). In this paper, we use the for each vertex vi in the mesh model
“barycenters” of a vertex to represent the vertex features { vi .mark = False
calculated by Eq. (3). vi .mark eligible = True
(iv) For a mark vertex v, its x j coordinate is slightly moved vi .adjusting eligible = True
toward x cj to the new locations x ej such that |x ej − x cj | are }
q
divisible by k j , j = 2, 3, respectively, set v1 as the active vertex, vact
while (vact ! = NULL)
q
(
e x j − (|x j − x cj | mod k j ), if x j > x cj ; { if vact is a mark eligible vertex and there is at least one
xj = q (4)
x j + (|x j − x cj | mod k j ), otherwise. eligible adjusting vertex among vact ’s neighboring
q vertices then
(v) Finally, we employ k j and k dj to embed watermark wi and { randomly select one eligible adjusting vertex v j from
hash function value h i in x ej , vact ’s neighboring vertices as its adjusting vertex
vact .mark = True
x + d j , if x j > x cj
 e
0
x j = ej , j = 2, 3, (5) vact .mark eligible = False
x j − d j , otherwise vact .adjusting eligible = False
q
k2
q
k v j .mark eligible = False
where d2 = w , d3 = 3d h i , h i = h(wi ), 0 < wi < k2d ,
k2d i k3 for each vact ’s neighboring vertex vi
0 < hi < k3d , wi , h i , k2d , k3d ∈ N ,
and h is a predefined vi .adjusting eligible = False
hash function. The embedding perturbs x ej toward the calculate the x2 and x3 coordinate barycenters of vact
original value x j with a small displacement d j which is using Eq. (3)
q
always less than k j , j = 2, 3. embed watermarks to vact ’s x2 and x3 coordinates
using Eqs. (4) and (5)
k w , k j , k dj , and h will serve as the keys in the watermark
q
}
extraction stage. elseif vact is surrounded by all adjusting vertices then
The causality problem and the convergence problem arise { set vact as an isolated vertex
in the embedding stage when we embed watermarks through vact .mark = True
the whole model. It is obvious that the barycenters (x2 and }
x3 coordinates) of a former processed vertex will be changed set the next vertex as the active vertex, vact (Traverse the
when any of its neighboring vertices was selected to be a whole model)
mark vertex too and need to be perturbed. We propose an }
“adjusting vertex” method to overcome the causality problem. set v1 as the active vertex, vact
The function of the adjusting vertex is to keep the barycenters while (vact ! = NULL)
of the mark vertex unchanged. For each chosen mark vertex, { modulate vact ’s x1 coordinate according to its mark flag
we randomly assign an adjusting vertex from its neighboring using Eqs. (1) and (2)
vertices. In other words, a vertex is qualified to be a mark vertex if vact is a mark vertex then
as long as it can find an adjusting vertex among its neighboring make compensation perturbation on vact ’s adjusting
vertices. Any mark vertex can’t be taken as an adjusting vertex using Eq. (6)
vertex and vice versa. To avoid the causality problem, the set the next vertex as the active vertex, vact (Traverse the
neighboring vertices of the previously selected mark vertices whole model)
can’t be taken as adjusting vertices for later mark vertices. This }
constraint eliminates the causality problem but may leave a for each isolated vertex vi in the mesh model
few isolated vertices, which is a vertex wholly surrounded by { calculate the x2 and x3 coordinate barycenters of vi
adjusting vertices. The isolated vertices will be treated as mark using Eq. (3)
embed watermarks to vi ’s x2 and x3 coordinates using
vertices and be perturbed after all adjusting vertices having
Eqs. (4) and (5)
been modulated. Most 3D fragile watermarking embedding
}
schemes perturb the positions of a subset of vertices to keep
 C.-M. Chou, D.-C. Tseng / Computer-Aided Design 38 (2006) 1154–1165
Three flags are used in the algorithm to indicate the state
of each vertex in the mesh model: the “mark” flag indicates
if a vertex is a mark vertex or a non-mark vertex, the
“mark eligible” flag indicates if a vertex is eligible to be a mark
vertex, and the “adjusting eligible” flag indicates if a vertex is
eligible to be an adjusting vertex. Initially, all vertices are set
to be non-mark, mark eligible, and adjusting eligible vertices.
Then we set v1 as the active vertex and traverse the whole model
starting from v1 to select a set of mark vertices. Any traversal
algorithm works fine in this scheme as long as it can visit every
vertex exactly once. In our experiments, a simple breadth-first
search (BFS) algorithm is used for the mesh vertex traversal. A
vertex is set to be a mark vertex if it is a mark eligible vertex
and there is at least one eligible adjusting vertex among its
neighboring vertices. We randomly select one eligible adjusting
vertex from its neighboring vertices as its adjusting vertex
and then modify the related flags: set the active vertex as
a mark, non-mark eligible, and non-adjusting eligible vertex.
The selected adjusting vertex is set as a non-mark eligible
vertex, and all active vertex’s neighboring vertices are set as
non-adjusting eligible vertices. For each selected mark vertex,
the barycenters of their x2 and x3 coordinates are calculated
using Eq. (3). Then we slightly perturb their x2 and x3
coordinates to embed watermarks by using Eqs. (4) and (5).
A vertex that is surrounded by all adjusting vertices (i.e., an
isolated vertex) is set to be a mark vertex. An isolated vertex’s
mark eligible and adjusting eligible flags are not modified
since these two flags won’t be checked anymore if a vertex
is surrounded by all adjusting vertices. Without adjusting
vertices, the isolated vertices are watermarked after all their
neighboring adjusting vertices have been perturbed to prevent
their barycenters from being changed. Therefore, the isolated
vertices are not watermarked at this stage. The selection of mark
vertices will keep going till the end of mesh traversal.
After the mark vertices have been selected, we traverse the
mesh model again with the same order as the selection of the
mark vertices. During this iteration, we first modulate the x1
coordinate of each vertex according to its mark flag using Eqs.
(1) and (2). The x1 coordinate will be used to indicate if a vertex
is a mark vertex in the watermark extraction stage. Then we
make compensation perturbations on adjusting vertices,
X
x a0 a
j = xj − (x 0j − x j ), j = 2, 3, (6)
N (mv)
where x2a and x3a are the second and third coordinates of the
adjusting vertex for a mark vertex v; N (mv) is the set of all v’s
neighboring mark vertices and adjusting vertices of previous
mark vertices. Lastly, we embed watermarks into all isolated
vertices using the same technique as we applied for other mark
vertices. The union of all mark vertices and their neighboring
vertices cover the whole model; thus we can detect any change
on the model. A brief proof of the coverage completeness is
given below.
Proof of coverage completeness: The union of all mark
vertices and their neighboring vertices cover the whole model.
Proof. Assume there is a non-mark vertex vi which is not
covered by any mark vertex; that is, it is surrounded by
1159
adjusting vertices and other non-mark vertices. If vi is
surrounded by all adjusting vertices, it is an isolated vertex and
will be set as a mark vertex; otherwise, vi can pick a non-mark
vertex from its neighboring vertices to be its adjusting vertex,
and it will be set as a mark vertex. In both cases, vi can be set
as a mark vertex; thus, there is no such non-covered vertex vi .
3.2. The watermark extraction scheme and tamper detection
In the watermark extraction stage, k w , k j , k dj , and h serve
q
as the keys for malicious change detection. The detailed
watermark extraction procedure is given in Algorithm 2.
Algorithm 2 (The Watermark Extraction Algorithm).
set all vertices in the mesh model as non-suspicious vertices
set v1 as the active vertex, vact
while (vact ! = NULL)
{ Check vact ’s x1 coordinate to see if it is a mark vertex
if vact is a mark vertex then
{ calculate the x2 and x3 coordinate barycenters of
vact using Eq. (3)
extract w 0 and h 0 from vact ’s x2 and x3 coordinates
using Eq. (7)
if h(w 0 )! = h 0 then
set vact and all its neighboring vertices as
suspicious vertices
}
set the next vertex as the active vertex, vact (Traverse the
whole model)
}
Initially, all vertices of the mesh model are set to be non-
suspicious vertices. Then we set v1 as an active vertex and
traverse the whole model starting from v1 to examine the model.
We check if a vertex is a mark vertex by applying its x1
coordinate and k w to Eq. (1). For each mark vertex, we first
calculate its x2 and x3 barycenters using Eq. (3), and then apply
q
its x2 and x3 coordinates, the barycenters, and k j , k dj to extract
the watermarks using the following equations,
 d
q k2


 w 0
= (|x c
2 − x 0
2 | mod k 2 ) q
 k2
(7)
kd
h 0 = (|x3c − x30 | mod k3q ) 3q .



k3
Vertices that have not been changed will satisfy the
relationship, h(w0 ) = h 0 . On the other hand, a vertex that
does not satisfy the above relationship indicates that at least
one of its neighboring vertices or the vertex itself (or both) has
been changed. Thus, for any mark vertex that can not satisfy
this relationship, we’ll set it and all its neighboring vertices
as suspicious vertices. There is no way for a forger to modify
a model and keeping the relationship unchanged without the
keys. Fig. 4 shows how our scheme detects modifications
and locates the suspicious modified regions. In Fig. 4(a), v
is a vertex that has been changed, and wi , i = 0–5, are
1160 C.-M. Chou, D.-C. Tseng / Computer-Aided Design 38 (2006) 1154–1165

Fig. 4. A mesh with one vertex changed. (a) v is a vertex that has been changed
and wi , i = 0–5, are mark vertices. (b) Two mark vertices, w1 and w4 , have
detected the change. (c) These two mark vertices and their neighboring vertices
are set to be suspicious vertices (linked by dashed lines). (d) Parts of suspicious
vertices are released by the undetected mark vertices (changed from gray to
non-gray nodes). In this figure, black nodes denote the mark vertices, white
nodes denote the non-mark vertices, and gray nodes denote the suspicious
vertices.

mark vertices. In Fig. 4(b), two mark vertices, w1 and w4 ,

have detected the change, whereas other four mark vertices
don’t. Fig. 4(c) shows that these two mark vertices and their
neighboring vertices are set to be suspicious vertices (linked by
dashed lines, shown as gray nodes). Then parts of suspicious
vertices are released by the undetected mark vertices (changed
from gray to non-gray nodes), as shown in Fig. 4(d). Lastly, we
can induce the possible modified vertices: v and/or w1 .
4. Distortion control
In 3D models, the distance between two surfaces X and Y
can be defined as an L 2 measurement [15],
s Z
1 distortion d(M, M 0 ) is relative to these three parameters in the
d(X, Y ) = d(x, Y )2 dx, (8)
area(X ) x∈X
where d(x, Y ) is the Euclidean distance from a point x on
X to the closest point on Y . We modify the definition of the
L 2 measurement to d(M, M 0 ) for representing the average
distortion of all vertices in a model:
|M|
1 X
d(M, M 0 ) = |vi − vi0 |,
|M| i=1
where M and M 0 are the original and marked models,
respectively. In our scheme, the distortion induced by
Fig. 5. The distortion control analysis. (a) The chart of k q versus the average
model distortion with various k w s. (b) The chart of k w versus the average model
distortion with various k q s.
watermark embedding depends on the x1 , x2 , and x3
quantization steps: k w , k2 , and k3 . Key value k w controls
q q
q
the quantization step of x1 coordinate and key values k2 and
q
k3 control the quantization steps of x2 and x3 coordinates,
respectively. The setting of these three key values depends on
the desired average distortion. Fig. 5 shows how the average
Venus model. Fig. 5(a) is the chart of k q versus the average
model distortion with various k w s; Fig. 5(b) is the chart of k w
versus the average model distortion with various k q s. For the
q q
simplicity of discussion, we set k2 = k3 = k q for both charts
in Fig. 5. From these two charts, we can see that the less k w
and k q are, the less the distortion is. Thus the average distortion
caused by the watermark embedding process can be controlled
(9) by setting appropriate k w and k q s. For example, suppose we
want to control the average distortion under 10−3 , we may
reasonably set the key values of k w to be 10−3 and both k q s
to be 10−3.5 by observing the curves in Fig. 5(a) and (b).
 C.-M. Chou, D.-C. Tseng / Computer-Aided Design 38 (2006) 1154–1165 1161

Fig. 6. The steps of the “watermark digest” method.

For some artistic or technical models, it is sometimes

very important not to make any modification on the original
mesh models. We propose a variant scheme to satisfy this
requirement. In the variant scheme, a watermark digest (WD)
is calculated from the original model and then attached to the
original model for transmission. The WD consists of two parts
of information: w m and w p . The w m part records the indices
of the mark vertices while the w p part records the required
perturbing displacements of all mark vertices. The receiver
can perturb the received model according to the WD record
and then check the originality of the received model by the
method described in Section 3. This scheme is simple and the
original model need not be modified. To ensure security, the WD
needs to be encrypted. In other words, the WD plays the same
role as the “message digest” in the digital signature scheme.
Users can treat this method as a simple scheme for extracting
message digests from 3D models. Fig. 6 illustrates the idea of
this alternative method.

5. Experimental results and conclusions

We evaluated the proposed watermarking scheme on a set

of 3D models with various unauthorized attacks. Table 2 lists
the models used in our experiments. In these models, about
38%–45% of vertices were chosen to be mark vertices. The key
values have to be carefully chosen since they directly influence
the average distortion of the marked models. The settings of k2d
and k3d depend on the range of embedded integer watermarks,
wi , and the hash function of wi , h(wi ), respectively. According
to Eq. (5), k2d has to be set greater than all wi and k3d has to be set
greater than all h(wi ). For example, if the selected set of integer
watermarks is in the range [0, n] and the hash function of this
watermark set is in the range [0, m], we may set k2d = n + 1 and
k3d = m + 1. The setting of key values k w and k q s depends on
the desired average distortion. Key values k w and k q s directly
Fig. 7. One example of 3D fragile watermarking. (a) The original Venus model.
(b) The marked Venus model. (c) The marked Venus model changed by various
attacks simultaneously, where ‘A’ denotes the region of invisible noise added,
‘B’ denotes the region of an extra vertex added, and ‘C’ denotes the region of
some vertices deleted. (d) The detection results: the marked areas represent the
suspicious regions.
relate to the quantization steps of x2 and x3 coordinates, thus the
smaller the key values are, the smaller the average distortion
is. Key values k d s, which relate to the watermarks embedded
within each quantization step of x2 and x3 coordinates, have
no certain relationship to the average distortion. Table 3 lists
several experimental results of various models to illustrate the
1162 C.-M. Chou, D.-C. Tseng / Computer-Aided Design 38 (2006) 1154–1165

Table 2
The list of models used in our experiments

Model name Number of vertices/faces Number of mark vertices Model

Apple 891/1704 343

Beethoven 2655/5028 1 022

Blade 24 998/49 992 10 320

Dinosaur 14 070/28 136 6 213

Horse 48 485/96 966 20 241

Pulley 25 482/50 964 10 402

Rocker-arm 10 044/20 088 4 142

Triceratops 2832/5660 1 132

Venus 8268/16 532 3 175

relationship between the setting of key values and the average
distortion. The precision level is 10−4 for the original Venus
model, and is 10−6 for all other original models in Table 3.
As shown in Table 3, smaller key values will produce smaller
average distortion, but will increase the precision requirement
of the marked model. Extra precision requirement will cause a
size overload of the marked model. Users should determine the
trade-off between a small average distortion and a small-sized
overload.
Fig. 7 illustrates how a Venus model is watermarked and
the detected changes by our scheme. Fig. 7(a) shows the
original Venus model. The Venus model has 8268 vertices and
16 532 faces; 3175 vertices were chosen to embed watermarks.
Fig. 7(b) shows the same view of the marked model. These two
models are visually identical. Fig. 7(c) shows a marked Venus
model that has been illegally changed by various operations:
noising, vertex adding, and vertex deleting simultaneously.
The regions labeled ‘A’, ‘B’, and ‘C’ denote the regions
of invisible noise added, an extra vertex added, and some
vertices deleted, respectively. The proposed scheme locates
these changed regions by setting all regions that can not hold
the predefined neighborhood relationship as suspicious regions.
Fig. 7(d) shows the detected suspicious regions with marks. In
this experiment, we tried to control the average distortion within
10−4 . By observing the charts of Fig. 5, we set k w = 10−4
 C.-M. Chou, D.-C. Tseng / Computer-Aided Design 38 (2006) 1154–1165 1163

Table 3
The average distortion of various models with different settings of key values

kw
q q
Model/Precision level of original k2 k3 k2d k3d Hash function Average distortion/Precision requirement of marked model
model
0.01 0.01 0.01 250 250 h(wi ) = wi 0.019382/10−5
0.001 0.01 0.01 250 250 h(wi ) = wi 0.018326/10−6
0.01 0.001 0.001 250 250 h(wi ) = wi 0.003973/10−6
0.001 0.001 0.001 250 250 h(wi ) = wi 0.002088/10−6
0.0001 0.001 0.001 250 250 h(wi ) = wi 0.001982/10−7
Blade/10−6 0.001 0.0001 0.0001 250 250 h(wi ) = wi 0.000383/10−7
0.0001 0.0001 0.0001 250 250 h(wi ) = wi 0.000192/10−7
0.0001 0.0001 0.0001 250 500 h(wi ) = 2wi 0.000193/10−7
0.0001 0.0001 0.0001 500 250 h(wi ) = 0.5wi 0.000215/10−7
0.0001 0.0001 0.0001 500 500 h(wi ) = wi 0.000213/10−7
0.00001 0.00001 0.00001 250 250 h(wi ) = wi 0.000019/10−8

0.01 0.01 0.01 250 250 h(wi ) = wi 0.013444/10−5

0.001 0.01 0.01 250 250 h(wi ) = wi 0.012352/10−6
0.01 0.001 0.001 250 250 h(wi ) = wi 0.003285/10−6
0.001 0.001 0.001 250 250 h(wi ) = wi 0.001330/10−6
0.0001 0.001 0.001 250 250 h(wi ) = wi 0.001222/10−7
Pulley/10−6 0.001 0.0001 0.0001 250 250 h(wi ) = wi 0.000332/10−7
0.0001 0.0001 0.0001 250 250 h(wi ) = wi 0.000136/10−7
0.0001 0.0001 0.0001 250 500 h(wi ) = 2wi 0.000146/10−7
0.0001 0.0001 0.0001 500 250 h(wi ) = 0.5wi 0.000146/10−7
0.0001 0.0001 0.0001 500 500 h(wi ) = wi 0.000155/10−7
0.00001 0.00001 0.00001 250 250 h(wi ) = wi 0.000014/10−8

0.01 0.01 0.01 250 250 h(wi ) = wi 0.014812/10−5

0.001 0.01 0.01 250 250 h(wi ) = wi 0.013800/10−6
0.01 0.001 0.001 250 250 h(wi ) = wi 0.003286/10−6
0.001 0.001 0.001 250 250 h(wi ) = wi 0.001266/10−6
0.0001 0.001 0.001 250 250 h(wi ) = wi 0.001153/10−7
Rocker-arm/10−6 0.001 0.0001 0.0001 250 250 h(wi ) = wi 0.000323/10−7
0.0001 0.0001 0.0001 250 250 h(wi ) = wi 0.000121/10−7
0.0001 0.0001 0.0001 250 500 h(wi ) = 2wi 0.000130/10−7
0.0001 0.0001 0.0001 500 250 h(wi ) = 0.5wi 0.000134/10−7
0.0001 0.0001 0.0001 500 500 h(wi ) = wi 0.000143/10−7
0.00001 0.00001 0.00001 250 250 h(wi ) = wi 0.000013/10−8

0.01 0.01 0.01 250 250 h(wi ) = wi 0.013823/10−5

0.01 0.001 0.001 250 250 h(wi ) = wi 0.003250/10−6
0.001 0.001 0.001 250 250 h(wi ) = wi 0.001343/10−6
0.0001 0.001 0.001 250 250 h(wi ) = wi 0.001222/10−7
Venus/10−4 0.001 0.0001 0.0001 250 250 h(wi ) = wi 0.000326/10−7
0.0001 0.0001 0.0001 250 250 h(wi ) = wi 0.000125/10−7
0.0001 0.0001 0.0001 250 500 h(wi ) = 2wi 0.000134/10−7
0.0001 0.0001 0.0001 500 250 h(wi ) = 0.5wi 0.000132/10−7
0.0001 0.0001 0.0001 500 500 h(wi ) = wi 0.000141/10−7

q
and k j = 10−5 , j = 2, 3, to achieve the requirement. As a
result, the average distortion of the marked Venus model was
10−4.5 . The value of k dj was set to 256; thus all watermarks were
integers randomly generated in the range [0, 255]. A simple
hash function h(x) = x was used for the change detection.
For engineering/technical models with flat surfaces, distor-
tion control of the watermark effect on the flat surfaces is the
most important issue. Our scheme can control the watermark
effect with proper key value setting. Fig. 8 shows the marked
results of three engineering models with different key value set-
q q
tings. We set k2 = k3 = k q for all models in Fig. 8. Fig. 8(a)
and (b) show that the surfaces of marked models Blade and
Pulley keep flat while the average distortion is around 10−3 ,
and become rugged while the average distortion is around 10−2 .
Fig. 8(c) shows that the surface of the marked model Rocker-
arm stays flat when the average distortion is around 10−4 , and
becomes rugged when the average distortion is around 10−3 .
The precision levels of these three original models are all 10−6 .
According to Table 3, if we want to keep these marked surfaces
flat, the precision level requirements of marked models Blade,
Pulley and Rocker-arm are 10−6 , 10−6 and 10−7 , respectively.
Users can set the key values according to their requirements of
precision level and visual effect of marked models. However,
for conservative users who do not want to make any change on
1164 C.-M. Chou, D.-C. Tseng / Computer-Aided Design 38 (2006) 1154–1165

Fig. 8. The marked results of three engineering models with different key value settings in front and back views. (a) The Blade model with various levels of
distortion. (b) The Pulley model with various-level distortions. (c) The Rocker-arm model with various-level distortions.

the original models, we recommend they choose the alternative
watermark digest method instead of the direct watermark em-
bedding scheme.
Our scheme is superior in that the average distortion of the
marked models is under control by the user while the other
schemes may suffer from the distortion problem due to the
convergence problem. In addition, a relatively small key is
needed for watermark extraction in our watermarking scheme.
In Yeo and Yeung’s work [11], three lookup tables each with
256 binary entries (256×3 = 768 bits) and two predefined hash
functions are needed to extract watermarks while the proposed
q q
scheme needs only three floating-point numbers (k2 , k3 , and
w d d
k ), two integers (k2 and k3 ) and a predefined hash function
for watermark extraction (32 × 3 + 16 × 2 = 128 bits). In both
schemes, the key size is independent of the size of the 3D mesh
model. Moreover, our scheme can detect the changed regions
and give a reasonable guess of unauthorized modifications. We
think the ability of locating unauthorized modifications is an
important issue in 3D fragile watermarking.
Fig. 9 shows an example of how our watermarking scheme
detects unauthorized modification and gives a reasonable guess
to the kind of change that has been added on the marked model.
Fig. 9(a) shows a marked Dinosaur model. The Dinosaur
model has 14 070 vertices and 28 136 faces. 6213 vertices
were chosen to embed watermarks. Fig. 9(b) shows a marked
Dinosaur model changed by cutting the end of its tail. Fig. 9(c)
shows the cutting plane and vertices on the cutting plane.
The mark vertices (black nodes) detected a modification since
their neighboring relations were changed. Fig. 9(d) shows these
detected mark vertices setting themselves and their neighboring
vertices as suspicious vertices (turn to gray nodes). As a
result, these detected suspicious vertices roughly form a circle.
Two possible attacks are most likely to produce this situation:
cropping and vertex decimation. Thus, we may reasonably
suspect that a part of the Dinosaur model has been cut from
this circle (the cutting plane) or a part of vertices around this
circle has been decimated.
The main contributions of the proposed scheme are
summarized as follows: (i) The causality problem has been
overcome using the adjusting vertex method so that the traverse
order is not needed in the watermark extraction stage. (ii)
The adjusting vertex method eliminates the possible problem
 C.-M. Chou, D.-C. Tseng / Computer-Aided Design 38 (2006) 1154–1165
Fig. 9. An example of detecting modification. (a) The marked Dinosaur model.
(b) The marked Dinosaur model changed by cutting the end of its tail. (c) The
cutting plane. (d) The circle formed by the suspicious vertices. In this figure,
black nodes denote the mark vertices and white nodes denote the non-mark
vertices.
of endless perturbing on mark vertices. This concept can
effectively limit the distortion ratio caused by watermark
embedding. (iii) Different functions are defined for the three
coordinates of vertices so that multiple meaningful information
can be embedded in one vertex. This characteristic is helpful
for other 3D applications such as robust watermarking and
data hiding. (iv) The average distortion of the marked models
is under user control with proper key value setting. (v)
The proposed scheme can detect and locate all unauthorized
modifications even if various multiple illegal changes are made
on a model simultaneously. (vi) The proposed scheme is public
and a relative small key is needed for the watermark extraction.
(vii) A variant scheme which attaches a “watermark digest”
with the original model instead of embedding watermarks in
the original model is proposed. It can be treated as a simple and
easy implementation version of the digital signature scheme in
extracting a “message digest” from 3D models.
1165
Acknowledgements
The authors thank the anonymous reviewers for their
valuable comments and suggestions which improved the
readability and quality of this paper. The Blade model was
provided courtesy of IMATI-GE/CNR by the AIM@SHAPE
Shape Repository. The Pulley model was provided courtesy of
INRIA by the AIM@SHAPE Shape Repository.
References
[1] Schneier B. Applied cryptography: Protocols, algorithms, and source code
in C. 2nd ed. New York: Wiley; 1996.
[2] Xie L, Arce GR. A class of authentication digital watermarks for secure
multimedia communication. IEEE Trans Image Process 2001;10(11):
1754–64.
[3] Barni M, Bartolini F, Piva A. Improved wavelet-based watermarking
through pixel-wise masking. IEEE Trans Image Process 2001;10(5):
783–91.
[4] Ohbuchi R, Mukaiyama A, Takahashi S. A frequency-domain approach
to watermarking 3D shapes. Comput Graph Forum 2002;21(3):373–82.
[5] Ohbuchi R, Masuda H, Aono M. Watermarking three-dimensional
polygonal models through geometric and topological modifications. IEEE
J Sel Areas Commun 1998;16:551–60.
[6] Ohbuchi R, Takahashi S, Miyazawa T, Mukaiyama A. Watermarking 3D
polygonal meshes in the mesh spectral domain. In: Proc of the graphics
interface. 2001.
[7] Benedens O. Geometry-based watermarking of 3-D models. IEEE
Comput Graph Appl 1999;19:46–55.
[8] Benedens O, Busch C. Towards blind detection of robust watermarks in
polygonal models. Comput Graph Forum 2000;19:C199–208.
[9] Praun E, Hoppe H, Finkelstein A. Robust mesh watermarking. In: ACM
siggraph proc. 1999.
[10] Hoppe H. Progressive meshes. In: ACM siggraph proc. 1996.
[11] Yeo BL, Yeung MM. Watermarking 3D objects for verification. IEEE
Comput Graph Appl 1999;19:36–45.
[12] Fornaro C, Sanna A. Public key watermarking for authentication of CSG
models. Comput Aided Des 2000;32:727–35.
[13] Lin HY, Liao HY, Lu CS, Lin JC. Fragile watermarking for authenticating
3-D polygonal meshes. IEEE Trans Multimedia 2005;7(6):997–1006.
[14] Wu HT, Cheung YM. A fragile watermarking scheme for 3D meshes. In:
Proc the 7th workshop on multimedia and security. 2005.
[15] Khodakovsky A, Schröder P, Sweldens W. Progressive geometry
compression. In: ACM siggraph proc. 2000.