Statistical properties of Tardos codes

Boris Škorić and Antonino Simone

Eindhoven University of Technology

Stochastics Seminar, 28 Nov. 2012

OutlineForensic watermarking

◦ collusion attacksq-ary Tardos schemeDensity function of "scores"

◦ convolution◦ series expansion◦ numerics

Open problems

Forensic Watermarking

Embedder Detector

originalcontent

payload

content withhidden payload

WM secrets

WM secrets

payload

originalcontent

Payload = some secret code indentifying the recipient

ATTACK

3

Collusion attacks

A B A C

C A A A

A B A B

AC

AB

A ABC

"Coalition of pirates"Symbols received by pirates

Symbols allowed

“Restricted Digit Model”

Aim

Trace at least one pirate from detected watermark

BUTResist large coalition

⇒ longer codeLow probability of innocent accusation (FP) (critical)

⇒ longer codeLow probability of missing all pirates (FN) ⇒ longer code ANDLimited bandwidth available for watermark

5

n users

embeddedsymbols

m content segments

Symbols allowed

Symbol biases

drawn from distribution

F

watermarkafter attack

A B C B

A C B A

B B A C

B A B A

A B A C

C A A A

A B A B

AC

AB

A ABC

p1A

p1B

p1C

p2A

p2B

p2C

piA

piB

piC

pm

A

pm

B

pm

C

c pirates

q-ary Tardos scheme

• Arbitrary alphabet size q

• Dirichlet distribution F

A B C B

A C B A

B B A C

B A B A

A B A C

C A A A

A B A B

Tardos scheme (cont.)Tracing:

• Attackers output symbol yi in segment i:

• Every user gets a score

• Sum of scores per content segment

• User is "accused" if score exceeds threshold

g0(p)

p

g1(p)

p

For innocent user:E[score]=0 and E[score2]=1

Accusation probabilities

m = code length

c = #pirates

μ = E[coalition score per segment]

Pirates want to minimize μand make the innocent tail longerCurve shapes depend

on: alphabet size q F, g0, g1

Code length #pirates Pirate strategy

CLT: Big m curves go to GaussianMethod to compute innocent curve [Simone+Škorić 2010]

threshold

total score (scaled)

innocent guilty

S/√m

Finding the innocent score pdf

1. Find pdf of innocent score in one segment.φ(u)

2. Use convolution property of characteristic functions.

€

˜ ϕ (k) = [Fϕ ](k)

€

˜ ρ S (k) = [Fρ S ](k) = [ ˜ ϕ (k)]m

€

ρS / m

€

ρS / m

= mρ S

€

˜ ρ S / m

(k) = ˜ ρ S (k / m ) = [ ˜ ϕ ( k

m)]m

9

Innocent score pdf (2)

Finding the single-segment pdf:

attack strategy

10

Single-segment pdf

11

Innocent score pdf (3)

The Fourier transform:

hypergeometric

12

Innocent score pdf (4)

Direct approach for finding False Positive prob:

Prob[S>Z] =

Z/√m

Try numerical computation of the k-integral.

Problem: numerical instability!

13

Innocent score pdf (5)

Less direct approach for finding False Positive prob:• Still use same starting point

• ... but do Edgeworth-like expansion

Gaussian tail Hermite function

• ... and then pray for numerical stability14

Numerical results on False Positive probs.Convergence

not enough terms

15

Power law in the tails

16

Score pdf for one guilty user

Same approach, minor differences:• Nonzero mean (strategy dependent) • Variance depends on attack strategy

17

Combine data for innocent and guilty

18

Open questions / future work

• Better understanding of the convergence

• Reduce the reliance on "prayer"

• Strategy-independent bounds

• avoid re-doing everything for each strategy

• Do the whole exercise for the coalition scoreor multiple scores simultaneously

• Avoid the series expansion altogether?

19