Slide #8 (Motivation)
  Why watermark images? The main reason is copyright protection. The
  aim of watermarking is to embed extra information in an image, such
  that if you try to remove the watermark, the image will be damaged. 

  There are a number of ways of manipulating images: filtering,
  cropping, color remapping, translation, scaling, rotation, and
  lossy compression. Since they do not destroy images, watermarks
  should also survive these manipulations. 

Slide #9 (The Simple, Elegant, and Wrong Solution)
  One approach to watermarking is to embed the copyright information
  in lower bits of the pixels. The embedding is easy to do, and
  modifying these bits does not harm the image. But this is exactly the
  wrong thing to do, because someone can remove your watermark, and
  still have a perfect image. Thus, we need to embed watermarks in
  perceptually significant parts of an image, so that removing them
  will also destroy the image.  

Slide #10 (Perception: The Human Visual System)
  There are a lot of different complexities in the human visual
  system, which govern the relationships between the bits stored in a
  picture, and  
  what you actually perceive. A key fact here is that humans are much
  happier with unstructured noise than structured noise. Ideal
  watermarking schemes should thus embed unstructured elements. 

Slide #11 (M-Sequences - Wolfgang, Swanson)
  The main idea behind the M-sequences approach is to use the watermark to
  modulate signals that look like noise. From the perception slide, we
  saw that humans much prefer unstructured noise. Thus, this approach
  allows us to generate watermarked images that look pretty much like
  the originals. 

  Also, one good thing about this technique is that it is orthogonal,
  in the sense that multiple watermarks can be embedded in an
  image, without one interfering with the others. Also, it is
  resistant to filtering, and cropping. With 
  respect to security, it relies on the fact that, to remove the
  watermark, one needs to know the pseudo-random sequence used in
  embedding it. 

Slide #12 (Signal Processing Approach)
  Among the group of people working on this signal processing
  approach, Cox et al and Ruanaidh et al have done the most
  interesting work. They both use the Spread Spectrum method, and
  share the realization that you want to target perceptually important
  parts of your image, rather than embedding the watermark in parts of
  the picture that are not important (because, in this case, someone
  can just run a filter to remove the watermarks). 

Slide #13 (Spread Spectrum)
  This slide shows the basic idea behind the spread spectrum
  approach. For the same data, we can have a large signal over a small
  bandwidth or a weak one over a large bandwidth. That is why it is
  called spread spectrum. The method picks perceptually important
  bands, and spreads out the noise (watermark) it is encoding over
  these bands. Given the knowledge of how it is spread out, the
  signal can be recovered. 

Slide #14 (Approaches (Cox, Ruanaidh))
  Cox et al used a model of the human visual system to
  decide which are the most important frequencies. Both Cox and
  Ruanaidh expected some kind of damage to their watermarks. So they
  keep huge databases of all watermarks ever embedded in images, and, when
  they want to recover a watermark, they recover the possibly damaged
  signal, and correlate it with the database to find the best match. 

  Ruanaidh's work concentrated on the phase portion of the Fourier
  Transform, which encodes most of the structure of an image. In
  his work, the spread spectrum signal is embedded in the phase part
  of the Fourier 
  Transform. He also used the cross-correlation mentioned above to
  recover watermarks, but he used a Bayesian model, which allowed him
  to quote the probability of a match being wrong. 

Slide #15 (Latest Work)
  Recently, Ruanaidh has been trying to add rotation, scaling,
  and translation invariants into his scheme. Instead of
  embedding watermarks in the phase portion of the Fourier Transform,
  he has been using log-polar mapping of the frequency content of the
  image. 

  In this mapping, we take an original image to
  a space where it is invariant to any of the transformations
  mentioned above, add the watermark, and then transform it back to the
  original space. Translation, rotation, and scaling are thus taken
  care of. 

Slide #16 (Removing a Watermark)
  The second half of the slide (the first part was skipped because of
  time constraints) shows attacks, other than filtering, that can 
  break watermarks. The first attack (bit-by-bit attack) tries to
  figure out what a watermark is by modifying the image until it
  reaches the watermark present/absent boundary, and then go through
  the image bit by bit, to find out what the watermark is. 

  The second attack (watermark insertion attack) is possible when you
  have access to the software program that inserts watermarks. In this
  case, it is possible, given a watermarked image, to form a slightly
  distorted version of that image, apply the watermark again, and get
  the original, unwatermarked image. 

  The third approach (statistical averaging) is possible when you have
  multiple images that belong to a same person. They allow you to get
  information about the watermark that is otherwise unavailable. 

  Lastly, a self-scrambling attack allows you to defeat copy
  protection built into recording devices. You make a scrambled copy of
  the material (The scrambled signal can be recorded
  normally, since the watermark is hidden). To 
  get the original back, you play the scrambled signal using a normal
  player, and insert a "de-scrambler" between the player
  and the output device. 

Slide #17 (Conclusions)
  Even if you have a perfect watermark scheme, there will still be
  attacks like the last one. Also, you can not get really robust
  watermarks because of bandwidth problems with small images, for
  example. There was a NYT article that came out yesterday reporting
  on problems with Digimark watermarks. NYT found out that a lot of
  images that Digimark claimed had watermarks did not actually
  have them. The suspicion was that this was caused by JPEG
  compression, small file size, down-sampling, etc. 

  So completely secure watermarking is not realistic. What we really
  want is to concentrate on 90% of copyright violations. In fact, in
  same cases, you 
  don't really want to catch small violations like photocopying
  paragraphs of a book. They constitute "fair use".