JND-Guided Perceptually Color Image Watermarking in Spatial Domain

Watermarking is an effective solution for copyright protection and forensics tracking via hiding information into the image signal. Recently, spatial-embedding watermarking methods from different transform domain have been proposed rapidly and effectively protect the copyright of the color image. Compared to the individual frequency domain method, it has both advantages of spatial domain and frequency domain. Here, we proposed a novel spatial-embedding watermarking method based on an attended just noticeable difference (JND) model with color complexity, to achieve a good tradeoff between robustness and perceptual quality. In particular, at the spatial embedding level, the direct current (DC) coefficients are selected for embedding and the perceptual JND model is used to guide the amount of pixel modification to improve visual quality. Different from the previous JND model, we proposed an attended JND model that considers color complexity, which is more consistent of the human visual perception model. Compared with the other JND models, the proposed JND model is more suitable for the watermarking framework. Experimental results show that the proposed watermarking scheme has better performance than other existing watermarking schemes. This greatly benefits the practical implementations of the spatial-embedding watermarking methods.


I. INTRODUCTION
With the rapid development of the internet and multimedia technologies, the distribution of digital media (e.g. audio, image, video) becomes much easier. Thus, the protection of multimedia copyright is an urgent problem. Digital watermarking, hiding proprietary information into the original product, is an effective solution for multimedia copyright protection [1]- [5].
Digital watermarking, especially robust image watermarking, has attracted a lot of attention during the past decades. In general, robust watermarking is classified into two categories: spatial domain and frequency domain watermarking schemes [6]- [9]. The spatial domain watermarking schemes carry out watermark embedding by modifying the values of image pixels directly. On the other hand, if the watermark The associate editor coordinating the review of this manuscript and approving it for publication was Feng Shao .
is embedded in the frequency domain, the pixel values are first transformed to the frequency coefficients and then the selected coefficients will be modified to embed the watermark. Commonly used transforms include discrete cosine transform (DCT) [10], discrete fourier transform (DFT) [11], discrete wavelet transform (DWT) [12] and singular value decomposition (SVD) [13], etc.
Currently, digital images are commonly stored and transmitted in JPEG format. Hence, most image watermarking methods are designed in DCT domain as DCT has a strong ''energy compaction'' property, capable of achieving high quality at high data compression ratios. In recent years, a large amount of DCT-based watermarking methods have been proposed. Roy and Pal [9] proposed a blind watermarking scheme that selects the middle band coefficients to embed watermark. But the visual quality of the watermarked image has serious distortion. Das et al. [10] presented a watermarking scheme based on the inter-block coefficient correlation in DCT. This scheme embedded watermark in DCT coefficients according to the different adjacent blocks. However, the robustness of watermarking scheme should be improved to satisfy a good resistance for noise attack and gaussian filter. Studies from Hang et al. [14] showed that, it is feasible to embed the watermark into direct current (DC) component of the DCT domain. Recently, a series of new methods [15]- [17] were proposed, which combine the advantages of spatial domain convenience and frequency domain robustness. These methods based on the combination of spatial embedding and DC quantization, where the pixel value in spatial domain was updated directly according to the DC modification from watermark embedding. So, the watermarking in frequency domain can distribute the energy of embedded data over the spatial domain. Though these existing methods have greatly improved the robustness performance of the watermarking method, it is worthy of noting that the modified pixel values with an uniform averaged sum for a fixed block. There is still a remarkable gap between visual distortion and the embedding strength. So, in this work, we focus on spatial domain embedding with the guideline from the perceptual quality measurement [18], [19].
Reliable robust watermarking methods aim to obtain as less distortion as possible, and acheieve a higher robustness performance. Consequently, human visual system (HVS), which can efficiently represent the visual distortions of an image, is usually designed for watermark embedding [20]. The visual threshold indicates that the maximum distortion in pixels or subbands that the HVS cannot perceive, which is called as just noticeable difference (JND). The JND model can be employed to achieve a better tradeoff between imperceptibility and robustness [21]- [26]. According to this assumption, Hu and Chang [24] proposed a DCT domain watermarking method which selected five low frequency DCT coefficients to embed watermark, and a weighting strategy based on JND model was developed to handle coefficient modifications. Wang et al. [26] proposed an enhanced JND model by formulating the orientation diversity as a factor to determine the contrast masking effect, and the JND model was used to control the watermark strength.
Most of existing perceptual watermarking algorithms regularly measure the degradations from the monochrome image [27]. However, the HVS presents obvious color differences measurement, with which the HVS focuses only on these color complex regions for detailed perception and withdraws the other regions. Besides, according to the visual cognition theory, attended regions play more important roles than the other unattended regions for visual perception, and degradations on attended regions have a larger influence on the watermarked images. Recently, the color measurement and the attention mechanism have already been taken into account for watermarking algorithms, in which the color and salient map is created to highlight these attended regions during watermark embedding.
In this work, we proposed a new color image watermarking in spatial domain based on an attended JND model with color complexity. The main contributions in this article are summarized as follows: 1) Herein, we present an innovative spatial watermarking method suitable for color images. The pixel values are directly modified with the visual guidance of the proposed JND estimation in the embedding procedure. The changed pixels, which are consistent with the HVS properties, are obtained. 2) A new attended JND model is designed with color complexity factor which considering structural information and applied to watermarking method. The proposed JND model have better robustness than existing JND models in the watermarking scheme.The robustness of the proposed method has increased while maintaining high transparency of the watermark in the image.
3) The proposed watermarking method has a tradeoff between invisibility and robustness. At the same time, the proposed watermarking algorithm is relatively robust against some common image processing (such as noise addition, JPEG compression, filtering, and volumetric attack) and geometrical distortions (such as cropping, scaling, and rotation). Experimental results show that the proposed scheme performs well under common signal processing operations. The remainder of the paper is organized as follows: In Sectionn II, we will introduce the related work on DCT transform and traditional pixel JND model. Section III shows the attended pixel domain JND model with color complexity. A spatial perceptual-embedding watermarking scheme is described in Section IV. We present the experimental results and discussions in Section V, and the conclusion are given in Section VI.

A. DCT
DCT, a kind of compression kernel in JPEG standard, has been widely used in watermarking methods. In general, an image can be transformed from the spatial domain to frequency domain by 2D block DCT, which can also be inverted to the original image. JPEG compression is obtained by DCT transform of image block, so we take an 8 × 8 image block as an example to illustrate. For k-th image block of image, B k (i, j) (i = 0, 1, 2, . . . , 7, j = 0, 1, 2, . . . , 7), 2-D DCT is given as follows, where u and v are the horizontal and the vertical frequency (u = 0, 1, 2, . . . , 7, v = 0, 1, 2, . . . , 7), and D k (u, v) are DCT coefficients of image block B k (i, j), VOLUME 8, 2020 Based on Eq. (1), DC coefficient X k can be given as follows, It is shown that the DC coefficient can be obtained directly in spatial domain instead of DCT transform.
And inverse 2-D DCT of the k-th image block B k (i, j) is described as following, Based on Eq. (4) and Eq. (5), the inverse DCT of the k-th image block in Eq. (4) will be rewritten by where N is the dimension of the k-th block (is 8 in this case), A k (i, j) represents the reconstructed image block from all the set of AC coefficients.

B. SPATIAL-UNIFORM EMBEDDING-BASED WATERMARKING
Recently, Su and Chen [15] proposed a robust color image watermarking methods based on DC coefficient, wherein the algorithm is executed in spatial domain, and it not only has simple and quick performance of the spatial domain but also has high robustness of DCT domain. In Su's method [15], when embedding watermark information into DC coefficient of k-th the image block, the modification of the image block's DC coefficient can be defined as E k , and the modifited DC coefficient with modification E k can be obtained by Eq. (7), where X k is DC coefficient of the k-th block, X k w is the watermarked DC coefficient, and E k is the modification. The embedding processing can be found in Ref. [15]. According to Eq. (6), the watermark bits are embedded into X k , and the uniform changing with E k /N for the value of each pixel is implemented. Obviously, it can be described as, where E k /N is the uniform changing for each pixel in the spatial domain, B k * (i, j) is pixel of the watermarked image block's in spatial domain. It can be shown that the pixel values are modified with a uniform change in Su' method [15]. However, on the other hand, it is obviously that HVS cannot perceive all the changes in the pixels due to its underlying physiological and psychological mechanism, so some perceptual redundancies exist equally. Firstly, it ensures that only the important visually information is protected. Secondly, better perceptual performance can be achieved by discarding perceptually unnecessary information. So how to build perceptual changes in watermarking becomes a challenging research task.

C. JND MODELING
The JND refers to the maximum distortion which cannot be perceived by the human eyes. Inspired by the research of cognitive scientists, numerous JND estimation models have been proposed. The JND models are divided into two categories by calculating the JND threshold domain. One category is the pixel-wise domain which can directly calculate the JND threshold for image pixel [18], [19]. Other category is the subband-domain, for example, DCT domain [28].
The subband-domain JND model first transfer the image into subband domain and the JND threshold can be calculated on each subband. Pixel-wise domain JND model does not need the transformation to subbands, it is more convenient than subband-domain JND to provide a JND threshold. JND gives us a promising way to guide the pixels changes.
In other word, JND refers to the minimum visibility threshold when visual content can be distinguished. JND can be determined by subjective observation and testing, but it will cost a lot of human and material resources. Therefore, through psychological research, researchers can model visual redundancy through various external environments and internal generation mechanism of brain information, and get objective JND model. Chou and Li [29] proposed pixelwise JND profile, in which luminance masking and contrast masking functions are proposed in the spatial domain. Wu et al. [18] proposed a JND model by considering the regular pattern complexity and contrast masking as a factor for spatial masking (SM) effect. Put the k-th image block as an example, thus, the traditional pixel JND model in kth image block can be expressed by the nonlinear additivity model for masking (NAMM) [18] model, where L k A (i, j) is luminance adaptation for k-th image block, S k M (i, j) is the spatial masking effect for k-th image block.

1) LUMINANCE ADAPTATION
As we all know, the HVS has different sensitivity with different luminance, and luminance adaptation needs to be considered. Therefore, the visual threshold based the luminance adaptation model [29] can be expressed by, where I k b (i, j) is the background luminance, which is calculated as the mean luminance value of a surrounding region that (i, j) located.

2) SPATIAL MASKING
In [18], Wu et al. proposed a pixel-based JND model based on pattern complexity. It is well known that the JND model can be impacted by spatial marking effect. Through different masking effects, a total spatial masking effect of the k-th image block can be given as follow, where the S k M (i, j) is the total spatial masking effect, P k CM (i, j) is the pattern masking effect of the k-th image block, C k M (i, j) is the contrast masking effect of the k-th image block. The visual pattern masking effect can be obtained by pattern complexity function and luminance contrast function, where P CM is the pattern masking effect, f (P C ) is the pattern complexity function, f (L C ) is the luminance contrast function. Thus, f (P C )can be modeled as, where three constants are set as a1 = 0.8, a2 = 2.7, a3 = 0.01 in [30], and the pattern complexity P C is calculated by its histogram in [18]. The function f (L C ) follows logarithmic form, where L C is luminance contrast which can be calculated by the gradient magnitude.
The G v and G h of the image block B k (i, j) can be calculated by the Prewitt edge kernels filters, where * denotes the convolution operation, K v and K h are the Prewitt edge kernels. The contrast masking function C M is fitted with the data of visibility thresholds from masking experiment on luminance contrast [18], [30], and it is defined as follows, where the two parameters a4, a5 are set to 16, 26 respectively, as discussed in [18]. The JND has been considered a suitable solution for controlling the watermark strength and generating robust watermarking schemes with distortions that are below the sensitivity threshold. However, JND assumes the same attention level for all image regions, which does not reflect the behavior of an observer. Visual saliency (VS) is an important feature of human visual system and the study of visual saliency was reported in early [31]. Human beings can show visual gaze, which is to keep the visual gaze on a single place. Inspired by this visual perception phenomenon, some visual saliency models were proposed. The visual saliency detection model simulates the perception scene of human visual system, and generally focuses on some areas of human interest, which affects JND threshold to a certain extent.
As we all know, color plays an extremely important role in our understanding of the world. Reference [32] points out that same color in two blocks can be recognized as the same color only when the color and direction structure information of its adjacent areas are identical. Therefore, there is a certain masking effect between adjacent regions. For color images, some existing JND models do not consider the influence of chrominance information, but simply use the luminance information to evaluate the JND threshold, which is a disadvantage. Therefore, for color image, JND threshold should consider the influence of color information.

III. PROPOSED JND MODEL
There are many JND models considering various factors that have been proposed in recent years. However, many existing JND models only consider the factors of the image itself, such as background brightness, texture region, structure information, and so on. Although some JND models consider complex features, they often only consider the influence of single complex features on JND. Therefore, we propose an attended JND model considering color complexity.
As we all know, the human sensitivity will be influenced by color change. The consistent color difference of color perception covers a variety of visual information, which plays an important role in the analysis and understanding of image content. The research of cognitive science shows that HVS can extract repetition patterns of visual content representation well. We regard pattern complexity as an important factor that affects JND threshold: in a regular pattern, interaction is relatively simple, masking effect is limited; in an irregular pattern, interaction is complex, masking effect is strong. For a given image, the VS map calculated by the appropriate VS model can reflect the significance of the local region to HVS, and the JND threshold corresponding to the region with large significance characteristics will be reduced accordingly. VOLUME 8, 2020 A. COLOR COMPLEXITY Color, an important part of HVS, is the basis of the perception of the world. The differences between colors will lead to different visual perceptions and different visual masking. In recent applications, the watermark information is embedded into the color image. Su et al. [16] used approximate Schur decomposition to each channel of RGB three channels, and each channel selected coefficient to embed watermark. Jia employed the left singular matrix of SVD to embed watermark into each color channel [33]. Above watermarking algorithms only embedding watermark into the individual channel of RGB, without considering the correlation between RGB channels, the robustness is limited compared with watermarking algorithms for grayscale images. Due to there are strong correlations between RGB channels, some watermarking methods were proposed to employ this correlation. Zhang et al. [34] used Tucker decomposition to color image, and employed the correlations between chromaticity to embed watermark information, which improved robustness.
And a series of watermarking schemes select Y channel in the YCbCr color space (Y channel denotes the luminance component, Cb and Cr channels are denoted to represent the color information) as the embedding channel for color watermarking method. Su et al. [6] directly calculated the DC coefficients of Y channel without DCT transform, and embedded watermark information by modified the each pixel of the block. Koju and Joshi [35] embedded watermark information to the Y channel, which has good robustness and imperceptibility. However, the visual perception of color images depends not only on luminance but also on chromaticity. Different from the previous watermarking algorithm that only selects the Y channel of as the embedding channel, we also used a color measurement method to measure color complexity. The transformation between RGB and YCbCr is defined as follows: In the psychophysical JND modeling, considering the component of color in YCbCr, using Cb channel Cb to get a color masking factor to better adjust JND model. It can be seen that Cb can reflect the change of color image [26]. Generally, since adjacent pixels exhibit regular structure, the structure is constructed by using the empirical distributions of pairwise products of neighboring values. Thus current pixel with four structure features among horizontal, vertical, main diagonal and sub diagonal directions can be obtained. It can be clearly seen in Figure 1. where respectively represents horizontal, vertical, main diagonal and sub diagonal direction. λ represents the value selected for calculation in a 3 × 3 window. The each pixel color complexity C bs from extracted each pixel with four structure images , and it can be given by where C bs is a max direction feature of color complexity from four structure images. max (·) means the maximal direction value of four structural feature images.

B. SPATIAL MASKING EFFECT WITH COLOR COMPLEXITY
In this part, we proposed a new spatial masking function which consider the masking effect of different visual contents.
In the color image, the color of the adjacent position with the same direction structure information is always consistent. To judge whether two image blocks have the same color, we should not only look at the color difference between the two blocks, but also consider the structure information of the two blocks. In other words, image blocks with the same color will show different color differences in the visual system under different structural information. And the structural information usually be used to calculate the pattern complexity. The experimental results from [36] showed that most observers tend to focus on some regions with the same pattern complexity in image, and the judgment of regional pattern complexity is generally determined by the color difference of these regions. In a word, color difference has a great influence on pattern complexity in visual content. Therefore, the chromaticity difference of color image will have a certain impact on the visual pattern complexity to a certain extent. The improved visual pattern masking effect can be obtained by pattern complexity function, luminance contrast function and color complexity function, where f (C C ) is the color complexity function which can be established with the linear transducer as, where is the normalization processing. And an improved spatial masking which consider color difference will be calculated,

C. VISUAL SALIENCY MODULATION
If an area has certain characteristics that make it stand out from the surrounding area and attract attention, it is called a VS area [37], [38]. The existing VS model can generate a saliency map, which can predict the saliency region in a given image. The JND threshold value in the region with a more significant image will be reduced accordingly, so visual significance can adjust JND threshold value well to avoid the problem of the too high threshold value. As a simple but effective saliency estimator, the classical saliency model for visual saliency-based index (VSI) [39] is employed. Given an color image block, the saliency model can be obtained by frequency prior, location prior and color prior in Zhang et al. [39].
where (i, j) is the location of the k-th image block, S k F (i, j) is the frequency prior, S k D (i, j) is the location prior and S k C (i, j) is the color prior. Complete calculation about saliency detection can be found in [39].
Considering the above complexity factors, we propose a JND model in pixel domain based on the multiple complexity features which impact the visual perception. The JND threshold for each pixel of the k-th image block is calculated using the NAMM [18] as where (i, j) is the location of k-th image block, L k A (i, j) is the luminance adaptation, S k * M (i, j) is the spatial masking effect with color effect, and the η(S k i,j , β) describes the salience modulation as follows, +β4. (29) where S k i,j is a sigmoid function which can be defined with four coefficients in a vector β = [β1, β2, β3, β4]. In this section, due to multiple complexity features will impact the visual perception, we proposed an improved pixel JND model considering some visual features. Then, to avoid the spatial distortion with uniform changes caused by embedding watermark information into DC coefficients, the proposed JND model in Eq. (28), which reveals the visibility thresholds of the HVS for spatial pixels, can be directly used to guide the watermark embedding for each pixel.

IV. PROPOSED SCHEME A. JND-GUIDED EMBEDDING IN SPATIAL DOMAIN
In this section, the DC coefficient was chosen as the watermark embedding position just like [14]- [16]. When the watermark information is embedded into the DC coefficients, the corresponding pixel values in the spatial domain will change as Eq. (8). Reference [15] make the pixel value modification amount of each block the same, which will cause some visual distortion in spatial domain. Each pixel in the spatial domain has the same amount of modification, and the texture, smoothness, edge features of the image itself are not well-considered, nor are they related to HVS visual perception features, which inevitably leads to distortion in the spatial domain. Therefore, it is necessary to use the JND model which accords with the characteristics of human visual perception to guide the amount of modification of each pixel and make it meet the perception characteristics of HVS. The flow of watermarking scheme can be given in Figure 2.
In our work, the JND model of the pixel domain is calculated directly from each pixel of the visual content, and JND model guides the amount of modification of each pixel in each image block, where B k * (i, j) is pixel of the watermarked image block in spatial after embedding watermark. (i, j) are the spatial indexes (i = 0, 1, 2, . . . , 7, j = 0, 1, 2, . . . , 7) in a block. E k , which can be caululated by Eq. (32), is the modification of DC coefficient. N · E k is the total modification of the k-th block in the spatial domain when the watermark information is embedded in the DC coefficient, JND k * (i, j) is the total JND threshold of the k-th block. Therefore, the JND model in the pixel domain is used to guide the modification amount of each pixel so that the watermarked image can better meet the characteristics of human eyes while getting a better robustness performance.

B. WATERMARK EMBEDDING
For a RGB color image, we select the Y channel to embed watermark information. Different from [15], we use dither modulation (DM) as embedding algorithm. Figure 2 gives the flow of the watermarking scheme. Firstly, the RGB color image I is converted into YCbCr color space by Eq. (18). The Y channel is divided into non-overlapped blocks with size 8 × 8. For k-th block, the DC coefficient can be obtained by Eq. (4), and the k-th image block's DC coefficient is then used as the host to embed the watermark bit m by dither VOLUME 8, 2020 modulation (DM) as follows: where X k is the DC coefficient of the k-th image block, is the quantization step, d m is the dither signal corresponding to the watermark bit m. The watermarked signal X k w is obtained by the quantized data. Therefore, the modification E k in Eq. (30) is obtained, The sum modification N · E k for the k-th block can distribute the energy of embedded data over the spatial block. Consequently, N · E k can be distributed over all pixels in the spatial block with the guidance of the perceptual JND in Eq. (30).
Repeating the same operation for the non-overlapped blocks, the watermark information is embedded in Y channel. Then YCbCr watermarked image transforms to RGB color watermarked image I w . The main steps of watermark embedding scheme can be described as Algorithm 1 showed.

C. WATERMARK EXTRACTION
Firstly, the RGB color watermarked image I w , which is obtained after the image transmission with I w , is converted into YCbCr image, and the watermarked channel Y is divided into non-overlapped 8×8 pixels blocks. In the extraction process, for k-th block, the DC coefficient X k w can be obtained by Eq. (4). Then, the watermark can be detected from X k w according to the minimum distance as follows: where m is the extracted watermark information of the block, is the quantization step, d m is the dither signal corresponding to the watermark bit m. Repeating the same operation for the non-overlapped blocks, the watermark is reconstructed. The main steps of watermark extracting scheme can be described as Algorithm 2 showed.

V. EXPERIMENTS AND RESULTS ANALYSIS
In this section, we show and discuss the experiment results. To prove the goodness of our proposed watermarking scheme, we perform experiments using the original code in MATLAB R2016b on a 64-bit Windows 10 operating system at 16 GB memory, 3.20 GHz frequency of Intel processors.
The images from databases CVG-UGR [40], are used as the host images. Six 24-bit 512 × 512 color images, as shown in Figure 3, are tested and displayed in this experiment. In this article, original watermark is the binary image with size 64 × 64, as shown in Figure 4.
For evaluating the imperceptibility of the proposed method, the peak signal-to-noise ratio (PSNR) and the visual saliency-based index (VSI) are utilized as the performance metrics. PSNR in Eqs. (34) is adapted to measure the similarity between the host image and watermarked image, where MSE is the mean square error for color original image and watermarked image.

Algorithm 1 Watermark Embedding
Input: Host image (I ); watermark (m) Output: Watermarked image (I w ) Begin Step 1: The RGB color image is converted into YCbCr color space. The Y channel is regard as the watermark embedding channel, and Cb channel can be select as a reference image for watermarking JND processing; Step Step 7: Generate the watermarked image Y by collecting all the modified blocks B * ; Step 8: Generate the watermarked color image by concatenating the modified Y with Cb and Cr image channel and then convert the color space from YCbCr to RGB; Return Watermarked image I w ; As an image quality assessment metric, VSI has good visual performance to measure the image quality between original image and distortion image. Thus, we used VSI for watermarked image and original image.
where S 1 , S 2 represent the VS map extracted from original images I and watermarked image I W ; T is the local similarity of I and I W , as follows, where T VS (x, y) is the similarity map of saliency images of I and I W , T G (x, y) is the similarity map of gradient images   of I and I W , T C (x, y) is the similarity map of chrominance components images of I and I W , as described in [39].
As an evaluation criterion, the bit error rate (BER) estimates the error rate of the watermark. Therefore, BER can be utilized for evaluating the robustness performance. The BER closed to 0 proves that the watermarking algorithm has better robustness performance, and the equation is as follows: where m is the original watermark and m is the extracted watermark, Area is the size of the watermark image (64×64).

A. EVALUATION OF PROPOSED JND MODEL
We verify the effectiveness by injecting noise into the pixels based on the corresponding JND valuê whereÎ (x, y, β) is the JND noise contaminated image. I (x, y) is the original image, δ regulates the energy of JND noise, which makes the same energy for different JND models, and rand(x) takes random value of +1 or −1.
where I (x, y) is the original image, andÎ (x, y, β) is the noise image which be obtained by Eq. (38).
and I (x, y). VSI Î (x, y, β) |I (x, y) is the VSI value of I (x, y, β) and I (x, y). γ is a regularization term, which is set to 30 here [41]. From the above formula, we can see that when the threshold value of JND increases, the value of PSNR will decrease, the value of VSI will increase, and the image quality of distorted image will improve. Therefore, to get a better visual quality, the distorted image will get a minimum cost function and a maximum JND threshold by adjusting β.  [19].
With the help of Eq. (37), the same level of noise (with PSNR=35 dB) is injected into the testing images, and VSI is adopted to reflect the visual quality of the distorted image obtained by injecting noise. And the comparison results can be given by Figure 5, though the proposed JND model cannot has better visual quality in 'Lena' than Refs. [18] and [19], our model still has better perceptual quality than Ref. [42]. It can be seen that the proposed JND model has good visual quality.

3) EVALUATION OF DIFFERENT JND MODELS FOR WATERMARKING METHODS
In this article, we use the JND model in the watermarking method. The JND model has adopted to guide the modification of the pixel when embedding the watermark, which can fit the HVS. In this section, the different JND models [18] (Wu 2017) and [19] (Jakhetiya 2018), which are used in watermarking scheme, can be compared to the robustness performance. The PSNR regulates to 42dB between the original image and watermarked image, which cannot be observed for HVS. Testing images are standard color images with a dimension of 512 × 512 as shown in Figure 3. And the watermark information is embedded into Y channel. A binary watermark with size 64 × 64 is used to embed into the cover images as shown in Figure 4.
To compare the performance of the proposed JND and the other pixel domain JND models within the watermarking framework, different kinds of attacks such as Gaussian Noise (GN) with mean zero and different variance, JPEG compression, where the JPEG quality factor varies from 30 to 40, and Salt & Pepper noise (SPN) with different factors were used to evaluate the robustness of the proposed JND model. Table 1 shows the average BER values of watermarked images attacked by Gaussian Noise, JPEG compression attacks and Salt & Pepper noise. When the watermarked images are attacked by Gaussian Noise with variance higher than 0.1%, the BER of our JND model is significantly lower than the other two JND models. This indicates that the proposed JND model performed much better than others. As shown in Table 1, performance emerges in the three JND models within the watermarking algorithms show about JPEG compression attacks. When the compression quality is 30, the average BER value of the proposed model is 1.7% lower than the model of Ref. [18], and the average BER is 2.7% lower than the Ref. [19]. When the watermarked   Table 1. It can be clearly seen that the proposed model always has the lowest BER for different Salt & Pepper noise intensities. Above all, the watermarking frame based on the proposed JND model has excellent robustness performance.

B. IMPERCEPTIBILITY TEST
In this part, to test the invisibility of the method, we use subjective tests. PSNR and VSI, which are consistent with HVS, are the object tests for watermarked images. Because the visual quality of watermarked image can be changed by the steps, therefore, the PSNR value between the watermarked image and the original image is fixed at 42dB. And the VSI and BER values can be obtained from our proposed method in Figure 6.
As we all know, the closer the VSI value to 1, the better the image quality. When VSI = 0.9920, the difference between the watermarked image and the original image cannot be seen by the human eyes. Figure 6, the VSI values from our method are closer to 1, which has better visual quality. Moreover, it can be seen from the BER, the watermark can be entirely extracted under without any attacks by our method.

C. ROBUSTNESS WITHIN INDIVIDUAL QUANTIZATION-BASED WATERMARKING TECHNIQUES
It is clear that the proposed image watermarking method has good visual perceptual quality with HVS in Figure 6. Moreover, robustness is an important metric for the watermarking scheme. In this section, in order to show the robustness of the proposed method, some basic attacks are selected to test the robustness, and we compared it with other quantization-based methods [21], [22], [43], [44] and [45]. To ensure the fairness of the experiment, the watermark is embedded into the Y channel of the color image, and we adjust the quantization step size so that the PSNR = 42dB of the watermarked image. In order to better demonstrate the robustness of the proposed method, we also show the average BER values of the testing watermarked images under some common attacks.
Noise attack is the most common image processing technology to verify robustness. In this article, Gaussian noise attack and Salt & Pepper noise attack have been taken as noise attacks to test the robustness of the proposed method. A Gaussian white noise with a mean of 0 and different standard deviations are used to attack the watermarked image. In Table 2, the average BER values can be given for the different Gaussian noise. It can be clearly seen that our method has lower BER values which attacked by Gaussian noise. Table 2 shows the average comparison results after adding the Salt & Pepper noise with different noise quantity. Although the average BER of our method is approximately the same as the Ref. [22] when the noise factor is 0.05%, but the experimental results of other noise factors, the average BER of our method is lower than Ref. [21], Ref. [22], Ref. [43], Ref. [44] and Ref. [45]. As can be seen from Table 2, the proposed scheme had good robustness against the noise attacks and exhibited the best performance.
The watermark robustness against the attack of lossy compression is an important performance to be evaluated. JPEG compression is one of the standard compression techniques that is used to compress the image. In this experiment, the watermarked image is attacked by JPEG compression. Table 3 lists the part experimental results of sample images with different compression factors, respectively. When the compression quality is 60, the average BER value of the   proposed model is nearly to zero. Thus, our method has better performance than others when against the JPEG compression attacks.
Filtering attack is one of the classical attacks for the watermarked image. Since the watermark can be removed from the watermarked image by the filter, the Gaussian filtering (GF) and the Median filtering (MF) are used to process the watermarked image. The robust to Gaussian filtering attack and Median filtering attack with window size 3 × 3. Table 4 shows the average experiment results by the GF attack and MF. On total, the proposed method has the best robustness performance under filtering attacks.
The watermarked image is first rotated clockwise by a certain number of degrees, and then counterclockwise by the same number of degrees. In this experiment, the watermarked image is first rotated 15 • , 30 • , 60 • clockwise, and then  restored to its original shape counterclockwise. Table 5 shows the average BER values at different rotation angles, and the average BER values do not exceed 0.2% from our method, which can prove our method has better performance. Generally, the watermarked image will be contaminated by multiple attacks. We further compared some combined attacks the same as Table 6. The testing images attacked by JPEG quality = 50, and then attacked by the noise attacked. It can be noted that our method shows better robustness performance. Table 7 demonstrates the comparsion average BER values between our scheme and other methods for different image attacks with filxed image quality, VSI = 0.9970. It is obviously seen that our proposed method has better robustness to against the process of adding Gaussian noise and noise. For JPEG compression, we only list the experimental results with QF of 40 and 50. It can be seen from Table 7 that our method has a lower BER than other watermarking algorithms. The value of BER obtained by proposed method do not exceed 0.1% for GF with window size 3 × 3. When the watermarked image is attacked by MF with window 3×3, the average BER of our method is about 0.5% lower than that of Ref. [44]. And for rotation, the value of average BER obtained by proposed method do not exceed 0.06% when the rotation angle is 15 • , 30 • . Besides, the robustness performance of our method is obviously better than others under combined image attacks.

D. ROBUSTNESS WITH SPATIAL-UNIFORM EMBEDDING-BASED WATERMARKING METHOD
In this section, the proposed method compares with the spatial-uniform watermarking method proposed in Refs. [15] and [16]. In Ref. [15], a simple preprocessing of a 32 × 32 binary watermark is proposed to obtain the actual 64 × 64 bits, which are embedded into 64 × 64 blocks. Another selective mechanism is used in Ref. [16], where 32 × 32 blocks are adaptive selected from the original 128 × 128 blocks. In this section, we compare the proposed scheme with Refs. [15] and [16]. To ensure the fairness of the experiment, the proposed method compares with other existing image watermarking Ref. [15], with the same image quality. The binary watermark with size 32 × 32, and the Y channel of the color image are utilized to embed watermark. And same as Ref. [15], an optimum sub-watermark can be obtained by combining 4 sub-watermarks here. The BER was computed to make the objective performance comparison.
To verify the robustness of our method, watermarked images are attacked by common image processing operations (such as adding noise, JPEG compression, filtering attacks, and combined attack) and geometrical distortions (such as scaling, rotation, and cropping). We test watermarked images by different attacks with different factors.  with filxed image quality, PSNR = 42dB. The BER of Gaussian noise with variance 0.0025 and the BER of Salt & Pepper noise (SPN) with the noise quantity 0.0025 are given in Table 8. It can be clearly seen that our method produces a lower BER than other methods for noise attack. For JPEG compression, we show the results of JPEG compression with JPEG factor=30 in Table 8. Although the average BER obtained by using our method is 0.19% higher than that of Ref. [16], it is 0.2% lower than that of Ref. [15]. In the filtering attack, our method and Ref. [15] has good robustness performance. The scaling operations, as an image geometric attack, is often used in image processing. At first, the  watermarked image is scaled down from 25% to 200% with an increment size 25%, respectively. We give the BER when the watermarked image is reduced by 25% and then restored to the original size. The BER of our method is about 1% lower than that of Ref. [15]. For cropping operations, we only give BER after the center-crop (Cen-Crop) by 128 × 128 white. It can be clearly seen that our method and Ref. [15] can resist this image processing operation. We give the experimental result of rotating (Rot) the watermarked image by 25 • . The watermarked image is first rotated clockwise by 25 • , and then counterclockwise by the same degree. Our method has the lower average BER than others. Moreover, the watermarked images also will be attacked by the combined attacks. The BER is not exceed 1.1% under JPEG=50 and GN with 0.002 (J+GN) in our method. Thus, the robustness performance of our method is obviously better than Ref. [15] and Ref. [16].
In order to better demonstrate the robustness of our method, 'Lena' watermarked image with image quality of PSNR = 42dB, and then attacked by various image processing opetations and the extracted watermark information are shown in Figure 7.
At the same time, we also tested the robustness of the watermarked image with the image quality maintained at VSI=0.9970. The average BER of watermarking algorithms are compared through various common image processing of watermarked image. For different attacks with various factors, we only give some experimental results in Table 9. The BER of Gaussian noise with variance 0.003 and the BER of Salt & Pepper noise with the noise quantity 0.01 are given in Table 9. Our proposed method can resist the noise attacks than other methods from BER values. For JPEG compression, we only give a BER with quality factor of 20. The BER  [15], Ref. [16], and our proposed scheme under different attacks. obtained by our method is about 0.1% lower than that of Ref. [15] and 0.2% lower than that of Ref. [16]. Our method and Ref. [15] both show good robustness under filtering attacks and cropping attacks. For Scaling attack, we list the BER of watermark information after the watermarked image is scaled to 25%, and then the BER of the original size is restored. The method we proposed and Ref. [15] get a similar bit error rate. Table 9 shows the experimental result of watermarked images at 25 • . The BER of our method is 10% lower than that of Ref. [16]. The BER of our method not exceed 0.01%, which can prove the proposed method can effectively against JPEG + Gaussian noise attacks. Table 10 lists the average BER values between our scheme and some quantization-based watermarking schemes [21], [22], [43], [44] and [45] on the software benchmark. There are different image attacks on the software benchmark, and we give experimental results on table 10. For filter attacks, we used the Gaussian filter, Median filter, and Wiener filter with a 3 × 3 window. In table 10, the proposed method has obvious performance than others for filter attacks. In the procedure of the sharpening, the watermarked image is attacked by different radii, and we only give the experiment result under radii with 0.5. The average BER value is higher than Ref. [44], but lower other watermarking methods. The watermarked image also has been attacked by Rotation and Scaling. The lower average results can be obtained by our proposed method under these two image attacks. For cropping attack, we respectively list average BER values after center cropping (Cen-Crop) with 128 × 128 white and left upper cropping (Lef-Up-Crop) with 128 × 128 white. The proposed method has better robustness than others for cropping attacks. For JPEG compression, we show the result for JPEG factor=40. Compared with the other methods, the proposed method can resist the JPEG compression attack to a certain extent. For the template removal attack, our method is robust than others. Compared with the other watermarking methods, we not only use the Y channel as the embedding position but also consider the relationship between the chromaticity of the color image. Meanwhile, using the chromaticity information to construct a visual perception model that guides the embedding of watermark information. It can be seen that the proposed method has better robustness than others.

VI. CONCLUSION
This article proposes a new spatial-perceptual embedding with the guidance of the JND model for color image watermarking. The DC coefficient of the block is used as the cover coefficient for watermark embedding, and the DC coefficients are quantized by DM. Different from the previous JND model, we proposed an attended JND model with color complexity, which is more consider the human visual perception model. The pixel modification amount is modified by the pixel domain JND thresholds so that the watermarked image is more consistent with the perceptual characteristics of HVS. Experimental results have demonstrated that the proposed JND model has better robustness than other existing JND models in watermarking scheme. And the proposed watermarking method is robust against common image processing attacks, such as noise addition, compression, and volumetric attack. In the future, we will not only consider the pixel update value in the watermarking framework from the HVS system but also consider implementing pixel updates in the watermarking framework together with other image enhancement tasks.