Bit-Level Triangular Content-Aware Permutation for Fragile Image Watermarking: Zero False Positive Rate, Single-Bit Sensitivity, and Arbitrary Dimension Support

Zahra Ghoraeian; Mohammad-Reza Sadeghi; Samaneh Mashhadi

cs.CRAug 14, 2026

Bit-Level Triangular Content-Aware Permutation for Fragile Image Watermarking: Zero False Positive Rate, Single-Bit Sensitivity, and Arbitrary Dimension Support

Authors: Zahra Ghoraeian, Mohammad-Reza Sadeghi, Samaneh Mashhadi

Organizations: Department of Mathematics and Computer Science, Amirkabir University of Technology (Tehran Polytechnic), Tehran, Iran · School of Mathematics and Computer Science, Iran University of Science and Technology, Narmak, Tehran, 1684613114, Iran

Abstract

With the growth of digital document exchange, protecting image integrity against attacks such as Vector Quantization (VQ) and collage has become critical. Existing methods are vulnerable to these attacks and limited to fixed image dimensions. This paper presents a novel, dimension-agnostic, fragile watermarking algorithm that enhances security and tamper localization by replacing conventional hash functions with Triangular Content-Aware Permutation (TCA). The image is combined with key-based global noise and divided into blocks. The core innovation is applying content-dependent permutation with intrinsic avalanche effect (TCA) at the bit-plane level, generating a unique content-dependent watermark. For color images, a vertical sandwich transformation merges channels, preserving inter-channel dependency with only 1.62x time increase. The "remainder merging" strategy eliminates padding constraints. Experiments on 50 grayscale and 10 color images under 18 attacks show FPR=0% and FNR=0% for 17 attacks. Salt-and-pepper noise yields negligible FNR of 0.27% (grayscale) and 0.14% (color). Average PSNR is 51.14 dB (8-bit), 75.25 dB (12-bit), and 99.33 dB (16-bit). Embedding and extraction times are 1.61 s and 1.63 s, respectively. The algorithm achieves 100% accuracy against collage, VQ, copy-move, JPEG (quality 5-95), and geometric attacks, providing a secure solution for digital forensics, medical imaging, and legal document authentication.

Figures & tables

Paper	Security Key	Localization	Block Size	Color Space & Depth	Rounding	Padding
Bouarroudj 2024 (High Cap.) [ 20 ]	✓	X	$1\times 1$ (Fixed)	Grayscale (8,12,16)	X (DFT)	X
Adi 2025 [ 9 ]	X	✓	Variable (Power-of-2)	Grayscale (8)	✓(Spatial)	X
Wu 2026 [ 14 ]	✓	✓	$4\times 4$ / $2\times 2$ (Fixed)	Grayscale (8)	✓(Spatial)	X
Sisaudia 2024 [ 23 ]	X	✓	$4\times 4$ (Fixed)	Grayscale (8)	✓(Spatial)	X
Akhtarkavan 2023 [ 18 ]	X	X	$10\times 10$ (Fixed)	Grayscale (16)	✓(IIDWT)	X
Bouarroudj 2025 [ 7 ]	✓	✓	$4\times 4$ (Fixed)	Gray/Color (8,12,16)	X (DFT+DWT)	X

TABLE I: Comparison of Seven Selected Fragile Watermarking Schemes

Fig. 1: Flowchart of the watermark embedding algorithm. The main steps include preprocessing (7-bit image construction, noise generation, and masking), block partitioning, CTR multiplication, bit-plane extraction, TCA scrambling, central watermark selection, and LSB embedding.

Fig. 2: Flowchart of the watermark extraction and tamper localization algorithm. The steps include extracting the existing watermark, recomputing the watermark from the 7 MSBs, comparing, and generating the binary tamper map.

Layer	Mechanism	Purpose
Noise masking	XOR with seed-driven noise	Spatial location binding
CTR-style keying	Multiplication by $K+(idx-1)$	Block order binding
TCA scrambling	Content-dependent permutation	Avalanche effect + non-analytic behavior
Center selection	Fixed offset from corners	Avoid boundary artifacts

TABLE II: Security Layers of the Proposed Scheme

Fig. 3: Vertical sandwich transformation for color images. The three R, G, B channels are stacked vertically to form a grayscale-like image of size

3H\times W

. Each

m\times n

block from the original image is transformed into a

(3m)\times n

block in the sandwiched image.

Advantage	Explanation
Zero change to core algorithm	All functions including block partitioning, TCA scrambling, and bitwise operations work without any modification.
Preserves inter-channel dependency	Unlike methods that process each color channel independently [ 25 , 8 , 27 , 7 , 14 ] , the proposed approach maintains dependency between channels. A manipulation in one channel (e.g., only the red channel) changes the watermark of the entire block.
Uniform security parameters	The secret seed, key $K$ , and number of TCA iterations are the same for all three channels.
Favorable time efficiency	The number of blocks remains constant and only the block height increases. Consequently, execution time increases by about 1.7 times (not 3 times). In contrast, if the three color channels were processed independently, the number of blocks would triple and execution time would approximately triple as well.

TABLE III: Advantages of the Proposed Approach for Color Images

Attack	TPR (%)	FPR (%)	FNR (%)	ACC (%)	Precision	F1
Gaussian Noise	100	0	0	100	1	1
Poisson Noise	100	0	0	100	1	1
Speckle Noise	100	0	0	100	1	1
Brightness Adjustment	100	0	0	100	1	1
Contrast Adjustment	100	0	0	100	1	1
Median Filtering	100	0	0	100	1	1

TABLE IV: Detection Performance against Different Attacks

Attack	Parameters	TPR (%)
Gaussian Noise	$\sigma^{2}\in\{0.0001,0.0005,0.001,0.005,0.01,0.02,0.05,0.1\}$	100
Poisson Noise	-	100
Speckle Noise	$d\in\{0.002,0.02,0.2\}$	100
Brightness Adjustment	$\Delta\in\{1,10,50,100,149,200,243,254,-254\}$	100
Contrast Adjustment	$\gamma\in\{0.1,0.2,0.5,0.8,0.9\}$	100
Median Filtering	$3\times 3$ kernel	100

TABLE V: Results for 17 Attacks on Color Images

Density ( $d$ )	TPR (%)	FPR (%)	FNR (%)
0.0001	$99.87\pm 0.41$	$0\pm 0$	$0.13\pm 0.41$
0.0005	$99.77\pm 0.28$	$0\pm 0$	$0.23\pm 0.28$
0.001	$99.73\pm 0.26$	$0\pm 0$	$0.27\pm 0.26$
0.005	$99.78\pm 0.11$	$0\pm 0$	$0.22\pm 0.11$
0.01	$99.81\pm 0.06$	$0\pm 0$	$0.19\pm 0.06$
0.02	$99.91\pm 0.05$	$0\pm 0$	$0.09\pm 0.05$

TABLE VI: Salt-and-Pepper Noise Results on 10 Color Images (Mean

\pm

Std)

Fig. 4: Example of tamper localization for a color image under a Photoshop collage attack using the ’peacock’ image from the MATLAB image set. (a) Original RGB image. (b) Attacked image; the tampered area (collage) is highlighted by a red circle. (c) Vertically sandwiched block image constructed by stacking the R, G, and B channels of each block of the attacked image. (d) Tamper map generated by the extraction algorithm in the sandwiched domain; note that the height is three times the original image height due to the vertical stacking of the three color channels. (e) Final tamper map resized to the original image dimensions (H $\times$ W), accurately localizing the tampered region.

Bit-Depth	Attack	TPR (%)	FNR (%)
12-bit	Single-Bit Change	100	0
12-bit	Salt-and-Pepper Noise (0.05)	99.97	0.03
16-bit	Single-Bit Change	100	0
16-bit	Salt-and-Pepper Noise (0.05)	100	0

TABLE VII: Performance on Synthetic High Bit-Depth Images (

512\times 512

)

Parameter	Value
Image Dimensions	$610\times 1027$
Block Size	$7\times 4$
Number of Blocks	22272
PSNR (dB)	51.15
Embedding Time (avg. 5 runs)	5.78 s
Extraction Time (avg. 5 runs)	5.47 s

TABLE VIII: Results of Experiment with Arbitrary Dimensions and Non-Square Block

Block Size	Number of Blocks	Duplicate Watermarks (Pairs)	Embedding Time (s)	Extraction Time (s)	PSNR (dB)
$3\times 3$	28,900	798,842	5.91	7.40	51.14
$4\times 4$	16,384	2,076	3.69	3.50	51.13
$5\times 5$	10,404	1	2.44	2.38	51.13
$6\times 6$	7,225	0	1.61	1.63	51.14
$8\times 8$	4,096	0	1.19	1.18	51.15
$16\times 16$	1,024	0	0.71	0.84	51.14

TABLE IX: Performance Comparison at Different Block Sizes (

512\times 512

Image)

Image Forgery Detection

Image Forgery Detection studies how to identify manipulated or synthetic images and locate the visual evidence of tampering.

See all 127 papers

A Content-Aware Pure Permutation with Intrinsic Avalanche Effect: Breaking the Diffusion-Permutation Dichotomy
Aug 10, 2026Zahra Ghoraeian, Mohammad-Reza Sadeghi, Samaneh Mashhadi
Department of Mathematics and Computer Science, Amirkabir University of Technology (Tehran Polytechnic), Tehran, Iran · School of Mathematics and Computer Science, Iran University of Science and Technology, Narmak, Tehran, 1684613114, Iran
Watermarks Attack Watermarks: Re-Watermarking as a Generic Removal Strategy
May 16, 2026Maria Bulychev, Neil G. Marchant, Benjamin I. P. RubinsteinWatermark Removal Digital Image Forensics
University of Melbourne
Hide&Seek: Remove Image Watermarks with Negligible Cost via Pixel-wise Reconstruction
Mar 1, 2026Huajie Chen, Tianqing Zhu, Hailin Yang +7Watermark Removal AI-Generated Image Watermarking
City University of Macau · CISPA Helmholtz Center for Information Security · Guangzhou University

Aug 10, 2026J/K move · Enter open · S save

A Content-Aware Pure Permutation with Intrinsic Avalanche Effect: Breaking the Diffusion-Permutation Dichotomy

Zahra Ghoraeian, Mohammad-Reza Sadeghi, Samaneh Mashhadi

Department of Mathematics and Computer Science, Amirkabir University of Technology (Tehran Polytechnic), Tehran, Iran · School of Mathematics and Computer Science, Iran University of Science and Technology, Narmak, Tehran, 1684613114, Iran

Open paper AskPDF arXiv

Pixel permutation is a fundamental tool in image processing, image encryption, and data hiding (including watermarking and steganography) that rearranges pixels without changing their values. A common assumption in the literature is that permutation alone cannot create differential sensitivity; changing one pixel merely relocates that pixel in the output, producing no avalanche effect. This paper challenges this by introducing the Triangular Content-Aware Permutation (TCA) algorithm. The method extracts edge points using Canny and applies Delaunay Triangulation to edges and corners, creating a unique partition. Since triangulation is highly sensitive to image geometry, changing a single pixel alters the edge map, resulting in a completely different triangulation and global permutation pattern. Unlike classical dimension-based permutations and advanced content-aware methods (2025-2026), which lack differential sensitivity, TCA increases NPCR from near-zero to 97.10% solely through pixel relocation. Experiments on 50 images show that TCA, with an average of 14.81 iterations, achieves NPCR = 97.10% and UACI = 20.06%, proving pure permutation can create significant differential sensitivity. Conventional methods maintain near-zero NPCR. The iteration threshold varies from 6.4 to 30.7 based on content complexity. Low PSNR (11.93 dB) and near-zero correlation (~10^-3) confirm superior statistical performance. Although slower than classical methods due to triangulation, this is a deliberate trade-off for stronger security. Given the non-analytic, content-dependent nature of the pattern, TCA is ideal for reference-based encryption, fragile watermarking, and non-blind steganography.

Abstract

Image Forgery Detection

Explore similar work

A Content-Aware Pure Permutation with Intrinsic Avalanche Effect: Breaking the Diffusion-Permutation Dichotomy

Watermarks Attack Watermarks: Re-Watermarking as a Generic Removal Strategy

Hide&Seek: Remove Image Watermarks with Negligible Cost via Pixel-wise Reconstruction