Dr Audrey Gabelle
email: gabelle@chu-montpellier.fr

Laure-Anne Gutierrez

Jean-François Dartigues

Karen Ritchie

Jacques Touchon

Claudine Berr

Affiliations

Palmomental reflex a relevant sign in early Alzheimer's disease diagnosis?

Keywords:

à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Background

On the hypothetical dynamic's curve of biomarkers' appearance for the diagnosis of Alzheimer disease (AD) [START_REF] Dubois | Revising the definition of Alzheimer's disease: a new lexicon[END_REF][START_REF] Jack | Hypothetical model of dynamic biomarkers of the Alzheimer's pathological cascade[END_REF] , clinical signs seem to appear late after the positivity of in vivo biomarkers reflecting the amyloid process and the Tau neuronal injury.

The development of brain imaging amyloid markers, based on the amyloid cascade theory of Hardy 3,[START_REF] Hardy | The amyloid hypothesis of Alzheimer's disease: progress and problems on the road to therapeutics[END_REF] gives us anatomical information regarding the amyloid load. The aim is to underline in vivo amyloid plaques in the brain regions of interest which reflect the AD process. In the first human study comparing Pittsburgh Compound-B (PIB) retention in 16 mild AD patients versus 9 controls, the PIB retention was increased most prominently in frontal cortex (1.94-fold, p = 0.0001) in the AD patients [START_REF] Klunk | Imaging brain amyloid in Alzheimer's disease with Pittsburgh Compound-B[END_REF] . If large increases were also observed in parietal, temporal and occipital cortices [START_REF] Klunk | Imaging brain amyloid in Alzheimer's disease with Pittsburgh Compound-B[END_REF] , other studies validated on visual inspection of the PIB images, a greater binding in the orbitofrontal, posterior cingulate and precuneus (for review Saidlitz et al., [START_REF] Saidlitz | Amyloid imaging in Alzheimer's disease: a literature review. The journal of nutrition[END_REF] ). Amyloid load assessed on PET scan may be also a risk marker of progression of healthy and Mild Cognitive Impairment (MCI) subjects to AD [START_REF] Villemagne | Longitudinal assessment of Abeta and cognition in aging and Alzheimer disease[END_REF][START_REF] Morris | Pittsburgh compound B imaging and prediction of progression from cognitive normality to symptomatic Alzheimer disease[END_REF][START_REF] Ossenkoppele | Amyloid imaging in prodromal Alzheimer's disease[END_REF] . Literature data show that 20 to 30% of healthy elderly subjects have increased amyloid. In these subjects amyloid load progresses during follow-up, as shown in a study [START_REF] Sojkova | Longitudinal patterns of beta-amyloid deposition in nondemented older adults[END_REF] which followed 24 non-demented subjects, mean age 79 years, for 1.5 years ± 6 months and found that PIB retention increased by 0.9% annually. The increase was greater in subjects who had high amyloid deposition at baseline, mainly in the prefrontal, parietal, lateral temporal, occipital, and anterior and posterior cingulate cortices. Moreover, certain regions of amyloid deposits (pre-frontal, posterior cingular, lateral temporal cortices) appear to be more predictive of risk of progression of amnestic MCI subjects toward dementia disorder [START_REF] Koivunen | Amyloid PET imaging in patients with mild cognitive impairment: a 2-year follow-up study[END_REF] . On the other hand, some neuropsychiatric signs like apathy or irritability seem to belong to the spectrum of prodromal AD symptoms [START_REF] Delrieu | Apathy as a feature of prodromal Alzheimer's disease: an FDG-PET ADNI study[END_REF][START_REF] Apostolova | Neuropsychiatric manifestations in mild cognitive impairment: a systematic review of the literature[END_REF] . No study underline the presence of frontal clinical signs at an early stage of AD.

We assume that clinical signs could help in a better and earlier diagnosis of AD and in particular specific clinical signs such as frontal release signs (snout, palmomental, grasping…) in relation with the frontal (pre-frontal, lateral frontal) amyloid load at an early stage [START_REF] Chetelat | Relationship between atrophy and beta-amyloid deposition in Alzheimer disease[END_REF][START_REF] Leinonen | Assessment of beta-amyloid in a frontal cortical brain biopsy specimen and by positron emission tomography with carbon 11labeled Pittsburgh Compound B[END_REF][START_REF] Armstrong | Laminar distribution of beta-amyloid (Abeta) peptide deposits in the frontal lobe in familial and sporadic Alzheimer's disease[END_REF] . To address this hypothesis, we explored whether neurological signs could be present at an early stage of AD in a subsample of the French Three-City (3C), a prospective cohort study of noninstitutionalized subjects aged 65 and over, followed during 12-years with an exhaustive and systematic clinical examination at each follow-up.

Materials and Methods

Study design

The French 3C study (three French cities: Bordeaux, Montpellier and Dijon) is a population-based study of non-institutionalized subjects aged ≥65 aiming to determine the relationship between vascular factors and dementia [START_REF] Lambert | Association of plasma amyloid beta with risk of dementia: the prospective Three-City Study[END_REF][START_REF]Vascular factors and risk of dementia: design of the Three-City Study and baseline characteristics of the study population[END_REF] . A nested case-control study [START_REF] Berr | How to optimize the use of biobanks from population-based cohorts in aging research[END_REF] is designed based on the 2259 participants stemming from the Montpellier cohort followed every two years during 12-years with standardized and detailed neurological examination. This neurological examination was carried out for all individuals by a trained practitioner at each follow-up. Each practitioner was trained by the same senior neurologist (JT) during all follow-ups. A systematic procedure for the neurological exam was fulfilled by the practitioner. A particular focus on extrapyramidal signs (akinesia, rigidity, rest tremor), pyramidal symptoms (spastic rigidity, Babinski' sign), primitive reflexes (snout, palmomental, grasp) and tremor (essential (action/postural), intentional, head) classified in 0 (absent) or 1 (present) is performed.

To test akinesia, as a change of the initiation and the automatic execution of the movements, the slowing down and the rarity of the harmonious character of the gesture, we analyzed rapid alternative movements, gait impairments and reduced facial expression (mask-like). For extrapyramidal rigidity, we analyzed the sustained "lead pipe" resistance throughout the range of motion affecting flexor and extensor muscles equally. Cog wheeling may be brought out when the examiner passively moves an elbow or wrist. This sign is increased by reinforcement maneuvers such as having the patient use the opposite hand to trace circles in the air. Asymmetric resting tremor corresponds to regular rhythmic tremor (frequency 4-6 Hertz) observed when the patient sits, hands on the knees.

To detect the palmomental reflex, the skin of the patient is scratched near the thenar eminence by a key. When present there is a brief contraction of the ipsilateral mentalis muscle with puckering the chin. The essential tremor included postural-or action-type tremor. It pertains to the abnormal oscillation around the axis when the postural manoeuver hand in tension is performed. The intentional tremor presents characteristics of cerebellar signs, the tremor appears when patients are asked to touch their nose with their fingers, oscillations are more marked when the target is reached.

The diagnosis of dementia is established at each follow-up using a two-step procedure. First, the evaluation of neuropsychological tests (MMSE, the Isaacs Set Test and the Benton Visual Retention Test) is performed by trained psychologists [START_REF] Gabelle | Plasma amyloid-beta levels and prognosis in incident dementia cases of the 3-City Study[END_REF] and the subject is systematically examined by a neurologist.

Second, an independent committee of neurologists reviewed all potential cases of dementia in order to obtain a consensus based on the Diagnostic and Statistical Manual of Mental Disorders (DSM-IV) criteria and NINCDS-ADRDA criteria for AD diagnosis. We excluded the 41 prevalent dementia cases for which clinical signs before diagnosis were unavailable, and the 66 incident dementia other than AD. Thus, the cases were the incident AD cases that were identified during the 12year follow-up (n=106). Two controls per case were randomly sampled from the set of those at risk i) under follow-up on the date the case was diagnosed ii) of the same sex, age (+2.5 years) and educational attainment (4 classes: primary, secondary, college and university as described in Table 1). We constitute a group of 208 matched controls (4 cases has only 1 matched-controls)."

Statistical analysis

Clinical signs variables are evaluated as binary characteristics. First we compared cases and controls using Chi2 test (for qualitative variables) or Wilcoxon's test (for quantitative variables). Multiple conditional logistic regressions were used to estimate the odds ratios with their 95 percent confidence intervals in matched cases-control analysis [START_REF] Breslow | Statistical methods in cancer research. Volume I -The analysis of case-control studies[END_REF][START_REF] Moulin | Lung cancer risk in hard-metal workers[END_REF] . We analyzed the neurological signs at time of diagnosis and two years before. Secondary, we performed the same analysis in two groups according to age: < 80 years-old/ >80 years old. Analyses were performed using the SAS software (version 9.2, SAS Institute Inc., Cary, NC).

Results

Sample characteristics at time of diagnosis (Table 1 and 2)

In the incident AD cases, the mean age was 82.2 (SD=5.9), 19.8% and were highly educated, the median MMSE was 23 [14-28], 20.4% presented a MMSE ≥26 and 58.3% a MMSE between 21 and 26. All cognitive scores were lower in the AD dementia group than in controls (p<0.001). At baseline, no difference was observed between groups for vascular risk factors (diabetes mellitus, blood pressure, alcohol consumption, tobacco abuse, BMI and presence of cardiovascular diseases) (data not shown).

Clinical signs two years before and at the time of the AD dementia diagnosis in the entire population (Table 3)

At time of diagnosis, akinesia (30.7 vs. 17.6%, OR=2.44, p=0.004), palmomental primitive reflex (22.6 vs 12.1%, OR=2.30, p=0.02) and essential tremor (17.3 vs. 8.51%, OR=2.16, p=0.03) were more frequent in incident AD cases than in controls. Two years before, no clinical sign differed between incident AD cases and controls in the entire population.

Clinical signs in patients younger than 80 years old (Figure 1) Interestingly, in younger patients (less than 80 years old) the palmomental reflex was more frequent in AD patients than in controls (25.0 vs. 7.0%, p=0.03) two years before. This result persists at the time of diagnosis (30.3 vs. 12.3%, p=0.02).

Discussion

To the best of our knowledge, this is the first report highlighting that primitive reflexes were present and relevant for AD diagnosis at an early stage in patients younger than 80 years. Two years before diagnosis, palmomental reflex could help discriminate young AD patients from controls. The palmomental reflex might be an useful warning sign in routine clinical practice. Our results challenge the dogma of the normal clinical examination in AD patients at an early stage of the disease [START_REF] Poncet | Clinical aspects and course of Alzheimer's disease[END_REF] .

Primitives reflexes such as palmomental, snout, grasp reflexes are present from birth and can be associated with feeding and attachment to the mother. They disappear as the frontal part of the brain matures. In healthy subjects, the primitive reflexes are often present and the prevalence increases with age as described in the large sample of the Maastricht Aging study [START_REF] Van Boxtel | Prevalence of primitive reflexes and the relationship with cognitive change in healthy adults: a report from the Maastricht Aging Study[END_REF] . It seems that primitive reflexes appear commonly after the age of 66 years. As the 3C study included subjects older than 65, we took into account the effect of age by matching controls to AD cases in regards to age. For specific dementia diagnosis, studies usually report a lack of specificity and sensibility of these reflexes particularly the palmomental [START_REF] Owen | The palmomental reflex: a useful clinical sign?[END_REF] .

However the exact prevalence of such primitive reflexes is unknown because of the variability in the means of eliciting these reflexes and the interpretation of their presence. In dementia patients, the presence of primitive reflexes has been linked to the severity of the dementia in a prospective study of 2914 Canadians over 65, with a higher frequency in patients with severe dementia than at an earlier stage of the disease [START_REF] Hogan | Primitive reflexes and dementia: results from the Canadian Study of Health and Aging[END_REF] . In a systematic description of 204 cases of dementia, primitive reflexes appear to be more indicative of advanced age, severity of the illness and diagnosis of Lewy body disease or mixed dementia [START_REF] Links | Prevalence of primitive reflexes and Parkinsonian signs in dementia[END_REF] . In the present study, we unveiled interestingly that palmomental primitive reflexes were pathologic early on in the AD process in younger patients younger than 80 years, a point that had never been examined in previous studies. The reasons why these clinical signs were only pathologic in younger patients remain hypothetical but one explanation might be the high prevalence of amyloid lesions in the frontal area in normal elderly people, observed for example in amyloid imaging studies, contributing to decreasing the difference between AD and non-AD in older people. Another hypothetical explanation might reside in the fact that older patients present a different AD clinical phenotype with less frontal-related signs and more akinetic symptoms related to the impact of vascular mixed brain lesions. The palmomental reflexes could be interpreted as a frontal-released reflex. Some neuropsychological and brain imaging studies underlined that frontal areas are pathologic at a prodromal stage of the disease. Frontal-related apathy could be considered as an early biomarker of AD diagnosis [START_REF] Robert | The apathy inventory: assessment of apathy and awareness in Alzheimer's disease, Parkinson's disease and mild cognitive impairment[END_REF][START_REF] Robert | Apathy in patients with mild cognitive impairment and the risk of developing dementia of Alzheimer's disease: a one-year follow-up study[END_REF][30] . In the same way, the amyloid PET-scan studies at a prodromal stage of AD, revealed that amyloid load is predominant on frontal areas such as dorsolateral frontal areas [START_REF] Villemagne | Longitudinal assessment of Abeta and cognition in aging and Alzheimer disease[END_REF] . In this study, the diagnosis of Alzheimer's dementia is based on the NINCDS-ADRDA diagnosis criteria and on a consensus adjudicative committee. As all the convertors and/or controls has not undergone brain imaging to exclude vascular changes in frontal lobes, we could not exclude that some vascular lesions are the cause of the positivity of frontal release signs.

A major strength of our work is the framework of a longitudinal follow-up and systematic neurological exam implemented in the 3C-Montpellier cohort.

Clinical signs were documented at each wave and can be studied two years before the diagnosis. So interpretation is not influenced by cognitive complaint or status and reflect the AD prodromal phase. However, we cannot exclude inter-operator differences in the interpretation of the presence of each clinical sign despite the fact that all physicians who examined participants have been trained to standardized the exam in the Neurology unit (JT, AG) associated closely to the epidemiological team.

Conclusion

Primitive reflexes can be tested easily and rapidly in clinical routine. Even if the sensibility of these signs is far from perfect, their presence may alert the clinician to the possibility of brain pathology, even at an early stage. The standardized examination with primitive reflexes evaluation should be included or re-included in the neurological bedside screening of patients with early AD degenerative process.

  Akinesia (43.5 vs. 23.8%, p=0.001) and essential tremor (21.1 vs. 11.8%, p=0.035) were more frequent in older AD patients (≥ 80 years-old) at the time of diagnosis only. No difference was observed for grasp reflexes, Babinski's sign, others types of tremor, plastic or spastic hypertonia, or others neurological clinical signs.

Figure 1 :

 1 Figure 1: Effects of primitive reflexes (palmomental, snout) and akinesia clinical signs

Table 1 :

 1 Characteristics of AD cases and matched controls presented on the whole population and in the two age-groups: Comparisons between AD cases and matched controls.

			Whole sample				<80 years
		Matched controls	AD cases		Matched controls	AD cases		Ma
		n	Mean (Std) n Mean (Std) p	n Mean (Std) n Mean (Std) p	n
			81.53
	Age at diagnosis	208	(5.63)	106 82.16 (5.91) 0.44 74 75.39 (3.0) 33 75.36 (3.24) 0.96 134
		n	%	n	%	p	n	%	n	%	p	n
	Sex (men)	69	33.17	35	33.02	0.98 27	36.49	13	39.39	0.77 42
	Years of education
	Primary	70	33.65	36	33.96	1 35	47.3	16	48.48	1 35
	Secondary	50	24.04	25	23.58		10	13.51	5	15.15		40
	College	47	22.6	24	22.64		15	20.27	6	18.18		32
	University	41	19.71	21	19.81		14	18.92	6	18.18		27

Table 2 :

 2 Neuropsychological scores (Median [Min-Max]) in the whole population and in the two age-groups: Comparisons between AD cases and matched controls.

	Whole sample			<80 years		>80 years
	Matched			Matched			Matched
	controls	AD cases		controls AD cases		controls	AD cases
	N=208	N=106	p	N=74	N=33	p	N=134	N=73	p
	At time of diagnosis
	MMSE *

Table 3 :

 3 Frequency of neurological clinical signs between incident AD cases and matched controls at time of diagnosis and two years before (p value are based on results of conditional logistic regression comparing AD and controls).

		At time of diagnosis		Two years bef
		Matched			Matched
		AD cases			AD cases
		controls	OR [CI 95%]	p	controls
		N=106			N=106
		N=208			N=208
	Akinesia	35 (17.6%) 31 (30.7%) 2.44 [1.32-4.49] 0.004 30 (15.6%) 19(21.1%)
	Snout reflex	55 (27.6%) 37(36.3%)	1.72 [0.91-3.27]	0.01 56 (29.3%) 35 (38.9%)
	Palmomental reflex	24 (12.1%) 23 (22.6%) 2.30 [1.17-4.52]	0.02 22 (11.5%) 17 (18.9%)
	Rigidity	12 (6.03%) 12 (11.8%) 2.14 [0.92-5.01]	0.08 10 (5.21%) 6 (6.67%)
	Essential tremor	17 (8.50%) 18 (17.3%) 2.16 [1.06-4.41]	0.03 13 (6.77%) 9 (10.0%)

Acknowledgements/Conflicts/Funding/Sources Funding: The 3C Study is conducted under a partnership agreement between the Institut National de la Santé et de la Recherche Médicale (INSERM), Victor-Segalen Bordeaux-2 University, and Sanofi-Aventis. The Fondation pour la Recherche Médicale funded the preparation and initiation of the study. The 3C Study is also supported by the Caisse Nationale Maladie des Travailleurs Salariés, Direction Générale de la Santé, MGEN, Institut de la Longévité, Conseils Régionaux d'Aquitaine et Bourgogne, Fondation de France and Ministry of Research -INSERM Programme « Cohortes et collections de données biologiques », Agence Nationale de la Recherche ANR PNRA 2006 and Longvie 2007 and Fonds de coopération scientifique Alzheimer (FCS 2009-2012).

Conflicts of interest:

All the authors report no disclosure.

Details of contributors: Individual contributions to the manuscript

A. Gabelle: study concept; analysis and interpretation of the data; drafting /revising the manuscript.

L.A Gutierrez: acquisition of data; analysis and interpretation of the data; statistical analysis; drafting/revising the manuscript.


Teddy Furon
email: teddy.furon@irisa.fr

A constructive and unifying framework for zero-bit watermarking

Keywords: Zero-bit watermarking, Pitman-Noether theorem, detection theory. I

In the watermark detection scenario, also known as zero-bit watermarking, a watermark, carrying no hidden message, is inserted in a piece of content. The watermark detector checks for the presence of this particular weak signal in received contents. The article looks at this problem from a classical detection theory point of view, but with side information enabled at the embedding side. This means that the watermark signal is a function of the host content. Our study is twofold. The first step is to design the best embedding function for a given detection function, and the best detection function for a given embedding function. This yields two conditions, which are mixed into one 'fundamental' partial differential equation. It appears that many famous watermarking schemes are indeed solution to this 'fundamental' equation. This study thus gives birth to a constructive framework unifying solutions, so far perceived as very different.

interest. Pioneer works are mostly heuristic approaches [START_REF] Miller | Informed embedding: exploiting image and detector information during watermark insertion[END_REF], [START_REF] Furon | JANIS: Just Another N-order side-Informed Scheme[END_REF]. More recent works use the binning principle to achieve zero-bit watermarking [START_REF] Liu | Error exponents for one-bit watermarking[END_REF], [START_REF] Pérez-Freire | Detection in quantization-based watermarking: performances and security issues[END_REF], although J. Eggers notices that SCS (Scalar Costa Scheme) is less efficient for zero-bit than for positive rate watermarking scheme [START_REF] Eggers | Informed Watermarking[END_REF]Sect. 3.6]. Indeed, Erez et al. prove the optimality of DC-DM based on lattices (those whose Voronoi region asymptotically tends to an hypersphere) for strictly positive rate data hiding as far as an additive white noise attack is considered [START_REF] Erez | Achieving 0.5 log 1 + SN R on additive white gaussian noise channel with lattice encoding and decoding[END_REF]. In the case of zero-rate watermarking, P. Moulin et al. reasonably conjecture that sparse lattice DC-DM is optimal [START_REF] Moulin | Optimal sparse-QIM codes for zero-rate blind watermarking[END_REF]. For zero-bit watermarking, lattice DC-DM achieves high performances showing some host interference rejection [START_REF] Liu | Error exponents for one-bit watermarking[END_REF]. However, there is a loss of efficacy compared to the private setup where the side information is also available at the detector.

At first glance, it would seem that the problem of watermark detection is simpler than the decoding of hidden symbols, because the decoder's output belongs to a message space which is bigger than the detector's range B = {0, 1}. In other words, whereas watermark detection implies a simple binary hypotheses test, decoding of watermark is a complex multiple hypotheses test. Yet, almost no theoretical limit, ie. an equivalent of Costa's result but for watermark detection, has been shown, except [START_REF] Furon | Some theoretical aspects of watermarking detection[END_REF]Sect. 2] which only tackles the Gaussian case. N. Merhav mentioned during the WaCha'05 workshop in Barcelona, that zero-bit watermarking is a hard problem whose optimal solution is not known for the moment [START_REF] Merhav | An information-theoretic view of watermarking embedding-detection and geometric attacks[END_REF]. Especially, up to now, there is no reason why the binning principle should be optimal, even if, as far as the author knows from the literature, it has the best performances against an AWGN attack. Yet, DC-DM schemes are known to be weak against scale gain attack.

II. STRATEGY AND NOTATION

Our goal is not to derive an accurate statistical model of the host signal as done in the above-mentioned prior works. On contrary, very basic assumptions (Gaussian distribution or flat-host assumption) are in order, allowing us to stress the major role of side information at the embedding side. While the binning scheme is commonly used to exploit side information, it is not the only way. Our approach is indeed closer to the theory of weak signal detection.

A. Embedding side

The embedder transforms an original host signal s into a watermarked content y = f (s) = s + x. The host signal or channel state s is a vector of n components of the original content, modeled as random variables. The notational key of the article is to decompose the watermark signal x as a unit power vector w and an amplitude θ. f (s) = s + x = s + θw(s).

(

) 1
w is a smooth function from R n to R n , with the constraints E S {w(s)} = 0 and E S { w(s) 2 } = n. This vector gives a direction pointing to an acceptance region of R n , towards which the host signal should be pushed. The scalar θ controls the gain or amplitude of the watermark signal. Theoretical frameworks often use a constant θ = √ P , where P is the fixed power of x. Yet, in practice, host contents might support different watermark power depending January 12, 2007 DRAFT on their individual masking property. This change might even occur within a content, such that we should resort to a vector θ = (θ 1 , • • • , θ n ) gathering positive and small gains affecting each sample. We restrict our study to scalar gain for the sake of simplicity, but the results of this paper can be easily extended to a vector gain. In this case, one might consider θ as the average gain.

Both parts of the watermark signal depends on the host content, either through side information, or for some perceptual reasons. Unfortunately, in blind schemes, side information is not made available at the detection side.

Moreover, we wish to maintain a low detector's complexity, which prevents the use of a human visual or auditive system in order to recreate an estimate of θ based on the received content. The only fact the detector knows is that the watermark amplitude θ is positive and small. We believe this model allows a great flexibility which eases practical implementations of watermarking schemes.

B. Detection side

Upon receipt of signal r, the detector makes a binary decision: d = 1 (d = 0) means that, according to the detector, the piece of content under scrutiny is watermarked (resp. it has not been watermarked). There are two hypotheses: Under hypothesis H 0 , the detector receives an original content r = r 0 = s (see end of subsection I-A for justifications), whereas under hypothesis H 1 , the detector receives a watermarked and possibly attacked content r = r 1 . Probability of false alarm P f a and power of the test P p are given by

P f a = Pr{d = 1|H 0 } ; P p = Pr{d = 1|H 1 }. (2)
Once again, in zero-bit watermarking, no symbol is transmitted. Our problem is then fundamentally different from the communication of one bit because, under hypothesis H 0 , no processing is applied and s, given by Nature, is directly sent to the detector.

We assume that the detector has the structure of a Neyman-Pearson test. First, it applies a detection function t mapping from R n to R. Then, this scalar is compared to a threshold τ : d = 1 if t(r) > τ , d = 0 else. The threshold is given by the constraint of a significance level α such that P f a = E D {d|H 0 } ≤ α. Note that, for a given detection function, this threshold does not depend on what happens under hypothesis H 1 (embedding function w, watermark's amplitude θ). Moreover, we assume without loss of generality, that, under hypothesis H 0 , t(r) is a centered random variable with unit variance:

E R {t(r)|H 0 } = 0, Var{t(r)|H 0 } = 1. (3)
If not the case, it is easy to built the test t

(r) = (t(r) -E R {t(r)|H 0 })/ Var{t(r)|H 0 }.

C. Pitman Noether efficacy

In this article, the tests are compared asymptotically for n → +∞. The Pitman-Noether theorem indicates that the best test has the higher efficacy η, whose general definition is given by [11, Sect. III.C.3]:

η = lim n→∞ n -mδ ∂ m ∂θ m E R {t(r)|H 1 } θ=0 Var{t(r)|H 0 } -1/2 1 mδ , (4)
January 12, 2007 DRAFT where m is the first integer for which the m-th derivative of E R {t(r)|H 1 } is not null, and δ a positive scalar such that the limit is not null. In our problem, it is not unreasonable to assume m = 1 and δ = 1/2 because the expectation of the detection function grows with √ n as Var{t(r)|H 0 } has been set to one for all n. This is at least true for well known watermarking schemes. We are not able to find a counter-example, ie. a watermarking scheme having a better growth rate than √ n. Therefore, we restrict our analysis to δ = 1/2.

The Pitman Noether theorem holds for composite one-sided hypothesis test. In Sect. II-A, motivations clearly show that our problem is not a simple hypothesis test (H 0 : θ = 0 versus H 1 : θ = √ P fixed), but a composite one-sided hypothesis test (H 0 : θ = 0 versus H 1 : θ > 0).

Last but not least, the proof of this theorem is based on an asymptotic study where the alternative hypothesis H 1 has a vanishing parameter θ n = kn -δ , with k a positive constant. Important assumptions are the following regularity conditions:

lim n→∞ ∂ ∂θ E R {t(r)|H 1 } θ=θn / ∂ ∂θ E R {t(r)|H 1 } θ=0 = 1 and lim n→∞ (Var{t(r|H 1 )}/Var{t(r)|H 0 }) = 1, (5)
and that t(r) -E R {t(r)} tends (convergence in law), as n → ∞, to a normal variable, both under H 1 and under

H 0 .
We also define the efficiency per element (a.k.a. the differential detector SNR) in the same way as the efficacy but without the limit, such that in our case:

η = 1 n ∂ ∂θ E R {t(r)|H 1 } 2 θ=0 . (6)

III. DETECTION OF WEAK SIGNAL DEPENDENT ON SIDE INFORMATION

The goal of this section is to give the expressions for the best detection and the best embedding functions. We mean 'best' in the sense of the Pitman Noether theorem, ie. such as they maximized the efficiency per element.

This section doesn't consider any attack. Hence, the Pitman Noether theorem considers signals r 0 = s and

r 1 = y = s + θ n w(s), with E S { w(s) 2 } = n and θ n = k/ √ n, k > 0.
It means that the proof of this theorem fixes the embedding distortion to D E = θ 2 n n = k 2 , but as n increases, the power of the watermarking signal vanishes.

A. Best detector for a given embedding function

In this subsection, embedding function w is fixed. A well known corollary of the Pitman Noether theorem [11, Sect. III.C.3] states that the Locally Most Powerful (LMP) test in θ = 0 is asymptotically the best. A Cauchy- January 12, 2007 DRAFT Schwarz inequality gives:

∂ ∂θ E R {t(r)|H 1 } θ=0 = R n t(r) ∂ ∂θ p(r|H 1 ) θ=0 dr (7) ≤ R n t(r) 2 p(r|H 0 )dr R n p(r|H 0 ) 1 p(r|H 0 ) ∂ ∂θ p(r|H 1 ) θ=0 2 dr (8) = R n p(r|H 0 ) 1 p(r|H 0 ) ∂ ∂θ p(r|H 1 ) θ=0 2 dr, (9)
with equality for the LMP test:

t(r) = k t 1 p(r|H 0 ) ∂p(r|H 1 ) ∂θ θ=0 , (10)
where k t is a positive constant whose role is explained below. The use of the LMP with θ = 0 is reinforced in practice by the fact the watermark power is very weak compared to the host power.

When there is no attack, p(r|H 0 ) = p S (r) and p(r|H 1 ) = p Y (r). We assume there exists θ > 0, such that function

f (s) is invertible at least when 0 ≤ θ ≤ θ: s = f -1 (y). This allows to write p Y (r) = p S (f -1 (r))|J f -1 (r)|, with
the last term being the determinant of the Jacobian matrix of f -1 taken at (r, θ). Developing this last equation (see Appendix I), we finally get these expressions:

t(r) = -k t ∇p S (r) T p S (r) w(r) -k t div(w(r)) (11)
= -k t div(p S (r)w(r)) p S (r) . (12)
The first term of [START_REF] Vincent Poor | An introduction to signal detection and estimation[END_REF] corresponds to the classical non-linear correlation based LMP test [START_REF] Cheng | Robust optimum detection of transform domain multiplicative watermarks[END_REF]- [START_REF] Barni | Optimum decoding and detection of multiplicative watermarks[END_REF], whereas the second term is not null whenever side information is enabled at the embedding side.

Let B n (R) be the ball of radius R centered on 0, S n (R) the associated hypersphere, and E(R) = Bn(R) t(r)p S (r)dr.

Then, thanks to the Gauss theorem, we have

|E(R)| = k t Bn(R) div(p S (r)w(r))dr (13)
= k t Sn(R)
p S (r)w(r) T e(r)dr

≤ k t Sn(R) p S (r) w(r) dr, (14)
with e(r) the unit normal vector at position r on S n (R). E{ w(r

) 2 } < ∞ implies that lim R→+∞ E(R) = 0.
This shows that the expectation of the detection function given by ( 12) is zero under hypothesis H 0 , as required in II-B. The constant k t enforces that Var{t(r)|H 0 } = 1:

k t = R n 1 p(r|H 0 ) ∂p(r|H 1 ) ∂θ 2 θ=0 dr -1/2 . ( 16
)
Finally, ( 6), [START_REF] Lin | Advances in digital video content protection[END_REF] and [START_REF] Huang | Robust detection of transform domain additive watermarks[END_REF] give the efficiency per element for such tests:

η = n -1 k -2 t ( 17
)
January 12, 2007 DRAFT

B. Best embedding function for a given detection function

The detection function t being given (such that t(r 0 ) is a centered random variable with unit variance), we write:

∂ ∂θ E R {t(r)|H 1 } θ=0 = E S ∂ ∂θ t(s + θw(s)) θ=0 (18)
= E S {w(s) T ∇t(s)}.

It appears that, for a given t, it is important to let w(s) ∝ ∇t(s), ∀s ∈ R n . The efficiency per element is then upper bounded by the following Cauchy-Schwarz inequality:

η = 1 n R n p S (s) w(s) ∇t(s) ds 2 ≤ R n p S (s) ∇t(s) 2 ds ( 20
)
with equality when:

w(s) = k w ∇t(s) ∀s ∈ R n , (21)
where k w is a normalizing constant to achieve E S { w(s) 2 } = n:

k w = n/E S { ∇t(s) 2 }. (22)
(20) and [START_REF] Furon | Some theoretical aspects of watermarking detection[END_REF] give the efficiency per element for such tests:

η = nk -2 w = E S { ∇t(s) 2 }. (23)

C. Synthesis

For the moment, we know how to design the best embedding function for a given detection function, and how to design the best detection function for a given embedding function. This is reminiscent of the Lloyd-Max algorithm in quantization. However, dealing with closed form equations, we can insert [START_REF] Moulin | Optimal sparse-QIM codes for zero-rate blind watermarking[END_REF] in [START_REF] Huber | Robust statistics[END_REF] yielding a partial differential equation, that we loosely name 'fundamental equation of zero-bit watermarking':

p S (r)t(r) + k t k w div(p S (r)∇t(r)) = 0 ∀r ∈ R n . (24)
Hence, the best couple of detection/embedding functions {t, w} is {t ⋆ , k w ∇t ⋆ }, with t ⋆ a fundamental solution, ie. a solution of [START_REF] Moon | Theorems on separability in Riemannian n-space[END_REF]. Note that ( 17) and ( 23) are still valid. Therefore, it is possible to build a scheme of a given η (virtually, as high as possible), provided (24) admits a solution with k w k t = η -1 . The fundamental equation can also be written as:

ηt(r) + ∇p S (r) T p S (r) ∇t(r) + ∇ 2 t(r) = 0, (25)
∇ 2 t(r) being the Laplacian of t(r).

D. A geometric property of fundamental solutions

A nice property induced by the fundamental equation is that a pair of its solutions with different efficiencies per element are orthonormal for the scalar product ., . defined here for two functions g and h by:

g, h = E R {g(r)h(r)|H 0 }. ( 26
)
January 12, 2007 DRAFT Denote L[t] = div(p S (r)∇t(r)). This differential operator is symmetric if R n t i (r)L[t j ](r)dr = R n L[t i ](r)t j (r)dr.

In our case,

R n t i (r)L[t j ](r)dr - R n t j (r)L[t i ](r)dr = R n div(p S (r)(t i (r)∇t j (r) -t j (r)∇t i (r)))dr. ( 27
)
The symmetry is enabled for functions t i , t j if the last term, denoted by C, is zero. Let us write it as a limit:

C = R n div(p S (r)(t i (r)∇t j (r) -t j (r)∇t i (r)))dr (28)
= lim

R→∞ Bn(R) div(p S (r)(t i (r)∇t j (r) -t j (r)∇t i (r)))dr (29)
= lim

R→∞ Sn(R)
p S (r)(t i (r)∇t j (r) T e(r)t j (r)∇t i (r) T e(r))dr (30)

The Gauss theorem gives the later equation. Assuming that the pdf of the host vanishes more quickly than the norm t i (r)∇t j (r) , we suppose in the sequel that the symmetry property is enabled for the solutions of the fundamental equation. Then, [START_REF] Moon | Theorems on separability in Riemannian n-space[END_REF] in [START_REF] Malvar | Improved spread spectrum: A new modulation technique for robust watermarking[END_REF] gives

R n t i (r)L[t j ](r)dr - R n t j (r)L[t i ](r)dr = - R n t i (r).η j p S (r)t j (r)dr + R n t j (r).η i p S (r)t i (r)dr (31) = (η i -η j ) t i , t j = 0 (32)
The restriction to normalized detection functions and this last equation imply that t i , t j = δ(ji) where δ is the Kronecker delta function. Hence, the solutions of the fundamental equation with different efficiencies per element constitute a family of orthonormal functions (Subsection IV-B.1 even shows orthonormal functions sharing the same efficiency), if the symmetry property holds for all pairs of elements of this family.

IV. SOME SOLUTIONS OF THE FUNDAMENTAL EQUATION OF ZERO-BIT WATERMARKING

We are not able to find a general solution of the fundamental equation. However, in some cases, we show some examples of solution in this section.

A. The scalar case

To avoid multiplication of notation, we use the same letter to denote the scalar version of above-mentioned vectorial functions.

We suppose here that the host samples are i.i.d. such that p S (s) = n i=1 p S (s i ). Moreover, our strategy is to maintain this statistical independence while embedding the watermark:

w(s) = (ǫ 1 w(s 1 ), • • • , ǫ n w(s n )) T ,
where ǫ is a secret vector, with for instance, ǫ i = ±1 ∀i ∈ {1, • • • , n}. [START_REF] Vincent Poor | An introduction to signal detection and estimation[END_REF] shows that the detection function is indeed a sum t(r) = n i=1 ǫ i t(r i ); and (25) boils down to a scalar second-order ordinary differential equation with non constant coefficients:

ηt(r) + p ′ S (r) p S (r) t ′ (r) + t ′′ (r) = 0. ( 33
) January 12, 2007 DRAFT TABLE I POLYNOMIAL SOLUTIONS OF THE SCALAR GAUSSIAN CASE s ∼ N (0, 1). η w(s) t(r) Var{t(r)|H 1 } 1 1 r 1 2 s -1+r 2 √ 2 (1 + θ) 4 3 -1+s 2 √ 2 -3r+r 3 √ 6 1 + 66θ 2 + O(θ 4 ) 4 -3s+s 3 √ 6 3-6r 2 +r 4 2 √ 6 1 + 12 √ 6θ + 608θ 2 + O(θ 3 ) 5 3-6s 2 +s 4 2 √ 6 15r-10r 3 +r 5 2 √ 30 1 + 5470θ 2 + O(θ 4 ) 6 15s-10s 3 +s 5 2 √ 30 -15+45r 2 -15r 4 +r 6 12 √ 5 1 + 40 √ 30θ + 49122θ 2 + O(θ 3 ) 7 -15+45s 2 -15s 4 +s 6 12 √ 5 -105r+105r 3 -21r 5 +r 7 12 √ 35 1 + 441392θ 2 + O(θ 4 )
1) Gaussian case: Assume that s ∼ N (0, σ 2 x ). (25) becomes even simpler: ηt(r)rt ′ (r)/σ 2 x + t ′′ (r) = 0. The solution is a linear combination of two 'independent' (ie. their Wronskian is not null) confluent hypergeometric functions of the first kind taken in r 2 /2:

t (a) (r) = k t1 . 1 F 1 - σ 2 x η 2 , 1 2 , r 2 2σ 2 x , (34)
t (b) (r) = k t2 .r. 1 F 1 1 -σ 2 x η 2 , 3 2 , r 2 2σ 2 x . ( 35
) If σ 2 x η is an even integer, t (a) is a polynomial function. If σ 2
x η is an odd integer, t (b) is a polynomial function. Another way to see this is to recognize this later differential equation as the Hermite equation when η is a positive integer and

σ 2 x = 1. Therefore, if ησ 2 x = k ∈ N, t k (r) = κ k H k (r/σ x )
, H k being the Hermite polynomial of order k. This family of polynomials is known to be orthogonal with a weighting function1 exp(-r 2 /2). In our context, this is confirmed by (30), which reduces to the value of the integrand on the boundaries on an increasing interval of R. The condition C = 0 is satisfied because lim r→∞ r m exp(-r 2 /2σ 2

x ) = 0, ∀m ∈ N. In the sequel, we call this set of fundamental solutions the 'polynomial family'.

Table IV-A.1 gives the expressions of the first elements of this family and their associated embedding function.

Figure [START_REF] Cox | Digital Watermarking[END_REF] shows a plot of the detection function of these first elements.

The first line of this table is the well known direct spread spectrum scheme with a linear correlator, optimal detector in the Gaussian i.i.d. case. The second line is known as the proportional or multiplicative embedding, first proposed in [START_REF] Cox | Secure spread spectrum watermarking for multimedia[END_REF]Sect. 4.2] for perceptual reasons (ie., it is known that a greater embedding power is not visible when watermarking wavelet coefficients with a proportional embedding, in comparison to a simple additive embedding).

A higher efficiency per element is another inherent advantage of proportional embedding. The remaining lines of this table generalize this idea to new schemes (as far as the author knows).

2) Uniform case: The classical 'flat-host' assumption used in DC-DM scheme studies states that the host pdf is a piecewise constant function. More precisely, we assume here the host pdf can be written as p S (s) =

-4,8 -4 -3,2 -2,4 -1,6 -0,8 0 0,8 1,6 2,4 3,2 4 4,8 -3,2 -2,4 -1,6 -0,8 0,8 1,6 2,4 3,2
Fig. 1. Plot of the detection function r → t(r) for the seven first elements of the polynomial family as listed in Table IV-A.1. Darker lines corresponds to higher orders.

+∞ i=-∞ P i Π i (s), with Π i the indicator function of the elementary interval [ π √ η i, π √ η (i + 1)), and +∞ i=-∞ P i = √ η/π.
In this case, (25) defined almost everywhere2 , is a lot simpler: ηt(r) + t ′′ (r) = 0, whose obvious solution 3is t(r) = √ 2 cos( √ ηr) and hence, w(s) = -√ 2 sin( √ ηs). Although these are not exactly the sawtooth embedding function of the scalar DC-DM (a.k.a. SCS), we find back at least periodic functions.

If the 'flat-host' assumption holds on the above partition of R, then it also holds on the finer partition

+∞ i=-∞ [ π k √ η i, π k √ η (i+ 1
)), k ∈ N. This gives birth to another fundamental solution t k (r) = √ 2 cos(k √ ηr), whose efficiency per element is k 2 greater. We call the sinusoidal family the set of fundamental solutions t k indexed with integers. Once again, elements of this family are orthonormal:

t k , t ℓ = i 2P i (i+1) π √ η i π √ η cos(k √ ηr) cos(ℓ √ ηr)dr = δ(k -ℓ). (36)

B. The vector case

IV-A uses the cartesian system where the embedding processes in a sample wise manner. We generalize this idea to block based watermarking schemes assuming there exists an integer p dividing n so that

R n = R p × R p • • • × R p and that p S (s) = n/p i=1 p(s (i-1)p+1 , • • • , s (i-1)p+p ). If t (p) is a solution of the fundamental equation in R p with a given efficiency, then t (n) (r) = p/n n/p i=1 t (p) (r (i-1)p+1 , • • • , r (i-1)p+p
) is a solution in R n yielding the same efficiency. This realizes a statistically independent embedding in the sense that the block of p watermark samples only depends on the same block of p host samples. The issue is now on finding solutions t (p) . A usual technique is the separation of variables method in a specific orthogonal coordinate system [START_REF] Moon | Theorems on separability in Riemannian n-space[END_REF].

1) Separation of variables:

Classically, the separation of variables method considers a solution t (p) (r) = p i=1 t ηi (r i ), where each t ηi have to satisfy (33) with their own efficiency η i . The resulting efficiency of t (p) is then η = p i=1 η i . For white Gaussian hosts, this gives birth to an extension of the polynomial family which is indeed based on the multivariate Hermite polynomials, indexed by the n/p-uple k ∈ N p :

H k (r) = n/p i=1 H ki (r i ).
Two different elements of this family are orthogonal for the scalar product [START_REF] Moulin | Data hiding codes[END_REF], even if they share the same efficiency per element. This extension of the polynomial family is illustrated in the following example. If S ∼ N (0, σ 2

x I n ), then ∇p S (r) = -p S (r)r/σ 2

x , and (24) becomes ηt(r)r T ∇t(r)/σ 2 x + ∇ 2 t(r) = 0. JANIS, a zero-bit watermarking scheme heuristically invented some years ago [START_REF] Delhumeau | Improved polynomial detectors for side-informed watermarking[END_REF], [START_REF] Furon | JANIS: Just Another N-order side-Informed Scheme[END_REF], is a fundamental solution. Its detection function is the following one:

t(r) = p n n/p i=1 p j=1 r (i-1)p+j σ x . ( 37
)
Note that r j appears only once in the detection function,

∀j ∈ {1, • • • , n}. It is easy to see that r T ∇t(r) = pt(r)
and ∇ 2 t(r) = 0. Thus, JANIS with order p is a solution to [START_REF] Moon | Theorems on separability in Riemannian n-space[END_REF] provided that ησ 2 x = p. This can be interpreted as follows: this is a block based watermarking scheme built on the p-multivariate Hermite polynomial H (1,••• ,1) . This theoretical framework proves the optimality of the heuristic JANIS scheme.

Separation of variables can be done on another coordinate system. The following spherical coordinate system

(ρ, θ 1 , • • • , θ p-1
) is adapted to isotropic host distributions, ie. p S (s) = f (ρ) with ρ = s :

r 1 = ρ sin θ p-1 sin θ p-2 • • • sin θ 2 sin θ 1 r 2 = ρ sin θ p-1 sin θ p-2 • • • sin θ 1 cos θ 1 r 3 = ρ sin θ p-1 sin θ p-2 • • • cos θ 2 . . . r p-1 = ρ sin θ p-1 cos θ p-2 r p = ρ cos θ p-1 .
For instance, we seek a function t(r) = t(ρ, θ p-1 ) = U (ρ)V (θ p-1 ), which depends on two simple statistics ρ = p i=1 r 2 i and θ p-1 = arccos(r T e p / r ). e p is a secret unit vector shared by the embedder and the detector taken as the p-th element of the canonical basis (ie. in the cartesian coordinate system). Separating variables in [START_REF] Balado | New geometric analysis of spread-spectrum data hiding with repetition coding, with implications for side-informed schemes[END_REF] yields two equations:

KV (θ) + (p -2) cot θV ′ (θ) + V ′′ (θ) = 0 (38) (ηρ 2 -K)U (ρ) + (p -1)ρ + ρ 2 f ′ (ρ) f (ρ) U ′ (ρ) + ρ 2 U ′′ (ρ) = 0 (39) January 12, 2007 DRAFT with K ∈ R. The choice U (ρ) = k t ρ 2 and V (θ) = p cos 2 θ -1 is a solution provided f ′ (ρ)/f (ρ) = -ρ/σ 2
x (white Gaussian host), K = 2p and ησ 2 x = 2. The detection function is then

t(r) = k t ( √ pr T e p ) 2 -r 2 = 1 σ 2 x 2p(p -1) (p -1)r 2 p - p-1 i=1 r 2 i . (40)
t(r) = τ defines a p-dimensional two-sheet hyperboloid. This is closed to a two-sheet hypercone, acceptance region of the absolute normalized correlation, which is the optimum detection function based on such simple statistics for Gaussian white host [START_REF] Merhav | Optimal watermarking embedding and detection strategies under limited detection resources[END_REF]. We agree here with N. Merhav and E. Sabbag that the acceptance region must be a two-sheet geometric form contrary to the well-known normalized correlation and its one-sheet hypercone [START_REF] Cox | Digital Watermarking[END_REF]. Yet, neither the absolute normalized correlation nor the famous normalized correlation are fundamental solutions. We suppose that this stems from the difference in the models of the perceptual constraint: fixed embedding power vs.

random small and positive gain. Eq.( 40) is however not unknown in the watermarking literature. This is the measure of robustness given in Cox et al. book [1, Eq.(5.13)].

Let us now invent a host such that

P (s ∈ B p (R)) =      R/R 0 , if R ≤ R 0 1 , if R > R 0 .
This extension of the one dimension uniform distribution (in the sense that, in one dimension, a uniform distribution gives a linear cumulative distribution function over the interval B 1 (R)) implies that its isotropic pdf equals f (ρ) = ρ 1-p /R 0 , if 0 < ρ < R 0 (0, else). A solution in the form t(r) = U (ρ) must then satisfy ηU (ρ) + U ′′ (ρ) = 0, whose solutions are as follows:

t (a) (ρ) = 2surf(S p (1)) cos( √ ηρ) with √ ηR 0 = 0 [π], (41)
t (b) (ρ) = 2surf(S p (1)) sin( √ ηρ) with √ ηR 0 = 0 [2π]. (42)
surf(S p (1)) is the surface area of the p-hypersphere of unit radius: surf(S p (1)) = 2π p/2 /Γ(p/2). This solution looks like the sphere hardening dither modulation scheme invented by F. Balado [START_REF] Balado | New geometric analysis of spread-spectrum data hiding with repetition coding, with implications for side-informed schemes[END_REF]Sect. 5].

2) Sparsity: Many possible coordinate systems allow a separation of variables [START_REF] Moon | Theorems on separability in Riemannian n-space[END_REF], but their investigation is out of the scope of this paper. Preferably, we would like here to rediscover a famous principle in watermarking.

Suppose we know a solution t ⋆ to the scalar equation:

η ⋆ t ⋆ (x) + f (x)t ⋆′ (x) + t ⋆′′ (x) = 0.
We would like to extend this solution considering a solution in the form: t = t ⋆ • g, with g : R p → R a differentiable function. Gradient and Laplacian have the following expressions:

∇t(r) = t ⋆′ (g(r))∇g(r), ∇ 2 t(r) = t ⋆′′ (g(r)) ∇g(r) 2 + t ⋆′ (g(r))∇ 2 g(r). ( 43
)
and the fundamental equation becomes:

t ⋆′ (g(r)) - η η ⋆ f (g(r)) + ∇p S (r) T p S (r) ∇g(r) + ∇ 2 g(r) + t ⋆′′ (g(r)) ∇g(r) 2 - η η ⋆ = 0 (44)
A linear form, ie. a projection g(r) = r T λ, is a solution providing the following simplifications: ∇ 2 g(r) = 0 and ∇g(r) = λ . Then, t is a fundamental solution with an efficiency per element η = η ⋆ λ 2 , provided we have:

January 12, 2007 DRAFT ∇p S (r) T p S (r) λ = λ 2 f (r T λ). (45)
For a white Gaussian host, this implies that f (x) = -x λ -2 σ -2 x , which is the score (ie. p ′ (x)/p(x)) associated to N (0, λ 2 σ 2

x ). Hence, the polynomial family is extended to the vector case with fundamental solutions of the form t k (r) = κ k H k (r T λ/ λ σ x ) whose efficiency per element is η = k/σ 2

x . For the flat host assumption, f appears to be the null function. Hence, the sinusoidal family is extended to the vector case with fundamental solution of the form t(r) = k t cos(r T λ) whose efficacy is η = λ 2 . This kind of solutions illustrates the principle known as sparsity or time sharing [ 3) Space partitioning: Under the flat host assumption, [START_REF] Balado | New geometric analysis of spread-spectrum data hiding with repetition coding, with implications for side-informed schemes[END_REF] reduces to the well known Helmholtz equation: ηt(r) + ∇ 2 t(r) = 0. Suppose t ⋆ is a solution, then the composition of this function by a translation operator yields another solution: t 0 (r) = t ⋆ (rr 0 ). This property is due to the fact the score ∇p S (r)/p S (r) is invariant by translation since it is null. One can also mix different solutions defined over a specific region C i ⊂ R p : t(r) = i t i (r)Π i (r), with Π i (.) the indicator function of region C i . Assume now, that regions {C i } constitute a partition of R p and that the host pdf is a piecewise constant function such that p s (s) = i P i Π i (s). Then, the above mixture is a solution of the fundamental equation, except on the boundaries of contiguous regions where the gradients of p S and t are a priori not defined.

An elegant way to set a partition is to define the regions as the Voronoi cells of a p-dimension lattice Λ:

C i = V + c i , c i ∈ Λ
and V the Voronoi cell centered on 0. With all these elements, we can write:

t(r) = i t i (r)Π i (r) = ci∈Λ t ⋆ (r -c i )Π i (r) = t ⋆ (r -Q(r)), (46)
with Q(.) the quantization function mapping R p onto Λ.

Under the flat host assumption, sparsity and space partitioning indeed give the same extension of the sinusoidal family: t k (r) = √ 2 cos(r T λ k ), when vector λ k is defined by 2πG -T k, with G the generator matrix of lattice Λ and k ∈ N p . r belonging to C i , means that r = c i + r = Gn i + r, with n i ∈ Z p and r ∈ V. Thus, t(r

) = t(r) because n T i k ∈ Z, ∀(k, n i ) ∈ N p × Z p . This gives η = λ k 2 = 4π 2 G -T k 2 .
Once again, this is not exactly the lattice quantizer based watermarking scheme, but at least we find back solutions which are periodic with respect to a lattice.

To conclude, the goal of this section is to show that several well-known watermarking schemes are indeed solutions of the fundamental equation, underlying the unifying character of this theoretical framework.

V. CONDITIONS, LIMITATIONS, AND EXTENSIONS

A. Conditions

Many assumptions have been made to derive the fundamental equation and we would like to collect and state them explicitly in this section before providing some limitations and extensions.

January 12, 2007 DRAFT First, at the embedding side, the model of the perceptual constraint is based on the masking phenomenon, modeled as a perceptual gain θ. Whereas this article focuses on a scalar gain for sake of simplicity, in practice, it is likely to be a vector of positive and small values locally adapting the power of the watermark signal to the power of the masking effect. The main fact is that this gain is unknown when generating the energy constrained signal w(s), and unknown at the detection side. This model is quite different than the classical power or energy constraint, which imposes a fixed amount of embedding distortion.

Second, in this paper, schemes are claimed optimal if they maximize the efficiency per sample. This meaning of optimality only holds when the Pitman Noether theorem can be applied, ie. for schemes fulfilling the following regularity assumptions [11, Sect. III.C.3]:

• The energy of the watermark signal and the variance of the tested statistic must be bounded. Without of loss of generality, we impose E S { w(s) 2 } = n and E R {t(r) 2 } = 1.

• The smoothness conditions on the density p(.|H 1 ) as a function of θ and on the non-linearity t(.) such that Eq. ( 5) holds,

• The convergence in law of the statistic t(R) to a normal variable under both hypothesis.

Moreover, we also restrict our study to detection functions defined in R n at least twice differentiable except on a zero-measure set to get the existence of its gradient and Laplacian. Then, the above study can be summarized in the following proposition.

Proposition 1: Suppose a zero-bit watermarking scheme based on the embedding and detection functions {w(.), t(.)} satisfies the above-mentioned conditions. Then, this scheme is optimal for a given efficacy η and when there is no attack, if and only if t(.) is a solution of the fundamental equation ( 24) and w(s) = k w ∇t(s), ∀s ∈ R n .

The convergence in law to a normal variable is a very restrictive condition. When the host samples are i.i.d. (or blocked based i.i.d.), a block based embedding gives an elegant solution because its matched detection function is the sum of n/p i.i.d. random variables. The parameter p must be fixed to ensure the asymptotic normality by the central limit theorem (as E{t (p) (r) 2 } < +∞).

Proposition 2: The principle of block based embedding gives birth to two important families of detection functions: sums of p-multivariate Hermite polynomials for white Gaussian hosts, and sums of cosine functions periodically defined on p-dimension lattices for flat hosts. Both families gather orthonormal functions for the scalar product defined by [START_REF] Moulin | Data hiding codes[END_REF].

B. Limitations

The Pitman Noether theorem states that the efficacy is a criterion for optimality only asymptotically. This makes sense in our study because the watermark signal is deeply embedded in the host, thus requiring spreading of the mark on long sequences. In the same way, efficacy is very useful in applications such as passive sonar and radio astronomy, also dealing with weak signals and long integration times.

Our framework nicely gives a unified theory gathering many known watermarking schemes. However, all new fundamental solutions may not be adequate for practical implementations where host signals are not so long, or θ January 12, 2007 DRAFT is not so small. We foresee at least two reasons:

• When θ is not so small, the variance under H 1 grows very fast with the efficacy, as shown in Appendix II and in Table IV-A.1.

• The Berry-Esseen theorem shows that the rate of convergence to the normal distribution depends on the third moment of t(.), which we suspect to be fast increasing with the efficacy.

A proper study requires a non asymptotic analysis of the performances which is out of the scope of this article. Some experimental works can be found in literature. For instance, the p-multivariate Hermite polynomial based family of detection functions has been already experimentally tested under the abbreviation JANIS: in [START_REF] Furon | JANIS: Just Another N-order side-Informed Scheme[END_REF], the efficacy is given by the order of the JANIS scheme, ie. η = p. The ROC curve (ie. P p = P p (P f a ) for a given embedding gain)

and the 'power' curve (ie. P p = P p (θ) for a given P f a ) are largely improved compared to performances of spread spectrum watermarking scheme (see respectively Fig. 3 and Fig. 4 in [START_REF] Furon | JANIS: Just Another N-order side-Informed Scheme[END_REF]). However, for a given vector length, the comparison of the performances based on a normal distribution of the tested statistic with the experimental measurements clearly mismatch as the efficacy increases and as the parameter θ increases. Hence, whereas the central limit theorem proves the asymptotic convergence in law needed in the theoretical framework, in any case, it shall not be used to estimate performances in practice. Another lesson learnt from [START_REF] Furon | JANIS: Just Another N-order side-Informed Scheme[END_REF], is that a scheme with a higher efficacy can perform more poorly than another one in an non asymptotic regime. In Fig. 3 of [START_REF] Furon | JANIS: Just Another N-order side-Informed Scheme[END_REF], the scheme with p = 5 yields a higher power than the one with p = 4 only if P f a > 10 -3 , with n = 2400 for both schemes.

Whereas this study provides a somewhat elegant, constructive and unifying theoretical framework; unfortunately it doesn't give clear guidelines on the design of a watermarking scheme in an non asymptotic regime.

C. Extension to asymmetric tests

So far, the main idea of the paper is to take advantage of the knowledge of the host value s to boost the efficiency per element. This results in the increase of E R {t(r)|H 1 } = θ √ nη + O(θ 2 ), while the variance Var{t(r)|H 1 } is maintained at the level of Var{t(r)|H 0 } at least to the first order. Asymptotically, the test has to make a clear cut between two distributions having the same variance. This is sometimes called a symmetric test. This subsection focuses on the variance Var(t(r)|H 1 ). As H. Malvar and D. Florencio did for zero-rate watermarking [START_REF] Malvar | Improved spread spectrum: A new modulation technique for robust watermarking[END_REF], we would like to control the value of Var(t(r)|H 1 ), achieving so-called asymmetric tests 4 .

The watermark signal is already dependent to the host through the vector w(s) which pushes the host towards a region in space where the detection function has a higher value, ie. hopefully the acceptance region. We add here another dependence which modulates the amplitude of this vector: host signals which are naturally far away from the acceptance region are more strongly pushed than those near the acceptance region. We write the watermark signal

x(s) = θk w (s)w(s). For a fair comparison with the previous sections, the constraint reads: E S {k w (s) 2 w(s) 2 } = n. The embedding strategy is not changed: w(s) = ∇t(s). Hence, we have:

n = E S {k w (s) 2 ∇t(s) 2 } (47) ∂ ∂θ E R {t(r)|H 1 } θ=0 = E S {k w (s) ∇t(s) 2 } (48) η = E S {k w (s) ∇t(s) 2 } 2 E S {k w (s) 2 ∇t(s) 2 } (49)
Now, the goal is to choose function k w such that it reduces the variance under H 1 :

∂ ∂θ Var{t(r)|H 1 } θ=0 = 2E S {t(s)ν(s)} ≥ -2Var{ν(s)}, (50)
where

ν(s) = k w (s) ∇t(s) 2 such that its centered version is ν(s) = ν(s) -∂ ∂θ E R {t(r)|H 1 } θ=0 .
The Cauchy-Schwarz inequality gives -2Var{ν(s)} as the lower bound, with equality when ν(s) = -ct(s), c a positive constant. Hence, we achieve to reduce Var(t(r)|H 1 ). However, this strategy consumes embedding distortion:

n = E S {k w (s) 2 ∇t(s) 2 } = E S {ν(s) 2 ∇t(s) -2 } = c 2 E S {t(s) 2 ∇t(s) -2 } + nηE S { ∇t(s) -2 } -2c √ nηE S {t(s) ∇t(s) -2 }. ( 51
)
For the simple cases explored in this paper, we are able to find a bijection

s ′ = h(s) such that p S (s ′ )t(s ′ ) ∇t(s ′ ) -2 = -p S (s)t(s) ∇t(s) -2 , which implies a third null term. Denote a = E S {t(s) 2 ∇t(s) -2 } and b = E S { ∇t(s) -2 }.
(51) finally reads:

n = ac 2 + bnη. (52)
A higher c decreases Var{t(r)|H 1 } (first order approximation) but also η due to the distortion constraint. In practice, this strategy brings a crucial issue. Starting from a tested statistic having a symmetric distribution under both hypotheses, a decrease of Var{t(r)|H 1 } yields a higher power of test only if E R {t(r)|H 1 } is greater than threshold τ > 0. Now, if this is not the case (for instance, due to an attack), then the impact of this strategy is just the opposite. This phenomenon does not appear in [START_REF] Malvar | Improved spread spectrum: A new modulation technique for robust watermarking[END_REF], as this article tackles watermark decoding where threshold τ equals 0, the distributions under H 0 (bit 1 has been hidden) and H 1 (bit 0 has been hidden) being symmetric around this value.

Experimental works about this variance reducing embedding strategy applied to the JANIS scheme are summarized in [START_REF] Delhumeau | Improved polynomial detectors for side-informed watermarking[END_REF]Sect. 6.4]. It stresses the difficulty in finding an appropriate value of c because it requires to foresee an attack scenario and its impact on the expectation of the tested statistic. The final rule applied in this experimental paper is to set c to the value which maximizes the Gaussian estimation of the power of test (which is, once again, a very poor estimation). Results are mitigated and more complex embedding strategies are investigated in [START_REF] Delhumeau | Improved polynomial detectors for side-informed watermarking[END_REF]Sect. 6.4].

VI. ATTACK NOISE

When there is an attack, the received signal under H 1 is r 1 = a(y). The attack channel a is defined through a conditional probability distribution p a (r 1 |y), whose associated attack power is

σ 2 a = r 1 -y 2 p a (r 1 |y)p Y (y)dydr 1 /n.
The parameters of the attack channel are unknown at the detection side. We would like to keep the detection as January 12, 2007 DRAFT simple as possible so that the estimation of these parameters is not tractable in this strategy. The performance of the detector should degrade slowly with the strength of the attack, according to the definition of robust watermarking

given in [START_REF] Kalker | Considerations on watermarking security[END_REF].

The Pitman Noether might then become useless because there is a disruption between the two hypotheses: H 1 doesn't asymptotically converge to H 0 , in the sense that the regularity conditions ( 5) are violated due to the presence of the attack channel only under H 1 .

We present here two ways to tackle this problem, changing our framework in order to enforce the Pitman Noether theorem. A first idea is to restrict our analysis to a fixed WNR (watermark to noise power ratio): θ 2 n /σ 2 a = g. The received signal can be written as:

r 1 = s + θ n w(s) + θ n g -1/2 z, with E { z 2 } = n.
Therefore, the power of the difference signal r 1r 0 asymptotically vanishes with θ 2 n . The second idea considers attacks with fixed DNR (document -ie. host-to noise power ratio) where signals are corrupted by the same attack under both hypotheses as T. Liu and P. Moulin did [START_REF] Liu | Error exponents for one-bit watermarking[END_REF]. Yet, the targeted applications as described in our introduction do not a priori motivate this possibility because the attack of unprotected contents under H 0 are clearly unlikely. We argue that a 'soft' attack on original pieces of content still produces regular content. The attack channel changes the value of the feature vectors, but it does not modify their inherent statistical structure.

Under both attack models, the fundamental equation appears to be statistically robust in the sense that it is not modified by the presence of the attack channel. However, this is only true for very particular conditions as described in the sequel.

A. Fixed WNR attacks

This subsection only shows that the fundamental equation remains unchanged when the watermarked signals goes through a fixed WNR AWGN attack channel.

1) Best embedding function for a given detection function:

As usual, we write:

∂ ∂θ E R {t(r)|H 1 } θ=0 = ∂ ∂θ t(s + θw(s) + θ √ g z) θ=0 p S (s)p Z(z)dsdz (53) = w(s) T ∇t(s)p S (s)ds + √ gz T ∇t(s)p S (s)p Z(z)dsdz (54)
We assume z is independent of s and centered, so that the second term is null. We find back the same best embedder as [START_REF] Moulin | Optimal sparse-QIM codes for zero-rate blind watermarking[END_REF].

2) Best detection function for a given embedding function:

The pdf of r 1 = y + √ gθz is given by the following convolution:

p R1 (r) = p Y (u)p √ gθ Z(r -u)du, (55)
whose derivative is composed of two terms:

∂ ∂θ p R1 (r) θ=0 = ∂ ∂θ p Y (u) θ=0 lim θ→0 p √ gθ Z(r -u)du + p S (u) ∂ ∂θ p √ gθ Z(r -u) θ=0 du (56)
We assume that z is normal distributed. Then, lim θ→0 p √ gθ Z(ru) is the Dirac distribution. Hence, the first term is, as detailed in Sect. III-A, ∂/∂θp Y (r)| θ=0 = -div(p S (r)w(r)).

January 12, 2007 DRAFT

The second term is calculated being inspired by some proofs of the De Bruijn's identity (see [START_REF] Cover | Elements of information theory[END_REF]Th. 16.6.2]).

It corresponds to the derivative of the pdf of a(s) = s + √ gθz with respect to θ. In one hand, we have:

∂ ∂θ p a(S) (r) = p S (u) r -u 2 gθ 3 - n θ p √ gθ Z(r -u)du. (57)
On the other hand, it appears that:

∇ 2 p a(S) (r) = p S (u) r -u 2 g 2 θ 4 - n gθ 2 p √ gθ Z(r -u)du = 1 gθ ∂ ∂θ p a(S) (r). (58)
Finally, the second term is null, because

∂ ∂θ p a(S) (r) θ=0 = lim θ→0 gθ∇ 2 p a(S) (r) = 0, (59)
and we find back the same best detection function as [START_REF] Huber | Robust statistics[END_REF].

B. Fixed DNR attacks

The framework is changed so that the hypotheses are now:

H 0 : r 0 = a(s) against H 1 : r 1 = a(s + θw(s)).
What are the impacts of this new framework on the detection and embedding functions?

As already said, our analysis only holds for channel attacks conserving the statistical structure of the host signal.

The restrictions are as follows. For host s ∼ N (0, I n ), the attack is an SAWGN channel:

a(s) = γ(s + z), with z ∼ N (0, σ 2 z I n ) independent of s and γ = 1/ 1 + σ 2 z .
The attack is a Wiener filtering for this very simple case, which maintains p(r|H 0 ) as a normal distribution. For the flat host assumption, the attack is an addition of an independent noise: a(s) = s + z. The new expression of p(r|H 0 ) is given by a convolution, which renders the pdf under H 0 even flatter and larger. Consequently, at the scale of the watermarking signal, p(r|H 0 ) is still a piecewise constant function. The expression [START_REF] Vincent Poor | An introduction to signal detection and estimation[END_REF] of the best detection function given the embedding function is not modified when restricting to attack channels preserving p(r|H 0 ). This is not the case for the best embedding function given the detection function. For the class of attack channel considered in this paper, we can write a(s) = γ(s+z) with γ = 1 for the additive noise attack, and γ = 1/ 1 + σ 2 z for the SAWGN attack. ( 18) is then modified as follows:

∂ ∂θ E R {t(r)|H 1 } θ=0 (γ, σ z ) = ∂ ∂θ t(γ(s + θw(s) + z)) θ=0 p Z (z)p S (s)dzds (60) = γw(s) T ∇t(γ(s + z))p Z (z)dz p S (s)ds. (61)
This last equation shows that the best strategy at the embedding side should set

w(s) ∝ E Z {∇t(γ(s + z))}. ( 62
)
This implies that the embedder knows the attack channel parameters. This counter attack may not be realistic in general, and we keep our former strategy given by [START_REF] Moulin | Optimal sparse-QIM codes for zero-rate blind watermarking[END_REF], so that

η(γ, σ z ) = γ 2 η(1, 0) n 2 (E S {w(s) T E Z {w(γ(s + z))}}) 2 . ( 63
)
January 12, 2007 DRAFT However, there are some cases where the counter attack (62) is surprisingly simple because it is indeed identical to the regular embedding strategy [START_REF] Moulin | Optimal sparse-QIM codes for zero-rate blind watermarking[END_REF] whatever the parameters of the attack channel. This occurs when t is such that E Z {∇t(γ(s + z))} = h(γ, σ z )∇t(s). As a consequence, the fundamental equation ( 25) derived in the no attack case, remains valid under these particular attack cases. The efficiency per element is then equal to

η(γ, σ z ) = γ 2 h 2 (γ, σ z )η(1, 0).
For the polynomial family, we rewrite the Wiener filtering denoting z = σ -1 z z distributed as N (0, 1) and α = arccos(γ). A less familiar identity of the Hermite polynomials allows to write:

t ′ ℓ (γ(s + z)) = κ ℓ ℓH ℓ-1 (cos(α)s + sin(α)z) = κ ℓ ℓ ℓ-1 k=0 ℓ-1 k cos k (α) sin ℓ-1-k (α)H k (s)H ℓ-1-k (z) (64)
E Z {t ′ ℓ (γ(s + z))} reduces to E Z {t ′ ℓ (γs + σ z γ z))} = κ ℓ ℓγ ℓ-1 H ℓ-1 (s) = γ ℓ-1 t ′ ℓ (s) because E Z {H k (z)} = δ(k)
. Consequently, we can state the following proposition: Proposition 3: The polynomial family is a set of fundamental solutions for i.i.d. Gaussian hosts and SAWGN attacks with Wiener filtering, whose efficiency per element is given by η(γ, σ z ) = ℓγ 2ℓ . Wiener filtering means that γ = (1 + σ 2 z ) -1/2 . Two noticeable exemptions are t 1 and t 2 , whose efficiency follows the same rule whatever the value of γ in the SAWGN channel. Last but not least: the higher the 'original' efficiency η(1, 0) = ℓ, the less robust is the scheme in the sense that η(γ, σ z )/η(1, 0) = (1 + σ 2 Z ) -η(1,0) decreases faster with the strength of the attack. For the sinusoidal family, an additive noise leads to

E Z {t ′ ℓ (s + z)} = t ′ ℓ (s)E Z {cos(ℓ √ ηz)} -ℓ 2η cos(ℓ √ ηs)E Z {sin(ℓ √ ηz)}. ( 65
)
The desired property is enable whenever the attack noise has an even pdf which sets the second term to zero. For instance, the AWGN channel gives E Z {t ′ ℓ (s + z)} = t ′ ℓ (s)e -ℓ √ ησ 2 z /2 . Consequently, we can state the following proposition:

Proposition 4: The sinusoidal family is a set of fundamental solutions for flat hosts and additive symmetric noise attacks. For the AWGN channel attack, its efficiency is given by η

(1, σ z ) = ℓ √ ηe -ℓ √ ησ 2 z .
Once again, the higher the 'original' efficiency η(1, 0), the less robust is the scheme in the sense that η(γ, σ z )/η(1, 0) = e -η(1,0)σ 2 z decreases faster with the strength of the attack.

The same analysis also holds for the extension of the polynomial and sinusoidal family to the vector case. For

B. Efficiency of a mixture of fundamental solutions

This section uses the geometric property of III-D to calculate the efficiency per element of a detection function defined by a mixture of fundamental solutions. Suppose a family of orthonormal fundamental solutions {t j } with integer indices (this is easily generalized to indices in N p ), and create the following detection function t(r) = Ω j=1 ω j t j (r). We have:

E R {t(r)|H 0 } = Ω j=1 ω j E R {t j (r)|H 0 } = 0, Var{t(r)|H 0 } = Ω j=1 ω 2 j = 1. (70)
The last equation gives a constraint on the weights {ω j }.

The reader must be aware of two facts. First, we have chosen here to mix some detection functions, but we could also do the mixture on the embedding functions. Second, this mixture is a priori not a fundamental solution.

Given this mixture, we select the best embedding function w(s) = k w ∇t(s). However, it is a priori not true that the mixture is the best detection function knowing w(s). The mixture of detection functions implies a mixture of the associated embedding functions, w(s) = Ω j=1 ̟ j w j (s), but with different weights:

̟ j = k w ω j η j (1, 0) and k w = ( Ω j=1 ω 2 j η j (1, 0)) -1/2
(23) gives the efficacy when there is no attack:

η(1, 0) = Ω j=1 ω 2 j η j (1, 0). (71)
(63) gives the following efficiency per element under attack,

η(γ, σ z ) =   Ω j=1 ω j ̟ j η j (γ, σ z )   2 = Ω j=1 ω 2 j η j (1, 0)η j (γ, σ z ) 2 Ω j=1 ω 2 j η j (1, 0) , (72)
if we suppose that E S {w j (s)E Z {w k (γ(s + z))}} = δ(jk)n/γ. η j (γ, σ z )/η j (1, 0), ie. the functions stay orthogonal even under attack. This assumption considerably simplifies the expression of the efficiency. From Sect.

VI-B, we know this holds for the polynomial family (γ = 1/ 1 + σ 2 z ), and for the sinusoidal family (γ = 1), because

E Z {w k (γ(s + z))} ∝ w k (s).
It is quite difficult to compare mixtures of fundamental solutions and to derive the optimum weighting. Let us denote the score g M ({ω j }, γ, σ z ) = η(1, 0)η(γ, σ z ) for a mixture with weights {ω j } and g P (η(1, 0), γ, σ z ) the same score but for a pure fundamental solution whose efficiency is η(1, 0) = Ω j=1 ω 2 j η j (1, 0) when there is no noise 5 . These two scores are equal when there is no noise, otherwise they have the following expressions:

g M ({ω j }, γ, σ z ) = Ω j=1 ω 2 j η j (1, 0)γh j (γ, σ z ) (73) g P (η(1, 0), γ, σ z ) = η(1, 0)γh(γ, σ z ), (74)
where function h is defined in VI-B. If the embedder knows the parameters of the attack noise, then the optimum weighting is given by a simplex optimization: ω j = δ(j -j ⋆ ) with j ⋆ = arg max j η j (1, 0)γh j (γ, σ z ). Otherwise, we set the following criterion: G M ({ω j }) = 1 0 +∞ 0 g M ({ω j }, γ, σ z )dσ z dγ. This represents the average performance of the mixture when no prior about the attack noise parameters is given.

For the sinusoidal family, (72) holds if γ = 1. The integration only made over σ z gives:

G M ({ω j }) = π 2 Ω j=1 ω 2 j η j (1, 0) ≤ π 2 η(1, 0) = G P (η(1, 0)). ( 75
)
The inequality is due to the concavity of the square root function and it holds for any weight distribution. In the same way, for the polynomial family, (72) holds if γ = (1 + σ 2 z ) -1/2 . The integration only made over γ gives:

G M ({ω j }) = Ω j=1 ω 2 j η j (1, 0) η j (1, 0) + 1 ≤ η(1, 0) η(1, 0) + 1 = G P (η(1, 0)). ( 76
)
The inequality is due to the concavity of the function x → x/(1 + x) on [0, +∞) and it holds for any weight distribution.

This tends to show that a pure fundamental solution is on average more robust than any mixture of fundamental solutions. However, this is not a general proof. We have shown this only for the sinusoidal and the polynomial families when considering attacks such that (72) holds and when h(γ, σ z ) has a known expression.

C. Application to DC-DM watermarking

Mixture is a tool which renders the study of some watermarking schemes easier. When applied on elements of the sinusoidal family, this allows to recreate whatever periodic detection function. For instance, the following weights ω j = -(-1) j 3 √ 10/π 2 /j 2 give the Fourier series decomposition of the SCS scheme:

t(s) = - 6 √ 5 π 2 ∞ j=1 (-1) j j 2 cos(j √ ηs) = √ 5 2 -(s -Q(s)) 2 6 √ 5 ∆ 2 (77) w(s) = k w 6 √ 5η π 2 ∞ j=1 (-1) j j sin(j √ ηs) = -(s -Q(s)) √ 12 ∆ (78)
with Q a quantizer whose step is ∆ = 2π/ √ η. The application of (72) gives the efficiency of SCS under an AWGN attack, which is otherwise cumbersome to calculate with the direct expressions of t and w. Here, we simply have:

η SCS (1, σ z ) = 90η π 4 . ( ∞ j=1 j -2 e -j 2 ησ 2 z 2 ) 2 ∞ j=1 j -2 = 60 ∆ 2   1 + 6σ 2 Z ∆ 2 - 3 π 2πσ 2 z ∆ 2 0 ϑ 3 (0, e -πu )du   2 , ( 79
)
where ϑ 3 is the third Jacobi theta function. When there is no attack, η SCS (1, 0) = 60/∆ 2 = 15η/π 2 ≈ 1.52η. Fig.

( ) shows the efficiency per element of SCS with σ z ranging from 0 to 1 for η = 1. It shows that the efficiency per element of a pure sinusoidal function starting from the same value, ie. η SCS (1, 0), is largely more robust in this range of noise. However, when the variance of the noise increases, the asymptotic behavior of (79) is dominated by the first term, j = 1, ie. e -ησ 2 z , whereas the efficiency of the previous pure sinusoidal function has a stronger exponential decay: e -1.52ησ 2 z . In this asymptotic case, a pure sinusoidal function with efficacy η performs better. In the same way, the detection function based on lattice quantizer of Sect. VII-A can be decomposed through a Fourier series over lattice Λ, whose generator matrix is G:

t(r) = I(Λ, 2) + √ 2 k∈N p ω k cos(2πr T G -T k), (80)
with ω k = √ 2vol(V) -1 V r 2 cos(2πr T G -T k)dr. This decomposition in Fourier series may not be easy to obtain except for low dimension lattices. Yet, whatever the resulting weight distribution, the mixture has for η(1, σ z ), g M ({ω k }, γ, σ z ), and G M ({ω k }) equivalent expressions as for the one dimensional case thanks to the common expression of the efficiency as shown in Appendix III. Therefore, the main conclusion is still valid: under an AWGN attack, a pure sinusoidal solution sharing the same efficiency without noise, performs better on average.

VIII. CONCLUSION

Rewriting classical elements of detection theory with the assumption that the watermark signal depends on the host gives us the expression of the best embedding function knowing the detector. Coupling this result with the expression of the LMP test gives a partial differential equation we named 'fundamental equation' of zero-bit watermarking. Its main advantage is to offer a constructive theoretical framework unifying most of the watermarking schemes the community knows. Moreover, a side product is that the decomposition onto a family of orthogonal fundamental solutions provide an easier way to characterize the performance of DC-DM schemes.

IX. ACKNOWLEDGMENTS

I would like to thank Pedro Comesana Alfaro and the reviewers for their numerous corrections and suggestions of improvement, Sandrine Le Squin and Julie Josse for having compared the results with their numerical simulations, and Arnaud Guyader for numerous discussions about test hypothesis. January 12, 2007 DRAFT

The derivative of (89) gives the elements of matrix ∂J f -1 ∂θ (r, θ): ∂ 2 f -1 i ∂θ∂y j (r, θ) = -∇w i (f -1 (r)) T J f -1 (r, θ)e jθ ∂ ∂θ (∇w i (f -1 (r)) T J f -1 (r, θ)e j ).

(93) So that, these elements are equal to -∇w i (r) T e j when θ = 0, and, finally, B(r) = -p S (r)div(w(r)).

APPENDIX II

MACLAURIN SERIES OF VAR{t(r)|H 1 } WITHOUT ATTACK.

We make the Maclaurin series of t(s + θw(s)) 2 , and take the expectation:

E S {t

A. First order term for even polynomial function

An even polynomial detection function means t(s) = κ k H k (s), with k even and κ k = k! -1/2 (probabilists' definition). Then, t ′ (s) = κ k kH k-1 (s) and w(s) = k w κ k kH k-1 (s) = κ k-1 H k-1 (s). Therefore, E S {w(s)t ′ (s)t(s)} =

κ 2 k κ k-1 kE S {H k (s)H k-1 (s) 2 }.
A known formula of the square of Hermite polynomials is the following one:

H k-1 (s) 2 = k-1 ℓ=0 k-1 ℓ 2 ℓ!H 2k-2-2ℓ (s) (95)
The orthogonality of the Hermite polynomial family allows us to conclude that: (96)

E S {w
The application of the Stirling approximation, when k is large, gives E S {w(s)t ′ (s)t(s)} ≈ 2/e(2π) -3/4 2 3k/2 k -1/4 .

The derivation of the second order term is tackled in the following section.

B. Second order term

In a similar way, we have:

w(s) 2 t ′2 (s) = k (k -1)! 2 k-1 ℓ=0 k-1 ℓ 2 ℓ!H 2k-2-2ℓ (s) 2 , (97)
whose expectation, thanks to the orthogonality feature, simplifies to:

E S {w(s) 2 t ′2 (s)} = k (k -1)! 2 k-1 ℓ=0 k-1 ℓ 4 ℓ! 2 (2k -2 -2ℓ)! (98)
The second term is slightly different:

w(s) 2 t ′′ (s)t(s) = k(k -1) k!(k -1)! H k-1 (s) 2 H k (s)H k-2 (s), (99)

  26, Sect. 5.2 and 8.2], where the watermark embedding is processed on the projection r T λ. A typical implementation of this principle is the Spread Transform Dither Modulation [26, Sect. 5.2].

2 z

 2 instance, JANIS is a solution of the fundamental equation for i.i.d. hosts and SAWGN attack, such that E Z {∇t(γ(s+ z))} = γ p-1 ∇t(s). The Wiener filtering restriction is not necessary as JANIS is based on first order Hermite polynomials. This gives the following efficiency per element η(γ, σ z ) = pγ 2p which follows the same decreasing rule as the scalar polynomial family. The extended sinusoidal family follows the same rule: η(1, σ z )/η(1, 0) = e -η(1,0)σ with η(1, 0) = 4π 2 G -T k 2 as shown in Appendix III.VII. ABOUT DC-DM WATERMARKING BASED ON LATTICE QUANTIZATIONOur theoretical framework doesn't succeed in finding back well known DC-DM watermarking schemes based on lattice quantization, where the detection function is usually defined by an Euclidean distance t(r) = k t Q(r)r 2 , January 12, 2007 DRAFT

Fig. 2 .

 2 Fig. 2. Efficiency per element of the SCS scheme under AWGN attack against σz. The grey plots are the approximations by (79) for jmax = {3, 5, 10, 20, 100}. The dotted line is the efficiency of the sinusoidal solution with η(1, 0) = 1, 52.

1 k/ 2 -1 2 (k/ 2 - 1 )

 12221 (s)t ′ (s)t(s)} = κ 2 k κ k-1 k k-!k! = (k -1)!k! (k/2 -1)!(k/2!) 2 .

  H 2k-2-2ℓ (s) 2k-2-2ℓ (s) , (100) = k 2 k!(k -1)! k-1 ℓ=0 k-1 ℓ 2 ℓ!H 2k-2-2ℓ (s) k-2 ℓ=0 kℓ -1 kℓ k-1 ℓ 2 ℓ!H 2k-2-2ℓ (s) ,(101)January 12, 2007 DRAFT

  (s + θw(s)) 2 } = 1 + 2θE S {w(s)t ′ (s)t(s)} + θ 2 E S {w(s) 2 (t ′ (s) 2 + t(s)t ′′ (s))} + O(θ 3 ). (94)If t is an odd function, then t ′ and w = k w t ′ are even functions. The second term of the series is null. If t is an even function, the second term is not null as shown in Table IV-A.1.

This is the probabilists' definition of Hermite polynomials. However, these polynomials take different forms according to the chosen standardization. For instance, κ k = 1/ √ k! when the coefficient of highest order of H k is set to 1.January 12,

DRAFT

Except on the boundaries due to discontinuities. This has little importance as the probability that the host signal is on a boundary is zero.

The other solution {t(r) = √ 2 sin( √ ηr), w(s) = √ 2 cos( √ ηs)} is valid on a shifted partition i [ π 2 √ η (2i -1), π2√ η (2i + 1)).January 12, 2007 DRAFT

Be careful not to confuse with asymmetric watermarking where the detection key is different from the embedding private key.January 12, 2007 DRAFT

Such fundamental solution might not exist for all weight distributions. For instance, the polynomial family requires that η(1, 0)σ 2 x ∈ N.January 12, 2007 DRAFT

January 12, 2007 DRAFT

This work was supported in part by the French national programme "Securité ET INformatique" under project NEBBIANO, ANR-06-SETIN-009.

and the embedding function x(s) = α(Q(s)s) complies with rule [START_REF] Moulin | Optimal sparse-QIM codes for zero-rate blind watermarking[END_REF]. Parameter α is fixed and it plays a crucial role in the trade-off between the embedding distortion and the inherent robustness of the scheme. Note that our point of view is very different as we suppose that the host signal is pushed in a direction given by w(s) = k t ∇t(s) = 2k t (Q(s)s), but the watermark signal x(s) = θw(s) is not deterministic because the amplitude θ is not fixed.

A. Efficiency without noise

We consider a lattice Λ and a host whose pdf is a piecewise constant function over the partition induced by Λ:

We study the detection function given by t(r) = k t ( Q(r)r 2µ), with Q the quantizer associated to Λ, and {k t , µ} enforcing a centered unit variance tested statistic under H 0 :

I(Λ, k) denotes the k-th normalized moment of V, ie. vol(V) -1 V r k dr. The embedding function is w(s) = 2k w k t (Q(r)r), ie. a vector pointing towards the nearest element of the lattice. Constant k w is given by:

Finally, [START_REF] Cox | Secure spread spectrum watermarking for multimedia[END_REF] gives the following efficiency per element for the noiseless case:

For a positive scale factor β < 1 giving a finer partition induced by βΛ, we have a higher efficiency η βΛ = β -2 η Λ .

Therefore, lattices should be compared for partitions with vol(V) = 1. Anyway, finding the optimal lattice giving the best efficiency is out of the scope of this paper. As an example, for cubic lattice Λ = Z p , V is the centered hypercube [-1/2, 1/2) p and η = 60. For the two dimension hexagonal lattice A 2 , whose associated generating matrix is

θ → 0 makes function f invertible: s = f -1 (y), and p(r|H 1 ) = p S (f -1 (r))|J f -1 (r, θ)|, with the last term being the Jacobian of f -1 . Finally, the detection function is:

Some simple equations are:

A. Expression of A(r)

Deriving this last expression gives:

The elements of the Jacobian matrix are given by:

The simplification taking θ = 0 yields |J f -1 (y, 0)| = 1, and the expression of A is as follows:

B. Expression of B(r)

This term implies the derivative of the determinant of matrix J f -1 (r, θ) which is invertible as θ → 0:

Taking θ = 0 gives:

January 12, 2007 DRAFT whose expectation is

(102)

C. Final expression

Withdrawing the square of E R {t(r)|H 1 } = √ kθ + O(θ 2 ), we get:

Var {t(r)|H 1 } = (103)

APPENDIX III

EFFICACY OF THE EXTENDED SINUSOIDAL FAMILY UNDER AWGN ATTACK

We have ∇t(r) = -√ 2 sin(r T λ k )λ k . Therefore:

The last term is null when the pdf of Z is odd (ie.