High-level description of ANGV

To handle this problem, we follow the approach of digital watermarking [7], [8] and propose a scheme called Active Noise Generation and Verification (ANGV) which is a variant of proof of ownership[2], [3]. Our scheme has several favorable properties:

• Efficiency: noise generation and verification require much lower computational resources compared with the graphics rendering; the total performance of the system is not affected.

• Fidelity: the scheme needs to modify the initial scene so the rendered output will be distorted, but the distortion is human perception sub-threshold.

• Robustness: the embedded noises are robust under rendering enhancements and post-processing operations (e.g. de-noising, anti-aliasing).

• Effectiveness: there is no need to use special rendering software as in the case of FHE.

• Security: without knowing the verification key, attackers need the same computational cost with the rendering to bypass the authenticity verification.

In current digital watermarking schemes for authentication and ownership verification [2], [3], [4], [9] invisible watermarks will be embedded into the digital content needed to be protected. The detector (or verifier) tries to extract the watermark from a tested content, then compares the extracted watermark with the original embedded one, if the comparison is passed then the content is authenticated.

However, in the context of Inferix's rendering network, the manager has access to the image only after the graphics scene has been rendered by workers. It is nonsense to embed watermark into the image at this point since the watermarking cannot help to detect any malicious manipulations which may happen before that, i.e. in the rendering process. Our approach is to embed watermarks into the graphics scene submitted by users before sending it to workers. The Active Noise Generation and Verification scheme consists of two algorithms as described below.