Resistance of digital watermarks to collusive attacks

In digital watermarking (also called digital fingerprinting), extra information is embedded imperceptibly into digital content (such as an audio track, a still image, or a movie). This extra information can be read by authorized parties, and other users attempting to remove the watermark cannot do so without destroying the value of the content by making perceptible changes to the content. This provides a disincentive to copying by allowing copies to be traced to their original owner. Unlike cryptography, digital watermarking provides protection to content that is in the clear. It is not easy to design watermarks that are hard to erase, especially if an attacker has access to several differently marked copies of the same base content. Cox et al. (see IEEE Trans. on Image Processing, vol.6, no.12, p.1673-87, 1997) have proposed the use of additive normally distributed values as watermarks, and have sketched an argument showing that, in a certain theoretical model, such watermarks are resistant to collusive attacks. Here, we fill in the mathematical justification for this claim.