Two-Stage Robust Lossless DWI Watermarking Based on Transformer Networks in the Wavelet Domain

Abstract

For copyright protection of diffusion-weighted imaging (DWI) images, traditional robust watermarking techniques result in irreversible distortions, while reversible watermarking methods exhibit poor robustness. We propose a two-stage lossless watermarking algorithm based on a Transformer network to solve this problem. The first stage of the algorithm is to train the robust watermarking network, embed the watermark into the cover image in the wavelet domain, and design the frequency information enhancement module to improve the reconstruction quality. In the second stage, based on the pre-trained robust watermarking network, the difference image between the watermarked image and the cover image is reversibly embedded into the watermarked image as the compensation information to losslessly recover the cover image. The difference image is compressed using DCT and Huffman coding to reduce the compensation information. Finally, the watermark extraction network is trained on the second embedding result to avoid weakening the robustness of the first stage caused by the reversible embedding. The experimental results demonstrate that the PSNR of the watermarked image reaches 60.18 dB. Under various types of image attacks, the watermark extraction BER is below 0.003, indicating excellent robustness. The cover image can be recovered losslessly under no attack.

1. Introduction

Due to medical imaging technology’s continuous development and maturity, digital medical images play an increasingly important role in hospital diagnostic and therapeutic information. Among them, diffusion-weighted imaging (DWI) [1] is a non-invasive imaging technique that can observe the diffusion motion of water molecules within tissues. As a four-dimensional medical image, DWI is widely used to diagnose diseases such as neurology, cardiology, breast cancer, hepatology, and cervical myelopathy. With the continuous rise in medical costs, remote medical care has become an economically efficient and convenient diagnosis and treatment mode, attracting more and more attention and applications. Remote consultations and surgeries have been widely implemented domestically and internationally in hospitals, and a large amount of digital medical imaging data is transmitted on the public network. As medical images contain patient health information and privacy, the direct dissemination of unprotected medical images on the public network can easily be misused and tampered with by unauthorized users, leading to problems such as patient information leakage, medical misdiagnosis, and copyright disputes. In order to effectively protect the copyright information of medical images, digital watermarking technology has become an essential means of protecting the copyright of digital medical images.

In medical diagnostics, applying digital watermarking techniques for copyright protection requires meeting specific requirements, including ensuring the integrity of medical image data and the robustness of the watermark. Traditional robust watermarking algorithms [2,3,4] can correctly extract watermarked information for copyright authentication under various types of image attacks, but they inevitably cause distortion loss to the cover image. Reversible watermarking algorithms [5,6,7], on the other hand, focus on lossless embedding and extraction of watermarked information, but they exhibit weaker resistance to attacks and are susceptible to common attack methods. Vulnerable watermarking [8] is capable of tamper detection and localization for protected images, but cannot extract watermarked information for copyright authentication when under attack. For medical images, the distortion caused by robust watermarking methods, the vulnerability of reversible watermarking to various attacks and the low robustness of vulnerable watermarking are unacceptable. This has prompted researchers to develop a new watermarking method that combines robustness and reversibility.

In recent years, robust reversible watermarking algorithms have emerged by integrating robust watermarking and reversible techniques. These algorithms achieve lossless recovery of cover images and robustness of watermarks, thereby better fulfilling the requirements for copyright protection of medical images. Coltuc [9] first proposed a lossless robust watermarking algorithm based on a two-stage watermarking scheme (TSW). In this algorithm, the watermark information is first embedded into the DCT coefficients of the image to generate a robust watermarked image. Then the data required to recover the cover image is used as compensation information and embedded into the watermarked image using a reversible watermarking algorithm. Wang et al. [10] improved the conventional TSW framework by proposing embedding the watermark and compensation information into two independent regions to avoid the negative impact of the second embedding on the first embedding. Liu et al.  [6] used recursive jitter modulation to achieve reversible information embedding and provided a reliable solution for image authenticity protection using Slantlet transform and singular value decomposition. Hu et al. [11] designed a new quantization watermarking strategy to embed robust watermarks into the extreme harmonic transform matrix, obtaining the ability to resist geometric distortion. Furthermore, quantization errors, watermark errors, and rounding errors to represent the differences between the cover image and the watermarked image can reduce the compensation information required to restore the cover image. Hu et al. [12] proposed a new lossless watermarking method for cover images that effectively embeds the watermark into low-order Zernike moments and embeds the distortion caused by the robust watermarking as compensation information to be reversibly hidden in the watermarked image.

Traditional robust lossless watermarking algorithms possess certain robustness and visual quality. However, most of them are designed to address specific types of image attacks and lack scalability. They become inadequate when the watermarked image is subjected to new noise attacks. In contrast, deep learning-based robust watermarking algorithms achieve robustness against such attacks by training on existing models. This paper proposes a two-stage robust lossless watermarking algorithm for DWI images based on deep learning to address the issues above. In the first stage, a robust watermarking framework combining wavelet transform and Transformer is employed to accurately extract the watermark information for copyright authentication, achieving robustness against various types of image attacks. Additionally, the reconstructed watermarked image exhibits excellent visual quality. In the second stage, reversible watermarking techniques embed the compensation information and image hash value into the watermarked image. The image hash value is utilized to detect whether the protected image has been attacked, and under the condition of no attack, the compensation information allows for lossless recovery of the cover image, ensuring the integrity of medical image data. The major contributions of this study are as follows.

(1)

We propose a two-stage robust lossless DWI watermarking framework based on deep learning in the wavelet domain. Separate branching networks are designed for different frequency bands, which can effectively reduce inter-frequency conflicts and improve the image reconstruction quality and robustness of watermarking.

(2)

In the watermark embedding network, we design a frequency-enhanced attention module using both low- and high-frequency information, and this approach effectively integrates multi-frequency features to improve the reconstruction performance.

(3)

Compared with other algorithms our proposed algorithm achieves better image reconstruction quality and watermark robustness.

The remainder of this paper is structured as follows. Section 2 introduces the related work. In Section 3, the proposed method is described. In Section 4, the experiments are described, and the experimental results are discussed. Finally, the conclusions of this paper are drawn in Section 5.

2. Related Works

2.1. Diffusion-Weighted Imaging

DWI [1] is currently the only non-invasive method to observe the movement of water molecules inside living tissues. DWI images have diffusion gradient fields in six or more directions to obtain the fibre orientation of an organ under different diffusion gradient fields, derived from two-dimensional cross-sections of multiple faults under different dispersion gradient directions. A DWI image can be represented as $I_D(x,y,s,d)$ and is a piece of four-dimensional data. The first two dimensions $f_i(x,y)(i\in [1,s\times d])$ represent organ cross-sections, the third dimension s indicates the tomograph, and the fourth dimension d indicates the direction of the dispersion gradient. As shown in the Figure 1, N denotes the number of diffuse gradient directions, and M denotes the number of two-dimensional cross-sections.

2.2. Robust Watermark

Robust watermarking algorithms based on deep learning have become a popular research topic due to their excellent image reconstruction quality and robustness. Zhu et al. [13] first proposed a framework for robust watermarking algorithms based on deep learning, comprising four components: watermark embedding network, attack network, watermark extraction network, and generative adversarial network (GAN). Later, Ahmadi et al. [14] proposed a fully convolutional neural network with residual structure, improving the imperceptibility and robustness of watermarking. Luo et al. [15] used a multilayer convolutional neural network to model the geometric or noise attacks that may be encountered in digital images and trained the convolutional neural network using adversarial training to improve the robustness of the model to unknown distortions and indistinguishable distortions. Liu et al. [16] proposed a watermark embedding framework with staged training, achieving a robustness to signal processing attacks and geometric attacks while ensuring the visual quality of the image.

The above algorithms all focus on the study of robust watermarking algorithms for natural images. Fan et al. [17] proposed a robust watermarking scheme for DWI images in medical images by combining global and local features for image reconstruction and embedding watermark redundancy into the features of multi-scale reconstruction. Chacko et al. [18] proposed a combination of a discrete cosine transform and a deep learning convolutional neural network. The DCT-transformed cover image and the IF coefficients of the watermark were used as inputs to a DLCNN for watermark embedding. Dhaya et al. [19] proposed a lightweight convolutional neural network using pre-trained network parameters to reduce the time to reconstruct the watermarked image and extract the watermark, achieving high robustness to geometric attacks. Chen et al. [20] proposed a copyright watermark recognition model based on deep learning techniques to replace the traditional copyright authentication algorithm based on error rate and normalized equivalence similarity estimation.

2.3. Discrete Wavelet Transform

The 2D discrete wavelet transform [21] (DWT) is a method for decomposing a 2D signal into different frequency components. It can separate an image into low- and high-frequency parts, allowing for image compression, de-noising, and feature extraction. The basic idea is to decompose the signal into multiple scales and different directional wavelet sub-bands, separating the local and global features of the signal for practical analysis and processing.

The Haar wavelet [22] is the simplest discrete wavelet transform and is the foundation for other wavelet transforms. Compared to other discrete wavelet transforms, the Haar wavelet has lower computational complexity, making it suitable for applications with high computational requirements. The first-level decomposition of the Haar wavelet divides an $N\times N$ matrix into four sub-matrices of size $N/2\times N/2$, representing the low-frequency information $L{L}_1$ that preserves the cover image content, the vertical high-frequency information $L{H}_1$, horizontal high-frequency information $H{L}_1$, and diagonal high-frequency information $H{H}_1$. Based on the first-level decomposition, the low-frequency information $L{L}_1$ can be used as the input for the next level of decomposition, resulting in four sub-matrices $L{L}_2$, $L{H}_2$, $H{L}_2$, and $H{H}_2$. The second-level decomposition and reconstruction process of the Haar wavelet for a 2D image is illustrated in Figure 2. For an $N\times N$-sized image I, the decomposition formula for the Haar wavelet can be expressed as follows:

$$\left\{\begin{array}{c}LL(i,j)=\left(I\right(i,2j-1)+I(i,2j\left)\right)/2\hfill \\ LH(i,j)=\left(I\right(i,2j-1)-I(i,2j\left)\right)/2\hfill \\ HL(i,j)=\left(LL\right(2i-1,j)+LL(2i,j\left)\right)/2\hfill \\ HH(i,j)=\left(LL\right(2i-1,j)-LL(2i,j\left)\right)/2\hfill \end{array}\right.(1\le i,j\le N)$$

(1)

3. Proposed Method

3.1. Watermark Frame

The two-stage robust reversible watermarking framework based on deep learning is illustrated in Figure 3. This framework consists of two stages. The first stage is the pre-training of the robust watermarking network, which focuses on pre-training the robust watermark embedding and extraction networks. First, the cover image $I_o$ and original watermark $W_o$ are fed into the watermark embedding network $N_{enc}$ to reconstruct the watermarked image $I_e$. Then, the attack layer network (randomly selecting an attack type and its corresponding parameters) containing the watermarked image and geometric attack methods, used to attack the watermarked image $I_e$, generate the distorted image $I_a$. Finally, the watermark extraction network $N_{dec}$ extracts the watermark information $W_d$ from the distorted image $I_a$.

The second stage involves adding reversible information embedding on top of the first stage’s robust watermarking network. In this stage, the watermark embedding network $N_{enc}$ and extraction network $N_{dec}$ load the pre-trained network parameters from the first stage and fix the watermark embedding network $N_{enc}$ without gradient backpropagation. Reversible information embedding involves using traditional algorithms to reversibly embed the different images between the cover image $I_o$ and the reconstructed watermarked image $I_e$ as compensation information into $I_e$, generating the watermarked image $I_m$. The attack layer network is directly migrated to attack the watermarked image $I_m$, generating the distorted image $I_a^{\prime }$. Finally, the watermark extraction network $N_{dec}$ extracts the watermark information $W_d$ from the distorted image $I_a^{\prime }$.

3.2. Watermark Embedding Network

The above robust watermarking algorithms based on deep learning perform watermark embedding in the spatial domain. However, since DWI images contain rich texture and greyscale information, to preserve their texture details and fibre direction, a two-dimensional discrete wavelet transform (DWT) is adopted to decompose the DWI image into its corresponding frequency components. It performs watermark embedding in the low-frequency part of the DWI image in the wavelet domain. Discrete wavelet transform can decompose the cover image into different spatial and temporal scales and obtain its corresponding frequency components, effectively performing various image processing tasks. Nowadays, discrete wavelet transform is widely used in various computer vision tasks in deep learning research, such as super-resolution reconstruction, style transfer, and quality enhancement. Unlike the literature that directly passes all wavelet frequency information in the image to convolutional layers, the algorithm proposed in this section independently designs network branches for each group of frequency information. It combines the features of other branches to achieve a better reconstruction performance.

The watermark embedding network proposed is shown in Figure 4. The input DWI image is subjected to a two-level discrete wavelet transform to obtain its corresponding wavelet frequency information. The frequency information in the horizontal direction ($L{H}_1$), vertical direction ($H{L}_1$), and diagonal direction ($H{H}_1$) obtained from the first-level wavelet decomposition are combined to represent $F_1$. Similarly, the frequency information in the horizontal direction ($L{H}_2$), vertical direction ($H{L}_2$), and diagonal direction ($H{H}_2$) obtained from the second-level wavelet decomposition are combined to represent $F_2$, and the low-frequency part of the second-level wavelet decomposition is represented as $L{L}_2$. To avoid damaging the texture details and fibre direction of the DWI image, the information in the three frequency bands of $F_1$, $F_2$, and $L{L}_2$ is separately input into three network branches for reconstruction.

Firstly, watermark embedding is performed on the low-frequency information $L{L}_2$ of the image. To enhance the robustness of watermark extraction, the method of multiple redundant embedding was adopted to embed the watermark information and obtain the reconstructed low-frequency information $L{L}_{2e}$. As shown in Figure 5.

Secondly, to transmit the embedded watermark information from the low-frequency information $L{L}_{2e}$ to the high-frequency information, we proposed a low-high-frequency attention (LHFA) block based on frequency information enhancement shown in Figure 6. The low-frequency information $L{L}_2$ in the second-level wavelet decomposition contains global information and important low-frequency components, which are the smooth parts of the cover image. The high-frequency information contains details and local information. By using $L{L}_2$ and the reconstructed low-frequency information $L{L}_{2e}$ as Q and K, respectively, the model can focus more on the important low-frequency components, thereby enhancing the global information and stability of the image. Meanwhile, the content of the high-frequency part $F_2$ is used as V, which can transmit details and local information to the reconstructed frequency band, thereby improving the accuracy and detail expression ability of the image. The frequency information after the LHFA block is subjected to the Transformer block and convolution and then added to the original frequency band $F_2$ content to obtain the reconstructed frequency band $F_{2e}$, completing the transfer of watermark information from low- to high-frequency bands and improving the reconstruction effect and robustness.

Thirdly, similar to the second stage, the high-frequency information $F_2$ and its corresponding reconstructed $F_{2e}$ from the two-level wavelet decomposition are used as Q and K, respectively. The high-frequency information part $F_1$ from the first-level wavelet decomposition is used as V. The frequency information processed by the LHFA block is then passed through a Transformer block and convolution and then added to the content of the frequency band $F_1$ to obtain the reconstructed frequency band $F_{1e}$. Finally, the reconstructed three frequency bands, $L{L}_{2e}$, $F_{2e}$, and $F_{1e}$, are subjected to a second-level discrete wavelet inverse transform to obtain the watermarked reconstructed image $I_e$. The Transformer block in the network uses a self-attention module [23] as shown in Figure 7.

3.3. Reversible Information Embedding

3.3.1. Difference Image Compression

During the watermark embedding stage, the watermark information $W_o$ is embedded into the cover image $I_o$ to obtain the reconstructed watermarked image $I_e$. To recover $I_o$, the difference image D between $I_e$ and $I_o$ is used as compensation information and embedded into $I_e$ using a reversible watermarking method. Ideally, we can losslessly compress D to obtain its corresponding binary sequence and then reversibly embed it into $I_e$ to obtain the watermarked image $I_m$. In the absence of attacks, the encoded information can be extracted from $I_m$ and decompressed to obtain D for lossless restoration of $I_o$. However, lossless compression of D typically results in a large amount of data, leading to the low visual quality of $I_m$. To reduce the amount of compensation information, We use a combination of DCT transformation and Huffman coding to compress D. Specifically, we divide D into blocks of size $8\times 8$ and apply DCT transformation to each block to obtain the DCT coefficients F, determined by the following equation,

$$\begin{array}{c}{F}_{uv}=\frac{1}{4}C\left(u\right)C\left(v\right)\left[{\sum }_{x=0}^7{\sum }_{y=0}^{7}I\left(x,y\right)cos\left[\frac{\left(2x+1\right)u\pi }{16}\right]cos\left[\frac{\left(2y+1\right)v\pi }{16}\right]\right]\\ where\left\{\begin{array}{c}C\left(u\right)C\left(v\right)=\frac{1}{\sqrt{2}},u,v=0\\ C\left(u\right)C\left(v\right)=1,otherwise\end{array}\right.\end{array}$$

(2)

where $F_{uv}$ represents the coefficient at position $(u,v)$ in the DCT domain, the DC coefficient is the first coefficient $F(0,0)$ after transformation, and the AC coefficients are the remaining coefficients excluding the DC coefficient. Since the values of D are usually small, the DCT coefficients need to be amplified and then quantized using the quantization matrix Q and the scaling factor n, as shown in the following equation.

$$F_q=round\left(\frac{F_{uv}\times 2^n}{Q}\right)$$

(3)

The quantized DCT coefficients $F_q$ and the scaling factor n are Huffman coded to obtain the binary sequence $D_c$, as shown in the following equation.

$$D_c=H\left(F_q,n\right)$$

(4)

where H represents the Huffman coding function. Since quantization is a loss compression process, there may be differences between the decompressed difference image $D^{\prime }$ and D. To eliminate these differences, we calculate the error matrix $e=D-D^{\prime }$ and directly add it to the watermarked image $I_e$ to obtain $I_e^{\prime }$.

3.3.2. Integrity Information

In order to verify whether the marked image $I_m$ has been attacked during transmission, we need to ensure the integrity of the image $I_e^{\prime }$ before reversible embedding. We use the hash value $H_o$ of $I_e^{\prime }$ as the integrity information and embed it into $I_e^{\prime }$ together with $D_c$ using the reversible watermarking method, as shown in Figure 8. When verifying the integrity of $I_m$ after transmission, we first use the same reversible watermarking method to extract $D_c$ and $H_o$. Then, we restore the image ${\tilde{I}}_e^{\prime }$ and calculate its hash value $H_d$. If $H_o$ and $H_d$ are equal, we consider that $I_m$ has not been attacked during transmission, and the cover image can be restored losslessly. Otherwise, it indicates that $I_m$ has been attacked during transmission, resulting in a permanent loss of restoration information. In this case, we can directly extract the watermark information from the distorted image $I_a^{\prime }$ for copyright verification.

We adopted a generic reversible algorithm framework and traditional reversible watermarking methods such as histogram modification (HM) [24], pixel value ordering (PVO) [25], difference expansion (DE) [26], and prediction error expansion (PEE) [27] techniques. In this paper, we specifically used difference expansion. The details of directly extracting a robust watermark or restor ing the cover image are presented in Section 3.5 and Section 3.6, respectively.

3.4. Attack Layer Network

Digital medical images are vulnerable to channel noise pollution, unauthorized use, and tampering during transmission through public networks. These intentional or unintentional attacks can cause a certain degree of distortion to the protected medical images, leading to the failure of correctly extracting watermark information embedded in the images, thus undermining copyright authentication. To improve the robustness of the watermark algorithms, common attack methods can be incorporated into the model training process to enhance the robustness of the watermark extraction networks. We selected eight common image attack methods to form an attack layer network: Median filtering (MF), Gaussian filtering (GF), salt and pepper noise (SPN), Gaussian noise (GN), rotation, cropping, JPEG compression (JPEG), and scaling. Figure 9 visualizes the distortion losses caused by these eight image attack methods.

3.5. Watermark Extraction Network

The watermark extraction network in this section is equivalent to the inverse process of the watermark embedding network, as shown in Figure 10. There are two types of input images: one with the watermark information represented as $I_a$, and one without the watermark information represented as $I_n$. Firstly, the two-level DWT on input images to obtain the frequency information of three parts: $F_1^{\prime }$, $F_2^{\prime }$, and $L{L}_2^{\prime }$. Similar to the embedding process, three independent branch networks are used to extract features of $F_1^{\prime }$, $F_2^{\prime }$, and $L{L}_2^{\prime }$, and then the extracted features are channel concatenated—the features extracted by the network corresponding to $F_1^{\prime }$ need to be downsampled before channel concatenation.

Subsequently, the extracted watermark information is obtained through Transformer blocks and convolutional processing. If the input image is $I_a$, containing the watermark information, the extracted watermark information is denoted as $W_d$. If the input image is $I_n$, not containing any watermark, the extracted information is a matrix of the same size as the watermark image, with all values equal to 0, denoted as $W_z$. This is performed to prevent over-fitting of the watermark extraction network. The MSE between the extracted watermark information and Wo is less than the threshold value of 0.01 as the discriminator, determining whether the image contains a watermark or not.

3.6. Image Recovery

The process of image restoration is shown in the Figure 11. First, the discriminator is used to determine if the marked image $I_m$ contains watermark information. If $I_m$ contains watermark information, the same reversible watermarking method is used to extract ${\tilde{I}}_e^{\prime }$, $H_o$, $D_c$, and calculate the hash value $H_d$ of ${\tilde{I}}_e^{\prime }$. Then, by comparing $H_d$ with $H_o$, we can verify the integrity of $I_m$. If $H_o$ and $H_d$ are equal, we assume $I_m$ has not been attacked during transmission. We can then use inverse compression to obtain $D^{\prime }$ from $D_c$, and add $D^{\prime }$ to ${\tilde{I}}_e^{\prime }$ to restore the cover image $I_o$. Otherwise, if $H_d$ is not equal to $H_o$, it indicates that the image has been attacked during transmission, and the restoration information is permanently lost. In this case, we can directly use the watermark extraction network $N_{dec}$ to extract the watermark from the attacked image $I_a^{\prime }$ for copyright verification.

3.7. Loss Functions

The network architecture of our proposed algorithm consists of two stages. In the first stage, we train the watermark embedding and extraction networks. The watermark embedding network takes the original watermark information $W_o$ and the cover image $I_o$ as inputs to generate the watermarked image $I_e$. The watermark extraction network extracts the watermark $W_d$ from the attacked image $I_a$. The total loss function of this stage consists of three parts, as shown in the following formula,

$$L_{stage1}=L_{mse}(I_o,I_e)+L_{pertotal}(I_o,I_e)+L_{mse}(L{L}_2,L{L}_{2e})+\lambda L_{mse}(W_o,W_d)+(1-\lambda )(W_o,W_z)$$

(5)

In addition, we use the watermark loss $L_{mse}(W_o,W_d)$ to improve the accuracy of watermark extraction, the perceptual loss $L_{percetotal}\left(I_o,I_e\right)$ to reduce the semantic differences between the two images, and the visual similarity loss $L_{mse}\left(I_o,I_e\right)$, $L_{mse}\left(L{L}_2,L{L}_{2e}\right)$ to enhance the visual similarity of the images. Here, $L_{mse}$ represents the $l_2$ loss, $\lambda =1$ means contains a watermark, $\lambda =0$ means its does not contain a watermark, and the perceptual loss is the $l_2$ loss of the output features from the first three modules ($F_1$, $F_2$, $F_3$) of the pre-trained VGG16 network, expressed as the following equation.

$$L_{pertotal}\left(x,y\right)=0.65L_{mse}\left(F_1\left(I_o\right),F_1\left(I_e\right)\right)+0.3L_{mse}\left(F_2\left(I_o\right),F_2\left(I_e\right)\right)+0.05L_{mse}\left(F_1\left(I_o\right),F_1\left(I_e\right)\right)$$

(6)

The second phase focuses on embedding reversible information and training the watermark extraction network. The watermark embedding network follows the pre-trained network in the first stage, fixes the network parameters, and does not perform gradient backpropagation. Since embedding reversible information causes distortion loss for watermarked image $I_e$, the watermark extraction network needs to continue training based on inheriting the training parameters from the first stage. The total loss function for this phase is shown in the following equation.

$$L_{stage2}=\lambda L_{mse}(W_o,W_d)+(1-\lambda )(W_o,W_z)$$

(7)

There is only one watermark loss $L_{mse}(W_o,W_d)$ that can improve the correct watermark rate.

3.8. Algorithm Process

To better illustrate the algorithm flow, Algorithm 1 shows the watermark embedding process and Algorithm 2 shows the watermark extraction process.

Algorithm 1 Watermark embedding algorithm.

Stage1:Training watermark embedding network $N_{enc}$, watermark extraction network $N_{dec}$   Input: Original DWI image $I_o$, Original watermark $W_o$   Output: Well-trained $N_{enc}$, $N_{dec}$ Required model: $N_{enc}$, $N_{dec}$, attack layer $Att$ While epoch<maxepochs:    1: Robust watermark embedding $I_e=N_{enc}\left(I_o\right)$    2: Random attack $I_a=Att\left(I_e\right)$ or $I_n=Att\left(I_o\right)$    3: Watermark extraction $W_d=N_{dec}\left(I_a\right)$ or $W_z=N_{dec}\left(I_n\right)$    4: Total loss $L_{stage1}(I_o,I_e,W_o,W_d,W_z)$    5: Update the parameters for $N_{enc}$, $N_{dec}$ Stage2:Training watermark extraction network $N_{dec}$   Input: Original DWI image $I_o$, Original watermark $W_o$, Pre-training $N_{enc}$, $N_{dec}$   Output: Well-trained $N_{dec}$, Marker Image $I_m$ Required model: $N_{enc}$, $N_{dec}$, $Att$, Compensation information generation $R_{gen}$, Reversible embedding $R_{emb}$ While epoch<maxepochs:    1: Robust watermark embedding $I_e=N_{enc}\left(I_o\right)$    2: Compensation information generation $R_{inf}=R_{gen}(I_o,I_e)$ (Section 3.3)    3: Reversible embedding $I_m=R_{emb}\left(R_{inf}\right)$    4: Random attack $I_a^{\prime }=Att\left(I_m\right)$ or $I_n=Att\left(I_o\right)$    5: Watermark extraction $W_d=N_{dec}\left(I_a^{\prime }\right)$ or $W_z=N_{dec}\left(I_n\right)$    6: Total loss $L_{stage2}(W_o,W_d,W_z)$    7: Update the parameters for $N_{dec}$

Algorithm 2 Watermark extraction algorithm.

Input: Marker Image $I_m$, Original watermark $W_o$   Output: Watermark $W_d$, Original DWI image $I_o$ Required model: $N_{dec}$, Contains watermark test $W_{tes}$, Copyright Authentication $C_{aut}$, Integrity Verification $A_{tes}$, Image Recovery $R_{rec}$    1: Watermark extraction $W_d=N_{dec}\left(I_m\right)$    2: Contains watermark test $True|False=W_{tes}(W_o,W_d)$ (Section 3.6)    3: Copyright Authentication $True|False=W_{tes}(W_o,W_d)$ (Section 3.6)    4: Integrity Verification $True|False=A_{tes}\left(I_m\right)$ (Section 3.6)    5: Image Recovery $I_o=R_{rec}\left(I_m\right)$ (Section 3.6)

4. Experiments

4.1. Experimental Settings

We selected publicly available brain DWI image data from the literature [28]. By reducing the dimensionality of the DWI image data, we obtained approximately 80,000 2D slice images. All slice images were cropped to $96\times 96$, 64,000 slices were chosen as the training set, and 16,000 slices were chosen as the test set. For the experimental settings, we used the Adam optimizer with a learning rate of 0.0001 and betas of (0.5, 0.99). The number of epochs was set to 100 with a batch size of 32. The watermark was a binary image of size $24\times 24$. The reversible watermarking method utilizes difference expansion, and the image hashing is computed using the MD5 algorithm. The model parameters and sizes of the robust watermarking network framework are presented in

Table 1. The number of parameters, model size, and runtime of the network.

Model Component	Parameters	Size	Time
Encoder	1,864,508	7.25 MB	1.514 s
Decoder	3,588,616	13.96 MB	1.128 s
Total	5,453,124	21.22 MB	2.642 s

.

The robustness of a watermarking algorithm refers to the accuracy of the watermark information extracted from the attacked protected image; the higher the accuracy, the better the robustness of the algorithm. We use the bit error rate (BER) to evaluate the robustness of the algorithm. The formula of BER is shown in the following,

$$BER=\frac{B_e}{N_h\times N_w},BER\in [0,1]$$

(8)

where $B_e$ is the number of watermarked bits for error detection; while $N_h\times N_w$ is the total number of bits of the binary watermarked image. To evaluate the difference in visual quality between the watermarked image $I_e$ and the cover image $I_o$. We used the peak signal-to-noise ratio (PSNR) as a measure. The higher the PSNR value, the higher the quality of the $I_e$ image and the PSNR definition can be expressed as follows,

$$PSNR=10•{log}_{10}(\frac{MA{X}^2}{MSE})$$

(9)

where MAX is the maximum greyscale order of the image; MSE is the mean squared difference between the $I_o$ and $I_e$ images.

4.2. Robustness Experiment

This section evaluates the robustness of our proposed algorithm under no attacks, single attacks (noise, filtering, JPEG compression, scaling, cropping, rotation) and multiple attacks.

4.2.1. No Attack

Table 2. BER and PSNR under no attack.

Images	Avg BER/bit	Avg PSNR/dB
64	0	1

shows the average BER values of the extracted watermark and the average PSNR values of the recovered image and the cover image for 64 slice images under the no-attack condition. Figure 12 displays the visual results of the differences between six slice images and their corresponding recovered images. It can be seen that the average BER value of our proposed algorithm is 0, and the average PSNR value is 1, indicating that our proposed algorithm can extract the watermark information and recover the cover image losslessly under no attack.

4.2.2. Common Attacks

The common types of image attacks mainly contain median filtering and Gaussian filtering with convolution kernel size K of $3\times 3$, $5\times 5$, $7\times 7$, SPN with a noise density p of 0.01, 0.02, and 0.03, Gaussian noise with a variance v of 0.001, 002, and 003, and JPEG compression with a quality factor Q of 90, 70, 30, and 10. The above attacks were applied to the slice images in each gradient direction of the DWI, and the watermark extraction BER values are shown in

Table 3. BER values under common attacks.

Attack Type	Parameter	BER/bit
median filtering	K = 3	0.000004
median filtering	K = 5	0.000004
median filtering	K = 7	0.000016
Gaussian filtering	K = 3	0.000005
Gaussian filtering	K = 5	0.00006
Gaussian filtering	K = 7	0.000081
SPN	p = 0.01	0.000004
SPN	p = 0.02	0.000006
SPN	p = 0.03	0.000006
Gaussian noise	v = 0.01	0.000004
Gaussian noise	v = 0.02	0.000385
Gaussian noise	v = 0.03	0.000013
JPEG compression	Q = 90	0.000004
JPEG compression	Q = 70	0.000011
JPEG compression	Q = 30	0.000005
JPEG compression	Q = 10	0.002077

. It can be seen that almost all values of BER are equal to 0 after the images are subjected to conventional attacks, indicating that our proposed algorithm has excellent robustness against common attacks.

4.2.3. Geometric Attacks

The geometric attack types mainly contain anticlockwise rotation attacks with rotation angles $\theta$ of 5, 15, 30, and 45, random cropping attacks with cropping scales q of 0.125, 0.25, 0.5, and 0.7, and scaling attacks with scaling factors r of 0.25, 0.5, 0.75, 1.25, 1.5, and 2. The scaling attack can be rescaled to the cover image size by interpolation after scaling to be used as an input to the watermark extraction network $N_{dec}$. The above attacks were applied to the slice images in each gradient direction of the DWI, and the watermark extraction BER values are shown in

Table 4. BER values under geometric attacks.

Attack Type	Parameter	BER/bit
rotation	$\theta$ = 5	0.000785
rotation	$\theta$ = 15	0.002837
rotation	$\theta$ = 30	0.001154
rotation	$\theta$ = 45	0.001025
cropping	q = 0.125	0.000004
cropping	q = 0.25	0.000004
cropping	q = 0.5	0.000004
cropping	q = 0.7	0.000004
scaling	r = 0.5	0.000003
scaling	r = 0.75	0.000004
scaling	r = 1.25	0.000003
scaling	r = 1.5	0.000004
scaling	r = 2	0.000004

. It can be seen that almost all values of BER are equal to 0 after the images are subjected to various geometric attacks, indicating that our proposed algorithm has excellent robustness to geometric attacks.

4.2.4. Multiple Attacks

Considering that the images are vulnerable to multiple types of attacks in the actual transmission process, the algorithm’s robustness can be further verified by conducting multiple attack experiments on the images. We randomly selected three attack methods to superimpose attacks on the slice images in each gradient direction of the DWI, and the BER values of the watermark extraction under multiple attacks are shown in

Table 5. BER values under multiple attacks.

Attack1	Attack2	Attack3	BER/bit
MF K = 7	GN v = 0.03	scaling r = 0.5	0.0003
GF K = 5	rotation $\theta$ = 45	JPEG Q = 30	0.0632
GF K = 3	cropping q = 0.125	JPEG Q = 90	0.0011
SPN p = 0.02	cropping q = 0.25	JPEG Q = 70	0.0756
MF K = 5	GN v = 0.01	JPEG Q = 30	0.0504
SPN p = 0.02	rotation $\theta$ = 30	JPEG Q = 30	0.0876

. It can be seen that almost all the BER values of the images are below 0.09 after three different types of superimposed attacks, indicating that our proposed algorithm still has good robustness against multiple attacks.

4.3. Ablation Experiment

In this section, we conducted experiments to demonstrate the effectiveness of the LHFA block by adding or removing it from the watermark embedding network $N_{enc}$. The results are shown in

Table 6. Validation of the effectiveness of the LHFA block in image reconstruction quality.

No.	LHFA Block	Avg PSNR/dB
1	✓	60.18
2	✕	58.43

, and the average PSNR improves to 60.18 dB after adding the LHFA block. This indicates that the attention module that combines low- and high-frequency information in the watermark embedding network with the LHFA block can improve the image’s accuracy and detail expression ability, thus reconstructing visually higher-quality watermarked images.

4.4. Comparative Experiment

In order to measure its performance comprehensively, the proposed algorithm was compared with (1) Hidden [13] and DwiMark [17] robust watermarking algorithms based on deep learning, also trained in a two-stage separated manner for fair comparison, and (2) three traditional robust lossless watermarking algorithms [10,11,12] with good performance.

Table 7. Comparison with the PSNR of watermarked images from other methods.

Watermarked Image	[13]	[17]	[10]	[11]	[12]	Proposed
PSNR/dB	39.08	58.69	43.7	43.1	46.8	60.18

shows the comparison results of the algorithms regarding the visual quality of watermarked images, and the proposed algorithm achieved the highest visual quality of the reconstructed images.

Table 8. Robustness comparison with other methods.

Attack	[13]	[17]	[10]	[11]	[12]	Proposed
GN (0.01)	0.002	0.000	0.000	0.010	0.000	0.000
GN (0.02)	0.024	0.000	0.000	0.060	0.010	0.000
GN (0.03)	0.025	0.026	0.000	0.180	0.050	0.000
JPEG (90)	0.164	0.000	0.000	0.000	0.000	0.000
JPEG (70)	0.333	0.012	0.000	0.000	0.000	0.000
JPEG (30)	0.394	0.343	0.000	0.000	0.000	0.000
JPEG (10)	0.430	0.375	0.150	0.000	0.000	0.002
rotation (5)	0.004	0.000	—	0.000	0.000	0.000
rotation (15)	0.009	0.010	—	0.000	0.000	0.002
rotation (30)	0.011	0.010	—	0.000	0.000	0.001
rotation (45)	0.011	0.020	—	0.000	0.000	0.001
scaling (0.5)	0.063	0.001	—	0.000	0.000	0.000
scaling (0.75)	0.096	0.010	—	0.006	0.002	0.000
scaling (1.25)	0.131	0.010	—	0.000	0.000	0.000
scaling (1.5)	0.150	0.015	—	0.000	0.030	0.000
scaling (2)	0.206	0.025	—	0.020	0.010	0.000

shows the comparison results of the algorithms in terms of robustness. The proposed algorithm exhibited the best robustness against Gaussian noise and scaling attacks, with a corresponding BER of 0 for watermark extraction. For rotation attacks, the proposed algorithm achieved a BER of 0.002 at a rotation angle of 15${}^{\circ }$. Moreover, the proposed algorithm also performed well against other common attacks on medical images, with a BER of 0 for multiple attacks, demonstrating its robustness against most attacks.

5. Conclusions

We proposed a two-stage deep learning-based robust lossless watermarking algorithm for DWI images by combining the advantages of robust and reversible watermarking. In the first stage, we pre-trained a robust watermarking network using a framework based on DWT and Transformer. The watermark redundancy was embedded into the decomposed low-frequency components, and an attention module was designed to effectively fuse multi-frequency features for a better reconstruction performance. In the second stage, the compensation information and image hash value were embedded into the watermarked image using reversible watermarking techniques. The image hash value was utilized to detect whether the image had been attacked, and under the condition of no attack, lossless recovery of the cover image was achieved using the compensation information, ensuring the integrity of the medical image data. The proposed algorithm enabled effective copyright protection for DWI images by extracting the watermark for copyright authentication under various types of attacks. Currently, the embedded watermark image was fixed and unchanged. In the future, the use of random watermarks can be considered to enhance security. The robustness of the watermark is designed to address known attacks, and in the future, adversarial training can be employed to enhance robustness against unknown attacks.