Information Sciences 653 (2024) 119810

Contents lists available at ScienceDirect

Information Sciences
journal homepage: www.elsevier.com/locate/ins

Hybrid watermarking algorithm for medical images based on

digital transformation and MobileNetV2
Saqib Ali Nawaz a, Jingbing Li a, *, Uzair Aslam Bhatti a,
Muhammad Usman Shoukat b, Dekai Li a, Muhammad Ahmad Raza c
a
School of Information and Communication Engineering, Hainan University, Haikou 570228, China
b
School of Automotive Engineering, Wuhan University of Technology, Wuhan, China
c
School of Cyberspace Security, Hainan University, Haikou 570228, China

A R T I C L E I N F O A B S T R A C T

Keywords: The current study presents a new methodology for zero watermarking that relies on the discrete
DWT wavelet transform (DWT) and an improved MobileNetV2 convolutional neural network, along
MobileNetV2 with the discrete cosine transform (DCT). This model is intended to overcome the issue of al­
DCT
gorithm robustness in encrypted medical image watermarking. The proposed technique targets
Zero watermarking
Medical images
medical images inside the area of encryption and offers a unique watermarking approach to
Logistic map overcome the issues above. The coefficients acquired from the fully linked network layer are
converted using DWT and DCT to create the medical image’s feature vector. Second, MobileNetV2
is initially fed the medical image; this network has been prepared by adjusting parameters such as
the convolution kernels’ size and the convolution modules’ typical architecture. Finally, the
encryption of watermarks is achieved through the utilization of the logistic map system and hash
function, whereby an independent party securely stores the requisite keys. The integration of a
zero-watermark involves the execution of logical operations on both the encrypted watermarks
and the attributes of the source image. The results of the experiment indicate that the algorithm
can effectively differentiate encrypted medical images and recover the initial data from encrypted
watermarked material despite conventional and geometric attacks. Compared to alternative al­
gorithms, their superior resilience and invisibility are noteworthy.

1. Introduction

The wide usage of digital data and the Internet has led to frequent instances of infringements on intellectual property rights,
including unauthorized utilization, replication, and misappropriation of digital content. Digital images contain high value-added
content, and watermarking technology embeds owner information (watermark) into images to protect their intellectual property
rights [1]. However, there are many threats to watermarking technology, mainly malicious attacks that damage or remove watermark
information or non-malicious attacks to achieve storage or distribution of content [2].
In recent times, the focus of digital watermarking technology has been primarily intensive on the “defensive side”, aiming to
recover the robustness of existing watermarking methods, but the existing watermarking attack system can no longer meet the needs of
watermarking techniques, and watermarked images are being attacked. The watermark information can be extracted with a very low

* Corresponding author.
E-mail address: jingbingli2008@hotmail.com (J. Li).

https://doi.org/10.1016/j.ins.2023.119810
Received 12 July 2023; Received in revised form 10 September 2023; Accepted 21 October 2023
Available online 24 October 2023
0020-0255/© 2023 Elsevier Inc. All rights reserved.
S.A. Nawaz et al. Information Sciences 653 (2024) 119810

bit error rate or even losslessly. The current watermark attack method does not consider the visual quality of the watermark image after
being attacked, which is impractical for many pieces of information that need to be protected [3]. Addressing the problem of visually-
focused attention models producing erroneous captions, the task-adaptive attention module is proposed for image captioning [4]. The
module is taught to recognize non– visual cues that aid in the creation of non-visual words.
The performance of depth images in computer vision applications is typically compromised due to the presence of noise, which
corrupts the images received from depth cameras. The suggested method, which is known as the group-based nuclear norm and
learning graph model, leverages the inherent low-rank characteristic of grouped patches [5]. Deep learning frameworks like Ten­
sorFlow [6], Torch [7], and pre-trained models like AlexNet [8] and ResNet [9] greatly simplify the development and deployment of
complex models, and developers can also use fine-tuning or transfer learning [10] to build a model swiftly. However, training a deep
neural network (DNN) model is still expensive: a large number of labeled data sets are needed, as are a large number of computing
resources to adjust the model’s structure, hyperparameters, and weights. This makes it profitable to pirate DNN models, which can be
vulnerable to malware during the R&D phase or remote API query attacks during the deployment phase. For this reason, protecting the
DNN model from being illegally copied, tampered with, and abused is a key issue that needs to be solved urgently. The DNN
watermarking scheme is to verify the watermark by verifying the output of a specific input prediction, and this kind of scheme is more
practical. The process of watermarking can be split into two separate phases, namely embedding and extraction. During the embedding
phase, proprietors have the ability to integrate watermarks into their produced models. In the extraction stage, if the model is stolen,
the owner can extract the watermark from the suspicious model as evidence of infringement. The key to watermarking lies in the
design of the activate mode, that is, how to construct the induction set, design the embedding, and design the extraction methods. At
present, watermark research mainly focuses on constructing the induction set and using the initiation set to fine-tune the target model
or train the model together with the original data set to embed the watermark [11].
Adi et al. [12] projected an algorithm to watermark DNN models in a backdoor manner. Their scheme is suitable for general
classification tasks and can be easily combined with current DNN models. Yan et al. [13] presented a novel supervised multi-view hash
model that leverages neural networks to augment multi-view information, by integrating both multi-view and deep learning tech­
niques. Zhang et al. [14] proposed to watermark the target model by using cause samples that have specified target categories and
superimposing irrelevant patterns, watermark patterns, and noises. Sharma et al. [15] introduced a robust hybrid watermarking
technology that can resist CNN-based adversarial attacks. They first evaluated the robustness of the image watermarking scheme
utilising transform domain (such as DWT, DCT, SVD, etc.) against a mixture of traditional attack methods. In 2020, Nam et al. [16]
proposed a watermarking attack network. They realized that the existing attack schemes cannot be used as a benchmark for testing the
robustness of watermarking schemes, and there are many problems. They pointed out that the current watermarking attack method
only interferes with the watermarked image but ignores the target watermark’s specific characteristics. Haribabu et al. [17] set out a
neural network digital image watermarking algorithm that utilizes self-encoding. The algorithm involves utilizing the standard
gradient descent backpropagation algorithm to learn the weight of the auto-encoding network for a given image, and based on this
idea, the watermark can be fixed into the given image invisibly.
Geng et al. [18] introduced a CNN-based real-time attack outline for robust watermarking schemes, based on the premise of
improving the robustness of watermarking schemes and pointing out that the existing attack methods cannot balance image quality
and watermark damage ability well. This proposed model, a CNN-based removal attack method, mainly attacks the blind water­
marking scheme that is highly robust and does not require host images; this attack scheme can preprocess the watermarked image
without any prior knowledge, thus hindering the watermark extraction; even when the watermarking scheme is unknown, it is still
possible to use Some common features of the watermarked image are used to destroy the watermark. Quiring et al. [19] studied a
black-box attack method based on adversarial learning, specifically for digital watermarking. First, the scheme clarifies that although
both machine learning and digital watermarking are independent, there is some commonality (vulnerability). They use neural net­
works to replace watermark detection tools and remove watermarks. Then they can complete the embedding under the premise that
the watermark scheme is unknown. Although a few research results show that deep learning technology can be used as a new
watermark attack method to interfere with watermark extraction and at the same time ensure the image quality of the watermark, the
attack system is still immature, and for most current watermark attacks, the solution is to recover the quality of the watermark image
(PSNR, SSIM, etc.), ignoring the problem of watermark extraction (bit error rate, BER).
As was just pointed out, the use of a deep learning network confers numerous benefits on the process of automatically extracting
and recognizing image and speech characteristics. Thus, deep learning networks and digital watermarking studies have become
increasingly intertwined. Research on digital watermarking has yielded unique results by integrating the two technologies [20]. Kandi
et al. [21] projected a CNN-based digital watermarking algorithm that first divided the original image into 8 × 8 image blocks, then
used CNN to learn the quality and brightness properties of the image and adaptively fix the embedding strength of the watermark to
balance invisible rows and robustness. Fonseca et al. [22] suggest a learning-based auto-encoder CNN for image watermarking that
surpasses standard methods in imperceptibility and robustness. Fierro-Radilla et al. [23] introduced using a convolutional neural
network (CNN), where the extracted features are used to construct the feature matrix. Although the algorithm can resist various attacks
and common image processing, the CNN itself has defects: 1) for traditional CNN, the weights in the image are the same; 2) the possible
interference in the image will affect the classification results of the CNN, which is caused by affecting the feature extraction of the CNN,
which is also a possible reason why the CNN is vulnerable to adversarial sample attacks. At present, there are three types of methods to
expand the robustness of the model: confrontation training, modifying the model, and adding the model. Hao et al. [24] used
adversarial neural networks to detect watermarked images. Baluja et al. [25] employed a neural network for the purpose of concealing
a complete color image within another image that shared comparable characteristics. The watermarked image looks excessive, and the
method can insert images of variable sizes, text, and audio. Literature [26,27] forms a permanent watermarking strategy using wavelet

2
S.A. Nawaz et al. Information Sciences 653 (2024) 119810

transforms and U-Net-based machine learning. Annadurai et al. [28] used adversarial generative networks to hide data for sharing. Yan
et al. [29] provided a unique method for exact no-reference image quality assessment (NR IQA) by first recognizing image distortion
and then quantifying it for targeted quality rating. The Waterloo Exploration database-trained Inception-ResNet-v2 neural network
classifies distortion into four typical types: Gaussian white noise, Gaussian blur, jpeg compression, and jpeg2000 compression. The
second phase develops a distortion-based image quality estimation method. Zhang et al. [14] watermark embedding the network
model without impacting performance to protect the shared neural network model’s intellectual property.
Based on the aforementioned research, we can state with confidence that watermark algorithms operating straight on the novel
image will inevitably degrade the resolution of the image and that watermarks are vulnerable to geometric attacks. This study suggests
an algorithm for analyzing medical images and extracting image feature vectors based on DWT, MobileNetV2, and DCT, with the goal
of resolving the infuriating issue of the medical image watermark algorithm. The integration of the “third party” concept with other
elements is employed to enhance the resilience of medical image watermarking systems, thereby enabling the attainment of zero
embedding and blind extraction of multiple watermarks.
The key contributions of this study are:

(1) The method obtains algorithmic innovation by combining deep learning theory with conventional image transformation theory.
(2) This study utilized the MobileNetV2 for processing the watermark of images.
(3) To increase the watermark’s security, a chaotic system is used to encrypt it, and the resulting key is kept in a remote location.
(4) It is possible to do neither zero watermarking nor blind extraction because the original image is not needed for the extraction
process.

2. Proposed model

2.1. Discrete wavelet transform

The discrete wavelet transform of an image is commonly achieved through a two-dimensional wavelet transform [30]. The process
of wavelet transformation is shown in Fig. 1. First, it divides the image data into a matrix composed of several rows and columns and
performs a one-dimensional wavelet transform on each row of the image. The procedure entails acquiring the low-frequency con­
stituent L and high-frequency constituent H of the initial image in the horizontal orientation, followed by executing a one-dimensional
wavelet conversion on every column of the modified data. After transformation, the image is decomposed into two similar parts: LL1 in
the upper left corner and LH1 in the lower left corner. The detailed part HL1 in the horizontal direction in the upper right corner, and
the detailed part HH1 in the diagonal direction in the lower right corner, and then perform a first-level decomposition on the similar
part LL1, so as to realize the second-level decomposition of the image.
The formula of wavelet transform is:
∫ +∞ ( )
1 t− b
Xf (a, b) = f (t).√̅̅̅ ψ * dt (1)
− ∞ a a

where: f(t) is any function on the L2R space, ψ (t) is a basic wavelet or wavelet mother function, a is the expansion feature, b is the
translation aspect, Xf (a, b) is f(t) continuous wavelet transforms.

2.2. MobileNetV2 model

MobileNetV2 [31] employs depthwise separable convolution as a substitute for normal convolution by utilizing depthwise
convolution (DW) and pointwise convolution (PC). The process of convolution is executed by the DW on individual channels of the
input feature map, with the number of convolution kernels being equivalent to the number of channels present in the input feature
map. The personal computer (PC) employs a 1 × 1 convolutional kernel, whereby the quantity of channels associated with the con­
volutional kernel corresponds to the number of channels present in the input feature map. Generally, a 3 × 3 convolution kernel is
used, and the depth-separable convolution structure can reduce the amount of parameters by about 9 times, greatly reducing the

Fig. 1. A full two-dimensional wavelet transforms process of image.

3
S.A. Nawaz et al. Information Sciences 653 (2024) 119810

computational cost and training time of network parameter updates, and is suitable for the identification task of drilling rig working
status. All layers in MobileNetV2 are expanded by a factor of 6. This number was found to be the best compromise between accuracy
and size in MobileNetV2 hyperparameter searches. Given these characteristics, MobileNetV2 is well suited for embedded deployment
in medical imaging applications due to its remarkable combination of performance and efficiency. The network structure of Mobi­
leNetV2 as shown in Fig. 2.

2.3. Discrete cosine transform

As one of the most commonly used algorithms in the field of digital signal processing, the discrete cosine transform can also
implement a fast algorithm like the fourier transform. Since the complex number operation in the fourier transform is avoided, the
discrete cosine transform can greatly improve the calculation speed through the orthogonal transformation of the real number and can
also achieve good energy compression and decorrelation capabilities. Consequently, the algorithm has gained significant popularity in
the domains of image compression and digital audio signal compression. Enhancing the anti-compression ability of watermark can be
realized by compressing the watermark embedding algorithm of the standard model. Consequently, the study of discrete cosine
transforms has significant significance for digital watermark processing technology [32]. In particular, the realization of the discrete
cosine transform makes the energy concentrated, and the algorithm is not complicated, so it can be more easily and quickly imple­
mented in the digital signal processor.
The image discrete cosine transform (DCT) formula is as:
[ ] [ ]
N− 1 ∑
2 ∑ N− 1
(2x + 1) (2y + 1)
F(i, j) = f (x, y).cos iπ cos jπ (2)
N x=0 y=0 2N 2N

where, F(i, j) is the discrete cosine function, and f(x, y) is the original data of the image. f(x, y)(x = 0, 1, 2, ⋯, N − 1 and y = 0,1,2,⋯,
N − 1).
The inverse discrete cosine transform (IDCT) formula of an image is as:
[ ] [ ]
N− 1 ∑
2 ∑ N− 1
(2x + 1) (2y + 1)
f (i, j) = F(x, y).cos iπ cos jπ (3)
N x=0 y=0 2N 2N

2.4. Logistic chaos mapping

Logistic chaotic map (Fig. 3) is a classic chaotic system, is a well-known chaotic system that finds extensive application in the
domain of digital image encryption, as shown in formula (4).
xn+1 = μxn (1 − xn ) (4)

where, μ represented the growth parameter. The sequence {xn , n = 0, 1, 2, 3, ⋯} made by the primary form x0 ∊(0, 1) under the logistic
map is non periodic, non convergent, and very complex to the initial rate.

2.5. Extraction of features from medical images

The suggested approach is shown in Fig. 4 as a flowchart, wherein the medical image is initially processed followed by the

Fig. 2. Various layer-based network structure of MobileNetV2.

4
S.A. Nawaz et al. Information Sciences 653 (2024) 119810

Fig. 3. A classic-diagram of logistic map [33].

watermarks. The original medical image is down sampled to a 512 × 512 image I(i, j) before being fed into the MobileNet V2 network.
The MobileNetV2 model selects the E(i) data of the fully linked layer (forecasts) subsequent to the convolution and pooling of the
primary medical image through three MobileNet modules and two grid size reduction modules. Last but not least, in the transformation
domain, data from a fully connected layer was DCT-transformed to produce a vector Vm (i, j) that is consistent with human visual
properties. An initial value x0 is used to construct a chaotic sequence xj , and binarized to provide a binary encryption matrix k(n).
Which is then operated against the watermark W(i, j) to produce the encrypted watermark BW(i, j). To embed a watermark, a hash is
calculated using the encrypted watermark BW(i, j) and the image’s visual feature vector Vm (i,j). This produces a binary logic sequence

Fig. 4. A complete flow-diagram of the proposed algorithm.

5
S.A. Nawaz et al. Information Sciences 653 (2024) 119810

Key(i, j), which is used to decrypt the watermark. Key(i, j) is a binary sequence of digits that can be saved on a third-party server.
Throughout the tests, the same procedure was carried out. Obtain the visual feature vector V′m (i, j) from the authenticated medical
image. Acquire the binary logic arrangements Key(i, j) from an external source. Get the extracted watermarks BW(i, j) by combining the
feature vector V′m (i, j) and the Key(i,j). Compute the visual feature vector V′m (i, j) for the medical image under examination. Utilizing the
identical initial value x0 , the generation of the disorderly sequences x(j) and encryption matrices k(n) was executed through the
replication of the aforementioned process. After that, the repaired watermarks W′(i, j) were found by hashing k(n) and BW(i, j).
In this experiment, a medical grayscale image with 512 × 512 pixels is chosen at random, then subjected to DWT and MobileNet V2
with DCT transformation. So then, try out a bunch of attacks on the medical image to see if the features we got using the algorithm are
authentic (Fig. 4). In this study, we used 32 bits of low-frequency data and modified it so that any data that was larger than or equal to
0 was changed to 1, while any other data was changed to 0. Consequently, the results of the experiment demonstrate that the image
properties that were removed using the suggested approach were successful.
In step 1, assuming x0 = 2, μ = 4, we will first generate a chaotic sequence X(j). An example of binarization is the chaotic X(j), a
binary encryption matrix k(n) is formed when X(j) is bigger than 0.5, where X(j) is “1″ and X(j) is “0” otherwise.
In Step 2, we use the hash function, such as in Eq. (5), to process the binary encryption matrix k(n) and the binary watermark W(i,j),
yielding the encrypted watermarks BW(i, j).
BW(i, j) = W(i, j) ⊕ k(n) (5)

2.6. Watermarks embedding

Step 3: Estimate the image feature matrix Vm (i, j) and the encrypted watermark BW(i, j) using Eq. (6) to embed the watermark into
the medical image and extract the logical key Key(i, j).
Key(i, j) = BW(i, j) ⊕ Vm (i, j) (6)

Step 4, copy the logical key Key(i, j) to a secure cloud storage. In order to remove the watermark from the sample image, we can submit
a request for the logical key Key(i, j) to the external service. It is possible to see the watermark embedding procedure in Fig. 5.

2.7. Watermarks extraction

Step 5: to extract the tested image’s features V′m (i, j) in the same way as the original medical image’s components were extracted.
Step 6: the encrypted watermark known as BW′(i, j) is retrieved using the Eq. (7).

BW′(i, j) = Vm′ (i, j) ⊕ Key(i, j) (7)

When eliminating the watermark, the algorithm needs only the Key(i, j) and never touches the original image. In other words, it is an

Fig. 5. A complete procedure of watermark embedding.

6
S.A. Nawaz et al. Information Sciences 653 (2024) 119810

algorithm for extracting no watermarks. The watermark extraction procedure is shown in Fig. 6.

3. Results

Fig. 7 (a) shows the images used for the dataset of medical images (512 × 512). Fig. 7 (b) shows the watermark used in this study
(32 × 32). MATLAB 2022b has been used for performing experiment and testing results. The normalized correlation (NC) value is used
for the purpose of validation. So, the NC is as:
∑∑ ′
i W(i,j) W(i,j)
(8)
i
NC = ∑ ∑ 2
i W
i (i,j)

where, W(i,j) is the watermark that was originally inserted and W′(i,j) is the watermark that was recovered from the image. If the NC
value is bigger, then the similarity among the original watermark and the extracted watermark is higher too.

3.1. Gaussian noise

We attacked medical images using Gaussian noise with different levels (10, 30, and 40), as well as the algorithm’s robustness,
which is shown by the NC coefficient (NC1 to NC8). Gaussian noise was chosen as the testing variable, and the results of the exper­
iments can be seen in Fig. 8 (a). This was done in order to estimate how resistant the method is to more conventional forms of attack.
The NC (1 to 8) value changes from 0.64 to 0.85 as the Gaussian noise attack approaches (10, 30, and 40). In spite of an attack from
Gaussian noise, as shown in Fig. 8 (a), it is possible to effectively retrieve the watermark information while maintaining a high level of
robustness.

3.2. JPEG

Examined the strength of the method using the NC coefficient (NC1 to NC8) and analyzed the encrypted medical images using JPEG
at three separate stages (35, 45, and 50). JPEG was chosen as the testing variable, and the results of the experiments can be seen in
Fig. 8 (b). This was done in order to estimate how resistant the algorithm is to more conventional forms of attack. The NC (1 to 8) value
changes from 0.68 to 0.87 as the JPEG attack approaches (35, 45, and 50). In spite of an attack from JPEG, as shown in Fig. 8 (b), it is

Fig. 6. A complete procedure of watermark extraction.

7
S.A. Nawaz et al. Information Sciences 653 (2024) 119810

Fig. 7. (a) Original medical images with (512 × 512) and (b) watermark with (32 × 32).

possible to effectively retrieve the watermark information while maintaining a high level of robustness.

3.3. Median filter

We examined medical images with various levels of median filter ([3 × 3], [5 × 5], and [7 × 7]), as well as the algorithm’s
robustness, as represented by the NC coefficient (NC1 to NC8). The median filter was chosen as the testing variable, and the results of
the experiments can be seen in Fig. 8 (c). This was done in order to estimate how resistant the algorithm is to more conventional forms
of attack. The NC (1 to 8) value changes from 0.63 to 0.88 as the median filter attack approaches ([3 × 3], [5 × 5], and [7 × 7]).
Notwithstanding a median filter attack, as shown in Fig. 8 (c), it is possible to obtain the watermark information while maintaining a
high level of robustness.

3.4. Clockwise rotation

In this paper, we examined medical images encrypted with clockwise rotation at three different angles (5◦ , 10◦ , and 20◦ ) and
evaluated the strength of the algorithm using the standardized correlation coefficient (NC1 to NC8). Rotation clockwise was chosen as
the testing variable, and the results of the experiments can be seen in Fig. 8 (d). This was done in order to assess how resistant the
algorithm is to more geometric forms of attack. The NC1 to NC8 values change from 0.68 to 0.89 as the rotation clockwise attack angles
(5◦ , 10◦ , and 20◦ ). In spite of an attack from Rotation clockwise, as shown in Fig. 8 (d), it is possible to effectively retrieve the
watermark information while maintaining a high level of robustness.

3.5. Anticlockwise rotation

This paper focuses on the issue of geometric attacks, which present a significant challenge for current algorithms. We evaluated
medical images encrypted with anticlockwise rotation at three different angles (5◦ , 10◦ , and 20◦ ) and the strength of the method as
measured by the stabilized correlation coefficient (NC1 to NC8). Rotation anticlockwise was chosen as the testing variable, and the
results of the experiments can be seen in Fig. 8 (e). This was done in order to estimate how resistant the algorithm is to more geometric
forms of attack. The NC (1 to 8) value changes from 0.70 to 0.89 as the rotation anticlockwise attack angles (5◦ , 10◦ , and 20◦ ). In spite
of an attack from rotation anticlockwise, as shown in Fig. 8 (e), it is possible to effectively retrieve the watermark information while
maintaining a high level of robustness.

3.6. Scaling factor

We tested the strength of an algorithm by measuring it using the NC coefficient on a set of medical images encrypted with scaling
factors of × 0.5, x 0.7, and × 0.8. This was done since geometric attacks are more challenging for existing methods to address (NC1 to
NC8). The scaling factor was chosen as the testing variable, and the results of the experiments can be seen in Fig. 8 (f). This was done in
order to assess how resistant the method is to more geometric forms of attack. The NC (1 to 8) value changes from 0.68 to 0.87 as the
scaling factor attack values (x 0.5, x 0.7, and × 0.8). Fig. 8 (f) demonstrates that it is possible to successfully retrieve the watermark
information while maintaining a high level of robustness in the case of a scaling factor attack.

3.7. Translation left

This study examines the challenge posed by geometric attacks on current algorithms. Specifically, we conducted an evaluation of

8
S.A. Nawaz et al. Information Sciences 653 (2024) 119810

Fig. 8. Algorithm’s robustness using the NC values, (a) Gaussian Noise (b) JPEG (c) Median filter (d) Clockwise rotation (e) Anticlockwise rotation
(f) Scaling Factor.

medical images that were encrypted using translation left at three different values (3, 20, and 25). The strength of the method as
measured by the regularized correlation coefficient (NC1 to NC8). Translation left was chosen as the testing variable, and the results of
the experiments can be seen in Fig. 9 (a). This was done in order to estimate how resistant the method is to more geometric forms of
attack. The NC (1 to 8) value changes from 0.69 to 0.89 as the translation left attack values (3, 20 and 25). In spite of an attack from
translation left, as shown in Fig. 9 (a), it is possible to effectively retrieve the watermark information while maintaining a high level of
robustness.

3.8. Translation right

The problem posed by geometric attacks presents a major challenge for current algorithms. Our study involved an assessment of
medical images that had been subjected to encryption via translation at three separate values (3, 10, and 45), and the efficacy of the
algorithm was gauged by the stabilized correlation coefficient (NC1 to NC8). Translation right was chosen as the testing variable, and

9
S.A. Nawaz et al. Information Sciences 653 (2024) 119810

Fig. 9. Algorithm’s robustness using the NC values, (a) Translation left (b) Translation right (c) Translation Up (d) Translation down (e) Clipping Y
direction (f) Clipping X direction.

the results of the experiments can be seen in Fig. 9 (b). This was done in order to evaluate how resistant the algorithm is to more
geometric forms of attack. The NC (1 to 8) value changes from 0.67 to 0.88 as the translation right attack values (3, 10 and 45). Despite
an attack from translation right, as shown in Fig. 9 (b), it is possible to effectively retrieve the watermark information while main­
taining a high level of robustness.

3.9. Translation up

We examined the NC coefficient’s (NC1 to NC8) performance as well as the effectiveness of the algorithm for medical images
encrypted with translation up at three different levels (5, 7, and 20). Translation up was chosen as the testing variable, and the results
of the experiments can be seen in Fig. 9 (c). This was done in order to estimate how resistant the algorithm is to more geometric forms
of attack. The NC (1 to 8) value changes from 0.68 to 0.89 as the translation up attack values (5, 7 and 20). Fig. 9 (c) shows that the
watermark information may be retrieved successfully while remaining highly resilient despite an attack from translation up.

10
S.A. Nawaz et al. Information Sciences 653 (2024) 119810

3.10. Translation down

In this paper, we analyzed the medical images encrypted with translation down at three levels (20, 45, and 50), as well as the
algorithm’s effectiveness as determined by the NC coefficient (NC1 to NC8). Translation down was chosen as the testing variable, and
the results of the experiments can be seen in Fig. 9 (d). This was done in order to estimate how resistant the algorithm is to more
geometric forms of attack. The NC (1 to 8) value changes from 0.68 to 0.84 as the translation down attack values (20, 45, and 50). Fig. 9
(d) shows that the watermark information may be retrieved successfully while remaining highly resilient despite an attack from
translation down.

3.11. Cropping (Y direction)

We analyzed the algorithm’s robustness using the NC coefficient and compared it to the results obtained with a 15, 25, and 30
cropping (Y direction) applied to medical images (NC1 to NC8). Cropping (Y direction) was chosen as the testing variable, and the
results of the experiments can be seen in Fig. 9 (e). This was done in order to estimate how resistant the method is to more geometric
forms of attack. The NC (1 to 8) value changes from 0.72 to 0.92 as the cropping (Y direction) attack values (15, 25, and 30),
respectively. Fig. 9 (e) shows that the watermark information may be obtained while preserving a high level of robustness in the face of
a cropping (Y direction) assault.

3.12. Cropping (X direction)

In this paper, we analyzed the algorithm’s robustness using the NC coefficient and compared it to the results obtained with a 3, 10,
and 25 cropping (X direction) applied to medical images (NC1 to NC8). Cropping (X direction) was chosen as the testing variable, and
the results of the experiments can be seen in Fig. 9 (f). This was done in order to assess how resistant the method is to more geometric
forms of attack. The NC (1 to 8) value changes from 0.68 to 0.88 as the cropping (X direction) attack values (3, 10, and 25),
respectively. Fig. 9 (f) shows that the watermark information may be obtained while preserving a high level of robustness in the face of
a cropping (X direction) assault.

4. Comparison

Fig. 10 displays the implementation of our watermarking algorithm. We compared the robustness of our proposed technique with
that of four representative methods, namely, QFT + Arnold + Chaotic [20], PHTs-DCT [34], KAZE-DCT [35], SURF-DCT [36] and
Inception V3-DCT [37], to demonstrate that the suggested scheme is more robust than traditional image processing and geometric and
conventional attacks. The proposed approach has an NC value of 0.83 and 0.81, while the compared Gussian noise and JPEG
compression values range from 0.32 to 0.76. The NC values of the compared scaling range from 0.32 to 0.74, whereas the proposed
approach achieves an NC value of 0.82. More comparison of the presented approaches with other improved hybrid algorithms is shown
in Table 1.
According to the data presented in Table 1, it is evident that the NC values obtained through our method demonstrate a statistically
significant rise compared to the values obtained through the application of the comparison methods. All of the NC values are between
0.63 and 0.87, with the exception of conventional and geometric attacks. This demonstrates that the robustness of the strategy that we
have provided is very much to our preference as compare to the other mention methods in the Table 1.

5. Conclusion

In this research, we provide a method for the encrypted watermarking of medical images that is focused on DWT, MobileNetV2
CNNs, and DCT. This method also combines zero watermarking, and transfer learning. In order to take out features from the encrypted
medical images, we improved the MobileNetV2 pre-trained network and then applied transfer learning to the improved network. The
utilization of logistic map for encrypting medical images and watermark information, as well as embedding and extracting said
watermark information. The results of the experiments show that the strategy is secure against both traditional and geometric forms of
attack. Consequently, the method might be more effective than others for the encryption of medical images. Obviously, this method
has a large amount of potential for development, and to improve its overall performance, it will modify the neural network to extract
more features that are typical of the whole.

CRediT authorship contribution statement

Saqib Ali Nawaz: Conceptualization, Methodology, Software, Formal analysis, Resources, Data curation, Writing – original draft,
Writing – review & editing. Jingbing Li: Conceptualization, Investigation, Resources, Supervision, Project administration. Uzair
Aslam Bhatti: Methodology, Validation, Visualization. Muhammad Usman Shoukat: Methodology, Validation, Visualization. Dekai
Li: Software, Data curation. Muhammad Ahmad Raza: Validation, Visualization.

11
S.A. Nawaz et al. Information Sciences 653 (2024) 119810

Fig. 10. Implementation process of extracted watermark of proposed algorithm, where, (a) median filter at [5 × 5], (b) rotation clockwise at 10 , (c)
◦

scaling at 0.7, (d) 45 % translation down, (e) 20 % translation left, (f) X-direction with 3 %, (g) Y-direction with 15 %.

Table 1
Comparative analysis of NC values of proposed method to various alternative algorithms under different attacks.
Attacks Intensity PHTs-DCT KAZE-DCT SURF-DCT QFT + Arnold + Chaotic Inception V3-DCT Proposed
[34] [35] [36] [20] [37]

Gussian Noise 13 0.45 0.32 0.71 0.67 0.35 0.83

JPEG Compression 10 0.63 0.76 0.72 0.71 0.63 0.81
Median Filter [7*7] 0.55 0.40 0.54 0.55 0.29 0.63
Rotation (◦ ) 30 0.62 0.42 0.87 0.65 0.05 0.75
Scaling ×0.1 – 0.43 0.74 0.54 0.32 0.82
Right Translation (%) 40 0.49 0.04 0.64 0.71 0.39 0.73
Up Translation (%) 40 0.31 0.20 0.62 0.44 0.39 0.64
Cropping(X-axis) 20 0.59 0.68 0.81 0.52 0.76 0.87
Cropping(Y-axis) 15 0.45 0.62 0.76 0.75 0.68 0.86

Declaration of Competing Interest

The authors declare that they have no known competing financial interests or personal relationships that could have appeared to
influence the work reported in this paper.

Data availability

The data that has been used is confidential.

12
S.A. Nawaz et al. Information Sciences 653 (2024) 119810

References

[1] T. Li, J. Li, J. Liu, M. Huang, Y.W. Chen, U.A. Bhatti, Robust watermarking algorithm for medical images based on log-polar transform, EURASIP J. Wirel.
Commun. Netw. 2022 (1) (2022) 1–11.
[2] J.E. Lee, Y.H. Seo, D.W. Kim, Convolutional neural network-based digital image watermarking adaptive to the resolution of image and watermark, Appl. Sci. 10
(19) (2020) 6854.
[3] A. Kumar, A cloud-based buyer-seller watermarking protocol (CB-BSWP) using semi-trusted third party for copy deterrence and privacy preserving, Multimed.
Tools Appl. 81 (15) (2022) 21417–21448.
[4] C. Yan, Y. Hao, L. Li, J. Yin, A. Liu, Z. Mao, X. Gao, Task-adaptive attention for image captioning, IEEE Trans. Circuits Syst. Video Technol. 32 (1) (2021) 43–51.
[5] C. Yan, Z. Li, Y. Zhang, Y. Liu, X. Ji, Y. Zhang, Depth image denoising using nuclear norm and learning graph model, ACM Trans. Multimedia Comput. Commun.
Appl. (TOMM) 16 (4) (2020) 1–17.
[6] A. Fkirin, G. Attiya, A. El-Sayed, M.A. Shouman, Copyright protection of deep neural network models using digital watermarking: a comparative study,
Multimed. Tools Appl. 81 (11) (2022) 15961–15975.
[7] L. Li, W. Zhang, M. Barni, Universal BlackMarks: Key-Image-Free Blackbox Multi-Bit Watermarking of Deep Neural Networks, IEEE Signal Process Lett. (2023).
[8] G. Zhao, C. Qin, H. Yao, Y. Han, DNN self-embedding watermarking: Towards tampering detection and parameter recovery for deep neural network, Pattern
Recogn. Lett. 164 (2022) 16–22.
[9] L. Zhu, X. Wen, L. Mo, J. Ma, D. Wang, Robust location-secured high-definition image watermarking based on key-point detection and deep learning, Optik 248
(2021), 168194.
[10] U.A. Bhatti, Z. Yu, J. Chanussot, Z. Zeeshan, L. Yuan, W. Luo, A. Mehmood, Local similarity-based spatial–spectral fusion hyperspectral image classification with
deep CNN and Gabor filtering, IEEE Trans. Geosci. Remote Sens. 60 (2021) 1–15.
[11] S. Lee, W. Song, S. Jana, M. Cha, S. Son, Evaluating the robustness of trigger set-based watermarks embedded in deep neural networks, IEEE Trans. Dependable
Secure Comput. (2022).
[12] Adi, Y., Baum, C., Cisse, M., Pinkas, B., & Keshet, J. (2018). “Turning your weakness into a strength: Watermarking deep neural networks by backdooring”. In
27th {USENIX} Security Symposium ({USENIX} Security 18) (pp. 1615-1631).
[13] C. Yan, B. Gong, Y. Wei, Y. Gao, Deep multi-view enhancement hashing for image retrieval, IEEE Trans. Pattern Anal. Mach. Intell. 43 (4) (2020) 1445–1451.
[14] J. Zhang, Z. Gu, J. Jang, H. Wu, M.P. Stoecklin, H. Huang, I. Molloy, May). “Protecting intellectual property of deep neural networks with watermarking”, in: In
Proceedings of the 2018 on Asia Conference on Computer and Communications Security, 2018, pp. 159–172.
[15] S.S. Sharma, V. Chandrasekaran, A robust hybrid digital watermarking technique against a powerful CNN-based adversarial attack, Multimed. Tools Appl. 79
(43–44) (2020) 32769–32790.
[16] Nam, S. H., Yu, I. J., Mun, S. M., Kim, D., & Ahn, W. (2020). “WAN: Watermarking attack network”. arXiv preprint arXiv:2008.06255.
[17] Haribabu, K., Subrahmanyam, G. R. K. S., & Mishra, D. (2015, December). “A robust digital image watermarking technique using auto encoder based
convolutional neural networks”. In 2015 IEEE Workshop on Computational Intelligence: Theories, Applications and Future Directions (WCI) (pp. 1-6). IEEE.
[18] L. Geng, W. Zhang, H. Chen, H. Fang, N. Yu, Real-time attacks on robust watermarking tools in the wild by CNN, J. Real-Time Image Proc. 17 (2020) 631–641.
[19] E. Quiring, K. Rieck, in: September). “adversarial Machine Learning against Digital Watermarking”, IEEE, 2018, pp. 519–523.
[20] U.A. Bhatti, Z. Yu, J. Li, S.A. Nawaz, A. Mehmood, K. Zhang, L. Yuan, Hybrid watermarking algorithm using clifford algebra with Arnold scrambling and chaotic
encryption, IEEE Access 8 (2020) 76386–76398.
[21] H. Kandi, D. Mishra, S.R.S. Gorthi, Exploring the learning capabilities of convolutional neural networks for robust image watermarking, Comput. Secur. 65
(2017) 247–268.
[22] J. Fonseca-Bustos, K.A. Ramírez-Gutiérrez, C. Feregrino-Uribe, Robust image hashing for content identification through contrastive self-supervised learning,
Neural Netw. 156 (2022) 81–94.
[23] Fierro-Radilla, A., Nakano-Miyatake, M., Cedillo-Hernandez, M., Cleofas-Sanchez, L., & Perez-Meana, H. (2019, May). “A robust image zero-watermarking using
convolutional neural networks”. In 2019 7th International Workshop on Biometrics and Forensics (IWBF) (pp. 1-5). IEEE.
[24] K. Hao, G. Feng, X. Zhang, Robust image watermarking based on generative adversarial network, China Commun. 17 (11) (2020) 131–140.
[25] Baluja, S. (2017). “Hiding images in plain sight: Deep steganography”. Advances in neural information processing systems, 30.
[26] L. Meng, L. Liu, G. Tian, X. Wang, An adaptive reversible watermarking in IWT domain, Multimed. Tools Appl. 80 (2021) 711–735.
[27] L. Liu, L. Meng, Y. Peng, X. Wang, A data hiding scheme based on U-Net and wavelet transform, Knowl.-Based Syst. 223 (2021), 107022.
[28] C. Annadurai, I. Nelson, K.N. Devi, R. Manikandan, A.H. Gandomi, Image Watermarking Based Data Hiding by Discrete Wavelet Transform Quantization Model
with Convolutional Generative Adversarial Architectures, Appl. Sci. 13 (2) (2023) 804.
[29] C. Yan, T. Teng, Y. Liu, Y. Zhang, H. Wang, X. Ji, Precise no-reference image quality evaluation based on distortion identification, ACM Trans. Multimedia
Comput. Commun. Appl. (TOMM) 17 (3s) (2021) 1–21.
[30] L. Wang, H. Ji, A Watermarking Optimization Method Based on Matrix Decomposition and DWT for Multi-Size Images, Electronics 11 (13) (2022) 2027.
[31] R. Indraswari, R. Rokhana, W. Herulambang, Melanoma image classification based on MobileNetV2 network, Procedia Comput. Sci. 197 (2022) 198–207.
[32] Takore, T. T., Kumar, P. R., & Devi, G. L. (2016, March). “A modified blind image watermarking scheme based on DWT, DCT and SVD domain using GA to
optimize robustness”. In 2016 international conference on electrical, electronics, and optimization techniques (ICEEOT) (pp. 2725-2729). IEEE.
[33] https://commons.wikimedia.org/wiki/File:Logistic_Map_Bifurcation_Diagram,_Matplotlib.svg.
[34] Yi, D., Li, J., Fang, Y., Cui, W., Xiao, X., Bhatti, U. A., & Han, B. (2021). “A robust zero-watermarkinging algorithm based on PHTs-DCT for medical images in the
encrypted domain”. In Innovation in Medicine and Healthcare: Proceedings of 9th KES-InMed 2021 (pp. 101-113). Springer Singapore.
[35] C. Zeng, J. Liu, J. Li, J. Cheng, J. Zhou, S.A. Nawaz, U.A. Bhatti, Multi-watermarking algorithm for medical image based on KAZE-DCT, J. Ambient Intell. Hum.
Comput. (2022) 1–9.
[36] S.A. Nawaz, J. Li, U.A. Bhatti, A. Mehmood, M.U. Shoukat, M.A. Bhatti, Advance hybrid medical watermarking algorithm using speeded up robust features and
discrete cosine transform, PLoS One 15 (6) (2020) e0232902.
[37] Y. Fan, J. Li, U.A. Bhatti, C. Shao, C. Gong, J. Cheng, Y. Chen, A Multi-Watermarking Algorithm for Medical Images Using Inception V3 and DCT, Comput.
Mater. Continua 74 (1) (2023).

13