A novel robust zero-watermarking algorithm for medical images

(1)

https://doi.org/10.1007/s00371-021-02168-5 O R I G I N A L A R T I C L E

A novel robust zero-watermarking algorithm for medical images

Kun Hu¹·Xiaochao Wang² ·Jianping Hu³·Hongfei Wang⁴·Hong Qin⁵

Accepted: 18 May 2021 / Published online: 1 June 2021

Abstract

A novel robust zero-watermarking algorithm for medical images is presented in this paper. The multi-scale decomposition of bi-dimensional empirical mode decomposition (BEMD) has exhibited many attractive properties that enable the proposed algorithm to robustly detect the tampering regions and protect the copyright of medical images simultaneously. Given a medical image, we first decompose a medical image adaptively into a finite number of intrinsic mode functions (IMFs) and a residue, by taking a full advantage of BEMD. The first IMF starts with the finest scale retaining fragile information and is best suitable for tampering detection, while the residue includes robust information at the coarser scale and is applied to the protection of intellectual property rights of medical images. Next, the feature matrices are extracted from the first IMF and the residue via singular value decomposition, which achieves robust performance subject to most attacks. For a given watermark image, it is encrypted by Arnold transform to enhance the security of the watermark. Then, the feature images are constructed by performing the exclusive-or operation between the encrypted watermark image and the extracted feature matrices. Finally, the feature images are securely stored in the copyright authentication database to be further used for copyright authentication and tampering detection. A large number of experimental results and comparisons with existing watermarking algorithms confirm that the newly proposed watermarking algorithm not only has strong ability on tampering detection, but also has better performance in combating various attacks, including cropping, Gaussian noise, median filtering, image enhancement attacks, etc. The newly developed algorithm also shows great promise in processing natural images.

Keywords Medical images · Zero-watermarking · Bi-dimensional empirical mode decomposition · Singular value decomposition·Tampering detection

B

Xiaochao Wang

wangxiaochao18@163.com

B

Hongfei Wang whf@csu.ac.cn Kun Hu

ucas_hukun@163.com Jianping Hu

neduhjp307@163.com Hong Qin

qin@cs.stonybrook.edu

1 Chinese Academy of Sciences, Beijing 100049, China

2 School of Mathematical Sciences, Tiangong University, Tianjin 300387, China

3 School of Sciences , Northeast Electric Power University, Jilin 132012, China

4 Key Laboratory of Space Utilization, Technology and Engineering Center for Space Utilization, Chinese Academy of Sciences, Beijing 100094, China

1 Introduction and motivation

Digital medical images store patient’s private information and play a vital role in disease diagnosis [6,10]. Hence, the protection of patients’ private information is of utmost importance to medical information system, because medical images might be duplicated, disseminated, and tampered by unauthorized individuals. To best protect the propri- etary rights of the patient’s medical images from being abused, digital image watermarking has been widely stud- ied [13,16,17,22,33,34].

Traditional watermarking algorithms provide the copyright protection by embedding watermarks into the host image, which may bring three main problems for medical images due to their special requirements. First, inserting information into the host image inevitably modifies the orig-

5 Department of Computer Science, Stony Brook University, Stony Brook, NY 11794-4400, USA

(2)

inal host image, which may cause doctor’s misdiagnosis due to any content modification. Second, the inserting scheme causes traditional watermarking algorithms hard to balance the robustness and the imperceptibility. Third, very few watermarking algorithms consider the copyright protection and the tampering detection simultaneously.

To combat the aforementioned problems, we develop a robust zero-watermarking algorithm for medical images with tampering detection by integrating the bi-dimensional empirical mode decomposition (BEMD) and singular value decomposition (SVD) in a seamless fashion. The proposed algorithm uses the zero-watermarking scheme that does not cause any content modification to the host image and effectively protects the integrity of the medical images. In fact, it can be applied to non-medical images as well. The attractive properties of BEMD are fully exploited to adaptively decompose the medical image into a finite number of intrinsic mode functions (IMFs) and a residue. This data-adaptive multi-scale decomposition makes the proposed algorithm ideal to handle tampering detection and copyright protection simultaneously. The first IMF starts with the finest scale and is best suitable for tampering detection. At the same time, the residue contains critical information at a coarser scale that is applied to protect the intellectual property rights of the medical images. Then, the feature matrices are extracted from the first IMF and the residue via singular value decomposition (SVD), respectively. For watermark image, it is encrypted by Arnold transform to enhance the security of the watermark. After that, the feature images are constructed by conducting the exclusive-or (XOR) operation between the encrypted watermark image and the extracted feature matrices. Finally, the feature images are securely stored in the copyright authentication database to be further employed for copyright authentication and tampering detection. We conduct extensive experiments and thorough comparisons to verify the efficiency and robustness of the newly-proposed zero-watermarking algorithm. The pipeline of the proposed algorithm is illustrated in Fig.1. The salient contributions of this paper are summarized as follows:

– A novel robust zero-watermarking algorithm for medical images is developed by utilizing BEMD and SVD, which effectively protects the copyright of medical images without any content change of the involved images.

– The newly proposed watermarking algorithm can not only detect whether the medical images are tampered or not, but also precisely locate the position of the tampering region, which enhances the effectiveness of algorithm.

– The proposed zero-watermarking algorithm also exhibits good robustness for copyright protection and tampering detection against various attacks, such as high-intensity noise, cropping, median filtering, and image enhancement attacks.

2 Related works

In the literature, plenty of medical image watermarking algorithms have been proposed, which are briefly introduced in this section, including robust watermarking algorithm, zero- watermarking algorithms, and tampering detection algorithms for medical images.

2.1 Robust medical image watermarking algorithms In robust medical image watermarking, Thanki et al. [26]

applied Fast Discrete Curvelet Transform to get different frequency coefficients. This method is robust to geomet- ric attacks, signal processing attacks, and JPEG compression attacks. However, it is limited against Gaussian noise and Pepper & salt noise. The resistance to noise attacks is also work not well in [39], which combines discrete cosine transform (DCT), SVD and discrete wavelet transform (DWT). Singh et al. [24] presented a watermarking algorithm based on spread spectrum by using selective DWT and pseudo-noise sequence. Wang et al. [29] proposed a multi- watermarking algorithm based on minimum Bayesian risk criterion of hybrid multi-bit multiplicative rules. The DWT coefficients are modelled as the generalized Gaussian distri- bution. These two algorithms do not perform very well in terms of robustness.

2.2 Zero-watermarking medical image algorithms Zero-watermarking algorithms do not alter the medical image but protect copyright, which are favoured. Liu et al. [16] proposed a zero-watermarking algorithm by using dual-tree complex wavelet transform and discrete cosine transform. This algorithm performs well under most image attacks, but performs mediocre for high-intensity Gaussian noise attacks, median filtering and rotation attacks. Wu et al.

[35] proposed a multiple watermarking algorithm for medical image based on contourlet transform and DCT. The proposed algorithm is resistant to most of the image attacks, but it is less robust in cropping attacks. Cedillo et al. [3] proposed a zero- watermarking algorithm, which creates a bridge between patient information, medical images and patient diagnosis.

This algorithm performs in the frequency domain by encod- ing and encrypting the watermark information. Qin et al. [23]

developed a zero-watermarking algorithm based on Curvelet- DCT to extract the visual feature vectors and pseudo-random sequence to encrypt the watermark. Although it has good robustness under many attacks, it does not perform well on cropping attacks and Gaussian noise attack.

(3)

2.3 Tampering detection of medical images

Swaraja et al. [25] combined DWT, Schur transform and Par- ticle Swarm Bacterial Foraging Optimization algorithm to propose a dual watermarking algorithm on medical image with the ability to detect tampering and authenticity. Alshan- bari [2] proposed a principal component-based copyright protection scheme to make the algorithm secure, and LZW- based fragile watermarking makes the algorithm capable of detecting tampering. Since the algorithm embeds fragile information into the ROI region of medical images, it makes the algorithm well reversibility, imperceptible, and robust. Hurrah et al. [12] proposed a novel reversible medical image authentication scheme for medical tamper detection and copyright authentication. Comparison results with similar schemes show the superiority of the scheme in terms of imperceptivity and fragility. However, the robustness of the algorithm is not good and tampering detection does not work well.

3 Proposed zero-watermarking algorithm

First, the overview of the proposed zero-watermarking algorithm is given; then, zero-watermarking construction is introduced in detail.

3.1 Overview of zero-watermarking

Given a grey imageH(x,y)with the sizem×nas the host image and a binary watermark imageW(x,y)with the size p×q, Fig.1illustrates the overview of the newly proposed algorithm by taking the Skull as the host image and the Ele- phant as the watermark image. For the host imageH(x,y) (Fig.1a), it is first decomposed into multi-scale representa- tion of IMFs and a residue by BEMD (Fig.1b). Then, the first

IMF (denoted asI M F1) and residueResare decomposed by SVD with the window sizeL. The larger value in the upper left corner of the singular matrix S is selected to construct the matrixesIandRwith size ofm/L×n/L(Fig.1c). After that, both of the matrices I andRare performed by binary operation (Fig.1d), denoted asIandR. At the same time, the watermark imageWis encrypted to obtainWA, and repeat the encrypted imageu=m/(pL)×v=n/(q L)times to the same size as theI (Fig.1g). Finally, the feature imagesF_I andF_R (Fig.1i) are obtained by performing XOR operation between theWAwithIandR, respectively.

3.2 Bi-dimensional empirical mode decomposition EMD was first developed by Huang et al. [11] and has become an effective and powerful tool for analysing nonlinear and non-stationary signals. It decomposes the signal into a finite sum of frequency components, namely IMFs and a residue, which ranges from higher frequency to lower frequency.

Unlike traditional Fourier and wavelet transform methods, it usually decomposes a signal in different scales using pre- defined basis functions, while EMD expresses a signal as expansion of IMFs, which is a fully adaptive and data-driven decomposition algorithm. For its good properties and ease of implementation, EMD has captured much attention and has been widely applied in 1D signal processing [4,5,11,14], 2D image processing [1,21,33,36,38], and 3D geometry processing [8,9,28,30–32,40].

BEMD is a natural generalization of one-dimensional EMD for two-dimensional image processing. Similar to one- dimensional EMD, BEMD is also achieved by the sifting processing, which involves the main steps of local extreme extraction, envelope computation, and stopping criteria of the sifting. Given an imageH(x,y),H(x,y)can be presented as

Fig. 1 Flowchart of zero-watermarking algorithm.aHost image.bI M F₁and the residue.cSVD.dBinarization.eWatermark image.fArnold transform.gRepeat watermark images.hXOR operation.iFeature images

(4)

H(x,y)= K

k=1

I M Fk(x,y)+Res(x,y), (1)

where K is the total number of the IMFs and I M Fk is the kth IMF.Resis the final residue of the image. More details of BEMD can be referred to [8,28].

Figure2shows the decomposition result by BEMD. Each IMF component represents a connotative modal component that exists in the original image. Usually, the leading IMFs contain the high-frequency details of the image and the residue contains the low-frequency information of the image, reflecting the overall shape of the image. The multi-scale decomposition of BEMD makes our algorithm can detect tampering and protect the copyright of medical images at the same time. Therefore, BEMD is adopted in our zero- watermarking algorithm.

3.3 Feature images construction

Host imageHis a grey-scale image with the size ofm× n, and the watermark imageWis a binary image with the size of p×q. To promote the decomposition efficiency of BEMD,I M F1is first generated from the host imageH, and the remaining part is left as residueRes, which means that K = 1 in Eq.1.I M F1 is suitable for tampering detection since it contains rich textures of the original host image, and the residue Res is relatively stable and suitable for robust algorithm.

Divide I M F1and Resinto M ×N blocks with size of L×L, withM =m/L,N =n/LandL=2. Then,I M F1

andResare decomposed by the SVD [18] with window size ofL×L, and the first values in the upper left corner of the matrixSare used to obtain the feature matricesIandR. The maximum eigenvalue contains most of the information of the decomposed image, which is stable under most attacks, and enhances the robust of the constructed feature image.

Fig. 2 BEMD.aInput Image.b–gFromI M F₁toI M F₆.fResidue

After that, the matricesIandRare binarized to get matri- cesI andRby the following rules

I x,y

=

1, i f I x,y

≥ IM

0, ot herwi se. (2)

R x,y

=

1, i f R x,y

≥RM

where 0 ≤ x ≤ M −1,0 ≤ y ≤ N −1, IM and RM are the mean of the matricesI andR.

At the same time, the watermark imageWis encrypted to obtainW A(i,j)by Arnold transform Eq.4.

i j

= 1 1

1 2 i j

mod(p), (4)

whereiand jrepresent the position after shifting from the original position ofi and j.p is the row size of watermark image;mod(p)denotes the modulus operation division byp.

After Arnold transform, the correlations between the image pixels are damaged and no meaningful information can be directly observed. Figure3 shows a watermark image and the result after Arnold transform, respectively. The times of Arnold transformation in this paper is chosen to be 5.

In order to further improve the robustness of the algorithm, the strategy of repeatable duplicate embedding [33] is adopted in this paper. The encrypted imageW Ais duplicated M/p×N/qtimes to the same size as the host image, namely W A.

Finally, we obtain feature imagesF_I andF_R by performing XOR operation [27] betweenW AwithI andR.

X O R(A,B)=

1, i f A=1||B=1

Fig. 3 Watermark image with a size of 32×32 recovered after 8 times Arnold transformations. Only the results of the transformation after 1, 3, 5, 7, and 8 times are shown

(5)

These feature images are stored in the copyright authentication database for further copyright protection and temper- ing detection. The process of the proposed zero-watermarking algorithm is shown in Algorithm1.

Algorithm 1Zero-watermarking algorithm

Notes: Since tampering and robust feature image operations are similar, only the tampering part for I M F₁ of the algorithm is described.

Input:Host imageHof size(m×n); Binary watermark imageWof size(p×q); SVD block sizeL×L;

Output:Feature ImageF_I(m/L×n/L)

1: Perform BEMD onH(x,y),0 ≤x ≤m−1,0≤ y≤n−1 to obtainI M F₁and theRes;

2: DivideI M F₁intoM×Nblocks with size ofL×L, which means M=m/LandN =n/L;

3:fori = 0 toM−1do 4: forj = 0 toN−1do

5: For each small block ofI M F₁using SVD, namedI(x,y)= {I(x,y),0≤x≤M−1,0≤y≤N−1};

6: end for 7:end for

8: Calculate mean value ofI to obtain I_M, and binary theI to get I(x,y);

9: Encrypt the watermark imageWwith size ofp×qby using Arnold transform to obtainW A;

10: RepeatM/p×N/qtimes of the watermark imageW Ato get the same size image as the host imageH, namedW Awith size ofM×N; 11: Perform an XOR operation onW AandI to obtain feature image

F_I(x,y).

4 Watermark extraction and tampering detection

At the stages of watermark extraction and tampering detection, for the watermarked imageHwith size ofm×n, which may be modified by various attacks or tampering, we first decomposeHtoI M F₁andResby BEMD. The extraction

algorithm and tampering detection flowchart are shown in Fig.4.

4.1 Watermark extraction

For watermark extraction,Resis divided intoM×Nblocks with window size ofL×L. The SVD is performed for each block, and the upper left corner values of the singular matrix S are selected to construct matrix R. Then, the matrix R is binarized to get R. After that, we perform XOR operation between the matrix R and feature image F_R stored in copyright authentication database to obtain the matrix W A (Fig.4c). Because W A contains the multiple watermarks,W Ashould be divided intoM/p×N/qsub-matrices W A_kl(i,j) = {W A_kl(i,j),0 ≤ i ≤ p −1,0 ≤ j ≤ q−1,0≤k≤M/p−1,0≤l≤N/q−1.W A∈ {0,1}}. Then, the voting strategy is carried out to extract the image W.

E(i,j)=

M/p−1

k=0 N/p−1

l=0

W A_kl(i,j) , (6) W(i,j)=

1, i f E(i,j)≥ ^M⁺₂^N

Finally, the inverse Arnold transform (Fig.4e) acts onW to obtainW. The process of watermark extraction is shown in Algorithm2.

4.2 Tampering detection

In tampering detection, I M F₁ of the watermarked image His utilized to extracted the watermark imageW F(x,y) as the process of the watermark extraction described in the above section. To locate the potential tampering regions, the watermark imageW Fis divided intoM/p×N/q blocks, namely W F^k^,^l(i,j)(Fig. 4g); NC value of each block is calculated between each block with the corresponding block

Fig. 4 Flowchart of watermark extraction and tampering detection algorithm.aWatermarked image.bPreprocessing, including BEMD, SVD, and Binary, which is same as b, c, and d of Fig.1.cXOR with

feature images.dVoting strategy according to Eqs.6and7.eInverse Arnold transform.fExtracted watermark image Elephant.gTampering detection

(6)

Algorithm 2Watermark extraction

Input:Watermarked imageH(m×n); Feature imageF_R Output:Extracted watermarkW(p×q)

1: Perform BEMD onH(x,y),0 ≤x ≤m−1,0≤ y≤n−1 to obtainI M F₁and theRes;

2: DivideResintoM×Nblocks with window size ofL×L;

3:fori=0 toM−1do 4: forj=0 toN−1do

5: Perform SVD onResto obtainR(x,y),0≤x≤M−1,0≤ y≤N−1;

8: Binarize theRto getR(x,y);

9: Apply XOR with the feature imageF_R andRto getW A 10: DivideW AintoM/p×N/qblocks to with size ofp×q;

11: Sum all the watermark images and conduct voting strategies to get imageW, as shown in Eq.6and Eq.7.

12: Apply inverse Arnold transform onWto obtain final watermark imageW.

in watermark imageWextracted from the above watermark extraction,

N C(k,l)=

p i=1

q

j=1W F^k^,^l(i,j)W(i,j)

p i=1

q

j=1W F^k^,^l(i,j)² _i^p₌₁ ^q_j₌₁W(i,j)², (8) where p and q denote the number of row and column of the extracted watermark image W(i,j) (Fig. 4f) and W F^k^,^l(i,j)is the block image in rowkand columnl. If there is one NC value of the blockN C(k,l)≤α, we consider that the image has been tampered. For the high robustness of the proposed zero-watermarking algorithm, theαis set to 0.98 in our work.

In practice, the NC values of the blocks with tampering attacks are significantly lower than the values of other blocks.

To locate the tampering regions, all divided blocks are clas- sified into two classes according to their NC values by the k-means algorithm [19], and the class with the smaller mean value is determined to be the tampered block. Figure5shows the original host image and the detection result after tampering with two blocks. Grids are numbered from top to bottom from left to right. Both tampered blocks are detected and identified using the red numbers. As shown in Fig.5, the area involved in the red number is successfully detected and the specific location can be accurately located. The process of watermark extraction is shown in Algorithm3.

5 Experimental results and discussions

In this section, the images used in the experiment are described and metrics for evaluating the algorithm are first given. Then, we demonstrate the effectiveness of tampering

Fig. 5 Tampered image with two tampered blocks. The yellow numbers represent the block numbers, and the red numbers represent tampered results

Algorithm 3Tampering detection

Input:Watermarked imageH(m×n); Feature imageF_I; Watermark imageWextracted from Algorithm 2

Output:Tampered regions.

1: Perform BEMD onH(x,y),0≤x≤m−1,0≤y≤n−1 to obtainI M F₁and theRes;

2: DivideI M F₁intoM×N blocks with window size ofL×L;

3: Perform SVD onI M F₁to obtainI(x,y),0≤x≤M−1,0≤ y≤N−1;

4: Binarize theIto getI(x,y);

5: Calculate the XOR values according to Eq.5betweenI(x,y)and F_I(x,y), namedW F(x,y);

6:fork=0 toM/p−1do 7: forl=0 toN/q−1do

8: Calculate the NC values according to Eq.8betweenW(i,j) andW F^k,l(i,j), namedN C(k,l);

11:if∀kandl,∃N C(k,l)≤αthen

12: The 16 blocks are divided into two classes using k-means. The class with the smaller mean was identified as having been tampered with;

13:else

14: The image has not been tampered with;

15:end if

detection. Afterward, the robustness of the algorithm is veri- fied against various attacks, including filtering attacks, noise attacks, and image enhancement attacks. In order to further illustrate the robustness of the proposed algorithm, several related watermarking algorithms are selected for comparison.

(7)

5.1 Experiment preparations

Host images used in this paper are selected from website (https://radiopaedia.org/), and most of the watermark images are selected from website (https://www.iconfinder.

com/), shown in Fig.6. Figure6l shows a watermark image containing virtual patient information, such as name, age, phone number, illness, and so on. All experimental results shown in this paper are carried out on Matlab2016a 32bit on a Laptop with the Intel Core i5-7300HQ CPU @ 2.50 GHz with 8.0 GB memory. In order to measure the robustness of our method, different attacks on the watermarked images are simulated and the extracted watermarks after the attacks are evaluated by normalized cross-correlation (NC), which

Fig. 6 Selected host images with the size of 512×512 and four watermark images with the size of 64×64.aBrain.bBreasts.cAbdominal.d Nasal.eOrbits.fSkull.gSpine.hOvarian.iDrugs.jCAD.kElephant.

lInfo

Table 1 Abbreviations for 12 kinds of attacks

Classes Full name of attack type Abbreviation Filtering attacks Gaussian low pass Filtering GF

Median filtering MF

Wiener filtering WF

Average filtering AF

Noise attacks Pepper & salt Noise PN

Speckle noise SN

Gaussian noise GN

Image enhancement attacks

Sharpening SH

Histogram equalization HE

Gamma correction GC

JPEG compression JC

Scaling SC

is defined in Eq. 8. NC value approximates to 1 when the extracted watermark closes to the original watermark. The abbreviations of attacks are listed in Table1.

5.2 Tampering detection

In this section, tampering detection is conducted on medical images and natural images database to illustrate the effectiveness of the proposed algorithm. There is no complete and mature dataset of tampered medical images. To illustrate the reliability of the algorithm in this paper for tampered image detection, existing natural image dataset is selected for experiments.

Eight medical images are subjected to three kinds of random tampering. Despite the complexity of tampering regions, some of which contain multiple blocks, the algorithm can still successfully detected with the success rate of 95.84%. Fig- ure7shows the tampering detection results for six medical images. The results in Fig.8show that the algorithm in this paper can detect and accurately locate tampering regions for a single small block and multiple small blocks.

Fig. 7 Display of tampering detection results for medical image datasets. From left to right, the tampered image and the detection result, the original images are shown in Fig.6

92.73%

94.55% 94.55%

96.36%

90%

91%

92%

93%

94%

95%

96%

97%

Canon_60D Nikon_D90 Nikon_D7000 Sony_A57

Detection success rate

Database Name

Fig. 8 Natural image database detection results

(8)

Table 2 NC results of extracted watermark images with eight different host images and watermark image Elephant under the twelve attacks

Attck&Host Brain breasts Abdominal Nasal Orbits Skull Spine Ovarian

GF-[3,3] 1.000 1.000 1.000 1.000 1.000 1.000 1.000 1.000

MF-[3,3] 1.000 1.000 1.000 1.000 1.000 1.000 1.000 1.000

WF-[3,3] 1.000 1.000 1.000 1.000 1.000 1.000 1.000 1.000

AF-[3,3] 1.000 1.000 1.000 1.000 1.000 1.000 1.000 1.000

PN-0.05 1.000 0.994 0.999 0.984 0.987 0.968 1.000 0.996

SN-0.005 1.000 1.000 1.000 1.000 1.000 1.000 1.000 1.000

GN-0.01 1.000 1.000 1.000 1.000 1.000 1.000 1.000 1.000

SH-3 1.000 1.000 1.000 1.000 1.000 1.000 1.000 1.000

HE-64 1.000 1.000 1.000 1.000 1.000 1.000 1.000 1.000

GC-3 1.000 0.982 1.000 0.933 0.999 0.989 1.000 0.996

JC-60 1.000 1.000 1.000 1.000 1.000 1.000 1.000 1.000

SC-4 1.000 1.000 1.000 1.000 1.000 1.000 1.000 1.000

Table 3 NC results of extracted watermark images under four different filtering attacks with six kinds of windows size using CAD watermark image and host image Spine

Window size Attack types

GF MF WF AF

[3,3] 1.0000 1.0000 1.0000 1.0000

[5,5] 1.0000 0.9998 1.0000 1.0000

[7,7] 1.0000 0.9996 1.0000 1.0000

[9,9] 1.0000 0.9994 1.0000 1.0000

[11,11] 1.0000 0.9994 1.0000 0.9998

[13,13] 1.0000 0.9996 1.0000 0.9998

The tampering public database (https://pkorus.pl/down loads/dataset-realistic-tampering) used in this paper contains 220 natural images, which contains a variety of challenging tampering scenarios. Some of the images are shown in Fig.8 shows that the tampering detection results with success rate.

The highest success rate is 96.36% and all the success rates are larger than 92%, which illustrates the proposed algorithm performs well in tampering detection.

5.3 Robustness evaluations

In order to evaluate the robustness of the proposed watermarking algorithm, twelve kinds of image processing attacks are applied on different watermarked images.

Filter attacksTable2shows the NC values of eight different host images and watermark image Elephant under various attacks. From the table, we can see that more than 100% of the NC values are 1, which indicates the watermark images are completely extracted and illustrates the proposed algorithm has good resistance to filtering attacks. To further verify the ability of the algorithm to resist filtering attacks, the window size of filtering is increased from 3×3 to 13×13. The NC val-

Fig. 9 NC values of extracted watermark images. Median filtering window sizes of 7×7,9×9,11×11 and 13×13 with host image (Obits) and watermark image (Drugs)

ues of them are listed in Table3and the extracted watermark images under Median Filtering are shown in Fig.9. Table3 and Fig.9show that the NC values of the extracted watermark images are all larger than 0.999, and the watermark images can be clearly extracted, which further demonstrates our algorithm can resist to filtering attacks.

Noise attacks As shown in Table2, the Pepper & salt Noise has a greater degree of damage to the algorithm, and the other two noises have no effect on the algorithm on small intensity attacks. Increasing the attack intensity to 0.1 and 0.15, the results are shown in Fig.10. It can be seen that the watermark image can be completely extracted under Speckle Noise attacks, and the NC values of them are all 1. Although there are few speckles appearing on the extracted watermark images under the attacks of Gaussian Noise, Pepper & salt Noise, the extracted watermark images can be well identified and the NC values of them are larger than 0.99. The experiment results show the ability of our method to against noise attacks.

Image enhancement attacks Four common image enhancement attacks, including Sharpening attack, His-

(9)

Fig. 10 NC values of extracted watermark images under noise attacks with host image (Brain) and watermark image (CAD)

togram Equalization, Gamma Correction, and JPEG Com- pression, are used to test the algorithms. From Table2, we can see that NC values of the extracted watermark images are 1 under attacks fo Sharpening, Histogram Equalization and JPEG Compression. Although the NC values of the watermark extracted by the Gamma Correction attack and the original watermark information are not 1, most of them are all above 0.98. It indicates that the algorithm in this paper has good robustness to the attacks of image enhancement attacks. Figure11shows the extracted watermark images and the corresponding NC value results after the Gamma Correc- tion attacks on eight different host images. As can be seen from the results, the extracted watermark images are clearly recognized.

Fig. 11 NC values of eight host images with watermark images Ele- phants extracted after the Gamma Correction attack with intensities of 3. The order from left to right from top to bottom is the same as that of Fig.6

5.4 Comparisons with previous algorithms

In this subsection, we first compare seven robust medical image watermarking algorithms [16,20,24,26,29,37,39].

Then, two zero-watermarking medical image algorithms are compared [3,23]. Finally, the robustness three related tampering detection algorithms are compared [2,12,25].

Comparison with robust medical image watermarking algorithmsIn order to evaluate the efficiency and advantage of the proposed watermarking algorithm, we first compare our algorithm with robust medical image watermarking algorithms. From Table4, we can see that for Gaussian Noise attacks, both of [24] and [16] are able to achieve N C = 1 with proposed algorithm at an intensity of 1%. The algorithm [37] cannot against Gaussian Noise attack and obtains the worse performance with the NC value 0.74, while our algorithm and [24] and [16] perform better on small intensities of Gaussian Noise attacks. When the intensity of Gaussian Noise increases to 10%, the NC value of the algorithm [16]

drops to 0.90 and the NC value of the algorithm [24] drops to 0.97. In contrast, our proposed algorithm still maintains N C =1 under the attack of 10% Gaussian Noise. Further- more, when intensity of Gaussian noise increases to 25%, our algorithm can still extract the watermark image completely and the NC value of the extracted watermarked image with the original watermark image is 1, while the NC values of the other algorithms are all below 0.9.

The smaller the intensity of the JPEG Compression attack, the more severe the breakage of the image. From Table4, we can see that at 4% intensity, the proposed algorithm outperforms all other algorithms and achieves maximum NC value 1. Algorithm [16] obtains the better performance than other algorithms; however, the NC value of it is just 0.84.

As the intensity increases and JPEG Compression becomes less destructive to the host image, with an intensity of 15%

or 25%, the NC value of each algorithm rises, only the algorithm [16] reaches a NC value of 1, performing as well as our algorithm. Other five algorithms still obtain the NC value smaller than 0.95, which indicates that these algorithms can against JPEG Compression attach even in low intensity. Our proposed algorithm has good resistance to JPEG Compres- sion than other compared algorithms.

For Median Filtering, Table 4 shows that as the filter window gradually increases, the NC values extracted by the algorithms keep decreasing and the magnitude of the decrease varies among the compared algorithms. For exam- ple, the NC values extracted by algorithm [39] and [37] for small windows are very small, below 0.3. The NC values extracted by algorithms [16,24,26] for a window size of 3×3 are above 0.9, and the best value is 0.97, while, when the filter window sizes are 3×3 and 5×5, the NC values of our algorithm are 1. As the filter window size is 9×9, the NC

(10)

Table 4 NC results of the extracted watermarks compared with six related watermarking algorithms

Attacks Intensity Zear [39] Thanki [26] Wang [29] Yuan [37] Singh [24] Liu [16] Proposed

GN 1% 0.88 0.86 0.92 0.74 1.00 1.00 1.00

10% 0.79 0.78 0.88 0.64 0.97 0.90 1.00

25% 0.63 0.65 0.81 0.52 0.88 0.86 1.00

JC 4% 0.11 NAN 0.32 0.81 0.51 0.84 1.00

6–8% 0.31 0.11 0.77 0.51 0.97 0.90 1.00

15–25% 0.91 0.47 0.85 0.72 0.95 1.00 1.00

MF [3,3] 0.15 0.91 0.22 0.97 0.89 0.94 1.00

[5,5] 0.04 0.80 0.77 0.17 0.88 0.84 1.00

[9,9] 0.01 0.72 0.69 0.11 0.81 0.82 0.99

The best results in each row are marked in bold

Fig. 12 Comparison results with algorithm [23] under Gaussian Noise and Cropping attacks. The host and watermark images are Ovarian (512×512) and CAD (64×64)

value of our algorithm is 0.99, which is still far better than the results of the other algorithms. In terms of median filtering attacks, our proposed algorithm performs the best results than other algorithms.

Comparison with zero-watermarking algorithmsThe left sub-figure shown in Fig.12gives the comparison results with [23] under Gaussian Noise attacks. Both of our algorithm and the [23] are able to achieveN C=1 at lower intensity of 1%

Gaussian Noise. However, as the intensity increases, the NC value of the [23] keeps decreasing, and it is already below 0.9 from 10%. When the intensity increases to 75%, the NC value is below 0.5; [23] is no longer able to extract the watermarked image. In contrast, our algorithm can still maintain a high NC value under the high intensity Gaussian Noise attack, with an NC value above 0.96 even at 75% intensity. The right sub- figure shown in Fig.12shows the results of the NC values for the Cropping attack. The intensity of the Cropping attack is to clip off the rectangular area from the top left corner of the host image, replacing the pixel values of the rectangular area with 255. It is clear to see that at 9% and 15% Cropping attacks, there is little difference between our algorithm and [23]. However, after 20% Cropping intensity, our algorithm clearly outperforms than [23], achieving NC value of 0.95 at a maximum Cropping intensity of 56%, while the comparison

algorithm [23] does not exceed 0.5. The comparison results show that our algorithm has strong ability to resist Gaussian Noise attacks and Cropping attacks very well.

Comparison with tampering detection algorithmsThree medical image watermarking algorithms [2,12,25] are used for comparison of tampering detection. As shown in Table5, the algorithm proposed in this paper significantly outperforms the results of the other three algorithms on no attack, Median Filtering 3×3, Pepper&Salt Noise 0.01, Gaussian Filtering 3, Sharpening attack, JPEG Compression 20, 50 and 70, and Histogram Equalization attack. Only the results of [25] can equal the results of this paper in Gaussian Noise 0.01, Scaling attack 0.5, and JEPG Compression 30, while all other results are also inferior to the algorithms of this paper.

Comparison with watermarking algorithms on non- medical imagesThe proposed zero-watermarking algorithm can be applied to non-medical images as well. As shown in Table6, [15] performs better under the Gaussian Noise attack and Scaling attack with NC values above 0.98; the results obtained by [41] are not very satisfactory; only the NC value under the Pepper & salt Noise attack is larger than 0.98; [7] achieves NC values above 0.99 under both median filtering and JPEG Compression attacks. The NC values of the extracted watermark images by our algorithm are 1 under seven attacks, and for the Pepper & salt noise, the NC value is 0.9998. The proposed algorithm outperforms than algorithms [7,15,41] under eight attacks, which also indicates that the proposed algorithm has better robustness on non-medical images.

6 Conclusion

In this paper, we have proposed a novel robust zero- watermarking algorithm for medical images, which can detect image tampering and efficiently protect the propri- etary rights of medical images by integrating BEMD with

(11)

Table 5 Comparison with three medical image watermarking algorithms [2,12,25] for tampering detection

Attacks Hurrah [12] Alshanbari [2] Swaraja [25] Proposed

No NAN 0.9216 NAN 1.000

MF-3 0.597 0.9103 NAN 1.000

PS-0.01 0.663 NAN 0.980 1.000

GN-0.01 0.482 NAN 1.000 1.000

GF-3 0.688 0.9191 NAN 1.000

SH(3) 0.547 0.8819 NAN 1.000

SC-0.5 0.524 0.919 1.000 1.000

JC-20 0.446 NAN NAN 1.000

JC-30 NAN NAN 1.000 1.000

JC-50 NAN 0.7574 NAN 1.000

JC-70 NAN 0.8118 NAN 1.000

HE(64) 0.541 NAN 0.890 1.000

NAN represents results without corresponding attack strengths. The host and watermark images used in the experiments are Brian (512×512) and Drugs (64×64), respectively

Table 6 Comparison with watermarking algorithms on non-medical images

Attacks Li [15] Zhou [41] Gong [7] Proposed

GN-0.0002 0.9971 0.9596 NAN 1.0000

GN-0.001 NAN NAN 0.9769 1.0000

PN-0.01 0.9079 0.9899 NAN 0.9998

AF-[3,3] 0.9040 NAN NAN 1.0000

MF-[3,3] 0.9799 0.9541 0.9928 1.0000

GF-[3,3] 0.9554 0.9771 0.9754 1.0000

JC-50 NAN NAN 0.9964 1.0000

SC-0.5 0.9823 0.9321 NAN 1.0000

The host and watermark images are Lena (512×512) and Info (64×64), respectively. The best result in each row is marked in bold

SVD. Taking advantage of the multi-scale decomposition of BEMD, the first IMF retaining rich textures is utilized for tampering detection, while the residue of image is used for copyright protection. To avoid any content modification of the original medical image necessary for any zero-watermarking algorithm, the first IMF and the residue are further decomposed by SVD to obtain the binary feature matrices. For a given watermark image, to improve the security of the watermark image, it is encrypted using the Arnold transform. Then, the feature images are constructed by performing XOR operation between the encrypted watermark image and feature matrices, respectively. Finally, the constructed feature images are securely stored in the copyright authentication database to be further used for copyright authentication and tampering detection. Compared with traditional medical image watermarking algorithms and existing zero-watermarking algorithms, our newly proposed zero-watermarking algorithm not only has stronger robustness against various attacks, including cropping, Gaussian

noise, median filtering, and image enhancement attacks, but also has better performance in tampering detection. Our new algorithm also has great processing and analysis potential in natural images.

Funding This research is supported in part by National Science Founda- tion of USA (IIS-1715985 and IIS-1812606), National Natural Science Foundation of China (Nos. 61532002, 61672077, 61672149, 61802279, 61872347); The Science & Technology Development Fund of Tianjin Education Commission for Higher Education (Grant No. 2018 KJ222);

The Open Project Program of the State Key Lab of CAD&CG (Grant No. A2105), Zhejiang University.

Declarations

Conflict of interest The authors declare no conflict of interest.

References

1. Ali, H., Hariharan, M., Yaacob, S., Adom, A.H.: Facial emotion recognition using empirical mode decomposition. Expert Syst.

Appl.42(3), 1261–1277 (2015)

2. Alshanbari, H.S.: Medical image watermarking for ownership &

tamper detection. Multimed. Tools Appl.80, 16549–16564 (2020) 3. Cedillo-Hernandez, M., Cedillo-Hernandez, A., Nakano- Miyatake, M., Perez-Meana, H.: Improving the management of medical imaging by using robust and secure dual watermarking.

Biomed. Signal Process. Control56(101695), 1–16 (2020) 4. Colominas, M.A., Schlotthauer, G., Torres, M.E.: Improved com-

plete ensemble emd: a suitable tool for biomedical signal processing. Biomed. Signal Process. Control14, 19–29 (2014)

5. Di, C., Yang, X., Wang, X.: A four-stage hybrid model for hydro- logical time series forecasting. PLoS ONE9(8), 1–18 (2014) 6. Fakhari, P., Vahedi, E., Lucas, C.: Protecting patient privacy

from unauthorized release of medical images using a bio-inspired wavelet-based watermarking approach. Dig. Signal Process.21(3), 433–446 (2011)

7. Gong, L.H., Tian, C., Zou, W.P., Zhou, N.R.: Robust and imperceptible watermarking scheme based on canny edge detection and svd