Zero-Watermarking Algorithm for Medical Image Based on VGG19 Deep Convolution Neural Network

Aiming at the security issues in the storage and transmission of medical images in the medical information system, combined with the special requirements of medical images for the protection of lesion areas, this paper proposes a robust zero-watermarking algorithm for medical images' security based on VGG19. First, the pretrained VGG19 is used to extract deep feature maps of medical images, which are fused into the feature image. Second, the feature image is transformed by Fourier transform, and low-frequency coefficients of the Fourier transform are selected to construct the feature matrix of the medical image. Then, based on the low-frequency part of the feature matrix of the medical image, the mean-perceptual hashing algorithm is used to achieve a set of 64-bit binary perceptual hashing values, which can effectively resist local nonlinear geometric attacks. Finally, the algorithm adopts a watermarking image after scrambling and the 64-bit binary perceptual hashing value to obtain robust zero-watermarking. At the same time, the proposed algorithm utilizes Hermite chaotic neural network to scramble the watermarking image for secondary protection, which enhances the security of the algorithm. Compared with the existing related works, the proposed algorithm is simple to implement and can effectively resist local nonlinear geometric attacks, with good robustness, security, and invisibility.


Introduction
With the construction of hospital normalization, digitization is widely applied in the medical field [1]. Modern medical equipment produces lots of digital medical images every day [2,3]. Owing to the rapid development of information technology, intelligent medicine and remote diagnosis are becoming more and more mature [4][5][6]. A large number of medical images are often transmitted through the Internet [7]. Unauthorized persons can easily obtain, store, use, and tamper with medical images on the network [8]. In this scene, sensitive information, such as patient information recorded in medical images, is also easy to leak. With the development of the medical information system, medical image sharing and remote diagnosis technology are becoming more mature [9]. In the application of these techniques, it becomes more and more urgent to protect patient's information, such as personal information in magnetic resonance imaging (MRI) and other medical images, as well as electronic medical record data from being leaked [10,11]. erefore, the problem of medical information security has become an urgent problem.
Medical image watermarking can effectively solve the above problem and provide safe and reliable protection for medical information. Current information security of the medical information system relies on the development of modern information technology [12]. Traditional encryption methods of cryptography have great limitations and high risks. It is unable to identify the copyright of data at the technical level, and it has been unable to adapt to the changing information environment. Digital watermarking is a kind of information security technology, which can be applied to image integrity authentication and image copyright protection [13,14]. Originally, digital watermarking was used for copyright protection of digital multimedia on the Internet. With the increasing demand for information security in the medical field, the invisibility and robustness of digital watermarking are used to hide patient's personal information in the medical image to secure transmission on the Internet. By means of digital watermarking, specific identification information is embedded into carrier images, so that the authenticity and integrity authentication of medical images, Electronic Patient Record (EPR) hiding, and copyright protection can be realized. erefore, medical image watermarking has an extremely important application value, which attracts continuous attention from researchers [15,16].
Medical image watermarking generally chooses different watermarking algorithms according to invisibility, robustness, and embedding capacity. e invisibility, robustness, and capacity of watermarking restrict each other, but most of the current medical image watermarking algorithms only focus on one of them. Medical images are mostly single channel gray images, and the details contained in the pixels are very important. Any changes may cause distortion, which will affect doctor's diagnosis. However, the application of traditional image watermarking to medical images can easily cause the distortion of medical images, which may lead to potential misdiagnosis. In order to reduce the influence of watermarking on the original information of the medical image, it is very important to design a medical image watermarking algorithm which is lossless to the original image. Since the robust zero-watermarking adopts the way of zero-embedding, the original medical image is not modified. While realizing protection, the robust zerowatermarking takes into account the robustness and capacity of the watermarking and will not destroy the integrity of the medical image. erefore, it is very suitable for the medical image [17][18][19].
Robust medical image zero-watermarking mainly focuses on the ability of the algorithm to resist various attacks, that is, the algorithm can completely extract the zerowatermarking information after various attacks [20][21][22]. e geometric attack will change the position relationship between the attacked medical image and the original medical image, resulting in serious out of synchronization between zero-watermarking information and medical images, which makes it is extremely difficult to extract zero-watermarking. erefore, the ability of the algorithm to resist geometric attacks has become a research hotspot in the field of medical image zero-watermarking [1,12]. But these geometric attacks mainly refer to global geometric transformation (rotation, scaling, translation, etc.), which is a kind of linear transformation. However, in practical applications, there is usually another type of geometric attack, which belongs to the local nonlinear geometric attack. At present, there are a few watermarking algorithms that can resist local nonlinear geometric attacks, which make almost all watermarking algorithms invalid. Compared with the global geometric attack, the local nonlinear geometric attack is more difficult to implement.
To solve this problem, a zero-watermarking algorithm based on VGG19 against local nonlinear geometric attacks is proposed in this paper. In this algorithm, VGG19 can extract complex high-level features using a deep structure with powerful representation and learning ability. At the same time, the network structure has good geometric invariance and can extract image features with high and good robustness. e algorithm uses a perceptual hashing algorithm based on deep features to construct zero-watermarking, which has good robustness against local nonlinear geometric attacks. Hermite chaotic neural network is used to scramble the watermarking image for secondary protection, and it can enhance the security of the algorithm. Experimental results show that the proposed algorithm can effectively resist local nonlinear geometric attacks and display the superior performance of the proposed algorithm compared with other watermarking algorithms.

Feature Extraction Based on VGGnet.
VGGnet is a representative type of deep convolutional neural network (CNN), which is often used in feature extraction and transfer learning [23]. e most widely used VGGnet is VGG19, which consists of 19 hidden layers (16 convolution layers and 3 fully connected layers), as shown in Figure 1. VGG19 uses a series of 3 × 3 convolution kernels to extract image features and expands the number of feature channels through convolution layers. Let W i and b i represent the weights and bias of the ith convolution layer, the feature can be extracted by where X out i and X in i , respectively, denote the input and output feature maps and σ(·) is the rectified linear unit (ReLU). In each convolution layer, the stride is set to 1. To avoid the explosion of calculation, VGG19 uses max pooling layers to reduce the size of the feature maps.
In fully connected layers, each node of the given layer is connected with all nodes of its previous layers, which can map the distributed feature representation to the sample label space by where FC(·) denotes the operation of the fully connected layer and P(·) refers to the max pooling operation. At the end of VGG19, a softmax layer produces the classification result of the image: where Y j is the probability of the jth node and z j and C, respectively, denote the output of jth node and the number of the classification. Compared with other types of CNNs, VGG19 improves the depth of the network and adopts the alternate structure of many convolution layers and nonlinear activation layers, which is beneficial to extract accurate features. In this work, different from image classification tasks, we just use the convolution layers and max pooling layers from the pretrained VGG19 as the preprocessing method to extract deep feature maps from medical images. Unlike other medical zero-watermarking algorithms, our method can extract abstract high-level features from medical images to improve the antigeometric attack ability of zero-watermarking.

Discrete Fourier
Transform. Discrete Fourier transform plays an important role in the development of signal analysis and processing. Because of its definite physical meaning, discrete Fourier transform is widely used in many fields of signal analysis and processing.

One-Dimensional Discrete Fourier
Transform. Let f(x) denote a time domain function of x, where x represents a time domain variable and u is a frequency domain variable. When f(x) reaches the Dirichlet condition, the discrete Fourier transform is formula (4) and the inverse transform is formula (5), where F(u) is a frequency domain function:

Two-Dimensional Discrete Fourier Transform.
For a given image with the size of M × N, when it satisfies the Dirichlet condition, the two-dimensional discrete Fourier positive transform is Its inverse transformation formula is where x and y are the values in the space domain and u and v are the values in the frequency domain. Two-dimensional discrete Fourier transform transforms an image from the space domain to the frequency domain, which has a clear physical meaning. e frequency of an image is an index that characterizes the intensity of the gray level change in the image and is the gradient of the gray level in the plane space. After the Fourier transform, the changes in the flat area of the image are represented by low-frequency coefficients, and the details of the image are represented by high-frequency coefficients. Figure 2 shows the result of the Fourier transform of a medical image.
After the two-dimensional discrete Fourier transform, the transform coefficient matrix of the image shows that if the origin of the transform matrix is set at the center, the spectral energy is concentrated near the center of the short transform coefficient matrix. If the origin of the two-dimensional discrete Fourier transform matrix is set in the upper left corner, the energy of the image will be concentrated in the four corners of the coefficient matrix. is is determined by the nature of the two-dimensional discrete Fourier transform itself. It also shows that the image energy is generally concentrated in the low-frequency area. is determines that the two-dimensional discrete Fourier transform is very suitable for image processing. In this paper, a two-dimensional discrete Fourier transform is used to transform the features of the medical image into the Fourier domain to construct zero-watermarking.

Perceptual Hashing Algorithm.
Perceptual hashing is considered as a one-way mapping from the multimedia data set to the perceptual content hashing value; that is, a short digital digest uniquely represents multimedia data with the same perceptual content. is digital digest is called perceptual hashing value, so the mapping process is also called the process of hash value generation.
Image perceptual hashing is usually called image digital fingerprint or image digital digest. It can map the image to a group of hash sequences, which greatly reduces the storage of  Journal of Healthcare Engineering the digital image and brings great convenience to image management and maintenance. It has become a research hotspot in the field of multimedia signal processing and security. Perceptual feature extraction is the core of the perceptual hashing algorithm. e effectiveness and reliability of perceptual feature extraction will directly affect the uniqueness and robustness of the perceptual hashing sequence. A mean-perceptual hashing algorithm is proposed in this paper.
e mean-perceptual hashing algorithm uses the mean value of the elements of the medical image feature matrix to generate a hashing sequence. e construction of the feature image is realized by VGG19 and image fusion. Figure 3 describes the flowchart of the mean-perceptual hashing algorithm.

Hermite Chaotic Neural Network. In this work, a new
Hermite chaotic neural network is used to scramble the watermarking image [24]. e structure of the network is shown in Figure 4, whose topology is m × n × 1. e hidden layer neuron input is where w j is the weight between the input layer and hidden layer and c j is the weight between the hidden layer and output layer. e hidden layer neuron output is where H j ( ), j � 0, 1, 2, . . . , n − 1 represents Hermite orthogonal polynomial terms. e Hermite orthogonal polynomial formula is as follows: e output of the Hermite chaotic neural network is where (T t , d t ), t � 1, 2, . . ., l is the training sample set and l is the number of training samples. Hermite chaotic neural network input is T t � (x 1t , x 2t , . . . , x mt ), and its desired output is d t . e backpropagation (BP) algorithm is used to train the network. e weights of the network are trained according to the following formula: Δc j � − η zE zc j , where t � 1, 2, . . . , l, i � 1, 2, . . . , m, j � 1, 2, . . . , n. e chaotic sequence produced by the logistic chaotic function is used as a sample set. e logistic chaotic function is as follows: where 3.5699456 ≤ u ≤ 4, x∈ (0, 1). In this work, we set μ � 3.8, l � 1000, E � 10 − 12 , η � 0.03, n � 3, and the maximum number of training to 1500 epochs. e training process of the Hermite chaotic neural network is shown in Figure 5. When the number of training times is 260, the error is 9.5169e− 13, which has reached the expected error. When the initial value of the Hermite chaotic neural network is 0.66, the chaotic sequence generated by the network is shown in Figure 6. e chaotic sequence is used to scramble the watermarking image. e number of the chaotic sequence is determined by the size of the watermarking image.

Embedding Algorithm.
Choosing an image with a specific meaning, our algorithm uses it as the original watermarking image in the experiment. It is recorded as e gray value of the original watermarking image is represented as w(i, j). e original medical image is recorded as Here, the pixel gray value of the original medical image is represented by f(i, j). For the convenience of calculation, let M 1 � M 2 � 64, N 1 � N 2 . Figure 7 shows the watermarking embedding procedure.
(1) Hermite chaotic neural network is used to scramble the position of pixels in the original watermarking image W(i, j) to get the scrambled watermarking image BW(i, j). (2) e pretrained VGG19 is used to extract the deep feature maps FM(k, l, p) of the original medical image F(i, j): where 1 ≤ k ≤ 8, 1 ≤ l ≤ 8, and 1 ≤ p ≤ 512.
(4) Two-dimensional discrete Fourier transform is used to transform the feature image FI(k, l), and the transform coefficients FIF(k, l) are obtained to construct the feature matrix of medical image FIM(k, l): (5) e hashing sequence of medical image feature matrix FIM(k, l) is extracted by the mean-perceptual hashing algorithm to generate 64-bit binary hashing sequence PH(q): where 1 ≤ q ≤ 64. (6) e 64-bit binary hashing sequence PH(q) is XORed with the scrambled watermarking image BW(i, j). And, the watermarking extraction key Key(i, j) is generated to extract the watermarking image: where 1 ≤ q ≤ 64, 1 ≤ i ≤ 64, and 1 ≤ j ≤ 64. e watermarking extraction key Key(i, j) can be saved in a third party for later watermarking extraction.     Journal of Healthcare Engineering

Extraction Algorithm.
e medical image to be tested is e extraction algorithm is similar to the embedding algorithm, and the specific steps are as follows. Figure 8 shows watermarking extraction procedure.
(1) e pretrained VGG19 is used to extract the deep feature maps FM ′ (k, l, p) of the medical image to be tested F ′ (i, j): (3) Two-dimensional discrete Fourier transform is used to transform the feature image FI ′ (k, l), and the transform coefficients FIF ′ (k, l) are obtained to construct the feature matrix of medical image FIM ′ (k, l): (4) e hashing sequence of medical image feature matrix FIM ′ (k, l) is extracted by the mean-perceptual hashing algorithm to generate 64-bit binary hashing sequence PH ′ (q): where 1 ≤ q ≤ 64. (5) e 64-bit binary hashing sequence PH ′ (q) is XORed with the watermarking extraction key Key(i, j) to extract the watermarking image BW ′ (i, j) from the medical image to be tested F ′ (i, j): (6) e Hermite chaotic neural network is used to inversely scramble the extracted watermarking image BW ′ (i, j) to obtain the restored watermarking image W ′ (i, j). (7) e normalized correlation coefficient (NC) is used to detect the restored watermarking image W ′ (i, j) obtained from the medical image to be tested F ′ (i, j). e normalized csrrelation coefficient formula is shown in the following formula: . (24) By comparing the NC value between the original watermarking image W(i, j) and the restored watermarking image W ′ (i, j), the restored watermarking image W ′ (i, j) obtained from the medical image to be tested is evaluated. e larger the NC value, the greater the correlation between the original watermarking image W(i, j) and the restored watermarking image W ′ (i, j). e peak signal-to-noise ratio (PSNR) was used to evaluate the quality of the medical image to be tested. e PSNR formula is as follows: where MAX is the maximum gray value of the image pixel and MSE is the mean square error between the original image and the test image.

Experiment and Analysis
In this work, several experiments are conducted by applying local nonlinear geometric attacks to investigate the performance and effectiveness of the proposed zero-watermarking algorithm. Five original medical images of different parts of the human body produced by different medical equipment are used to test the effectiveness of the proposed zero-watermarking algorithm. e original medical images with the size of 128 × 128 are shown in Figure 9. e original 64 × 64 watermarking image and the scrambled watermarking image are shown in Figure 10. e following experiments test the ability of the watermarking algorithm to resist local nonlinear geometric attacks. For the convenience and repeatability of the experiment, we use the filter function of Adobe Photoshop software to implement the following common local distortion attacks. ere are four types of local distortion attacks: ripple distortion attack, extrusion distortion attack, spherical distortion attack, and rotation distortion attack.

Ripple Distortion Attack.
Ripple distortion attack is a common local nonlinear geometric attack, which transforms the coordinates of image pixels according to different functions. Table 1 shows the experimental results under the ripple distortion attack when the distortion quantity increases from 150% to 750%. Table 2 gives the restored watermarking images with the smallest NC value and their corresponding test medical image. e restored watermarking images can be clearly identified from Table 2, which shows that the proposed algorithm is very effective against ripple distortion attack.

Extrusion Distortion Attack.
For extrusion distortion attack, distortion quantity is varied between 10% and 90% for simulation. e experimental results are shown in Table 3. All NC values are greater than 0.74. In Table 4, it is obvious that the restored watermarking image is very clear.
e experimental results show that the proposed watermarking algorithm has good robustness against extrusion distortion attacks.

Spherical Distortion Attack.
en, we test the robustness of the proposed method on image spherical distortion. e test medical images were attacked by spherical distortions of 10%, 30%, 50%, 70%, and 90% in turn. Experimental results are listed in Table 5. It can be observed from Table 5 that most of the NC values are close to 1.0. e restored watermarking image in Table 6 further proves that the proposed algorithm has excellent performance under the spherical distortion attack.

Rotation Distortion Attack.
We also evaluate the robustness of the proposed algorithm under rotation distortion attack. Table 7 shows that when the distortion quantity increases, the NC value and the PSNR values gradually decrease. As can be seen from Table 8, even if the NC value is 0.5621, the watermark image can still be accurately extracted. ese results demonstrate that the proposed algorithm has better robustness against the rotation distortion attack. e above experimental results indicate that the proposed algorithm has strong capability against all the four types of local distortion attacks. Because it is a local nonlinear attack, the NC value does not necessarily decrease with the increase of the distortion quantity, and the change of the NC value is not the same as the change of the PSNR value.

Algorithm Comparison
In this section, the proposed algorithm is compared with two representative medical image watermarking algorithms. e details of these three algorithms are shown in Table 9. ese three algorithms are robust medical image watermarking algorithms. Every robust watermarking algorithm can resist all kinds of attacks with good robustness and security and can solve all kinds of information security problems of the medical image. e proposed algorithm and [25,26] are zero-watermarking algorithms. eir watermarking is based on the important features of the medical image rather than modifying the content of the medical image. ey are easy to implement, fast to embed and extract, and have the advantages of small amount of computation and high speed. erefore, the proposed algorithm and [25,26] are very suitable for medical images. In these algorithms, DWT, DCT, and DFT are all linear transformations. However, VGG19 is a multilayer perceptron specially designed for image recognition. Its feature extraction is essentially a nonlinear transformation.
In order to further analyze the performance of the proposed algorithm, the algorithm [25,26]   e comparison of the algorithms under four types of local nonlinear geometric attacks is shown in Figure 11. As the blue bar of Figure 11(a) shows, it is obvious that the          Algorithm [26] (b) Figure 11: Continued.
ability of the proposed algorithm to resist ripple distortion attack is better than the other two algorithms [25,26]. e comparison of the experimental results of the extrusion distortion attack is shown in Figure 11(b). Figure 11(b) shows that, with the increase of extrusion distortion quantity, the NC value of the algorithm is close to 1, which is obviously higher than that of the other two algorithms [25,26]. Especially when the extrusion distortion quantity is more than 70%, the difference of NC value is more significant. Figure 11(c) shows the comparison under the spherical distortion attack. e NC values of the proposed algorithms are all greater than 0.87. is proves that the proposed algorithm is more resistant to the spherical distortion attack. It can be observed from Figure 11(d) that the three algorithms can effectively resist the rotation distortion attack, but the proposed algorithm has a stronger ability. With the above comparison and analysis of the four local nonlinear geometric attacks, the proposed algorithm is obviously stronger than the other two algorithms in resisting local nonlinear geometric attacks. erefore, the proposed algorithm has good robustness and can well resist local nonlinear geometric attacks.

Conclusions
In recent years, the medical image watermarking algorithm against geometric attacks has been a hot and difficult topic in the research of robust watermarking technology. In this paper, a zero-watermarking algorithm based on VGG19 is designed to resist local nonlinear geometric attacks. VGG19 is used to extract deep features of the medical image, and two-dimensional discrete Fourier transform and meanperceptual hashing algorithm are used to generate zerowatermarking. e design process of the algorithm combines the concepts of deep convolution neural network, Fourier transform, perceptual hashing, cryptography, and zero-watermarking, which solves the problem of watermarking resisting local nonlinear geometric attacks. At the same time, the scrambling of the watermarking image ensures the security of the algorithm. It has high practical value for medical information protection.

Data Availability
e data used to support the findings of this study are available from the corresponding author upon reasonable request.

Conflicts of Interest
e authors declare that they have no conflicts of interest regarding this work. Algorithm [25] Algorithm [26] (c) Algorithm [25] Algorithm [26] (d) Figure 11: Robustness comparison between the proposed algorithm and two algorithms [25,26]