AGFI-GAN: An Attention-Guided and Feature-Integrated Watermarking Model Based on Generative Adversarial Network Framework for Secure and Auditable Medical Imaging Application

Abstract

With the rapid digitization of healthcare, the secure transmission of medical images has become a critical concern, especially given the increasing prevalence of cyber threats and data privacy breaches. Medical images are frequently transmitted via the Internet and cloud platforms, making them susceptible to unauthorized access, tampering, and theft. While traditional cryptographic techniques play a vital role, they are often insufficient to fully ensure the integrity and confidentiality of these sensitive images. In this paper, we present AGFI-GAN, a robust and secure framework for medical image watermarking that leverages attention-guided and Feature-Integrated mechanisms within a Generative Adversarial Network (GAN). Specifically, a Feature-Integrated Module (FIM) is proposed to effectively capture and combine both shallow and deep image features to facilitate multilayer fusion with the watermark. The dense connections within the module facilitate feature reuse, boosting the system’s robustness. To mitigate distortion from watermark embedding, an Attention Module (AM) is utilized, generating an attention mask by extracting global image features. This attention mask prioritizes features in less prominent and textured regions, allowing for stronger watermark embedding, while other features are downplayed to enhance the overall effectiveness of the watermarking process. The framework is evaluated based on its versatility, embedding capacity, robustness, and imperceptibility, and the results confirm its effectiveness. The study shows a marked improvement over the baseline, thus highlighting the framework’s superiority.

1. Introduction

Advancement in computer networking and multimedia technology have facilitated the rapid development of telemedicine, radiomics, and smart healthcare, marking a comprehensive transition of medical information exchange into the digital stage [1]. Thanks to rapid development of modern technology, medical imaging plays an increasingly important role in clinical diagnosis. Sharing digital medical images and electronic patient records (EPRs) over the internet provides great convenience to doctors and patients, significantly enhancing the efficiency and accuracy of medical information transmission while promoting the optimal allocation of medical resources [2]. However, the widespread application of digital medical images also brings new challenges in information security and privacy protection [3].

The rapid advancement of modern technologies, such as the Internet of Things (IoT), cloud computing, and telemedicine, has surpassed traditional healthcare models. The growing transmission of digital medical images via the internet and cloud platforms has led to a significant rise in both active and passive cyberattacks on these data [1]. Common threats, including illegal access, tampering, deletion, and copying, pose serious risks to patient privacy and the integrity of medical images [4]. Despite the implementation of regulations such as the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act [5], incidents of data theft and unauthorized access remain widespread. In addition, the digitization of medical images, while facilitating their storage and transmission, has also increased their vulnerability to cyberattacks [6]. Medical institutions are frequently targeted by cybercriminals, and the unauthorized access and distribution of patient data have become increasingly severe issues [7]. The legality and security of medical data directly impact the reliability of diagnoses, and the theft of patient information has emerged as a growing criminal activity, urgently necessitating stronger protection measures [8]. Thus, ensuring the security and privacy of medical images during transmission has become a critical challenge in the field of e-health services. Researchers have developed various technologies to safeguard the security and privacy of medical images, including steganography, cryptography, fingerprinting, and digital watermarking.

By embedding invisible data within digital media, digital watermarking has become a vital method for securing medical information in applications such as copyright enforcement, content verification, and forensic investigations [9]. Its core attributes, including imperceptibility and robustness, make digital watermarking (DW) a reliable solution for protecting e-health systems. Unlike traditional cryptographic methods, digital watermarking enhances protection against unauthorized access and enables anti-counterfeiting traceability by embedding identifying information—such as text or images—into carriers like medical images or audio [10]. This technique exploits human sensory insensitivity and signal redundancy, allowing for the retrieval of hidden information when necessary.

Digital watermarking in medical imaging plays a vital role in protecting image content and verifying the authenticity and integrity of electronic patient records (EPRs), preventing unauthorized modifications and theft. With the rapid growth of telemedicine and advancements in technologies like IoT and cloud computing, the need for secure remote transmission of medical images has become increasingly critical, as these technologies, while enhancing the efficiency of medical services, also heighten security risks. High-capacity, high-invisibility reversible watermarking algorithms provide a reliable solution by ensuring patient privacy, preserving the visual quality of medical images, and allowing undistorted recovery. Additionally, watermarking technology facilitates provenance tracking by embedding watermarks to trace the origin and ownership of medical images, maintaining data authenticity in research and clinical collaborations. It enables tamper detection by identifying unauthorized modifications in diagnostic images, such as CT or MRI scans, ensuring reliability in clinical decision making. Furthermore, it supports copyright protection by safeguarding intellectual property rights for proprietary medical imaging algorithms and datasets. By balancing embedding capacity, robustness, and visual quality, digital watermarking offers a promising mechanism to address security challenges and verify the authenticity and validity of medical data.

Conventional digital watermarking methods for medical data can be divided into spatial-domain and frequency-domain approaches. Spatial-domain methods work by directly altering the pixel values of the original image, with the Least Significant Bit (LSB) technique being a well-known example. On the other hand, frequency-domain methods embed the watermark into the image’s frequency coefficients, which are derived using transformations like the Discrete Cosine Transform (DCT) [11], Discrete Wavelet Transform (DWT) [12], or Discrete Fourier Transform (DFT) [13]. While these methods are effective, they often demand extensive prior knowledge and involve intricate processes, including both preprocessing and postprocessing.

Deep learning has achieved remarkable progress in medical image processing tasks like classification and segmentation, owing to its ability to capture and represent intricate patterns [14,15]. In contrast to traditional machine learning methods, deep learning models autonomously learn complex features from images, enabling better generalization across various scenarios when trained on extensive datasets. This capability has also been successfully applied to the field of medical image watermarking. Current deep learning models for medical image watermarking primarily utilize convolutional neural network (CNN) architectures. An advanced CNN-based watermarking approach incorporates an iterative learning framework to enhance the robustness of embedded watermarks, building upon the frequency-domain methods traditionally used in watermarking. One such example is ReDMark, a comprehensive deep learning framework for diffusion-based watermarking that can adapt to various transform domains [16]. ReDMark utilizes two fully convolutional networks with a residual design and integrates a differentiable network layer to simulate diverse attacks, enabling efficient end-to-end model training.

Guo et al. [17] proposed a novel learning-based blind watermarking algorithm using a modified CNN, which optimizes feature extraction and embedding through self-adjustment and achieves improved robustness against common signal processing attacks. Geng et al. [18] investigated the integration of deep learning and blockchain technologies for copyright protection. Their work focused on applying this fusion in photography and art studies by developing a digital image watermarking model that incorporates singular value decomposition (SVD) and deep learning techniques. The proposed model demonstrated strong scalability, robust performance in image processing, and effective decentralization, making it highly suitable for applications such as image copyright protection and postprocessing. Fan et al. [19] proposed an image watermarking technique that combines CNN Inception V3 and DCT for image processing and feature extraction. This approach uses a logistic map and hash functions to scramble the watermarks. Three watermark forms were used in this method to test the algorithm’s viability and generalizability.

Medical images are crucial for accurate diagnoses, but traditional watermarking algorithms compromise image quality and lack robustness against high-intensity attacks. Fan et al. [19] proposed a novel watermarking algorithm using CNN Inception V3 and DCT to preserve image quality and improve robustness, achieving over 90% accuracy in experimental tests under various geometric attacks. Geometric attacks refer to manipulations or transformations of an image that alter its geometric properties, such as position, orientation, or shape, aiming to distort or remove the embedded watermark without significantly degrading the image quality. Zhang et al. [20] presented a robust multiwatermarking algorithm for medical images, using GoogLeNet transfer learning to enhance privacy protection during transmission and storage while improving resistance to geometric attacks and increasing watermark capacity. By fine-tuning a pretrained GoogLeNet model and employing two-dimensional Henon chaos encryption, the algorithm achieved zero-watermark embedding and blind extraction, demonstrating its robustness and multiwatermark embedding in experimental tests. Nawaz et al. [21] proposed a zero-watermarking method for medical images using DWT, ResNet101-DCT, and chaotic scrambling for encryption. By extracting deep features with ResNet101 and applying XOR operations, the algorithm demonstrated its robustness against conventional and geometric attacks, ensuring effective ownership verification. Nawaz et al. [22] introduced a zero-watermarking method for encrypted medical images using DWT, DCT, and an improved MobileNetV2 convolutional neural network. The technique enhances robustness by encrypting watermarks with a logistic map system and hash function, showing superior resilience and invisibility against conventional and geometric attacks in experimental results.

To address the challenges of computational efficiency and resource constraints in digital watermarking, researchers propose leveraging lightweight watermarking architectures, which are designed to maintain robust watermark embedding and extraction capabilities while minimizing computational overhead. Nazari et al. proposed a method utilizing lightweight encryption, discrete wavelet transform (DWT) watermarking, and DCT+LZW compression [23]. Xiong et al. proposed a robust reversible watermarking scheme, RRWEI-SM, which leverages lightweight cryptography, additive secret sharing, and block-level scrambling for secure multiparty copyright protection, with experimental results demonstrating its security, robustness, and effectiveness [24].

GANs, alongside CNNs, present an alternative and often more effective approach for deep medical image watermarking. A GAN framework includes a generator and a discriminator, which work in opposition to one another through an adversarial process [25]. This interplay allows GANs to excel in creating robust image watermarking solutions that balance capacity, invisibility, and resilience. Yildiz et al. introduced a novel unconditional GAN model that generates realistic, high-quality, and diverse images from a single training image by integrating a self-attention mechanism (SAM), DenseNet architecture, and a relativistic average least-squares GAN with a gradient penalty (RaLSGAN-GP) [26]. The combination of these components enhances global context capture, improves information flow, reduces overfitting, and stabilizes training, enabling efficient image synthesis and manipulation, which demonstrate that the model provides a robust solution for image generation in data-limited scenarios. In recent years, multiple GAN-based models for image watermarking have been developed. Among them, the HiDDeN model stands out as an innovative framework that utilizes the adversarial relationship between the generator and discriminator to ensure robust watermarking [27]. HiDDeN employs an encoder–noise–decoder structure, where the encoder embeds an invisible watermark, and the decoder accurately extracts the watermark from the encoded image.

Based on the aforementioned research, we can confidently state that watermark algorithms operating directly on novel images inevitably degrade the image resolution, making watermarks vulnerable to geometric attacks. Furthermore, contemporary watermarking techniques, particularly those reliant on the extraction of image features for watermark embedding, often lack robustness and prove inadequate against image noise. A notable limitation of these models is their inability to prioritize critical image features during the learning process, which ultimately undermines the effectiveness of watermarking.

To address the challenges of achieving a balance between invisibility and robustness in digital watermarking, we introduce AGFI-GAN, an advanced model that incorporates attention mechanisms and a feature-integrated module within a GAN framework. The architecture of AGFI-GAN is structured as an encoder–noise–decoder model, allowing for end-to-end training. To mitigate the distortion commonly associated with watermarking, our model integrates an attention-guided module (AGM). This module analyzes global image features to produce an attention mask that dynamically adjusts the watermark’s strength across various regions of the image. It minimizes the watermark’s presence in flat or sensitive areas while amplifying it in inconspicuous or textured sections, thereby optimizing embedding. Additionally, a feature-integrated module (FIM) is employed to boost the extraction of image features by combining shallow and deep attributes from various layers. This integration of the watermark with deep features enhances the model’s resistance to image noise, while dense connections further reinforce its robustness. Furthermore, the adversarial dynamic between the encoder and the discriminator is leveraged to refine the quality of the encoded image. The discriminator plays a crucial role in distinguishing between the encoded and original images throughout the iterative training process, which is further supported by the AGM.

To summarize, the key contributions of this paper are outlined as follows:

• (1). To improve watermarking invisibility and robustness, we introduce an attention module (AM), which computes a probability distribution among feature channels of the original image and applies spatial attention to learn spatial weights, generating an attention mask. This mask adaptively guides watermark strength across different image regions. Inconspicuous and textured areas receive higher embedding strength, while other regions are suppressed with lower strength.

• (2). To address the limitation of extracting insufficient image features in existing deep learning-based watermarking models, we implement a feature-integrated module (FIM) to learn and fuse shallow and deep features across multiple layers with the watermark. This multilayer integration enhances robustness and improves resistance to various image attacks.

• (3). We assess the effectiveness of the watermarking model through experiments. The results highlight the importance of both the AM and FIM components, showing that they significantly enhance the model’s performance and achieve superior image quality and robustness against various attacks compared to existing approaches.

The structure of this paper is as follows: Section 2 outlines the foundational concepts of DenseNet and the feature-integrated module, as well as examines attention mechanisms applied in watermarking. Section 3 details the AGFI-GAN model’s architecture and describes its primary components. Section 4 discusses the prototype development and evaluates its performance. Lastly, Section 5 concludes the study and highlights potential future research directions.

2. Background Knowledge and Related Work

This section describes the underlying principles of DenseNet, which has inspired the design of our feature-integrated module. Subsequently, we delve into a discussion of the attention mechanism, exploring its functionality and diverse applications across various domains, as well as demonstrating its effectiveness in enhancing model performance through selective focus on relevant features.

2.1. Residual Network

Traditional neural networks face challenges as their depth increases, particularly the problem of network degradation, where accuracy improves to a certain point before rapidly decreasing. This issue arises despite the network’s ability to converge. To address this, Kaiming He and his team at Microsoft Research introduced the Residual Network (ResNet) architecture in 2015 [28]. ResNets introduce residual learning, where the network learns the residual—the difference between input and output instead of a direct mapping between them. This is achieved through skip connections, which allow input to bypass intermediate layers and be directly added to the output. These skip connections offer two options: (i) residual mapping, where features are processed through convolutional layers and activation functions, and (ii) identity mapping, which directly adds the input to the output. Figure 1 illustrates the structure of the residual network. In this figure, X represents the output value from the previous layer that is fed into the neuron.

By utilizing these mechanisms, ResNets alleviate the vanishing gradient problem and enable the training of much deeper networks without degradation in performance. Once the network reaches an optimal depth, the residual mapping can be set to zero, leaving only the identity mapping, ensuring that network performance remains stable even as the depth increases further. ResNets, available in various configurations (e.g., ResNet-50, ResNet-101, and ResNet-152), have become foundational in tasks such as image recognition and serve as the backbone for more complex models in object detection, segmentation, and other domains.

2.2. Feature-Integrated Module Based on DenseNet

Feature integration is vital in image processing, with notable progress fueled by the emergence of convolutional neural networks (CNNs). One of the most impactful contributions in this field is DenseNet (Densely Connected Convolutional Networks), introduced by Huang in 2017 [29]. DenseNet utilizes direct connections between layers that share the same feature map size, optimizing information flow and mitigating the vanishing gradient issue. This architecture promotes feature reuse and reduces parameter count compared to conventional CNNs. By passing feature maps from earlier layers to all subsequent layers, DenseNet ensures that the network can learn features of varying complexities more effectively, combining low-level details with high-level abstractions. In addition, the network achieves high performance with fewer parameters compared to architectures like ResNet or VGG, leading to better computational efficiency without sacrificing accuracy [29]. As illustrated in Figure 2 and detailed in Table 1, a DenseNet architecture is structured using several Dense Blocks. Each block is formed by a series of BN–ReLU–Conv1×1 and BN–ReLU–Conv3×3 layers, where ‘BN–ReLU–Convj×j’ denotes a sequence comprising Batch Normalization (BN), the ReLU activation, and a convolution operation with a kernel of size j × j. The output of the ith dense block is given by the following formula:

(1)$F_i=T_i\left(\mathrm{concat}(F_1,F_2,F_3,\dots ,F_{i-1})\right)$

where $T_i$ represents a series of nonlinear transformations of the dense block, and $\mathrm{concat}(·)$ is the concatenation operation.

By densely connecting layers, DenseNet integrates features from all previous layers, significantly enhancing the network’s representational capacity. This feature reuse strategy has been effectively applied in tasks such as image super-resolution [30] and medical image analysis [31], where it improves performance by combining shallow and deep features. DenseNet’s architecture, by focusing on feature reuse rather than simply deepening or widening the network, enhances resistance to image distortions and attacks, making it particularly valuable for applications like medical image watermarking.

2.3. Attention-Guided Module

Incorporating attention mechanisms into deep learning model can enhance model performance by allowing the network to focus more precisely on critical information regions. Attention mechanisms enable the model to concentrate on meaningful areas or channels, effectively suppressing irrelevant or redundant information and helping it perform more effectively across complex tasks [15]. Attention mechanisms assign dynamic weights to various features, enabling the model to focus on essential information while downplaying less significant elements. Their use in image processing tasks has proven to be highly effective. For example, the Squeeze-and-Excitation (SE) network [32] emphasizes the value of channel-wise attention, enhancing network performance by adaptively adjusting responses across channels.

To enhance watermarking performance, attention mechanisms are integrated into the deep learning-based watermarking model. Depending on the specific task, the attention mechanism serves different purposes within the watermarking model. For improving watermark invisibility, Yu et al. [33] utilized ResNet to design an attention module that identifies inconspicuous areas for embedding the watermark. However, this model lacks robustness. Zhang et al. [34] created an attention mask based on image content to guide watermark embedding and extraction. Nevertheless, the robustness is insufficient, because image distortions lead to significant discrepancies between the attention masks during embedding and extraction processes. To achieve robustness, Zhang et al. [35] focused on identifying stable locations by calculating an inverse gradient attention mask for watermark extraction. Despite this, the accuracy of watermark extraction significantly decreases under high-intensity noise conditions.

While existing watermarking approaches leverage attention mechanisms to enhance either invisibility or robustness, achieving both qualities at the same time continues to be a challenging issue [33]. Our method advances beyond prior approaches by utilizing both channel and spatial attention mechanisms, which extract essential information through max and average pooling, as depicted in Figure 3. First, the channel attention mechanism collects global statistics for each channel using two pooling methods—global max pooling and global average pooling—with the data then passed through a shared two-layer multilayer perceptron (MLP). Spatial weights are then derived using a convolutional layer followed by a sigmoid activation, applying these weights across each spatial position on the feature map to strengthen spatial relevance. Moreover, global features generate an attention mask that emphasizes subtle, textured regions, leading to improved watermarking performance overall.

3. AGFI-GAN Digital Watermarking: Design Rationale and System Architecture

Medical images often contain complex and variable features, such as irregular shapes, occlusions, scale variations, and blurred boundaries—especially around lesions or abnormalities [36]. These factors make embedding watermarks more difficult, as they can affect both the visibility and robustness of the watermark. To address these challenges, adapting to local variations in texture, shape, and intensity is critical for a watermarking model. Therefore, we propose AGFI-GAN, a robust and secure framework for medical image watermarking that leverages attention-guided and feature-integrated mechanisms within a GAN. The architecture based on DenseNet and GAN has been applied to medical imaging analysis, such as Chest CT Scans [37] and Breast Screening [38]. However, our AGFI-GAN leverages nseNet and GAN aims for robustness and imperceptibility of watermarking techniques instead of medical image segmentation and classification. In the AGFI-GAN model, the GAN framework is employed to ensure the invisibility of the embedded watermark, while DenseNet is utilized to achieve effective feature integration. DenseNet’s dense connectivity design allows the output of all preceding layers to serve as input for subsequent layers, promoting feature reuse and mitigating the vanishing gradient problem. Owing to its strong performance, DenseNet has found widespread application in various image processing tasks. AGFI-GAN can help the model prioritize features in less prominent and textured regions, which allows for stronger watermark embedding. Other features are downplayed to enhance the overall effectiveness of the watermarking process.

3.1. System Overview

For the system model, we assume that medical image generation and watermarking model rely on a secure execution environment. Thus, an adversary can neither modify original images and watermarks at the source side nor compromise watermark verification at the end-user side. We assume that image transmission and storage are not secure; therefore, an adversary can replace tampered images with original ones. Figure 4 demonstrates the system architecture of AGFI-GAN watermarking model that guarantees the authenticity and provenance of medical images. Once medical images are captured by imaging devices such as Computed Tomography (CT) and Magnetic Resonance Imaging (MRI) at the source, the watermark embedding procedure creates digital watermarks $W_{in}$ to serve as proof of authenticity, which are then embedded within the medical images. Then, these watermarked medical images $F_{en}$ can be transmitted among healthcare professionals for clinical diagnosis. At the end user side, the watermark extraction process can recover watermarks $W_{out}$ from watermarked medical images and then verify whether medical images are forged or tampered.

To ensure both invisibility and resilience of the embedded watermarks in medical images, the AGFI-GAN watermarking model utilizes an encoder–noise–decoder structure. During the watermark embedding phase, the encoder identifies key features, merges them with the watermark, and spreads them over subtle regions to preserve the imperceptibility of the image. The FIM module can extract robust features from original image $F_{cover}$ that can be fused with watermark $W_{in}$. Meanwhile, the AGM module can use attention mechanisms to minimize the distortion during watermark embedding process. Thus, the watermark can ideally be imperceptible to the human eye, which is accomplished by embedding it in regions of the image that are less noticeable to the human visual system, such as areas with high redundancy or low texture. Another objective of AGFI-GAN watermarking model is to ensure that the embedded watermark withstands various image manipulations, including compression, noise addition, rotation, and cropping. To achieve resilience against these attacks, the trained noise module adds the distribution of differentiable noises to $F_{en}$ and outputs image $F_{noise}$ that can resist various image attacks. Finally, the discriminator adopts adversarial training cycles based on encoder loss and decoder loss to improve quality of watermarked images.

Figure 4 illustrates the main components of AGFI-GAN, which include the encoder $E_{\theta }$, decoder $D_{\gamma }$, noise layers $Noise$, and discriminator $D{C}_{ϵ}$. Here, $\theta$, $\gamma$, and $ϵ$ denote the trainable parameters for the encoder, decoder, and discriminator, respectively. These parameters are iteratively optimized during training to enhance the invisibility and robustness of the watermark. Given an input image $F_{cover}$ with dimensions $H\times W\times C$ and a binary watermark $W_{in}$ of length L, the encoder $E_{\theta }$ transforms $F_{cover}$ into an encoded image $F_{en}$.

The discriminator $D{C}_{ϵ}$ evaluates the likelihood that $F_{en}$ resembles the original image, by analyzing the similarity between $F_{cover}$ and $F_{en}$. This feedback guides the encoder $E_{\theta }$ in refining $F_{en}$. To improve the watermark’s robustness, the noise layers $Noise$ introduce various types of perturbations. Meanwhile, adversarial training is performed in which the decoder $D_{\gamma }$ extracts the decoded watermark $W_{out}$ from $F_{noise}$, aiming to make $W_{out}$ as similar as possible to the original watermark $W_{in}$. The following sections will provide an in-depth explanation of each component.

3.2. Encoder

The encoder, denoted as $E_{\theta }$, is specifically designed to embed a watermark into the original image $F_{cover}$ with the goal of preserving the image’s perceptual quality. This approach ensures that the embedded watermark remains unobtrusive while enhancing the overall resilience of the watermarked image against various attacks, such as noise addition, compression, and geometric transformations. To further improve the training process, a residual configuration is incorporated, which includes a global residual skip connection that effectively enhances backpropagation efficiency. This architectural choice not only accelerates convergence but also stabilizes training, helping to maintain the integrity of the embedded watermark. Here, we embed a watermark $W_{in}$ into the original image $F_{cover}$ to generate the encoded image $F_{en}$:

(2)$F_{en}=E(F_{cover},W_{in})$

where $E(·)$ represents the process of encoding, as illustrated in Figure 5.

The encoder consists of two key components: the feature-integrated module (FIM) and the attention-guided module (AGM). The FIM addresses the limitation of depending only on surface-level image features, which may not be sufficient for robust watermark embedding. By extracting both shallow and deep features from various convolutional layers, the FIM provides a more complete representation of the image’s structure and texture. This integrated feature set significantly boosts the encoder’s ability to embed the watermark with greater resilience and precision. The feature $X_W$ is derived through the following process:

(3)$X_W=E_{FIM}(F_{cover},W_{in})$

where $E_{FIM}$ represents the operation performed by the FIM. The FIM architecture consists of several dense blocks, where each block includes a sequence of batch normalization (BN), ReLU activation functions, and convolutional layers. The dense connections between these layers facilitate the reuse of features, significantly improving the encoder’s capacity to capture complex patterns.

Watermarks embedded in different regions of an image exert varying influences on distortion levels and robustness. Embedding in less prominent or low-texture regions can help maintain high visual quality by reducing noticeable distortions, whereas embedding in highly textured areas strengthens robustness, making the watermark more resilient against removal or degradation. To address these requirements, we developed a specialized module known as the attention-guided module (AGM). This module is designed to mitigate distortion from the watermark embedding process by selectively enhancing or diminishing specific regions in the spatial domain of the feature map based on their relevance for watermarking. The AGM dynamically captures both local and global features of the image to generate an attention mask, which dictates differential embedding strengths across various image regions, thus achieving an optimal balance between watermark invisibility and resilience.

The attention mask serves a crucial role in fine-tuning the embedding process. By identifying and downscaling embedding strengths in smooth, flat, and visually sensitive areas, the AGM minimizes any perceptible impact on image quality. In contrast, regions that are inconspicuous or exhibit complex textures are assigned higher embedding strengths, thereby reinforcing watermark robustness without compromising visual stealth. Through this mechanism, the AGM ensures that the watermark remains imperceptible in visually sensitive areas while enhancing durability in parts of the image that can support stronger embedding. This carefully balanced approach enables robust watermarking that maintains the aesthetic integrity of the original image.

Specifically, the AGM utilizes both channel and spatial attention mechanisms, which extract essential information through max and average pooling, as depicted in Figure 3. First, the channel attention mechanism collects global statistics for each channel using two pooling methods—global max pooling and global average pooling—with the data then passed through a shared two-layer multilayer perceptron (MLP). Spatial weights are then derived using a convolutional layer followed by a sigmoid activation, applying these weights across each spatial position on the feature map to strengthen spatial relevance. Moreover, global features generate an attention mask that emphasizes subtle, textured regions, leading to improved watermarking performance overall.

The AGM progressively generates a channel attention map, denoted as $M_c$, followed by a spatial attention map, $M_s$, as illustrated in Figure 3. The channel attention calculation is given by

(4)$M_c\left(F_{cover}\right)=\sigma (MLP\left(F_{avg}^c\right)+MLP\left(F_{max}^c\right))$

where $\sigma$ denotes the sigmoid function, and MLP represents a mult-layer perceptron containing a single hidden layer. For the input feature map, we apply global maximum pooling and global average pooling operations to each channel to compute the maximum and average eigenvalues per channel. This results in two vectors, each corresponding to the channel count and representing the global maximum and average features of the channels, respectively. The feature vectors derived from global maximum pooling and average pooling are fed into a shared MLP, which is designed to learn the attention weights for each channel, enabling the network to dynamically determine the significance of various channels for the given task. By combining the global maximum and average feature vectors, the final attention weight vector is obtained. In a similar manner, the spatial attention is calculated as follows:

(5)$M_s\left(F_{cover}\right)=\sigma \left(f^{7\times 7\times 7}\left([F_{avg}^s,F_{max}^s]\right)\right)$

where $f^{7\times 7\times 7}$ denotes a convolution operation with the filter size of $7\times 7\times 7$. For the input feature map, we apply maximum pooling and average pooling along the channel dimension to capture features at varying contextual scales. The resulting features from both pooling operations are concatenated along the channel dimension, forming a feature map enriched with multiscale context information. This combined feature map is then passed through a convolutional layer to produce spatial attention weights. The spatial attention weights are then used to adjust the original feature map, emphasizing significant regions of the image while diminishing the impact of less important areas. Once the channel-wise and spatial-wise attention are computed, the resulting features are represented as

(6)$F_{cover}^{\prime }=M_c\left(F_{cover}\right)\otimes F_{cover}$

(7)$F^{out}=M_s\left(F_{cover}^{\prime }\right)\otimes F_{cover}^{\prime }$

where ⊗ indicating element-wise multiplication, and $F^{out}$ is the refined output of AGM. Based on the calculated $F^{out}$, we also need to obtain features in less prominent and textured regions, allowing for stronger watermark embedding. Let $M_A$ represent the attention mask:

(8)$M_A=E_{AGM}\left(F_{out}\right)$

where $E_{AGM}\left(\right)$ represents the process of generating attention mask. Next, $M_A$ is employed to modify the distribution of $X_W$. Lastly, a global residual skip connection is applied to produce $F_{en}$ by

(9)$F_{en}=F_{cover}+X_W\times M_A$

The encoding loss function, $L_E$, aims to reduce the difference between $F_{cover}$ and $F_{en}$ by adjusting the parameter $\theta$. $L_E$ consists of both the image reconstruction loss and the visual loss:

(10)$L_E={\eta }_{1}MSE(F_{cover},F_{en})+{\eta }_{2}SSIM(F_{cover},F_{en})$

where $MSE\left(\right)$ represents the mean square error function, and $SSIM\left(\right)$ refers to the structural similarity index metric. The weights for the image reconstruction loss and visual loss are represented by the parameters ${\eta }_1$ and ${\eta }_2$, respectively.

3.3. Decoder for Extracting Watermarks

The Noise module plays a critical role in simulating different attack scenarios during iterative training by introducing differentiable noise, which enhances the robustness of watermarking. This approach allows the network to intelligently place watermarks in areas of the image that are less susceptible to distortion, creating a watermark that can endure both anticipated and unforeseen noise. The final noisy image, $F_{noise}$, is produced by applying several types of noise in a systematic manner:

(11)$F_{noise}=Noise(F_{en},N_{train})$

where $N_{train}$ is trained noise. We simulate the encoded image to evaluate whether the decoder can successfully extract the watermark information $W_{out}$ after introducing noise. Thus, the decoder $D_{\gamma }$ is utilized to extract $W_{out}$ from $F_{noise}$:

(12)$W_{out}=D_{\gamma }\left(F_{noise}\right)$

To compute the decoding loss $L_D$, we aim to minimize the difference between $W_{out}$ and $W_{in}$ via adjustments to the parameter $\gamma$. By training this decoding loss $L_D$, the robustness of the watermark can be improved. We can define it as follows:

(13)$L_D={\displaystyle \frac{\sqrt{{(W_{in}-W_{out})}^2}}{L}}$

Watermark extraction is essentially the reverse of the embedding process, employing a framework akin to the FIM to retrieve the watermark from the watermarked image. The decoder, which is responsible for extracting the watermark, leverages deep feature extraction techniques, incorporating dense connections to ensure efficient propagation and utilization of important features throughout the network. The use of dense connections in the decoder facilitates the flow of critical information, preventing the loss of key features during the decoding process. This allows the network to concentrate on the most relevant regions of the image, even when it has undergone transformations such as compression, added noise, or mild blurring. As a result, the decoder can accurately recover the watermark, even in the presence of various distortions and noise-related artifacts.

Error tolerance is a crucial aspect of modern watermarking techniques, ensuring that the watermark remains recoverable despite noise-induced distortion. However, this tolerance has its limits. Excessive distortion, especially when introduced by aggressive noise or image degradation, can suppress the decoding process, making it challenging or even impossible to extract the watermark. To address this issue, feedback from the decoder to the encoder plays a vital role. During the training process, the decoder provides valuable insights into how well the watermark is being recovered, which in turn helps the encoder adjust its feature embedding strategy. This feedback mechanism allows the encoder to fine-tune its representation, ensuring that the features associated with the watermark are placed in regions of the image that are less likely to be affected by distortion. By doing so, the model can avoid fragile regions that might be vulnerable to excessive noise or transformation, thus improving the robustness of the watermark.

3.4. Discriminator

In a GAN-based watermarking framework, the discriminator plays a pivotal role in ensuring that the watermark embedded within the image is both imperceptible and robust. The primary function of the discriminator $D{C}_{ϵ}$ is to distinguish between real (unwatermarked) image $F_{cover}$ and fake (watermarked) image $F_{en}$. During training, the encoder(or generator) produces watermarked images by embedding the watermark into the input image, while the discriminator is tasked with classifying the image as either real or fake. The discriminator’s output is used to compute a loss function that guides the learning process for both the discriminator and the encoder. The discriminator loss measures its ability to correctly classify real and fake images, while the encoder loss incentivizes the encoder to create watermarked images that are increasingly difficult for the discriminator to identify as fake. This adversarial training process drives the encoder to embed the watermark in a manner that minimizes perceptibility while ensuring it remains detectable under various transformations.

To enhance the invisibility of the encoded image, the discriminator aims to reduce the likelihood of incorrect classification by adjusting the parameter $ϵ$. The adversarial loss, $L_A$, is defined as

(14)$L_A={\mathbb{E}}_{p\sim F_{cover}}[log(1-P\left(F_{en}\right))]$

where $\mathbb{E}$ denotes the expectation function to calculate the mean value of sampled data p over a probability distribution $F_{cover}$, and $P(·)$ represents the probability that $F_{en}$ contains $W_{in}$.

Through the adversarial training process, the discriminator forces the encoder to refine the watermark embedding, making it robust against perceptual attacks, such as visual removal or distortion from compression and noise. The discriminator thus helps the encoder learn how to produce watermarked images that are both difficult to detect and resistant to various image alterations while still allowing the watermark to be reliably extracted when needed. This synergistic interaction between the encoder and discriminator ensures that the watermarked images maintain high visual fidelity, preserving the quality of the original content while embedding the watermark in a concealed and robust manner. Furthermore, the decoder complements this process by reliably extracting the watermark, even under challenging conditions such as lossy compression, Gaussian noise, or intentional tampering. These components collectively contribute to the system’s robustness and practical applicability, setting the stage for an in-depth experimental evaluation.

In the following section, we present a comprehensive analysis of the system’s performance, highlighting its resilience against various attacks and its minimal impact on image quality. The experiments are designed to assess both the visual imperceptibility of the watermarked images and the accuracy of watermark extraction, providing insights into the effectiveness of the proposed framework under real-world conditions.

4. Experimental Results and Discussion

This section begins with an overview of the experimental setup for training the watermarking model. Afterwards, we provide a detailed analysis of the AGFI-GAN watermarking model’s performance. Finally, we examine the security measures of the proposed solutions, which are designed to protect against a range of potential attacks on medical data service platforms.

4.1. Experimental Setup

The proposed watermarking framework was evaluated using a diverse set of publicly available medical imaging datasets to cover a range of anatomical regions and imaging modalities. The datasets include the Brain Tumor Detection Dataset [39], Liver Segmentation Dataset [40], Pneumonia Detection Dataset [41], Diagnosis of Coronary Artery Stenosis Dataset [42], Hand Image Dataset [43], and Spine Image Dataset [44]. Each dataset was selected to provide a comprehensive evaluation of the proposed framework across various imaging modalities, supporting an extensive analysis of robustness, accuracy, and applicability in medical imaging contexts. The watermarking model was developed in PyTorch and run on an NVIDIA Tesla V100 GPU. For consistency, all images were standardized to a resolution of 512 × 512 × 3. To evaluate the watermark’s invisibility, we measured the model’s performance through both the Peak Signal-to-Noise Ratio (PSNR) and the Structural Similarity Index Metric (SSIM).

To guarantee a fair and dependable performance assessment, five-fold cross-validation was applied to the above datasets, and the average results across all evaluation metrics were documented. During training, 15% of the training data was randomly designated as an internal validation set. In addition, both subjective and objective evaluations were conducted in this study to comprehensively assess the effectiveness of the watermarking model.

4.2. Subjective Assessment

The subjective assessment evaluates the visual quality of the watermarked images based on human perception, emphasizing aspects like image sharpness, overall aesthetic, and the lack of noticeable distortions. By combining the FIM and AGM, the encoded image $F_{en}$ is generated as shown in Equation (2). To improve the invisibility of the watermark, we optimized the loss function in Equation (10) throughout the AGFI-GAN model training process. This approach reduces the difference between the original and watermarked images, ensuring minimal visual impact. Figure 6 illustrates the subjective invisibility achieved by AGFI-GAN by displaying both the original and watermarked images. As depicted in panels (a) and (b), the original and encoded images are nearly identical to the human eye, confirming that the watermark is embedded in visually imperceptible regions.

To evaluate the invisibility of the proposed approach regarding distribution of pixel value, Figure 7 provides a comparison of the histograms of the original and watermarked images. By analyzing pixel value distributions in both images, this comparison aims to measure any distortion introduced by the watermarking. The results reveal only minor pixel value deviations, suggesting that the watermarking process maintains high visual quality with minimal distortion.

Additionally, the Scale-Invariant Feature Transform (SIFT) method was employed to assess the performance of the watermarking technique by comparing the feature descriptors of the original and watermarked images [45,46]. This comparison evaluates the structural integrity and perceptual quality of the watermarked images, ensuring that the embedding process does not significantly alter key visual features. The SIFT-based analysis provides a robust framework for assessing resilience against image processing attacks, as it highlights any discrepancies in the local invariant features that could impact the utility of the images in real-world applications. By comparing the SIFT feature descriptors of the original and watermarked images, it is possible to quantify the extent to which the watermark embedding process affects these critical image attributes. A minimal deviation in feature descriptors demonstrates that the watermarking method effectively preserves the image’s essential characteristics, as illustrated in Figure 8.

4.3. Objective Assessment

Objective assessment relies on quantitative metrics like PSNR, SSIM, and robustness analysis to systematically assess the performance of watermarking techniques. By utilizing these quantitative tools, the effect of watermarking on image fidelity can be accurately evaluated, allowing for effective comparisons between various watermarking methods. Table 2 shows the PSNR and SSIM values for the watermarking models, which were derived by averaging results from 4500 encoded images in the Brain Tumor Detection dataset. For comparison, we used six state-of-the-art (SOTA) watermarking models: HiDDeN [27], ReDMark [16], DA [47], TSDL [48], MBRS [49], and MIWET [50]. While we attempted to replicate the experiments from DA and TSDL, we were unable to fully reproduce their results, so we relied on the published outcomes from their respective studies for comparison. Additionally, MBRS offers a pretrained model, and we used their provided test results for evaluation. To ensure consistency in the comparison, the binary watermark length was fixed at L = 30 for all models considered.

As presented in Table 2, our AGFI-GAN model significantly outperformed the other six state-of-the-art watermarking models in terms of its SSIM. Specifically, AGFI-GAN achieved a PSNR of 44.37, which is 12.16 dB higher than HiDDeN’s PSNR of 32.21 and 10.67 dB higher than DA’s PSNR of 33.70. In terms of the SSIM, AGFI-GAN scored 0.9902, surpassing HiDDeN’s SSIM of 0.9287 by 0.0615. Moreover, compared to MBRS, which had an SSIM of 0.8926, AGFI-GAN’s SSIM is 0.0976 higher, demonstrating that AGFI-GAN better preserves image details and visual quality. Additionally, AGFI-GAN also outperformed ReDMark in the SSIM, indicating that our method more effectively retains the structural integrity of the original image after watermarking.

To assess the robustness of the proposed watermarking model, we calculated the bit accuracy (BA) by averaging the results across all the tested images. The BA is computed using $W_{out}$, as outlined in Equation (12). To optimize performance, we adjusted the loss function presented in Equation (14), where a lower loss value $L_D$ is associated with a higher BA, indicating improved robustness.

The bit accuracy (BA) results are shown in Figure 9, where a comparative evaluation of the proposed method is made against HiDDeN [27], TSDL [48], MBRS [49], and ReDMark [16] under various noise attack scenarios. The average BA values for HiDDeN, TSDL, MBRS, ReDMark, and our AGFI-GAN came out to 0.7997, 0.8062, 0.9377, 0.8534, and 0.9817, respectively, clearly illustrating that AGFI-GAN outperformed all other models. Specifically, AGFI-GAN showed an 18.2% improvement over HiDDeN and a 17.55% improvement over TSDL. When compared to ReDMark, AGFI-GAN achieved a 12.83% performance boost. Even though MBRS achieved a BA of 0.9377, AGFI-GAN surpassed it by 4.4%, establishing itself as the most robust model among those tested. Notably, AGFI-GAN demonstrated superior robustness against JPEG compression and Gaussian noise when compared to TSDL, ReDMark, and HiDDeN.

For a watermarking system to be considered practical, it must demonstrate robustness against a wide range of image distortions. To assess its ability to generalize to various image attacks, we evaluated the system using twelve types of untrained noise: JPEG compression, Gaussian noise, salt and pepper noise, cropping, dropout, rotation, contrast adjustment, median filtering, brightness adjustment, histogram equalization, image scaling, and shearing attacks.

As shown in Table 3, the robustness evaluation of our proposed AGFI-GAN model reveals superior performance over HiDDeN in the presence of various noise attacks. Specifically, under Gaussian noise, AGFI-GAN achieved nearly flawless performance with an accuracy of 95.61% at a noise density of 0.10, while HiDDeN’s accuracy dropped significantly to 75.48%. Similarly, in the case of JPEG compression, AGFI-GAN outperformed HiDDeN, with HiDDeN’s accuracy reaching only 72.81% at a quality factor (QF) of 10, further highlighting the robustness of our model.

In comparison, AGFI-GAN achieved significantly better performance, with an accuracy of 93.82%. The performance differences are especially notable in several attack scenarios. During a shearing attack with parameters [0.4, 0.4], AGFI-GAN achieved an accuracy of 98.84%, far surpassing HiDDeN’s accuracy of just 79.84%. For a 90° rotation, HiDDeN’s accuracy dropped to 73.28%, while AGFI-GAN attained a much higher accuracy of 97.08%. Under salt and pepper noise with a density of 0.1, HiDDeN’s accuracy was 79.01%, whereas AGFI-GAN maintained a significantly better accuracy of 97.05%. Additionally, with a contrast adjustment factor of 2.0, HiDDeN’s accuracy fell to 74.63%, while AGFI-GAN held a higher accuracy of 95.26%. Overall, AGFI-GAN showed strong and consistent performance across a wide range of noise attacks, outperforming HiDDeN by a substantial margin, particularly in challenging distortion scenarios and high noise densities.

4.4. Impacts on Medical Imaging Detection

To evaluate the impact of the AGFI-GAN watermarking method on downstream tasks, we conducted a classification experiment using a watermarked Brain Tumor Detection dataset. The objective was to determine whether embedding watermarks would affect classification accuracy when employing a deep learning model. Specifically, we used a ResNet-50 model trained from scratch on the dataset over 100 epochs, with classification accuracy recorded at each epoch to detect any potential performance deviations due to watermarking.

The results, shown in Figure 10, indicate that the test accuracy for the watermarked dataset remained consistently close to that of the original dataset across all epochs. This close alignment demonstrates that the AGFI-GAN watermarking method preserves the integrity of image features essential for classification. The negligible difference in accuracy between the two datasets supports the conclusion that our watermarking approach does not negatively impact classification performance, confirming its suitability for medical image authentication and protection without compromising the effectiveness of subsequent diagnostic tasks. This result aligns with the findings of Ahmed et al. [51], who conducted a comprehensive investigation into the impact of watermarking on classification accuracy. Their results demonstrated that, although watermarking can slightly affect image quality due to increased scaling factors, its influence on classification accuracy remains minimal. Both our study and theirs demonstrate that digital watermarking can seamlessly integrate with deep learning-based image classification models without significantly compromising performance of tasks in medical imaging analysis.

4.5. Security Analysis

We assume a security execution environment for medical images generation at the source side, such as CT and MRI. Thus, an adversary cannot compromise medical imaging devices and then modify original images. We also assume a secure communication channel to deliver decoder to user side. Our approach integrates invisible and resilient watermarks into medical images at the data source. This ensures that data recipients can easily extract these watermarks and verify the authenticity of the images upon arrival. Since an attacker cannot influence the watermark embedding or extraction processes, they are unable to generate counterfeit medical images with valid watermarks. The security mechanisms inherent in the digital watermarking scheme effectively safeguard against forgery attacks within medical network systems.

5. Conclusions and Future Work

This study presents AGFI-GAN, an advanced model for secure and robust watermarking of medical images, designed to meet the unique challenges of maintaining both invisibility and robust against attacks in a digital healthcare environment. With the integration of an attention-guided module (AGM) and a feature-integrated module (FIM), AGFI-GAN achieves significant improvements in watermark embedding without compromising image quality. The AGM effectively minimizes visual distortion by dynamically adapting the watermark’s strength across various regions based on global feature analysis, reducing visibility in sensitive or smooth areas while allowing for stronger watermark embedding. This adaptive approach is further supported by the FIM, which enhances feature extraction by fusing shallow and deep layers, improving the model’s robustness against image noise and attacks. The experimental evaluation validates AGFI-GAN’s superiority over baseline models in terms of watermark imperceptibility, robustness, and classification accuracy on watermarked datasets. The results indicate that the framework preserves image fidelity essential for diagnostic tasks, confirming its compatibility with real-world medical image applications where accuracy is paramount.

Future work could further explore optimizing the model for other image modalities and enhancing its resilience to emerging forms of digital attacks, thereby strengthening its applicability across diverse healthcare settings. Additionally, the AGFI-GAN model’s computational demands currently limit its deployment on resource-constrained edge devices, which are commonly used in real-time medical imaging applications. Future research will focus on making the model lightweight and adaptable, possibly through model pruning, quantization, and other compression techniques that can reduce computational overhead while preserving watermark robustness and invisibility. This approach could enable deployment across a range of medical applications, including portable diagnostic tools and remote healthcare environments.

Author Contributions

Conceptualization, X.L., R.X. and C.Z.; methodology, X.L. and R.X.; software, X.L. and R.X.; validation, X.L., R.X. and C.Z.; formal analysis, X.L. and R.X.; investigation, X.L., R.X. and C.Z.; resources, X.L. and R.X.; data curation, X.L. and R.X.; writing—original draft preparation, X.L. and R.X.; writing—review and editing, X.L., R.X. and C.Z.; visualization, X.L. and R.X.; supervision, R.X.; project administration, R.X.; funding acquisition, R.X. All authors have read and agreed to the published version of the manuscript.

Data Availability Statement

The original data presented in the study are openly available in following datasets: [Brain Tumor Detection datasets] accessed at 27 December 2024 [https://www.kaggle.com/code/pkdarabi/brain-tumor-detection-by-cnn-pytorch/input]; [liver-segmentation datasets] accessed at 27 December 2024 [https://www.kaggle.com/code/tenebris97/liver-segmentation-resnet-50/input]; [Diagnosis Of Pneumonia datasets] accessed at 27 December 2024 [https://www.kaggle.com/code/pkdarabi/diagnosis-of-pneumonia-by-cnn-classifier/input]; [Coronary Artery datasets] accessed at 27 December 2024 [https://www.kaggle.com/code/ahmadpk/heart-disease-classification/input]; [Hand X-ray datasets] accessed at 27 December 2024 [https://www.kaggle.com/datasets/antonbudnychuk/hand-xray]; [Spine Segmentation datasets] accessed at 27 December 2024 [https://www.kaggle.com/datasets/pycadmk/spine-segmentation-from-ct-scans].

Conflicts of Interest

The authors declare no conflicts of interest.

Abbreviations

The following abbreviations are used in this manuscript:

AGM	Attention-Guided Module
AGFI-GAN	Attention-Guided and Feature-Integrated Model Based on GAN
AI	Artificial Intelligence
BA	Bit Accuracy
BN	Batch Normalization
CNN	Convolutional Neural Network
CT	Computed tomography
DW	Digital Watermarking
DFT	Discrete Fourier Transform
DCT	Discrete Cosine Transform
DWT	Discrete Wavelet Transform
EPR	Electronic Patient Record
FIM	Feature-Integrated Module
GAN	Generative Adversarial Network
HIPAA	Health Insurance Portability and Accountability Act
HITECH	Health Information Technology for Economic and Clinical Health
IoT	Internet of Things
MLP	Multilayer Perception
MRI	Magnetic Resonance Imaging
PSNR	Peak Signal-to-Noise Ratio
ReLU	Rectified Linear Unit
SIFT	Scale-Invariant Feature Transform
SSIM	Structural Similarity Index Metric
SVD	Singular Value Decomposition

Footnotes

Disclaimer/Publisher’s Note: The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content.

Figures and Tables

Figure 1. Residual network. The X represents the output value from the previous layer that is fed into the neuron.

Figure 2. The DenseNet architecture captures both shallow and deep features, which are subsequently combined with the watermark to strengthen its resilience.

Figure 3. Architecture of attention-guided module, which employs both channel attention and spatial attention to enhance the performance of image feature extraction. It helps embed the watermark in less noticeable regions.

Figure 4. The architecture of the proposed AGFI-GAN is designed as an end-to-end watermarking framework capable of automatically producing watermarks that are both imperceptible and resilient. Its main components consist of an encoder, decoder, noise subnetwork, and a discriminator.

Figure 5. Encoder architecture. The encoder consists of (1) a feature-integrated module (FIM) that leverages dense connections to extract both shallow and deep features, which are subsequently combined with the watermark to enhance its robustness, and (2) an attention-guided module (AGM) that uses both spatial attention and channel attention to embed the watermark in less perceptible areas of the original image.

Figure 6. Performance of watermarking in AGFI-GAN. (a) Original image. (b) Watermarked image. The original and watermarked images appear nearly identical, demonstrating that the watermark has been effectively embedded in imperceptible regions.

Figure 7. Subjective assessment by comparing the histograms of the original and watermarked images.

Figure 8. The result of SIFT feature matching between the original and watermarked images. The colorful lines are used to link the matching keypoints between two images.

Figure 9. Comparative analysis of proposed work with HiDDeN [27], TSDL [48], MBRS [49], ReDMark [16]. The vertical axis represents bit accuracy.

Figure 10. The impact of watermarking on the classification accuracy of medical images.

Table 1

Detailed architecture of DenseNet.

Layer	DenseNet
Convolution	7 × 7 conv, stride 2
Pooling	3 × 3 max pool, stride 2
Dense Block (1)	$\left[\begin{array}{c}1\times 1\mathrm{conv}\\ 3\times 3\mathrm{conv}\end{array}\right]$× 6
Transition Layer (1)	1 × 1 conv
	2 × 2 average pool, stride 2
Dense Block (2)	$\left[\begin{array}{c}1\times 1\mathrm{conv}\\ 3\times 3\mathrm{conv}\end{array}\right]$× 12
Transition Layer (2)	1 × 1 conv
	2 × 2 average pool, stride 2
Dense Block (3)	$\left[\begin{array}{c}1\times 1\mathrm{conv}\\ 3\times 3\mathrm{conv}\end{array}\right]$× 48
Transition Layer (3)	1 × 1 conv
	2 × 2 average pool, stride 2
Dense Block (4)	$\left[\begin{array}{c}1\times 1\mathrm{conv}\\ 3\times 3\mathrm{conv}\end{array}\right]$× 32
Transition Layer (4)	1 × 1 conv
	2 × 2 average pool, stride 2

Table 2

Comparison of different models on Brain Tumor Detection dataset.

Model	PSNR	SSIM
HiDDeN [27]	32.21	0.9287
TSDL [48]	33.50	-
DA [47]	33.70	-
MBRS [49]	35.74	0.8926
ReDMark [16]	37.86	0.9689
MIWET [50]	41.83	0.9845
AGFI-GAN	44.37	0.9902

Table 3

Evaluation of the robustness of the proposed approach.

Attack	Noise Density	HiDDeN [.%]	AGFI-GAN [.%]
Gaussian noise	0.001	82.96	100.00
	0.05	79.83	97.25
	0.10	75.48	95.61
JPEG Compression	QF = 10	72.81	93.82
	QF = 50	76.57	97.75
	QF = 90	91.68	99.54
Cropping	[20, 20, 420, 420]	78.54	97.89
Dropout	0.3	85.26	98.73
Salt and Pepper	0.001	89.74	99.32
	0.05	81.92	98.41
	0.1	79.01	97.05
Rotation	${45}^{\circ }$	77.62	97.64
	${90}^{\circ }$	73.28	97.08
Median filter	[2, 2]	87.15	99.57
	[3, 3]	79.34	96.49
Adjust Brightness	1.1	91.57	99.05
	1.3	79.85	96.78
Adjust Contrast	1.0	83.19	96.91
	2.0	74.63	95.26
Image scaling	0.5	74.71	98.53
	2	79.29	95.29
Shearing attack	[0.4, 0.4]	79.84	98.84
Histogram equalization	1.0	84.51	99.07

References

1. Anand, A.; Singh, A.K. Watermarking techniques for medical data authentication: A survey. Multimed. Tools Appl.; 2021; 80, pp. 30165-30197. [DOI: https://dx.doi.org/10.1007/s11042-020-08801-0]

2. Aherrahrou, N.; Tairi, H. PDE based scheme for multi-modal medical image watermarking. Biomed. Eng. Online; 2015; 14, pp. 1-19. [DOI: https://dx.doi.org/10.1186/s12938-015-0101-x]

3. Singh, A.K.; Anand, A.; Lv, Z.; Ko, H.; Mohan, A. A survey on healthcare data: A security perspective. ACM Trans. Multimed. Comput. Commun. Appl.; 2021; 17, pp. 1-26. [DOI: https://dx.doi.org/10.1145/3422816]

4. Alshanbari, H.S. Medical image watermarking for ownership & tamper detection. Multimed. Tools Appl.; 2021; 80, pp. 16549-16564.

5. Nosowsky, R.; Giordano, T.J. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) privacy rule: Implications for clinical research. Annu. Rev. Med.; 2006; 57, pp. 575-590. [DOI: https://dx.doi.org/10.1146/annurev.med.57.121304.131257] [PubMed: https://www.ncbi.nlm.nih.gov/pubmed/16409167]

6. Anand, A.; Singh, A.K. Hybrid nature-inspired optimization and encryption-based watermarking for e-healthcare. IEEE Trans. Comput. Soc. Syst.; 2022; 10, pp. 2033-2040. [DOI: https://dx.doi.org/10.1109/TCSS.2022.3140862]

7. Anand, A.; Singh, A.K. An improved DWT-SVD domain watermarking for medical information security. Comput. Commun.; 2020; 152, pp. 72-80. [DOI: https://dx.doi.org/10.1016/j.comcom.2020.01.038]

8. Aparna, P.; Kishore, P.V.V. A blind medical image watermarking for secure e-healthcare application using crypto-watermarking system. J. Intell. Syst.; 2019; 29, pp. 1558-1575. [DOI: https://dx.doi.org/10.1515/jisys-2018-0370]

9. Liu, X.; Xu, R.; Chen, Y. A Decentralized Digital Watermarking Framework for Secure and Auditable Video Data in Smart Vehicular Networks. Future Internet; 2024; 16, 390. [DOI: https://dx.doi.org/10.3390/fi16110390]

10. Aparna, P.; Kishore, P.V.V. An efficient medical image watermarking technique in E-healthcare application using hybridization of compression and cryptography algorithm. J. Intell. Syst.; 2018; 27, pp. 115-133. [DOI: https://dx.doi.org/10.1515/jisys-2017-0266]

11. Ko, H.J.; Huang, C.T.; Horng, G.; Shiuh-Jeng, W. Robust and blind image watermarking in DCT domain using inter-block coefficient correlation. Inf. Sci.; 2020; 517, pp. 128-147. [DOI: https://dx.doi.org/10.1016/j.ins.2019.11.005]

12. Liu, J.; Huang, J.; Luo, Y.; Cao, L.; Yang, S.; Wei, D.; Zhou, R. An optimized image watermarking method based on HD and SVD in DWT domain. IEEE Access; 2019; 7, pp. 80849-80860. [DOI: https://dx.doi.org/10.1109/ACCESS.2019.2915596]

13. Jin, T.; Zhang, W. A novel interpolated DFT synchrophasor estimation algorithm with an optimized combined cosine self-convolution window. IEEE Trans. Instrum. Meas.; 2020; 70, pp. 1-10. [DOI: https://dx.doi.org/10.1109/TIM.2020.3033073]

14. Liu, X.; Liu, Z.; Chatterjee, S.; Portfleet, M.; Sun, Y. Understanding human behaviors and injury factors in underground mines using data analytics. Proceedings of the 2021 43rd Annual International Conference of the IEEE Engineering in Medicine & Biology Society (EMBC); Guadalajara, Mexico, 26–30 July 2021; pp. 2459-2462.

15. Liu, X.; Zhao, C. AGFA-Net: Attention-Guided and Feature-Aggregated Network for Coronary Artery Segmentation using Computed Tomography Angiography. arXiv; 2024; arXiv: 2406.08724

16. Ahmadi, M.; Norouzi, A.; Karimi, N.; Samavi, S.; Emami, A. ReDMark: Framework for residual diffusion watermarking based on deep networks. Expert Syst. Appl.; 2020; 146, 113157. [DOI: https://dx.doi.org/10.1016/j.eswa.2019.113157]

17. Guo, X.; Yang, W.; Zhang, L.; Shi, Y.; Li, J.; Sun, J.; Wan, W. Deep image watermarking with loss-driven modification. Multimed. Tools Appl.; 2024; 83, pp. 37665-37685. [DOI: https://dx.doi.org/10.1007/s11042-023-16809-5]

18. Geng, H.; Zhou, M. Novel post-photographic technique based on deep convolutional neural network and blockchain technology. J. Supercomput.; 2024; 80, pp. 6119-6139. [DOI: https://dx.doi.org/10.1007/s11227-023-05705-2]

19. Fan, Y.; Li, J.; Bhatti, U.A.; Shao, C.; Gong, C.; Cheng, J.; Chen, Y. A multi-watermarking algorithm for medical images using inception v3 and dct. CMC-Comput. Mater. Contin.; 2023; 74, pp. 1279-1302.

20. Zhang, W.; Li, J.; Bhatti, U.A.; Liu, J.; Zheng, J.; Chen, Y.W. Robust multi-watermarking algorithm for medical images based on GoogLeNet and Henon map. Comput. Mater. Contin.; 2023; 75, pp. 565-586. [DOI: https://dx.doi.org/10.32604/cmc.2023.036317]

21. Nawaz, S.A.; Li, J.; Shoukat, M.U.; Bhatti, U.A.; Raza, M.A. Hybrid medical image zero watermarking via discrete wavelet transform-ResNet101 and discrete cosine transform. Comput. Electr. Eng.; 2023; 112, 108985. [DOI: https://dx.doi.org/10.1016/j.compeleceng.2023.108985]

22. Nawaz, S.A.; Li, J.; Bhatti, U.A.; Shoukat, M.U.; Li, D.; Raza, M.A. Hybrid watermarking algorithm for medical images based on digital transformation and MobileNetV2. Inf. Sci.; 2024; 653, 119810. [DOI: https://dx.doi.org/10.1016/j.ins.2023.119810]

23. Nazari, H.; Bidgoli, M.M.; Ghasvari, H. Integration of lightweight cryptography and watermarking with compression for high speed and reliable communication of digital images in IoT. IET Image Process.; 2023; 17, pp. 2984-3001. [DOI: https://dx.doi.org/10.1049/ipr2.12849]

24. Xiong, L.; Han, X.; Yang, C.N.; Shi, Y.Q. Robust reversible watermarking in encrypted image with secure multi-party based on lightweight cryptography. IEEE Trans. Circuits Syst. Video Technol.; 2021; 32, pp. 75-91. [DOI: https://dx.doi.org/10.1109/TCSVT.2021.3055072]

25. Saxena, D.; Cao, J. Generative adversarial networks (GANs) challenges, solutions, and future directions. ACM Comput. Surv. (CSUR); 2021; 54, pp. 1-42. [DOI: https://dx.doi.org/10.1145/3446374]

26. Yildiz, E.; Yuksel, M.E.; Sevgen, S. A Single-Image GAN Model Using Self-Attention Mechanism and DenseNets. Neurocomputing; 2024; 596, 127873. [DOI: https://dx.doi.org/10.1016/j.neucom.2024.127873]

27. Zhu, J.; Kaplan, R.; Johnson, J.; Fei, L. Hidden: Hiding data with deep networks. Proceedings of the European Conference on Computer Vision (ECCV); Munich, Germany, 8–14 September 2018; pp. 657-672.

28. He, K.; Zhang, X.; Ren, S.; Sun, J. Deep residual learning for image recognition. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition; Las Vegas, NV, USA, 27–30 June 2016; pp. 770-778.

29. Huang, G.; Liu, Z.; Van Der Maaten, L.; Weinberger, K.Q. Densely connected convolutional networks. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition; Honolulu, HI, USA, 21–26 July 2017; pp. 4700-4708.

30. Zhang, K.; Guo, Y.; Wang, X.; Yuan, J.; Ding, Q. Multiple feature reweight densenet for image classification. IEEE Access; 2019; 7, pp. 9872-9880. [DOI: https://dx.doi.org/10.1109/ACCESS.2018.2890127]

31. Adegun, A.A.; Viriri, S. FCN-based DenseNet framework for automated detection and classification of skin lesions in dermoscopy images. IEEE Access; 2020; 8, pp. 150377-150396. [DOI: https://dx.doi.org/10.1109/ACCESS.2020.3016651]

32. Hu, J.; Shen, L.; Sun, G. Squeeze-and-excitation networks. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition; Salt Lake City, UT, USA, 18–23 June 2018; pp. 7132-7141.

33. Yu, C. Attention based data hiding with generative adversarial networks. Proceedings of the AAAI Conference on Artificial Intelligence; New York, NY, USA, 7–12 February 2020; Volume 34, pp. 1120-1128.

34. Zhang, K.A.; Xu, L.; Cuesta-Infante, A.; Veeramachaneni, K. Robust invisible video watermarking with attention. arXiv; 2019; arXiv: 1909.01285

35. Zhang, H.; Wang, H.; Cao, Y.; Shen, C.; Li, Y. Robust data hiding using inverse gradient attention. arXiv; 2020; arXiv: 2011.10850

36. Singh, A.K.; Kumar, B.; Singh, G.; Mohan, A. Medical Image Watermarking; Springer: Berlin/Heidelberg, Germany, 2017.

37. Sahu, H.P.; Kashyap, R. FINE_DENSEIGANET: Automatic medical image classification in chest CT scan using Hybrid Deep Learning Framework. Int. J. Image Graph.; 2023; 2550004. [DOI: https://dx.doi.org/10.1142/S0219467825500044]

38. Calisto, F.M.; Santiago, C.; Nunes, N.; Nascimento, J.C. BreastScreening-AI: Evaluating medical intelligent agents for human-AI interactions. Artif. Intell. Med.; 2022; 127, 102285. [DOI: https://dx.doi.org/10.1016/j.artmed.2022.102285] [PubMed: https://www.ncbi.nlm.nih.gov/pubmed/35430044]

39. Darabi, P.K. Brain Tumor Detection. Available online: https://www.kaggle.com/code/pkdarabi/brain-tumor-detection-by-cnn-pytorch/input (accessed on 27 December 2024).

40. Tenebris97. Liver-Segmentation. Available online: https://www.kaggle.com/code/tenebris97/liver-segmentation-resnet-50/input (accessed on 27 December 2024).

41. Darabi, P.K. Diagnosis of Pneumonia. Available online: https://www.kaggle.com/code/pkdarabi/diagnosis-of-pneumonia-by-cnn-classifier/input (accessed on 27 December 2024).

42. ahmadpk. Coronary Artery. Available online: https://www.kaggle.com/code/ahmadpk/heart-disease-classification/input (accessed on 27 December 2024).

43. BUDNYCHUK, A. Hand X-Ray. Available online: https://www.kaggle.com/datasets/antonbudnychuk/hand-xray (accessed on 27 December 2024).

44. Amine, M.M.E. Spine Segmentation. Available online: https://www.kaggle.com/datasets/pycadmk/spine-segmentation-from-ct-scans (accessed on 27 December 2024).

45. Bellavia, F.; Colombo, C. Is there anything new to say about SIFT matching?. Int. J. Comput. Vis.; 2020; 128, pp. 1847-1866. [DOI: https://dx.doi.org/10.1007/s11263-020-01297-z]

46. Pele, O.; Werman, M. A linear time histogram metric for improved sift matching. Proceedings of the Computer Vision–ECCV 2008: 10th European Conference on Computer Vision; Marseille, France, 12–18 October 2008; Proceedings, Part III 10 Springer: Berlin/Heidelberg, Germany, 2008; pp. 495-508.

47. Luo, X.; Zhan, R.; Chang, H.; Yang, F.; Milanfar, P. Distortion agnostic deep watermarking. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition; Seattle, WA, USA, 13–19 June 2020; pp. 13548-13557.

48. Liu, Y.; Guo, M.; Zhang, J.; Zhu, Y.; Xie, X. A novel two-stage separable deep learning framework for practical blind watermarking. Proceedings of the 27th ACM International Conference on Multimedia; Nice, France, 21–25 October 2019; pp. 1509-1517.

49. Jia, Z.; Fang, H.; Zhang, W. Mbrs: Enhancing robustness of dnn-based watermarking by mini-batch of real and simulated jpeg compression. Proceedings of the 29th ACM International Conference on Multimedia; Virtual, 20–24 October 2021; pp. 41-49.

50. Anand, A.; Bedi, J.; Rida, I. MIWET: Medical image watermarking using encryption and fusion technique. Comput. Electr. Eng.; 2024; 115, 109114. [DOI: https://dx.doi.org/10.1016/j.compeleceng.2024.109114]

51. Mohammed, A.A.; Awad, S.R.; Abdullah, M.A.; Elbasi, E.; Woo, W.L. Quantifying the Impact of Watermarking on Deep Learning Accuracy in Medical Image Classification. IEEE Access; 2024; 12, pp. 162040-162061. [DOI: https://dx.doi.org/10.1109/ACCESS.2024.3486757]