Robust watermarking method for medical images against multiple attacks based on mamba architecture

Abstract

This invention discloses a robust watermarking method for medical images based on the Mamba architecture, resistant to multiple attacks. The method includes: generating a watermarked image by processing the original medical image and watermark information through an encoder network, where the encoder includes a hierarchical feature refinement sampler module and a channel-aware Mamba architecture bottleneck layer; recovering the watermark from the potentially attacked watermarked image through a decoder network, where the decoder includes a wavelet domain Mamba module and a sequence context dependency module for dual-path processing; randomly selecting 2-4 attacks from an attack library and applying them to the watermarked image in a random order and intensity using dynamic composite attacks; and end-to-end optimization using a composite loss function containing reconstruction loss, clean decoding loss, robust decoding loss, and perceptual loss. This invention decouples the image frequency band through discrete wavelet transform, embeds the watermark at high frequencies, and utilizes Mamba's selective state-space mechanism to model the long-range dependencies of wavelet coefficients, thereby improving the robustness of the watermark.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence technology, and relates to deep learning, digital watermarking, robust training and other aspects in artificial intelligence integrated systems. In particular, it relates to a robust watermarking method for medical images based on the Mamba architecture to resist multiple attacks. Background Technology

[0002] With the deep penetration of artificial intelligence technology into clinical diagnosis, the digital management of medical images has become a core support of the modern medical system. The flow and sharing of massive amounts of medical data such as X-rays, CT scans, and MRIs have greatly improved diagnostic and treatment efficiency. However, the challenges of tampering, forgery, and source traceability during data transmission, storage, and use are becoming increasingly prominent. Ensuring the authenticity, integrity, and traceability of medical images has become a key bottleneck in the development of medical informatization. Digital watermarking technology, by concealing authentication or source information within the image itself, provides a potential solution for the security protection of medical data.

[0003] In recent years, deep learning-based digital watermarking methods have made significant progress in the field of natural images, achieving high embedding capacity and invisibility. However, their direct application to medical images has significant limitations. The diagnostic fidelity requirements for medical images are extremely stringent. Subtle textures, grayscale variations, and anatomical details in the images are the core basis for clinical interpretation. Existing methods, in pursuit of robustness, introduce visual artifacts that can easily interfere with diagnostic accuracy, making it difficult to meet the professional needs of medical scenarios.

[0004] Mainstream convolutional neural network (CNN) architectures have shown significant shortcomings in medical image watermarking tasks. The inherent local receptive field characteristics of CNNs make it difficult for them to effectively capture the global anatomical structural relationships and long-range dependencies in medical images that are crucial for diagnosis. This limits the model's ability to represent key image features, affecting the accuracy of watermark embedding and the reliability of watermark extraction.

[0005] On the other hand, medical images in real clinical workflows often encounter complex compound attacks, including compression distortion and noise interference during data transmission, window level adjustment and cropping during processing, and format conversion during storage. These attacks act on images in a non-linear combination, and their destructive power far exceeds that of a single attack scenario. Existing watermarking methods are mostly designed for single attack types and lack adaptability to complex attack environments in the real world. As a result, the robustness of watermarks is difficult to meet the needs of actual medical applications. Summary of the Invention

[0006] The main objective of this invention is to provide a robust watermarking method for medical images based on the wavelet domain Mamba architecture, which is resistant to multiple attacks, in order to achieve a high level of balance between diagnostic-grade fidelity and robustness against real-world composite attacks.

[0007] Based on the first main aspect of the present invention, a robust watermarking method for medical images resistant to multiple attacks based on the wavelet domain Mamba architecture is provided, comprising the following steps performed by a computer system:

[0008] S110, Watermark Embedding: The original medical image and watermark information are processed by the encoder network to generate a watermarked image. The encoder contains a hierarchical feature refinement sampler module and a channel-aware Mamba architecture bottleneck layer.

[0009] S120, Watermark Extraction: Recover the watermark from potentially attacked watermarked images through a decoder network. The decoder includes a wavelet domain Mamba module and a sequence context dependency module for dual-path processing.

[0010] S130, Dynamic Robust Training: Randomly select 2-4 attacks from the attack library and apply dynamic composite attacks to the watermarked image in random order and intensity;

[0011] S140, Multi-objective optimization: end-to-end optimization through a composite loss function containing reconstruction loss, clean decoding loss, robust decoding loss and perceptual loss.

[0012] In some possible implementations, the watermark embedding is performed by an encoder network, including: embedding a binary information bitstream into the original host medical image to generate a watermarked image;

[0013] The encoder network adopts a U-Net-based architecture. Its downsampling path uses a hierarchical feature refinement sampler module based on discrete wavelet transform to decompose the feature map, retaining low-frequency components and performing residual fusion on high-frequency components. Its bottleneck layer adopts a channel-aware Mamba architecture to capture global context dependencies, and finally generates a residual signal added to the original image to obtain a watermarked image.

[0014] As a further preferred embodiment, in the aforementioned method, the residual fusion mechanism of the hierarchical feature refinement sampler module satisfies:

[0015] ;

[0016] in, For the first High-frequency information aggregated by a hierarchical feature refinement sampler module , , The first High-frequency subbands decomposed by a hierarchical feature refinement sampler module (·) represents the residual function.

[0017] As a further preferred embodiment, in the aforementioned method, the watermark extraction is performed by a decoder network, including: recovering the binary information bitstream from the watermarked image or the attacked watermarked image;

[0018] The core of the decoder network is the wavelet domain Mamba module, which first performs layer normalization on the input features and then enhances them through the sequence context dependency module.

[0019] The sequence context-dependent module uses discrete wavelet transform to decompose the features into low-frequency and high-frequency sub-bands, and processes them using a depth illumination information estimator and a channel-aware Mamba architecture, respectively. Finally, it reconstructs the features and predicts information bits through inverse discrete wavelet transform.

[0020] As a further preferred embodiment, in the aforementioned method, the dynamic robustness training includes constructing an attack library containing multiple attack types. In each training iteration, multiple attack types are randomly sampled from the attack library, and the watermarked image generated in the watermark embedding step is processed with random order and intensity parameters to form a composite attack sample.

[0021] The composite attack process is implemented through a differentiable attack layer to ensure the continuity of end-to-end training;

[0022] The attack library contains at least three differentiable attack operations from JPEG compression, Gaussian noise, rotation, scaling, cropping, brightness adjustment, and contrast adjustment.

[0023] As a further preferred embodiment, in the aforementioned method, the composite loss function includes at least four parts:

[0024] Image reconstruction loss Used to minimize pixel differences between the original host image and the watermarked image;

[0025] Clean image decoding loss Used to ensure accurate extraction of watermark information from unattacked watermarked images;

[0026] Robust decoding loss Used to ensure accurate extraction of watermark information from images subjected to complex attacks;

[0027] Perceived quality loss Features are extracted using a pre-trained VGG network, and the distance between the original image and the watermarked image in the feature space is minimized to ensure visual fidelity.

[0028] Based on a second key aspect of the invention, an encoder network for robust watermarking of medical images is provided, comprising at least:

[0029] The information preprocessing unit copies and expands the binary watermark information into a tensor that matches the size of the original medical image and splices them together along the channel dimension to form the input;

[0030] The downsampling unit consists of three hierarchical feature refinement sampler modules. Each hierarchical feature refinement sampler module decomposes the features into low-frequency and high-frequency subbands through Haar wavelet transform (DWT) implemented by 2D convolution, and aggregates high-frequency information through a residual fusion mechanism.

[0031] The bottleneck layer unit uses a channel-aware Mamba architecture to capture global dependency relationships.

[0032] The upsampling unit recovers the feature map resolution and outputs the residual signal through transposed convolution and skip connections;

[0033] The generation unit adds the residual signal to the original medical image and processes it through a cropping function to generate a watermarked image.

[0034] Based on a third key aspect of the invention, a decoder network for robust watermarking of medical images is provided, comprising at least:

[0035] The initial feature extraction unit extracts features from watermarked images that may be vulnerable to attack.

[0036] The wavelet domain Mamba module includes a sequence context-dependent module, which decomposes the features into low-frequency and high-frequency subbands using Haar wavelet transform (DWT).

[0037] The dual-path processing unit processes the low-frequency subband through a depth illumination information estimator and the high-frequency subband through a channel-aware Mamba architecture.

[0038] The feature reconstruction unit obtains the final feature map by fusing low-frequency and high-frequency features after inverse discrete wavelet transform;

[0039] The watermark recovery unit converts the watermark into a logits vector through global average pooling and a fully connected layer, and then recovers the watermark information through the Sigmoid function and threshold binarization.

[0040] Based on the fourth main aspect of the present invention, a robust watermarking system for medical images against multiple attacks based on the wavelet domain Mamba architecture is provided, including an encoder network, a decoder network and a differentiable attack layer.

[0041] The encoder network is a U-Net structure, which includes a hierarchical feature fine sampler module, a channel-aware Mamba architecture bottleneck layer and an upsampling unit. The hierarchical feature fine sampler module decomposes image features into low-frequency and high-frequency subbands through discrete wavelet transform and aggregates high-frequency information through residual fusion. The bottleneck layer captures global dependencies, and the upsampling unit outputs residual signals to generate watermarked images.

[0042] The decoder network includes a wavelet domain Mamba module. The sequence context dependency module within the wavelet domain Mamba module (WDM) decomposes the features into low-frequency and high-frequency subbands through DWT. After dual-path processing, the features are fused through inverse discrete wavelet transform to restore the watermark.

[0043] The differentiable attack layer is used to randomly select 2-4 attacks from the attack library and apply them to the watermarked image in a random order and intensity for dynamic robustness training.

[0044] Based on the fifth principal aspect of the present invention, a computer-readable storage medium is provided having a computer program stored thereon, characterized in that, when the program is executed, it implements the aforementioned robust watermarking method for medical images against multiple attacks based on the wavelet domain Mamba architecture.

[0045] Compared with existing technologies, this invention, by cleverly integrating frequency domain signal processing priors and state space models, constructs a robust watermarking framework that effectively overcomes the application limitations of traditional digital watermarking methods in the field of medical images, achieving a high level of balance between diagnostic-grade fidelity and robustness against complex attacks.

[0046] Secondly, the wavelet transform-based frequency domain decoupling embedding design of this invention exhibits significant advantages. The hierarchical feature refinement sampler decomposes image features into low-frequency and high-frequency sub-bands, minimizing perturbations on key low-frequency information (such as organ contours and main structures) that are crucial to diagnostic quality. At the same time, it hides the watermark signal in high-frequency texture details that are insensitive to the human eye, thus avoiding the interference of visual artifacts on clinical interpretation from the source. This lays a robust foundation while ensuring the imperceptibility of the watermark.

[0047] Furthermore, the Mamba-based sequence dependency modeling of this invention significantly improves model performance. The channel-aware Mamba architecture, with its efficient ability to capture long-range dependencies through the state-space model, accurately models the global correlation of wavelet coefficient sequences, significantly enhancing the model's ability to understand and reconstruct complex distortion patterns, enabling the watermark to maintain a high recovery accuracy even after severe attacks. The sequence context dependency module in the decoder further enhances the pertinence and effectiveness of feature representation by differentiating low-frequency and high-frequency components.

[0048] Finally, the dynamic composite attack training paradigm adopted in this invention significantly enhances the practical application value of the model. By randomly combining 2 to 4 attacks from the attack library and applying them to the watermarked image in a random order and intensity, the nonlinear degradation chain in the clinical workflow is simulated, forcing the model to learn more generalizable feature representations. This enables the model to maintain stable watermark extraction performance when facing unknown composite attacks such as compression, noise, and cropping in the real world, effectively improving its survivability in complex medical scenarios. Attached Figure Description

[0049] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, obtaining other drawings based on these drawings without creative effort still falls within the scope of the present invention.

[0050] Figure 1 The following is an execution flowchart of a robust watermarking method for medical images against multiple attacks based on the wavelet domain Mamba architecture in one embodiment of the present invention.

[0051] Figure 2 The diagram illustrates a framework of a robust medical image watermarking system based on the wavelet domain Mamba architecture proposed in one embodiment of the present invention, demonstrating the complete process from watermark embedding, composite attacks to watermark recovery.

[0052] Figure 3 A detailed architecture diagram of the encoder network in one embodiment of the present invention is shown, illustrating the structure of the HFRS module and the CAMA bottleneck layer.

[0053] Figure 4 A detailed architecture diagram of the decoder network in one embodiment of the present invention is shown, illustrating the dual-path processing mechanism of the WDM module and SCDM.

[0054] Figure 5 The following are representative medical image samples used in experiments in one embodiment of the present invention, wherein (a)-(d) NIH Chest X-ray; (e)-(f) Brain-Tumor-MRI; (g)-(h) COVIDx CT-3.

[0055] Figure 6A qualitative comparison of the visual effects of the method of the present invention with other methods is shown in one embodiment, wherein (a) original image; (b) magnified residual; (c) watermarked image of the present method; (d) DWT-DCT-SVD; (e) HiDDeN; (f) StegaStamp; (g) ProMark; (h) CNNWatermark. Detailed Implementation

[0056] The preferred embodiments of the present invention will be described in detail below to provide a clearer understanding of the purpose, features, and advantages of the present invention. It should be understood that the following embodiments are not intended to limit the scope of the present invention, but are merely illustrative of the essential spirit of the technical solution of the present invention.

[0057] In the following description, certain specific details are set forth for the purpose of illustrating various disclosed embodiments in order to provide a thorough understanding of the various disclosed embodiments. However, those skilled in the art will recognize that embodiments may be practiced without one or more of these specific details. In other instances, well-known techniques associated with the invention may not have been shown or described in detail to avoid unnecessarily obscuring the description of the embodiments.

[0058] Throughout this specification, references to "an embodiment" or "an embodiment" indicate that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. Therefore, the appearance of "in an embodiment" or "an embodiment" in various places throughout the specification does not necessarily refer to the same embodiment. Furthermore, a particular feature, structure, or characteristic may be combined in any manner in one or more embodiments.

[0059] The specific meanings of the technical terms or English abbreviations that may be used in this invention are explained below:

[0060] Wavelet Domain Mamba (WDM) Module: This refers to a module in the decoder that includes a Sequence Context Dependency Module (SCDM), which decomposes features into low-frequency and high-frequency subbands through Discrete Wavelet Transform (DWT) and performs dual-path processing.

[0061] Discrete Wavelet Transform (DWT): A signal processing method that decomposes image features into low-frequency subbands (containing main structural information) and high-frequency subbands (containing detailed texture information).

[0062] Haar wavelet transform (DWT): A discrete wavelet transform implemented through 2D convolution, used in hierarchical feature refinement samplers to decompose features into different frequency subbands. Haar wavelet transform (DWT) is a specific type or implementation of discrete wavelet transform (DWT).

[0063] Inverse Discrete Wavelet Transform (IDWT): A transformation method that fuses processed low-frequency and high-frequency subband features to reconstruct a complete feature map.

[0064] Hierarchical Feature Refinement Sampler (HFRS): A module in the encoder downsampling unit that decomposes features into low-frequency and high-frequency subbands through discrete wavelet transform, and aggregates high-frequency information through a residual fusion mechanism.

[0065] Channel-aware Mamba architecture (CAMA): A structure used for encoder bottleneck layers and decoders that can capture global dependencies of features and efficiently model long-range correlations of wavelet coefficient sequences.

[0066] State-space model (SSM): A model that can efficiently capture long-range dependencies in sequential data with linear complexity. Mamba is an advanced implementation of this model.

[0067] Sequence Context Dependency Module (SCDM): A submodule in the wavelet domain Mamba module, which decomposes features into low-frequency and high-frequency subbands through discrete wavelet transform, supporting differentiated processing of different frequency components.

[0068] NIHChestX-ray: A large-scale chest X-ray dataset released by the National Institutes of Health (NIH) Clinical Center, containing over 100,000 anonymized images and corresponding data from more than 30,000 patients (including cases of advanced lung disease), for research and AI-assisted diagnostic development.

[0069] Brain-Tumor-MRI: A magnetic resonance imaging technique for the diagnosis of brain tumors. Through enhanced scanning (such as gadolinium), diffusion-weighted / perfusion imaging, etc., it can accurately assess the location, size and relationship with surrounding tissues of the tumor, and assist in treatment planning.

[0070] COVIDxCT-3: A multinational open-source chest CT benchmark dataset containing over 430,000 CT slices from 6,068 patients (covering 17 countries), used for training computer-aided screening models for COVID-19, emphasizing data diversity and large scale.

[0071] DWT-DCT-SVD: A digital watermarking method that integrates Discrete Wavelet Transform (DWT), Discrete Cosine Transform (DCT), and Singular Value Decomposition (SVD). Through frequency domain layered processing and optimization algorithms, it balances robustness and invisibility in image copyright protection.

[0072] HiDDeN: A deep learning-based steganographic watermarking method that uses generative adversarial networks (GANs) to embed information into high-frequency regions of images, emphasizing visual invisibility. It is commonly used in natural images, but can easily introduce diagnostic interference in medical scenarios.

[0073] StegaStamp: A robust watermarking technique based on image patches. It embeds information through local feature perturbation and has a certain resistance to geometric transformations, but may affect the details of medical images due to modifications in fixed areas.

[0074] ProMark: A classic semi-fragile watermarking scheme based on the DCT domain. It embeds identifiers by quantizing mid-frequency coefficients and focuses on tamper detection, but its globally uniform embedding strategy may destroy key low-frequency structures in medical images.

[0075] CNNWatermark: An end-to-end watermarking framework based on convolutional neural networks. It learns embedding / extraction strategies directly through the encoder and decoder. It is suitable for natural images but lacks frequency domain priors. In medical images, it is easy to ignore the correlation of global anatomical structures due to local convolution.

[0076] U-Net structure: The feature extraction structure adopted by the encoder network is a symmetrical architecture consisting of a downsampling part (feature decomposition through a hierarchical feature refinement sampler) and an upsampling part (recovering resolution and fusing features through transposed convolutions and skip connections).

[0077] Depth Illumination Information Estimator (DLIE): A module in the decoder's dual-path processing used to handle low-frequency subbands. It estimates and compensates for potential photometric distortions in the image through a depth model, improving the stability of low-frequency features.

[0078] Global Average Pooling (GAP): An operation in the decoder used to transform the final feature map into a fixed-length feature vector by calculating the average value of each channel, simplifying the feature dimension and preserving global information.

[0079] Fully connected layer: A network layer in the decoder that connects the global average pooling output and the logits vector. Through fully connected neurons, it maps the feature vector to a specific dimension output, realizing the transformation from features to predicted values.

[0080] The logits vector is an unnormalized probability vector output by the fully connected layer. It contains the original predicted values ​​of each bit of the watermark information and is the input to the Sigmoid function.

[0081] The Sigmoid function is an activation function used to process logits vectors, mapping values ​​to the [0,1] interval to obtain the probability value of each watermark bit, providing a basis for subsequent binarization.

[0082] Binary Cross-Entropy Loss (BCE): A metric in the loss function used to measure the difference between the predicted watermark and the real watermark. It is suitable for binary classification tasks and evaluates the prediction accuracy by calculating the cross-entropy between the predicted probability and the real label.

[0083] VGG-19 network: A pre-trained deep convolutional neural network used in perceptual loss calculation to extract feature maps at different levels between the original image and the watermarked image, and to measure visual perceptual differences by the distance between the feature maps.

[0084] like Figure 1 As shown, in one feasible embodiment, a robust watermarking method for medical images resistant to multiple attacks based on the wavelet domain Mamba architecture includes the following steps performed by a computer system:

[0085] S110, Watermark Embedding: The original medical image and watermark information are processed by the encoder network to generate a watermarked image. The encoder contains a hierarchical feature refinement sampler module and a channel-aware Mamba architecture bottleneck layer.

[0086] S120, Watermark Extraction: Recover the watermark from potentially attacked watermarked images through a decoder network. The decoder includes a wavelet domain Mamba module and a sequence context dependency module for dual-path processing.

[0087] S130, Dynamic Robust Training: Randomly select 2-4 attacks from the attack library and apply dynamic composite attacks to the watermarked image in random order and intensity;

[0088] S140, Multi-objective optimization: end-to-end optimization through a composite loss function containing reconstruction loss, clean decoding loss, robust decoding loss and perceptual loss.

[0089] The following describes steps S110-S140 of the present invention in detail, taking into account the overall framework of a robust medical image watermarking system based on the wavelet domain Mamba architecture in one embodiment of the present invention.

[0090] This invention provides a robust watermarking system framework for medical images based on the wavelet domain Mamba architecture, resistant to multiple attacks. Figure 2 As shown, the whole consists of an encoder network. Decoder network and a differentiable attack layer constitute.

[0091] In most feasible implementations, encoder networks The U-Net structure includes a Hierarchical Feature Refined Sampler (HFRS) module, a channel-aware Mamba architecture bottleneck layer, and an upsampling unit. The Hierarchical Feature Refined Sampler (HFRS) module decomposes image features into low-frequency and high-frequency subbands through discrete wavelet transform and aggregates high-frequency information through residual fusion. The bottleneck layer captures global dependencies, and the upsampling unit outputs residual signals to generate watermarked images.

[0092] In most feasible implementations, the decoder network The Mamba module (WDM) in the wavelet domain is included. The sequence context-dependent module in the WDM decomposes the features into low-frequency and high-frequency subbands through DWT. After dual-path processing, the features are fused through inverse discrete wavelet transform and the watermark is restored.

[0093] In most feasible implementations, a differentiable attack layer is used to randomly select 2-4 attacks from an attack library and apply them to the watermarked image in a random order and intensity for dynamic robustness training.

[0094] In one feasible implementation, the present invention may rely on an encoder network for robust watermarking of medical images, comprising at least:

[0095] The information preprocessing unit copies and expands the binary watermark information into a tensor that matches the size of the original medical image and splices them together along the channel dimension to form the input;

[0096] The downsampling unit consists of three hierarchical feature refinement sampler modules. Each hierarchical feature refinement sampler module decomposes the features into low-frequency and high-frequency subbands through Haar wavelet transform (DWT) implemented by 2D convolution, and aggregates high-frequency information through a residual fusion mechanism.

[0097] The bottleneck layer unit uses a channel-aware Mamba architecture to capture global dependency relationships.

[0098] The upsampling unit recovers the feature map resolution and outputs the residual signal through transposed convolution and skip connections;

[0099] The generation unit adds the residual signal to the original medical image and processes it through a cropping function to generate a watermarked image.

[0100] In one feasible implementation, the present invention may rely on a decoder network for robust watermarking of medical images, comprising at least:

[0101] The initial feature extraction unit extracts features from watermarked images that may be vulnerable to attack.

[0102] The wavelet domain Mamba module includes a sequence context-dependent module, which decomposes the features into low-frequency and high-frequency subbands using Haar wavelet transform (DWT).

[0103] The dual-path processing unit processes the low-frequency subband through a depth illumination information estimator and the high-frequency subband through a channel-aware Mamba architecture.

[0104] The feature reconstruction unit obtains the final feature map by fusing low-frequency and high-frequency features after inverse discrete wavelet transform;

[0105] The watermark recovery unit converts the watermark into a logits vector through global average pooling and a fully connected layer, and then recovers the watermark information through the Sigmoid function and threshold binarization.

[0106] In one feasible implementation, the present invention may include the following specific steps:

[0107] Step S110, watermark embedding (encoder)

[0108] The encoding process is as follows Figure 3 As shown. Given a host medical image. and a length of Binary watermark information In the figure, n×n represents n×n convolution, NFSP represents nonlinear feature space projection, HFRS represents hierarchical feature refinement sampler, TConv represents inverted transformation, ResBlock represents cross-scale feature fusion, CAMA represents channel-aware Mamba architecture, C with a circle represents concatenation operation, + with a circle represents element fusion, and Tanh represents hyperbolic tangent activation function.

[0109] Includes the following steps:

[0110] 1. Information preprocessing: Preprocessing information... Copy and expand into a tensor that matches the image size. and the original image The input is stitched together along the channel dimension to form the encoder input. .

[0111] 2. Encoding Network deal with: The input is fed into the encoder network. This network has a U-Net structure, and its downsampling part consists of three Hierarchical Feature Refinement Sampler (HFRS) modules. Each HFRS module uses Haar wavelet transform (DWT) implemented with 2D convolution to perform feature decomposition, obtaining low-frequency (LL) and high-frequency (HL, LH, HH) subbands. High-frequency information is then aggregated through a residual fusion mechanism. This is to enhance feature representation while maintaining computational efficiency.

[0112] 3. Bottleneck layer processing: The feature map after multiple downsamplings enters the bottleneck layer. This layer adopts the channel-aware Mamba architecture (CAMA) and uses its state space mechanism to efficiently capture the global dependencies of features.

[0113] 4. Upsampling and Output: The feature map resolution is gradually restored through transposed convolution and skip connections, and finally a residual signal with the same size as the original image is output. .

[0114] 5. Generate a watermarked image: This involves processing the residual... Add to original image The image is then cropped to ensure that the pixel values ​​are within a valid range (e.g., [0,1]), ultimately resulting in a watermarked image. .

[0115] Step S120, Watermark Extraction (Decoder)

[0116] Decoding process as follows Figure 4 As shown, the purpose is to extract from the image (Possibly attacked) Restore information in ) It includes the following steps:

[0117] 1. After initial feature extraction, the feature map enters the core wavelet domain Mamba (WDM) module.

[0118] 2. Within WDM, features first pass through the Sequence Context Dependency Module (SCDM). SCDM uses DWT to decompose the input features into low-frequency subbands. and high-frequency subband .

[0119] 3. Dual-path processing:

[0120] (1) Low-frequency path: The image is processed using a depth illumination information estimator (DLIE) to compensate for potential photometric distortion, resulting in... .

[0121] (2) High-frequency path: Processing is performed using a CAMA module to accurately model the long-range dependencies in high-frequency coefficients, resulting in... .

[0122] 4. Feature Reconstruction and Prediction: The processed low-frequency and high-frequency features are fused into the final feature map using inverse discrete wavelet transform (IDWT). It is then transformed into a logits vector through global average pooling (GAP) and a fully connected layer. .

[0123] 5. Information Recovery: Apply the Sigmoid function to the logits vector to obtain the probability of each bit, then binarize it using a threshold to recover the final watermark information. .

[0124] Step S130, Dynamic Robust Training

[0125] To improve the model's generalization ability to complex real-world attacks, a dynamic composite attack strategy is introduced during training. This includes the following steps:

[0126] 1. Define an attack library It includes various differentiable attack operations, such as JPEG compression, Gaussian noise, rotation, scaling, cropping, brightness / contrast adjustment, etc.

[0127] 2. In each training batch, for the watermarked image Randomly selected from the attack database Extraction without replacement Type of attack ( (This is a random number, for example, between [2, 4]).

[0128] 3. This The attack is applied sequentially in a random order and with random strength parameters. Generate the final attacked image. This process forces the model to learn robust features that are insensitive to the order and intensity of attacks.

[0129] Step S140, Multi-objective optimization

[0130] The entire system uses a composite loss function End-to-end optimization is defined as follows:

[0131]

[0132] 1. To ensure the original image and watermarked images The difference between them, we define ,in It refers to the dimension of the image;

[0133] 2. To accurately extract watermarks from distortion-free images, we use binary cross-entropy loss (BCE) with Logits: ;

[0134] 3. In order to resist counter-attacks The loss function is: ;

[0135] 4. (Perceived loss) calculation and The L2 norm distance between feature maps at different levels of the pre-trained VGG-19 network is used to ensure high-quality visual invisibility. , ( ).

[0136] In the above feasible implementations, the present invention decouples the image frequency band through discrete wavelet transform, protects the key low-frequency components for diagnosis, embeds watermarks in high frequencies, and utilizes Mamba's selective state-space mechanism to model the long-range dependence of wavelet coefficients, significantly improving the robustness of the watermark under complex distortion.

[0137] like Figure 5 and Figure 6 As shown, this invention introduces a dynamic composite attack training paradigm to enhance the model's generalization ability to real-world degradation. Experiments on datasets such as NIH, Brain-Tumor-MRI, and COVIDx CT-3 demonstrate that it outperforms existing methods in terms of imperceptibility (PSNR: 43.8dB, SSIM: 0.971) and attack robustness (BER under standard attack: 12.4%), showing potential applicability in clinical scenarios.

[0138] The technical terms, principles, or means related to the technical solutions of the present invention mentioned in the above embodiments, which are not described in detail above, are all well-known technologies or common practices that are known to those skilled in the art.

[0139] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A robust watermarking method for medical images based on the Mamba architecture, resistant to multiple attacks, characterized in that... This includes the following steps performed by the computer system: S110, Watermark Embedding: The original medical image and watermark information are processed by the encoder network to generate a watermarked image. The encoder contains a hierarchical feature refinement sampler module and a channel-aware Mamba architecture bottleneck layer. S120, Watermark Extraction: Recover the watermark from potentially attacked watermarked images through a decoder network. The decoder includes a wavelet domain Mamba module and a sequence context dependency module for dual-path processing. S130, Dynamic Robust Training: Randomly select 2-4 attacks from the attack library and apply dynamic composite attacks to the watermarked image in random order and intensity; S140, Multi-objective optimization: end-to-end optimization through a composite loss function containing reconstruction loss, clean decoding loss, robust decoding loss and perceptual loss; The encoder network includes at least: The information preprocessing unit copies and expands the binary watermark information into a tensor that matches the size of the original medical image and splices them together along the channel dimension to form the input; The downsampling unit consists of three hierarchical feature refinement sampler modules. Each hierarchical feature refinement sampler module decomposes the features into low-frequency and high-frequency subbands through Haar wavelet transform implemented by 2D convolution, and aggregates high-frequency information through residual fusion mechanism. The bottleneck layer unit uses a channel-aware Mamba architecture to capture global dependency relationships. The upsampling unit recovers the feature map resolution and outputs the residual signal through transposed convolution and skip connections; The generation unit adds the residual signal to the original medical image and processes it through a cropping function to generate a watermarked image. Decoder network, including at least: The initial feature extraction unit extracts features from watermarked images that may be vulnerable to attack. The wavelet domain Mamba module includes a sequence context-dependent module, which decomposes the features into low-frequency and high-frequency subbands through Haar wavelet transform. The dual-path processing unit processes the low-frequency subband through a depth illumination information estimator and the high-frequency subband through a channel-aware Mamba architecture. The feature reconstruction unit obtains the final feature map by fusing low-frequency and high-frequency features after inverse Haar wavelet transform; The watermark recovery unit converts the watermark into a logits vector through global average pooling and a fully connected layer, and then recovers the watermark information through the Sigmoid function and threshold binarization.

2. The robust watermarking method for medical images based on Mamba architecture according to claim 1, characterized in that, The watermark embedding is performed by an encoder network and includes: embedding a binary information bitstream into the original host medical image to generate a watermarked image; The encoder network adopts a U-Net-based architecture. Its downsampling path uses a hierarchical feature refinement sampler module based on Haar wavelet transform to decompose the feature map, retaining low-frequency components and performing residual fusion on high-frequency components. Its bottleneck layer adopts a channel-aware Mamba architecture to capture global context dependencies, and finally generates a residual signal added to the original image to obtain a watermarked image.

3. The robust watermarking method for medical images based on Mamba architecture against multiple attacks according to claim 1 or 2, characterized in that, The residual fusion mechanism of the hierarchical feature refinement sampler module satisfies: ； in, For the first High-frequency information aggregated by a hierarchical feature refinement sampler module , , The first High-frequency subbands decomposed by a hierarchical feature refinement sampler module (·) represents the residual function.

4. The robust watermarking method for medical images based on Mamba architecture according to claim 2, characterized in that, The watermark extraction is performed by a decoder network, including: recovering the binary information bitstream from the watermarked image or the attacked watermarked image; The core of the decoder network is the wavelet domain Mamba module, which first performs layer normalization on the input features and then enhances them through the sequence context dependency module. The sequence context-dependent module uses Haar wavelet transform to decompose the features into low-frequency and high-frequency sub-bands, and processes them using a depth illumination information estimator and a channel-aware Mamba architecture, respectively. Finally, the features are reconstructed and information bits are predicted through inverse Haar wavelet transform.

5. The robust watermarking method for medical images based on Mamba architecture according to claim 1, characterized in that, The dynamic robustness training includes constructing an attack library containing multiple attack types. In each training iteration, multiple attack types are randomly sampled from the attack library and processed with random order and intensity parameters on the watermarked image generated in the watermark embedding step to form a composite attack sample. The composite attack process is implemented through a differentiable attack layer to ensure the continuity of end-to-end training; The attack library contains at least three differentiable attack operations from JPEG compression, Gaussian noise, rotation, scaling, cropping, brightness adjustment, and contrast adjustment.

6. The robust watermarking method for medical images based on Mamba architecture according to claim 1, characterized in that, The composite loss function comprises at least four parts: Image reconstruction loss Used to minimize pixel differences between the original host image and the watermarked image; Clean image decoding loss Used to ensure accurate extraction of watermark information from unattacked watermarked images; Robust decoding loss Used to ensure accurate extraction of watermark information from images subjected to complex attacks; Perceived quality loss Features are extracted using a pre-trained VGG network, and the distance between the original image and the watermarked image in the feature space is minimized to ensure visual fidelity.

7. A robust watermarking system for medical images based on the Mamba architecture, resistant to multiple attacks, for implementing the method as described in any one of claims 1 to 6, characterized in that, This includes encoder networks, decoder networks, and differentiable attack layers; The encoder network is a U-Net structure, which includes a hierarchical feature fine sampler module, a channel-aware Mamba architecture bottleneck layer and an upsampling unit. The hierarchical feature fine sampler module decomposes image features into low-frequency and high-frequency subbands through Haar wavelet transform and aggregates high-frequency information through residual fusion. The bottleneck layer captures global dependencies, and the upsampling unit outputs residual signals to generate watermarked images. The decoder network includes a wavelet domain Mamba module. The sequence context dependency module in the wavelet domain Mamba module decomposes the features into low-frequency and high-frequency subbands through Haar wavelet transform. After dual-path processing, the features are fused through inverse Haar wavelet transform and the watermark is restored. The differentiable attack layer is used to randomly select 2-4 attacks from the attack library and apply them to the watermarked image in a random order and intensity for dynamic robustness training.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed, it implements the Mamba-based robust watermarking method for medical images against multiple attacks as described in any one of claims 1 to 6.

Images