With the continuous development of convolutional neural network (CNN) models, general convolutional neural networks will improve their performance by extending the depth and width of the network model; however, more profound or wider networks will face many problems such as too many parameters prone to overfitting, gradient dispersion, and increased computational complexity. Therefore, the proposed GoogLeNet network [26] can effectively improve the problems of traditional networks, which is a convolutional neural network model architecture for multi-scale image information extraction proposed by a team at Google Inc. and won the championship at the ImageNet Large-Scale Visual Recognition Challenge (ILSVRC) in 2014.

The GoogLeNet convolutional neural network has 22 layers of depth, as shown in Fig. 1, and has nine Inception modules at the core of its architecture. Although its network depth reaches 22 layers, its parametric size is much smaller than that of ALexNet and VGG networks, and its performance is much superior. Meanwhile, to avoid the gradient dispersion problem brought about by increasing the network depth, two auxiliary classifiers are added to the GoogLeNet network structure for back-propagating gradients in the training phase, which can effectively avoid the gradient disappearance problem. Then in the testing phase, only the final Softmax3 is used to output the results, and the two auxiliary classifiers will be removed.

Of course, the proposed Inception module structure is an essential innovation in the GoogLeNet network. The main principle of the Inception module is to use multiple different convolutional kernels to extract feature information of different image sizes and fuse this feature information as the output. The Inception module can obtain better image features than a single convolutional kernel size. This structure uses a locally optimal sparse structure instead of the original convolutional neural network’s fully connected approach to minimize redundancy and increase the width and depth of the network structure, and the performance is improved. As shown in Fig. 2, it is a net-within-a-network structure, and it can be seen from the structure diagram that 1 × 1 convolutional layers are added before the 3 × 3 convolutional layer and the 5 × 5 convolutional layer, and after the 3 × 3 maximum pooling layer, respectively, where 1 × 1 convolution is mainly used for dimensionality reduction, which reduces the number of parameters and thus the complexity of computation. Therefore, when memory or computational resources are limited, GoogLeNet network will play a great advantage.

Henon map [27] is a two-input two-dimensional nonlinear discrete chaotic mapping system that is very sensitive to chaotic initial values. Since the system is controlled by two variables simultaneously, then its security performance will be better than that of one-dimensional chaotic techniques such as Logistic mapping, so it is suitable for generating pseudo-random sequences in image encryption. The iterative equation of its mapping is as in Eq. (1).

(1){xn+1=1−axn2+ynyn+1=bxnwhere x and y are the two variables of the system and n is the number of iterations, the study shows that when the parameters take the values a=1.4 and b=0.3, the system is in a chaotic state, generating both x and y chaotic system variables system, in Fig. 3 is the generated chaotic attractor, this chaotic attractor is two irregular curves. Fig. 4 shows the bifurcation diagram of the xn component of the Henon system with the variation of the parameter a, where the initial values xo=0, yo=0, b=0.3, and a∈[0,1.4] are taken, and it can be seen that the more the value of a is taken close to 1.4, the higher the complexity of the chaotic system. Therefore, in cryptographic applications, the parameters are usually taken to be a=1.4 and b=0.3.

At present, deep learning has been widely used in the field of medical image processing, however, due to the particular characteristics of medical images, it is difficult for us to obtain a large amount of medical image data for training, and the annotation cost is high, and there are few free and publicly available medical datasets. Then it becomes a difficult task to obtain a network model for deep feature extraction by training a large number of medical images. Therefore, combining it with transfer learning can be a good solution to the current problem. Transfer learning [28] is a machine learning method that refers to a pre-trained model being reused in another task, which can effectively circumvent the shortcoming of insufficient training data and improve the performance of neural networks.

Then in the zero watermarking algorithms, extracting stable features of medical images is a very important part. The method in this paper is to select the pre-trained GoogLeNet network on the ImageNet database, which has been trained with more than one million natural images and has a good feature extraction effect; on this basis, the network is fine-tuned for the medical dataset we constructed and transfer learning is performed to train the medical image feature extraction network.

Since the algorithm in this paper uses the zero watermarking technique, the main method of this technique is to associate the image features with the watermark. Then extracting a stable image feature vector can guarantee the robustness of the watermarking algorithm. At this time, we utilize the trained GoogLeNet network to extract the feature information, which has the architecture of multi-scale image information extraction and can be well combined with the zero watermarking technique to obtain stable feature vectors. Fig. 6 shows the process of feature extraction with the following steps:

Step 1: Using the original medical image I(i, j) as the input to the trained GoogLeNet network, with the input images all resized to 224 × 224 × 3.

Step 2: Since we previously used the 32-bit image binary feature vector as the label of the dataset, the original 1000 parameter values of the fully connected layer (FC) are adjusted to 32, so the medical image is processed by the trained GoogLeNet network, and the fully connected layer FC outputs 32 feature values D(j).

Step 3: Combined with the perceptual hash, the 32 values D(j) are quantized and encoded, and those greater than or equal to 0.5 are judged as “1” and those less than 0.5 are judged as “0” to generate a binary feature sequence, which is used as the feature vector V(j) of the medical image.

This time, Henon mapping is used to perform chaotic encryption of watermark, which is a two-dimensional discrete chaotic system with higher security than one-dimensional chaotic systems such as Logistic mapping. Fig. 7 is the flow chart of the chaotic encryption algorithm with multiple watermarks.

The steps of the watermark encryption principle are:

Step 1: We first generate the chaotic sequence XY(j) given the initial values of the system x0 and y0.

Step 2: By quantization coding the chaotic sequence XY(j), the value greater than or equal to 0 is judged as “1” and the opposite is judged as “0”, thus converting the chaotic sequence XY(j) into a binary encrypted sequence C(j).

Step 3: Three different types of binary watermark Wk(i, j) were selected, including text, symbols and graphics, with a pixel size of 32 × 32. Finally, XOR operation is performed on each line of the binary watermarking image Wk(i, j) and binary encryption sequence C(j) to obtain chaotic encrypted multi-watermark BWk(i, j), as shown in Eq. (2), where “⊕” is an XOR operator. The operation rule is: when the two values are different, the XOR result is 1; conversely, the result is 0. (2)BWk(i,j)=C(j)⊕Wk(i,j)

Digital watermarking system mainly has two important processes of watermark embedding and watermark extraction, this section introduces the watermark embedding part, the watermark embedding process is shown in Fig. 8. The specific implementation steps are as follows:

Step 1: The feature vector V(j) of the original medical image I(i, j) is extracted through the trained GoogLeNet network, and the detailed steps of obtaining the feature vector can refer to the chapter: feature extraction of medical images.

Step 2: Before watermark embedding, Henon chaos encryption is performed on different types of multi-watermark information to improve information security, and chaos encrypted multi-watermark BWk(i, j) is obtained.

Step 3 : The feature vector V(j) and the encrypted watermark BWk(i, j) are performed XOR operation to generate the logical key Keyk(i, j), which is saved in the third party to realize the embedding of multiple watermarks, as shown in Eq. (3). (3)Keyk(i,j)=V(j)⊕BWk(i,j)

This section includes the extraction and decryption of the watermark, the process of which is shown in Fig. 9, with the following implementation steps:

Step 1: Firstly, extract the feature vector V′(j) of the medical image I′(i,j) to be tested using the same method as watermark embedding.

Step 2: The feature vector V′(j) and key Keyk(i, j) are XOR operation, and then the encrypted multi-watermark information BWk′(i,j) is extracted, as shown in Eq. (4). (4)BWk′(i,j)=Keyk(i,j)⊕V′(i)

Step 3: Watermark decryption process: the extracted encrypted watermark BWk′(i,j) and the binary encryption sequence C(j) are performed XOR operation to restore the watermark information Wk′(i,j), as shown in Eq. (5). (5)Wk′(i,j)=BWk′(i,j)⊕C(j)

In our experiments, we used two performance metrics: peak signal-to-noise ratio (PSNR) and normalized correlation coefficient (NC). Among them, PSNR can measure the distortion degree of medical images containing watermarks, and the smaller the PSNR value, the greater the distortion degree of the image. In Eq. (6), I(i, j) denotes the grayscale value of each pixel point in the original image; I′(i,j) denotes the grayscale value of each pixel point in the embedded watermarked image; M and N denote the pixel values of the rows and columns of the medical image.

(6)PSNR=10lg⁡[MNmaxi,j(I(i,j))2∑i∑j(I(i,j)−I′(i,j))2]

Meanwhile, to compare the correlation between the original watermark and the extracted watermark, we use the normalized correlation coefficient NC. In Eq. (7), W(i,j) is the original watermark and W′(i,j) is the extracted watermark. in the experiment, when the NC value is not less than 0.5, the algorithm can effectively extract the watermark information; when the NC value is closer to 1, it means that the correlation between the two is higher and the algorithm is more robust against attacks.

(7)NC=∑i∑jW(i,j)W′(i,j)∑i∑jW2(i,j)

To prove the reliability of the algorithm, it is guaranteed that the extracted feature vectors are representative. We can use the normalized correlation coefficient NC to measure the similarity between different image feature vectors, when the NC value is lower than 0.5, it means that the similarity of different image feature vectors is low and the extracted feature vectors are well representative; on the contrary, it means that the feature vectors are not very representative. In this time, we selected 4 different medical images from inside and outside the test set to test, and Fig. 11 shows the 8 medical images tested, and Table 3 shows the NC values between them.

The data in Table 3 shows that the absolute values of NC values between different images are less than 0.5, and the NC values between the same images are all 1. Therefore, the medical image feature vectors extracted by the trained network are representative and can distinguish between different images, indicating that the algorithm is reliable.

In this simulation experiment, we tested conventional and geometric attacks of different intensities, respectively, and selected three types of watermark information. The original watermark is shown in Fig. 10 above. Meanwhile, in the experimental results, “NC1” represents the NC value after the original watermark 1 attack, “NC2” represents the NC value after the original watermark 2 attacks, and “NC3” represents the NC value after the original watermark 3 attacks.

To better verify the robustness of the proposed algorithm, we compare it with a part of existing classical watermarking algorithms. In the experimental process, we selected the same size of brain map and text “HN” watermark information for testing to maintain uniformity. Then, we compared with the existing algorithms KAZE-DCT [30], Zernike-DCT [31], Inception V3-DCT [32], and DWT-DCT. As can be seen, from both Table 6 and Fig. 14, the performance of the proposed algorithm is similar to the other four algorithms in conventional attacks; in geometric attacks, although the algorithm performs slightly lower than the DWT-DCT algorithm in downshift attacks, it significantly outperforms the existing algorithms in most geometric attacks, especially in comparison with the algorithm using pre-trained Inception V3, the proposed paper based on GoogLeNet transfer learning based watermarking scheme in this paper has superior performance. Thus, the proposed algorithm is generally better than the existing algorithms and has good robustness in both conventional and geometric attacks.