In digital age, intelligent medicine and telemedicine diagnosis also have a better development. To realize the convenience and speed of medical diagnosis, a large number of medical images have to be transmitted through the Internet [1], which involves the leakage of medical image information. Whether it is remote diagnosis or data sharing, the protection of patient privacy information is an important concern. Therefore, the protection of medical images are very important. Digital watermarking is an effective means of information protection, which can be used to protect medical images [2,3].

When protecting the medical images, we can’t destroy the original medical image, because once the images are destroyed, it will affect the doctor’s diagnosis. Therefore, the digital zero watermarking algorithms appear in the research idea of the researchers [4]. Many researchers in the field of image processing use hybrid transformation to solve the problem of leakage in medical image transmission [5–8]. Traditional digital watermarking schemes embed an invisible and detectable watermark in the host image to protect the image. These methods are feasible, but embedding a watermark directly into the image will lead to image distortion, which will affect the doctor’s diagnosis. The zero watermarking scheme does not embed any information in the original image, but associates the internal information of watermark with the feature vector of the original image through a logical relationship to form a key [9], and will not modify the original image. Compared with the classical watermarking algorithm, zero watermarking has relatively perfect invisibility and is very suitable for the protection of medical images.

In 2003, Wen et al. proposed zero watermarking, which is a new digital watermarking technique that does not modify the original image data. In this paper, high-order cumulants are used to extract the features of the image to construct zero watermarking [10]. Xiong proposed a robust zero-watermarking algorithm in spatial domain in 2018. The algorithm 1) uses chaotic system to map the location of image blocks, which is sensitive to initial values, and uses chaotic encryption and Arnold space scrambling techniques to preprocess the original watermark signal; 2) uses the robust performance of the relationship between the overall mean and block mean values of all selected blocks in the carrier image to construct feature information; 3) uses chaotic encryption and Arnold space scrambling techniques to post-process the generated zero watermark signal [11]. In 2019, Khan et al. proposed a new zero-watermarking scheme. The scheme generates NDD (neighbor distance difference) contour based on image scanning, whose redundant region shows the perceptual unimportant region of the grayscale image, extracts features from the robust region of the image, and uses reversible XOR operation to generate zero-watermark binary key image [12]. In 2020, Wu and others proposed an image zero watermarking technique based on improved singular value and sub-block mapping. Image features are extracted by Arnold scrambling, Curvelet transform, block segmentation and singular value decomposition (SVD) [13]. At the same time, the original copyright image is divided into different sub-blocks and summed, and different characters are used to represent the watermark sub-blocks. Finally, a feature of the image and watermark sub-block is logically operated by bit to generate zero watermarks [14].

Recently, convolution neural network (CNN) and machine learning algorithms have been applied to computer vision, including the application of extracting image features with trained CNN to complete expected tasks. In this paper, a zero-watermarking algorithm for medical images based on Resnet50 depth residual neural network is proposed. The image features are extracted by the trained CNN to obtain the output of the full connection layer (fc_1000). Then the deep features are further transformed by DCT transform and the feature vector is generated by the hash function. In the image verification phase, the watermark information is restored by a series of operations using the same method, and compared with original watermark information to verify the availability of the algorithm [15].

The algorithm mainly consists of three parts, namely, image feature extraction, zero watermark construction and embedding, and zero watermark extraction. First of all, the image features are extracted by ResNet50 and DCT transform, and the feature vector is generated by perceptual hash. Secondly, the XOR operation between the feature vector generated in the previous step and the encrypted watermark is carried out to get the zero watermark and embed the zero watermark. Finally, the zero-watermark detection algorithm is used to extract the watermark.

The purpose of this experiment is to verify the performance and effectiveness of the algorithm by using conventional attacks (non-geometric attacks) and geometric attacks. Section 4.1.1 lists the experimental results of the algorithm’s ability to resist conventional attacks, and Section 4.1.2 lists the experimental results of the algorithm’s ability to resist geometric attacks. The medical image used in the experiment is shown in Fig. 6a, and the watermark image and the scrambled image are shown in Figs. 6b and 6c.

In addition, the NC values between different images are tested, which are all less than 0.5, which can distinguish different images. The experimental figure is shown in Fig. 7 and the results are shown in Table 2. Among them, two values in Table 2 are 0.56, which is greater than the set reference value 0.50 described earlier, which may be because the shapes or types of individual images are somewhat similar.

To further illustrate the anti-geometric attack ability of the algorithm, some experimental data are compared. The comparison results are shown in Table 15. As can be seen from the table, for non-geometric attacks, such as Gaussian noise and JPEG compression (the attack intensity of the two is 5%), the performance of the proposed algorithm is slightly lower than that of the algorithm proposed by others in Table 15 [29–32], but the NC value of the two kinds of attacks is more than 0.5, which shows that the algorithm is robust.

For geometric attacks, when the rotation angle reaches 10°, the NC value can reach 0.88 respectively, while the NC value of the algorithm [29,30] is 0.82 and 0.61 respectively. When the rotation angle reaches 20°, the NC values of the algorithm [29,30] are 0.79 and 0.53 respectively. In this paper, it is proposed that the clockwise rotation angle of the algorithm can reach 80°, which is much higher than that of the algorithm [29–32]. For the downward translation attack with 15% attack intensity, the NC values of algorithm [30] and algorithm [32] are 0.61, 0.90 respectively, and the proposed algorithm NC is 0.91. For the left translation attack with 10% attack intensity, the NC value of the algorithm [29] is 0.63, and the proposed algorithm NC is 0.87. For the right translation attack with 5% attack intensity, the NC value of the algorithm [31,32] is 0.90, and the proposed algorithm NC is 0.97. When cutting in Y direction, when the shear ratio is 20%, the NC value of algorithm [29] is 0.64, the NC value of algorithm [31] is 0.79, and the NC of the proposed algorithm is 0.80. at the same time, it shows that the algorithm has a stronger ability to resist geometric attacks and a better effect than the algorithm [29–32].

To sum up, the proposed algorithm has good robustness and invisibility. The algorithm can effectively prevent information leakage and protect personal privacy information.

In recent years, the algorithm for watermarking medical images against geometric attacks has been a hot topic and a challenge in the study of robust watermarking technology. A zero watermarking algorithm based on Resnet50-DCT is designed to withstand geometric attacks in this paper. Resnet50-DCT is used to extract the deep features of medical images, while a two-dimensional discrete cosine transform and a mean-aware hashing algorithm are used to generate the zero watermark. Combining the concepts of Deep Residual Neural Network, Discrete Cosine Transform, and zero watermarking, the algorithm’s design process primarily solves the problem of watermarks resisting geometric attacks. Likewise, the scrambling encryption of the watermark image ensures the algorithm’s safety. According to the aforementioned experimental findings, the proposed algorithm is efficient and trustworthy, and has some practical value for the protection of medical and patient-specific data.

However, the algorithm needs to be improved. From the experimental data, it is difficult for the algorithm to strike a balance between geometric attacks and non-geometric attacks. Not only will this algorithm encounter this problem, but also the same kind of algorithms proposed by others will encounter this dilemma. Therefore, I have some ideas: as the core tools of the algorithm-ResNet50 and DCT transform, the combination of them or changing the type of transformation will also affect the performance of the algorithm. The function of the core tool is to extract image features, and the future research direction may be to find the optimal feature extraction method to balance the performance of the algorithm under geometric and non-geometric attacks.