🤖 machine learning

Vol-Mark: A Watermark for 3D Medical Volume Data Via Cubic Difference Expansion and Contrastive Learning

Vol-Mark is a novel reversible zero-watermarking framework for 3D medical volumetric data that combines contrastive learning for robust feature extraction and cubic difference expansion for low-distortion embedding, thereby ensuring both data integrity and ownership verification against various attacks without compromising diagnostic accuracy.

Original authors: Jiangnan Zhu, Yuntao Wang, Shengli Pan, Yujie Gu

Published 2026-05-07

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Jiangnan Zhu, Yuntao Wang, Shengli Pan, Yujie Gu

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a precious, three-dimensional sculpture made of thousands of tiny, glowing blocks (voxels). This is no ordinary statue; it is a detailed map of a human organ, such as a brain or a liver, created by advanced medical scanners. In the world of telemedicine, doctors must send these 3D maps over the internet to consult with specialists. Yet there is a problem: once these maps leave the hospital, they become vulnerable. Someone could steal them, copy them without permission, or even worse, secretly alter a few blocks to hide a tumor or falsify a diagnosis.

The work introduces Vol-Mark, a sophisticated security system specifically designed to protect these 3D medical maps. Think of Vol-Mark as a "digital spirit" living within the sculpture, invisible to the naked eye but impossible to remove without destroying the sculpture itself.

Here is how Vol-Mark works, broken down into simple concepts:

1. The "Fingerprint" (Contrastive Learning)

First, the system must know what the sculpture is so it can prove who owns it.

The Analogy: Imagine trying to describe a unique snowflake. If you only look at one flat side, you might miss its true 3D shape. Old methods treated medical data like a stack of flat 2D photos (slices). Vol-Mark, however, uses a special AI (a 3D ResNet-18) trained with "contrastive learning."
How it works: Consider this AI as a master sculptor who views the entire 3D object at once. It learns to ignore noise (like static on a television) and focus on the unique, stable shape of the organ. It creates a "digital fingerprint" (a series of 0s and 1s) that is unique to the scan of that specific patient. Even if the image is slightly blurry or rotated, the fingerprint remains the same.

2. The "Secret Message" (Cubic Difference Expansion)

Now that we have the fingerprint, we must hide the proof of ownership within the data without altering the image.

The Analogy: Imagine you have a group of four friends standing in a square (a "cube" of voxels). You want to hide a secret note (the watermark) in their conversation without them noticing you are there.
How it works: Vol-Mark examines the tiny differences in "height" (intensity) between these four friends. It uses a technique called Cubic Difference Expansion (c-DE).
- It takes the difference between the friends, doubles it (expands it), and slips the secret note into the gap.
- By expanding the difference, it creates just enough space to hide the note without making the friends look different to an observer.
- Crucially, this is done with mathematics that can be perfectly reversed; the system can later "shrink" the difference back to its original size, remove the note, and return the friends exactly to their original positions. This is called reversible watermarking. The medical data is restored to 100% pixel-perfect accuracy after verification.

3. The "Double Lock" (Verification)

Vol-Mark does not just check if the data is present; it checks whether it has been tampered with.

Integrity Check: When the data arrives, the system first checks if the "seal" is broken. If the data has been altered (like a block that has been moved), the system knows immediately.
Ownership Check: If the data is intact, it extracts the hidden note and compares it with the owner's ID. If the data has been tampered with, the system switches to an emergency plan: it uses the pre-stored "fingerprint" to prove ownership anyway, even if the hidden note is damaged. It is like a spare key that works even if the front door lock is jammed.

Why is this special?

Most security systems for medical images are like sticking a sticker on a 2D photo. They work well for flat images but fall apart when you try to rotate or stretch a 3D object.

The 3D Advantage: Vol-Mark is built for the third dimension. It understands that the blocks in a 3D scan are connected in all directions (up, down, left, right, forward, backward).
The Result: In tests, Vol-Mark survived attacks that would have destroyed other systems. Whether someone tried to rotate the 3D model, cut out a corner, add noise, or compress the file, Vol-Mark held firm. It consistently proved ownership with over 90% accuracy, even when the data was heavily damaged.

Summary

Vol-Mark is a reversible, Zero-Watermarking system.

Reversible: It can hide the proof and then perfectly remove it, leaving the medical data exactly as it was (crucial for accurate diagnosis).
Zero-Watermarking: It does not simply stick a watermark on top; it generates a unique code based on the data itself, making it extremely difficult to forge.
3D-Aware: It treats the medical scan as a solid 3D object, not a stack of flat pages, making it robust against 3D-specific attacks like rotation.

In short, Vol-Mark acts as an invisible, indestructible seal on 3D medical data, ensuring that a doctor receiving a scan knows exactly who it belongs to and that no one has secretly altered the diagnosis.

Technical Summary: Vol-Mark for 3D Medical Volumetric Data

Problem Statement
The rapid adoption of 3D medical volumetric data (e.g., CT and MRI) in telemedicine and diagnostics has introduced significant security challenges regarding data integrity and ownership protection. While watermarking represents a standard solution for 2D medical images, existing methods encounter critical limitations when applied to 3D volumes:

Loss of Spatial Context: Many approaches treat 3D data as a stack of 2D slices, failing to capture spatial dependencies between slices, thereby rendering them vulnerable to 3D-specific attacks such as out-of-plane rotations.
Data Quality: Reversible watermarking techniques developed for 2D images cannot be easily transferred to voxel-based data due to complex spatial relationships. Conversely, Zero-Watermarking methods often rely on 2D features or slice averaging, which limits their distinctiveness and robustness.
Security Gaps: There is a lack of methods that simultaneously offer lossless data recovery, robust ownership verification, and resilience against geometric and hybrid attacks specifically tailored to volumetric structures.

Methodology: Vol-Mark
The article introduces Vol-Mark, a novel reversible Zero-Watermarking framework specifically developed for 3D medical volumetric data. The workflow consists of three phases:

Feature Extraction and Ownership Key Generation:
- Contrastive Learning: A 3D ResNet-18 backbone (pre-trained on MedicalNet) is employed as a feature extractor. It is trained using a contrastive loss function on augmented views of the volumetric data to learn discriminative and stable volumetric features that capture correlations between slices.
- Binarization: The extracted feature vectors are binarized using a zero threshold.
- Ownership Key (OS): The binary watermark is combined with the binarized features and a chaotic sequence generated via the Henon map (using XOR operations) to create an encrypted ownership key. This ensures the watermark is tightly linked to the data content and secured against forgery.
Reversible Embedding (Cubic Difference Expansion – c-DE):
- 3D Integer Wavelet Transform (3D-IWT): The original volumetric data is decomposed into low-frequency (LLL) and high-frequency sub-bands. Embedding occurs in the LLL sub-band to preserve structural integrity.
- Cubic Difference Expansion: The LLL sub-band is divided into $2 \times 2 \times 2$ cubes. For each cube, one reference voxel and its three neighbors are selected. The differences between the reference pixel and the neighbors are expanded (doubled) to create an embedding space.
- Embedding: The bits of the ownership key are embedded into these expanded differences. The process uses integer arithmetic and includes an overflow/underflow check with a location map to ensure perfect reversibility.
- Recovery: The inverse 3D-IWT reconstructs the watermarked volume. During extraction, the inverse c-DE process exactly restores the original voxel values, ensuring lossless data recovery.
Dual Verification:
- Integrity Check: The Bit Error Rate (BER) between the original and extracted watermark is calculated. A BER of zero indicates that the data is unaltered and can be recovered losslessly.
- Ownership Verification: If the data has been manipulated (BER > 0), a hypothesis test (Binomial test) is performed on the extracted bits against the pre-stored ownership key to verify ownership with high statistical confidence ( $p \le 10^{-6}$ ).

Main Contributions

Novel Architecture: Introduction of Vol-Mark, the first reversible Zero-Watermarking scheme specifically designed for 3D medical volumetric data, combining contrastive learning with reversible embedding.
3D Feature Extraction: Development of a contrastive learning-based 3D ResNet-18 extractor that extracts volumetric features directly from the entire volume, thereby increasing robustness against 3D geometric attacks (e.g., out-of-plane rotations) compared to slice-based methods.
Cubic Difference Expansion (c-DE): A new embedding technique that exploits 3D voxel dependencies within $2 \times 2 \times 2$ cubes at low-frequency coefficients. This enables reversible embedding without additional storage requirements and ensures perfect data recovery.
Dual Verification Mechanism: A robust verification protocol that first performs integrity checks, followed by ownership verification via hypothesis testing, to ensure reliability even in cases of data manipulation or watermark removal attacks.

Experimental Results
The method was evaluated on the MSD dataset (Tasks: Brain tumors, Liver, and Pancreas) against conventional, geometric, and hybrid attacks.

Reversibility: Under attack-free conditions, Vol-Mark achieved perfect reversibility with a BER of 0.00 and infinite PSNR for the recovered data. The watermarked data exhibited high quality (average PSNR > 80 dB).
Robustness: Vol-Mark demonstrated superior robustness against Gaussian noise, Salt-and-Pepper noise, JPEG compression, Median/Average filtering, scaling, rotation, translation, and cropping.
- In most attack scenarios, Vol-Mark maintained an Accuracy (ACC = 1-BER) of over 0.90.
- It significantly outperformed existing baseline methods (3D-DTCWT and ADCL-ZW), particularly under geometric attacks (rotation and scaling) and hybrid attacks.
- The method demonstrated consistent performance across various anatomical structures (Brain, Liver, Pancreas) and data formats.
Resilience Against 3D Attacks: Unlike baseline methods that suffer performance degradation under out-of-plane rotations or scaling along the Z-axis, Vol-Mark maintained high accuracy due to its volumetric feature extraction and 3D embedding strategy.

Significance
The article claims that Vol-Mark bridges the critical gap in securing 3D medical volumetric data for telemedicine. By integrating contrastive learning for robust feature extraction and c-DE for reversible embedding, the method ensures that medical data can be securely transmitted and ownership verified without compromising diagnostic accuracy. The capability for lossless recovery and resistance against complex 3D attacks makes it a practical solution for protecting the integrity and authenticity of medical volumetric data in real-world clinical and research environments.

1. The "Fingerprint" (Contrastive Learning)

2. The "Secret Message" (Cubic Difference Expansion)

3. The "Double Lock" (Verification)

Why is this special?

Summary

More like this