Structure-Aware Reversible Data Hiding for Images with Functional Modules

Abstract

Reversible data hiding (RDH) in structured images remains challenging: most deep-learning methods target natural images, where distortions can be spread across the entire picture. When the carrier contains functionally critical regions—the finder and alignment patterns of a QR code, for instance—a uniform allocation of distortion directly hurts machine readability and, as a result, reversibility. This paper presents AR-WeNet, a structure-aware reversible data hiding framework for images with rigid functional structures. It brings together two components: (1) a Regulatory Information Encryption Module (RIEM) that turns a structured regulatory record into an encrypted binary pattern through UTF-8 encoding, QR error-correction coding, and Arnold scrambling; and (2) a DWT-domain invertible neural network backbone enhanced by Multi-Scale Wavelet Subband Attention (MSWA). A region-adaptive embedding (RAE) strategy, steered by a predefined structural weight map, concentrates embedding distortions in redundant data modules while leaving functional modules intact. On the self-constructed E-Voucher-500 benchmark, AR-WeNet reaches 63.29 dB PSNR, 0.9999 SSIM, a 0.000% pre-correction bit error rate, and 100% exact QR decoding success—an 8.00 dB improvement over the uniform-weighting WeNet baseline. Robustness tests under JPEG compression, Gaussian noise, and cropping confirm resilience at both the bit level and the decoding level. On DIV2K, the INN backbone achieves 55.27 dB, surpassing HiNet by 10.41 dB, showing that the design extends beyond structured images to natural-image hiding.

1. Introduction

Reversible data hiding (RDH) aims to embed secret information into a cover image while making it possible to recover both the hidden message and the original image without any loss [1,2]. The problem has been studied extensively for natural images, where embedding distortions can be distributed globally under the assumption that the human visual system barely notices small, evenly spread perturbations. Yet a growing class of images violates this assumption: images containing rigid functional modules whose integrity is essential to their intended use. Typical examples include QR codes, barcodes, document images with structured layouts, and machine-readable labels—images in which certain regions must remain untouched if they are to be decoded or recognized correctly.

Electronic vouchers—value-added tax invoices, digital receipts, commercial contracts, transportation tickets, and licenses among them—are a representative case. In digital finance and governance, there is a growing need to embed regulatory information (tax identifiers, audit tags, timestamps, digitally hashed seals) into voucher images without it being visible, while letting authorized parties extract that information losslessly for traceability and compliance. Because these vouchers carry QR codes whose functional modules (finder patterns, alignment patterns, timing patterns) are indispensable for decoding, applying conventional RDH schemes to them raises a challenge that has received little attention: embedding distortions must be allocated unevenly, protecting functional modules while confining perturbations to redundant data modules.

Beyond the financial and governance sector, smart education is another setting where structured-image RDH has clear practical value. Digital academic credentials—diplomas, degree certificates, transcripts, and professional qualification certificates—are increasingly issued and circulated as images carrying QR codes for authenticity checks. These documents typically embed structured regulatory information such as student identifiers, course records, credit accumulations, graduation audits, and digitally signed seals. Just as with electronic vouchers, the QR codes on educational certificates contain functionally critical modules whose integrity is essential for machine-readable authentication. The proposed framework’s ability to reversibly embed regulatory data while preserving the decodability of these functional modules makes it directly applicable to building trustworthy digital education systems, where certificate authenticity and academic record integrity must be verifiable without degrading the visual quality or machine readability of the documents. The Key Laboratory of Data Science and Smart Education (Ministry of Education), to which the authors are affiliated, views this line of work as a step toward intelligent document-security infrastructure for educational governance.

RDH for such structured images has to meet three technical requirements at once. (1) Imperceptibility: the stego image must be visually indistinguishable from the original, so that manual inspection and OCR-based recognition are unaffected. (2) Reversible extraction: the embedded payload must be recovered with no character-level loss whatsoever—a stricter requirement than the usual bit-level reversibility, since the payload consists of structured text. (3) Structural integrity: functionally critical modules must remain decodable after embedding. This constrains not merely how large the distortions are, but where they may be placed.

Traditional RDH methods, such as difference expansion (DE) [1] and histogram shifting (HS) [2], face an inherent trade-off between embedding capacity and visual quality. Recent improvements—prediction error expansion [3,4], encrypted-domain RDH [5,6], and JPEG-domain schemes [7]—have pushed the field forward, but these methods remain vulnerable to deep-learning-based steganalysis [8]. More importantly, they treat the cover image as a homogeneous signal and offer no mechanism for safeguarding specific functional regions, which is precisely what structured images demand.

Invertible neural networks (INNs) have emerged as a promising alternative. Lu et al. [9] introduced ISN, which uses affine coupling layers to build a bijective mapping between embedding and extraction. Jing et al. [10] proposed HiNet, embedding information in the DWT domain and reporting 44.86 dB PSNR on DIV2K. Later work has looked at lightweight designs (LiDiNet [11]), multi-image steganography (iSCMIS [12], DeepMIH [13]), and robust RDH (RIS [14]). Still, these methods are built for natural images and spread embedding distortions uniformly across the spatial or wavelet domain. Applied to structured images, this even-handed allocation damages functionally critical modules and weakens decodability, as our experiments in Section 4.3 confirm.

Two further challenges appear when the payload itself is structured. First, regulatory text is not random binary data: it shows strong statistical correlation and recognizable patterns, making it easier for steganalysis to detect. Second, the payload must survive the numerical deviations introduced by neural embedding so that character-level recovery stays exact. Existing INN-based methods provide no preprocessing tailored to structured payloads, leaving both problems unresolved.

To tackle these issues, we propose AR-WeNet, a structure-aware reversible data hiding framework for images with rigid functional structures. Built on a DWT-domain INN backbone, AR-WeNet introduces: (1) a Regulatory Information Encryption Module (RIEM) for secure encoding and invertible recovery of structured text, paired with Arnold scrambling to break up the structural correlation of the embedded payload; (2) a region-adaptive embedding (RAE) strategy that allocates distortions according to the functional geometry of the carrier; and (3) Multi-Scale Wavelet Subband Attention (MSWA) for stronger subband feature learning on structured carriers.

The main contributions of this work are summarized as follows:

(1) We propose AR-WeNet, an end-to-end structure-aware RDH framework for images with rigid functional modules. It integrates RIEM for secure encoding and invertible recovery of structured text, together with Arnold scrambling to remove the structural correlation of the embedded payload.

(2) We design the RAE strategy, which uses a predefined structural weight map and a region-aware loss function to safeguard functional modules while concentrating distortions in redundant data modules. To our knowledge, this is the first RDH scheme that explicitly allocates embedding distortions according to the functional structure of the carrier.

(3) We build E-Voucher-500, a controlled benchmark of 500 synthetic electronic voucher pairs for structure-aware RDH research, and run extensive experiments on both structured and natural-image benchmarks. The proposed method reaches 63.29 dB PSNR, 0.9999 SSIM, a 0.000% pre-correction BER, and 100% exact QR decoding success on E-Voucher-500, while the INN backbone hits 55.27 dB on DIV2K—evidence that it generalizes beyond structured images to natural-image hiding.

2. Related Work

2.1. Reversible Data Hiding

RDH techniques aim to recover both hidden data and the original cover image without loss. Early approaches include DE [1] and HS [2]. Later developments include prediction error expansion [3], pixel-value ordering (PVO) [4], encrypted-domain RDH [5,6], and JPEG-domain schemes [7]. These methods, however, face inherent capacity-distortion trade-offs and limited resistance to modern steganalysis. More fundamentally, they all assume that every pixel of the cover is equally available for modification. For a structured carrier, this assumption falls apart: shifting a finder pattern by even a single gray level can alter the module decision of a downstream decoder.

2.2. Deep-Learning-Based Image Steganography

Deep learning has reshaped image steganography. HiDDeN [15] uses an encoder–decoder architecture with adversarial training, while SteganoGAN [16] reaches high embedding capacity through GAN-based encoding. Mou et al. [17] extended steganography to video. A persistent problem, though, is that separately trained encoders and decoders often work against each other optimization-wise.

INNs get around this through bijective mappings. ISN [9] and HiNet [10] established INN-based steganography in the spatial and DWT domains, respectively. LiDiNet [11] trims down the computational cost, while iSCMIS [12] strengthens multi-image embedding through spatial-channel attention. PUSNet [18] combines steganography with denoising, and Wang et al. [19] merged invertible neural networks with generative adversarial networks for high-accuracy steganography. That said, these methods all target natural images and overlook the structural constraints of QR codes; a thorough survey of deep-learning-based image hiding can be found in [20].

Security analysis has drawn growing attention. Boroumand et al. [8] put forward SRNet for deep residual steganalysis. Wei et al. [21] built a universal deep steganalysis network based on channel representation. RFNNS [22] uses text-to-image models for robust steganography, while StegaINR4MIH [23] turns to implicit neural representation for multi-image hiding. These detectors—and the steady improvements being made to them—motivate payload preprocessing along the lines of the scrambling step in our RIEM: once the meaningful structure of the payload is stripped away, detection based on payload regularities becomes far harder.

2.3. Document Security and Anti-Counterfeiting

Traditional document protection relies on digital watermarking [24] and digital signatures. More recent deep-learning work focuses on forgery detection [25] and signature verification [26]. Still, RDH designed specifically for electronic voucher supervision remains largely unexplored. This work steps into that gap.

2.4. Encryption and Watermarking for Structured Carriers

Security-oriented protection of document and code carriers has taken a different route. Zou et al. [27] proposed an invisible and robust watermarking model based on hierarchical residual fusion multi-scale convolution, spreading the watermark redundantly across multiple scales so it survives common signal processing. Their objective is robust detection rather than exact recovery of the original carrier, and the embedding is not bounded by any functional geometry. Gong et al. [28] devised an encryption-authentication scheme driven by pixel-adaptive diffusion, encrypting the visual content itself into a noise-like image that is later authenticated. Such schemes protect confidentiality well, but the encrypted output can no longer be read by ordinary scanners—a serious limitation for vouchers that must remain machine-readable. Zhou et al. [29] combined quantum image encryption with watermarking using the quaternion discrete cosine transform and the Baker map, demonstrating how transform-domain scrambling can serve both encryption and copyright marking; their setting, however, is quantum image representation, where carrier readability is not a concern. In contrast, our framework never damages the carrier: the voucher stays visually intact and decodable by standard means, and only the embedded regulatory payload is encrypted and scrambled. The Arnold cat map used in RIEM plays a role similar to the Baker-map scrambling in [29], but it is chosen for exact integer reversibility, negligible cost, and compatibility with QR module grids—and in our setting, it is the payload, not the carrier, that gets scrambled.

3. Proposed Method

3.1. Problem Formulation and Overall Framework

Let m denote the regulatory text and V ∈ ℝ^3×H×W the electronic voucher image. The goal is to learn an invertible embedding transformation F and its inverse F⁻¹ such that

$$(V^{\prime },K)=F(V,P;\theta ), (\widehat{V},\widehat{P})=F^{-1}(V^{\prime },K;\theta )$$

where P is the encrypted pattern derived from m, V′ is the stego voucher, K is an auxiliary subband stream produced during embedding and kept by the issuing authority, and θ denotes the network parameters. To be precise about their roles: V′ is the version of the voucher that is actually issued and circulated—visually indistinguishable from the original V and carrying the same human-readable and machine-readable content, but with its pixels now also carrying the encrypted pattern P; K, by contrast, is not part of the published voucher and serves as extraction-side information for the authority (Section 3.3.1). The system must satisfy four requirements simultaneously: (a) visual indistinguishability between V and V′; (b) lossless recovery of m by the authority—stricter than bit-level reversibility, since the payload is structured text; (c) undetectability of P by unauthorized parties, ensured by both payload encryption and the fact that the inverse pass cannot be computed without the authority-held K; and (d) structural integrity—the functional modules of the QR code on the voucher must remain exactly decodable after embedding.

The overall pipeline is shown in Figure 1. The system has two core components: the Regulatory Information Encryption Module (RIEM), which encodes the regulatory text into an encrypted binary pattern; and the AR-WeNet reversible embedding module, which embeds that pattern into the cover image under the guidance of the RAE strategy.

Figure 1. Overall framework of the proposed AR-WeNet.

3.2. Regulatory Information Encryption Module (RIEM)

RIEM turns a structured regulatory record into a secure binary pattern that can be handled by neural embedding, while guaranteeing lossless recovery. One design choice deserves emphasis up front: RIEM works entirely in the binary domain, whereas the INN backbone works with continuous-valued tensors. The bridge between the two is defined in Step 4, and it is the key to exact recovery. RIEM has four steps.

Step 1: Text encoding. The regulatory text m is encoded into a byte sequence via UTF-8: b = UTF8(m), b ∈ {0, …, 255}. In the electronic voucher scenario, m is a fixed-format record made up of several semantically distinct fields: a voucher registration identifier, a verification code, a taxpayer identifier, an amount, a transaction category code, and an issuance timestamp. Because these fields are produced by the issuing authority in a controlled format, the encoded record has a stable length of 69–70 bytes in practice (roughly 70 bytes). That allows the QR version and error-correction level to be fixed in advance and keeps the payload comfortably below the channel capacity introduced in Step 2.

Step 2: QR error-correction coding. The byte sequence is encoded into a QR symbol using Version 10 (57 × 57 modules) with H-level error correction (30% codeword recoverability):

X = QR_H(b),  X ∈ {0,1}^57×57.

A Version 10 H-level symbol holds 119 bytes, leaving roughly 50 bytes of slack above the ~70-byte record; this slack is deliberate, as it allows for possible field-value expansions. Exact recovery of X is protected by two complementary mechanisms. First, the INN backbone is invertible, and its embedding–extraction round trip is numerically near-exact: the deviation in the pattern branch is at most 1.1 × 10⁻³ in [0, 1] units (Section 3.5), well below the 0.5 decision margin of binarization. Second, even if a few modules were misread, H-level error correction tolerates up to 30% codeword loss, providing an independent safety net. The version can be swapped for others: Section 4.5 evaluates Versions 8 (49 × 49, 84 bytes) and 9 (53 × 53, 98 bytes) using the same trained network.

Step 3: Pattern expansion and Arnold scrambling. The QR matrix X is first expanded from the 57 × 57 module grid to a 256 × 256 pixel pattern by nearest-neighbor interpolation, so that each module occupies a 4–5 pixel block (256/57 ≈ 4.49) with sharp boundaries and no intermediate gray levels. The resulting binary pattern is then scrambled with the Arnold cat map, iterated k = 5 times:

$$\left(\begin{array}{c}{x}^{\prime }\\ y^{\prime }\end{array}\right)=\left(\begin{array}{cc}1& 1\\ 1& 2\end{array}\right)\left(\begin{array}{c}x\\ y\end{array}\right)\left(\mathrm{mod}\hspace{0.25em}256\right).$$

The transformation matrix has determinant 1 and is therefore invertible over the integer lattice; the inverse map,

$${\left(\begin{array}{cc}1& 1\\ 1& 2\end{array}\right)}^{-1}=\left(\begin{array}{cc}2& -1\\ -1& 1\end{array}\right),$$

On a 256 × 256 lattice the map is a permutation of period 192 (A¹⁹² ≡ I mod 256), so every iteration count k with 1 ≤ k < 192 is exactly reversible: the iteration count controls only the scrambling strength, never the recoverability. On the actual expanded pattern (Figure 2), the horizontal and vertical adjacent-pixel correlations fall from 0.776 and 0.784 at k = 0 to 0.022 and −0.007 at k = 5, while the correlation between scrambled and original patterns drops to 1.1 × 10⁻⁴. More iterations yield no measurable extra decorrelation, so k = 5 is used throughout; it also keeps the scrambling cost to a single memory permute (Section 3.4).

Figure 2. Arnold scrambling of the expanded secret pattern (k = 5 adopted). (a) The pattern at iterations k = 0, 1, 2, and 5. (b) Adjacent-pixel and scrambled-vs-original correlations versus iteration k; the adopted k = 5 is marked.

Step 4: Channel replication and domain bridging. The scrambled binary pattern is replicated across the three color channels to form the secret tensor:

$$P_c[u,v]=\tilde{X}[u,v], c\in \{1,2,3\}, P\in \{0,1{\}}^{3\times 256\times 256}.$$

A deliberate choice here is that P takes values in {0, 1} rather than {−1, +1} or normalized gray levels. The INN operates on continuous-valued tensors and treats P as a real-valued image; keeping its entries at the two endpoints of the unit interval means that recovering the pattern after extraction comes down to a single thresholding operation at 0.5, whose decision margin (0.5) exceeds the worst-case round-trip deviation by more than two orders of magnitude (Section 3.5). The inverse process recovers m exactly: inverse network pass → inverse Arnold transform (k = 5) → binarization at 0.5 → module-center sampling on the 57 × 57 grid → QR decoding with H-level correction → UTF-8 decoding. Every step after the network is integer-exact and deterministic, so character-level recovery does not depend on any statistical approximation.

3.3. AR-WeNet Reversible Embedding Module

The AR-WeNet module uses a DWT-domain INN backbone to guarantee bijectivity between embedding and extraction. It brings in QR structural priors through the RAE strategy, which generates a structural weight map that protects functional modules differently while applying a lower weight to data modules.

Definition 1 (Structural weight map).

Given a QR carrier of version v, the structural weight map S assigns to each pixel (x, y) a weight equal to the functional criticality of the module it belongs to:

$$S\left(x,y\right)=\left\{\begin{array}{ll}3.0,& (x,y)\in \mathrm{finder\; patterns},\\ 2.5,& (x,y)\in \mathrm{separators},\\ 2.0,& (x,y)\in \mathrm{timing\; and\; alignment\; patterns},\\ 1.0,& (x,y)\in \mathrm{data\; modules}.\end{array}\right.$$

The weights are fixed by the QR specification rather than learned, and the map is computed analytically from the module geometry in O(HW) time (Section 3.4); Figure 3a shows S for the Version-3 carrier, and Figure 3b overlays the module classification on a voucher. Higher weights mark modules whose misreading cascades into decoding failure—finder, separator, and timing patterns determine the sampling grid, while alignment patterns correct perspective distortion—whereas the data modules, covering roughly 70% of the symbol area, carry the payload and tolerate local perturbation. The training objective therefore does not eliminate distortion but redirects it: coupling this map to the region-aware fidelity loss (Section 3.3.3) pushes most of the embedding energy into the low-weight region.

Figure 3. RAE strategy. (a) Structural weight map S for the Version-3 carrier. (b) Functional-module classification overlaid on a voucher image. (c) Per-region distortion (1—SSIM, scaled by 10³) for the WeNet baseline, the RAE ablation, and the full model on the test set.

3.3.1. DWT-Domain Invertible Backbone

The cover image V and the encrypted pattern P are decomposed by a single-level Haar DWT into four subbands (LL, LH, HL, HH); each subband is scaled by 0.5 during decomposition so that all coefficients stay in a range comparable to the input, and the four subbands of the three color channels are concatenated into a 12-channel tensor per branch. The two branches are then concatenated into a 24-channel input to a stack of N = 8 cascaded affine coupling blocks.

An affine coupling block is the basic reversible unit of an INN. It splits its input into two halves (x₁, x₂) and transforms them as

y₁ = x₁ + ϕ(x₂),

y₂ = x₂⊙exp(τ ⋅ ρ(y₁)) + η(y₁),

where ϕ(·), ρ(·), η(·) are nonlinear mappings implemented by convolutional sub-networks (described below) and τ = 0.1. The intuition is straightforward: one half of the tensor is modulated using the other half as its controller. Because each update depends only on quantities already available at inversion time, the transformation can be undone exactly. Formally, x₁ is changed only by an additive function of x₂, and x₂ only by a multiplicative-plus-additive function of y₁, so the Jacobian is block-triangular with unit diagonal and its determinant is identically 1—the map is bijective for any choice of ϕ, ρ, η. The inverse is

x₂ = (y₂ − η(y₁))⊙exp(−τ ⋅ ρ(y₁)),  x₁ = y₁ − ϕ(x₂);

the dependencies fix the order of recovery (first x₂, then x₁). The sub-network for ρ ends with a tanh activation, so τ·ρ(y₁) ∈ (−0.1, 0.1) and the multiplicative factor exp(τ·ρ(y₁)) stays within (0.905, 1.105) for every input—a smooth, parameter-free bound. In the implementation the reciprocal factor is computed as 1/(exp(τ·ρ(y₁)) + ε) with ε = 10⁻⁸ for numerical safety.

Each of ϕ, ρ, η is a lightweight convolutional sub-network with the same structure: a 1 × 1 convolution lifts the 12 input channels to W₀ = 128 channels; a dense block with L = 6 layers and growth rate g = 64 follows; a final 1 × 1 convolution projects the 512 channels back to 12. Each dense layer applies a 3 × 3 convolution followed by LeakyReLU(0.2) and concatenates its output with its input along the channel dimension (dense connectivity in the spirit of DenseNet [30]), so the width grows from 128 to 128 + 6 × 64 = 512 through the block.

The two outputs of the network are handled asymmetrically. The first 12 channels go through the inverse DWT to form the stego voucher V′; the remaining 12 channels form an auxiliary subband tensor K (aux in Figure 1) that is not carried by the published voucher—it is kept by the issuing authority and is needed, together with the subbands of the received voucher, for the inverse pass. Because K completes the state of the invertible transform, extraction is mathematically exact up to floating-point error (Section 3.5) and relies on no statistical approximation. This also sharpens the security model: a party holding only V′ cannot evaluate the inverse mapping—the network needs the full 24-channel state—so the regulatory record cannot be reconstructed without the authority-side K, while the voucher itself stays fully and publicly decodable since its QR code lives entirely in the visible image.

3.3.2. Multi-Scale Wavelet Subband Attention (MSWA)

MSWA treats each subband differently. Within a block, the 12 channels are arranged as four subband groups of three channels each. The LL group is refined by a 1 × 1 pointwise convolution; LH and HL by a single 3 × 3 convolution with LeakyReLU(0.2); HH by a 3 × 3 convolution with LeakyReLU(0.2) followed by a 1 × 1 convolution. An inter-subband attention branch computes four blending weights: the refined groups are concatenated, globally average-pooled, mapped by a linear layer to four logits, and normalized by Softmax. Each group is then blended with its refinement in a residual fashion:

x_k ← x_k + w_k($𝒞$_k(x_k) − x_k),  k ∈ {LL,LH,HL,HH},

where C_k denotes the subband-specific convolution above and w_k the corresponding attention weight (Σ w_k = 1). Because the Softmax weights are input-dependent and directly scale the corrections, the module carries no separate global scaling hyperparameter—its strength is set entirely by the four attention weights. MSWA is inserted at the input of every sub-network in blocks 0, 2, 4, and 6 (every other block of the eight).

3.3.3. Region-Adaptive Loss Function

Training minimizes a weighted sum of five terms:

$$\mathcal{L}={\lambda }_{\mathit{fid}}{\mathcal{L}}_{\mathit{fid}}^S+{\lambda }_{\mathit{rec}}{\mathcal{L}}_{\mathit{rec}}+{\lambda }_{\mathit{cov}}{\mathcal{L}}_{\mathit{cov}}+{\lambda }_{\mathit{lf}}{\mathcal{L}}_{\mathit{lf}}+{\lambda }_{\mathit{adv}}{\mathcal{L}}_{\mathit{adv}},$$

with λ_fid = 5, λ_rec = 15, λ_cov = 10, λ_lf = 5, λ_adv = 0.002.

(1)

Region-aware fidelity loss: L_fid^S = (1/HW) Σ S(x,y)·(V′(x,y) − V(x,y))², which weights the per-pixel squared embedding distortion by the structural weight map S, pushing the network to concentrate distortions in the redundant data modules.

$${\mathcal{L}}_{\mathit{fid}}^S={\displaystyle \frac{1}{\mathit{HW}}}{\sum }_{x,y}S(x,y){\left(V^{\prime }(x,y)-V(x,y)\right)}^2$$

(2)

Secret recovery loss: L_rec = (1/HW) Σ (P̂(x,y) − P(x,y))², computed on the recovered pattern after the inverse Arnold transform—that is, on the signal that is actually decoded.

$${\mathcal{L}}_{\mathit{rec}}={\displaystyle \frac{1}{\mathit{HW}}}{\sum }_{x,y}{\left(\widehat{P}(x,y)-P(x,y)\right)}^2$$

(3)

Cover reconstruction loss: L_cov = (1/HW) Σ (V̂(x,y) − V(x,y))², a plain unweighted MSE on the extracted cover V̂ that complements the region-weighted embedding term and keeps the recovered voucher globally faithful.

$${\mathcal{L}}_{\mathit{cov}}={\displaystyle \frac{1}{\mathit{HW}}}{\sum }_{x,y}{\left(\widehat{V}(x,y)-V(x,y)\right)}^2$$

(4)

Low-frequency consistency loss: L_lf = (1/(HW/4)) Σ_(x,y)∈LL (K(V)_LL(x,y) − K(V′)_LL(x,y))², which preserves the global structure of the low-frequency subband, where K(·) denotes the Haar decomposition and the subscript LL picks out its low-frequency component.

$${\mathcal{L}}_{\mathit{lf}}={\displaystyle \frac{1}{\mathit{HW}/4}}{\sum }_{(x,y)\in \mathit{LL}}{\left(\mathcal{K}\left(V{)}_{\mathit{LL}}\right(x,y)-\mathcal{K}(V^{\prime }{)}_{\mathit{LL}}(x,y)\right)}^2$$

(5)

Adversarial loss, following an LSGAN formulation with a spectral-normalized PatchGAN discriminator: generator L_adv^G = −E[D(V′)], discriminator L_adv^D = ½E[(D(V)−1)²] + ½E[(D(V′))²]. The discriminator consists of four 4 × 4 convolutions with stride 2 (64, 128, 256, 512 channels) followed by a final 4 × 4 convolution with stride 1; every convolution is spectrally normalized, and InstanceNorm with LeakyReLU(0.2) follows each hidden layer.

$${\mathcal{L}}_{\mathit{adv}}^G=-\mathbb{E}\left[D\left(V^{\prime }\right)\right]{\mathcal{L}}_{\mathit{adv}}^D={\displaystyle \frac{1}{2}}\mathbb{E}\left[{\left(D\left(V\right)-1\right)}^2\right]+{\displaystyle \frac{1}{2}}\mathbb{E}\left[{\left(D\left(V^{\prime }\right)\right)}^2\right]$$

The five weights were fixed once, before any experiment, and kept the same across the full model and all ablations in Section 4; no per-experiment tuning was done. Their ordering reflects a clear priority: recovery accuracy comes first (λ_rec is the largest, since the payload must survive embedding exactly), cover fidelity is next (λ_cov, as the voucher must remain visually intact), the two region-structure terms share a moderate weight (λ_fid steers where distortion goes, λ_lf suppresses global drift), and the adversarial term is deliberately small (λ_adv = 0.002) so that it regularizes the statistical realism of V′ without dominating the pixel-level objectives. The region-aware fidelity term is the only part of the RAE strategy that touches the loss; the structural weight map and the Arnold transform have no trainable parameters.

3.3.4. Training Strategy

Training alternates between the generator (the invertible network) and the discriminator. Two implementation choices proved essential at the small batch size of 2 used here: the discriminator is updated first in each iteration, and the generator gradients are clipped to a global norm of 1.0. With only two samples per update, the discriminator gets very noisy gradient estimates; updating D first stabilizes the adversarial signal seen by the generator in the same iteration, and clipping prevents occasional large adversarial gradients from disturbing the invertible pathway—the fine-grained numerical behavior on which reversibility depends. The effect is far from marginal: the same architecture, data, and schedule trained with the plain generator-first order and without clipping plateau below 54.5 dB cover–stego PSNR, whereas the full recipe converges to 63.29 dB (Section 4.4, Figure 4). Details: AdamW optimizer, learning rate 3 × 10⁻⁵, weight decay 10⁻⁴, betas (0.5, 0.999); batch size 2; 200 epochs with a step decay of 0.5 at epoch 100; the checkpoint with the highest validation cover–stego PSNR is selected (seed 42).

Figure 4. Training dynamics. (a) Full AR-WeNet versus the WeNet baseline. (b) The ablation ladder: configurations (a–c) and the full model (d) of Section 4.4. Stars mark the checkpoint selected for evaluation in each run; their colors match the corresponding curves.

3.4. Complexity Analysis

Each affine coupling block processes a 12-channel tensor at spatial resolution HW/4 (the wavelet domain). Its three sub-networks each consist of a 1 × 1 convolution lifting C = 12 channels to W₀ = 128, a dense block of L = 6 layers with growth rate g = 64, and a 1 × 1 convolution projecting back to C = 12 channels. Counting multiply-accumulate operations and expressing them as FLOPs (one MAC = 2 FLOPs), the cost of one block is

$${\mathrm{FLOPs}}_{\mathrm{block}}=2\cdot 3\left[C{W}_0+9g\left(L{W}_0+{\displaystyle \frac{\mathit{gL}(L-1)}{2}}\right)+\left(W_0+\mathit{Lg}\right)C\right]\cdot {\displaystyle \frac{\mathit{HW}}{4}},$$

where the factor 3 covers the three sub-networks, 9 accounts for the 3 × 3 kernels in the dense layer, and the arithmetic series counts the channel widths concatenated by successive dense layers. Plugging in C = 12, W₀ = 128, g = 64, L = 6 gives about 98.6 × 10⁹ FLOPs per block; with N = 8 blocks the total is about 7.89 × 10¹¹ FLOPs (788.9 GFLOPs as measured by a profiler, Section 4.8), with roughly 26.8 M parameters. Asymptotically, the dense widths grow with the channel dimension, so per-block cost is O(C² · HW/4) and total complexity is O(N · C² · HW), linear in the number of blocks. The auxiliary operations are negligible: the structural weight map is computed analytically once per carrier format in O(HW) threshold operations (0.038 ms, Section 4.8), and the Arnold permutation is a single O(HW) memory gather with no multiplications.

3.5. Complete Reconstruction Guarantee

AR-WeNet secures lossless recovery through three layers of protection that build on one another.

(1)

INN numerical invertibility. Each affine coupling block is exactly invertible in exact arithmetic, and the multiplicative factors are bounded away from zero by construction (Section 3.3.1). In floating point, the measured maximum round-trip deviation of the subband tensors is 2.3 × 10⁻³ for random inputs (a stress case) and 7.8 × 10⁻⁴ for real voucher images. At the image level, the end-to-end deviations are at most 3.7 × 10⁻⁴ for the cover branch (V versus V̂) and 1.1 × 10⁻³ for the pattern branch (P versus P̂).

(2)

Binarization margin and integer-domain exactness. The recovered pattern is thresholded at 0.5; the worst-case deviation of 1.1 × 10⁻³ leaves a margin roughly 450 times larger than the error, so binarization cannot flip a bit. The rest of the recovery chain is integer-exact by construction: the Arnold map is a permutation of the integer lattice with an exact inverse (period 192), module-center sampling reads fixed coordinates, and QR decoding plus UTF-8 decoding are deterministic. During 8-bit conversion the stego image, which lies in [−0.0047, 1.0045], is clipped by at most about one gray level—an operation that, as the robustness tests confirm, does not disturb decoding even after lossy JPEG recompression (0.000% pre-correction BER and 100% QR decoding success, Section 4.6).

(3)

QR error-correction redundancy. H-level coding tolerates up to 30% codeword loss, providing an independent safety net for any residual numerical deviation anywhere in the pipeline.

Taken together, the three layers make end-to-end recovery of the regulatory text deterministic rather than statistical: the network error is absorbed by a margin two orders of magnitude larger, the post-network chain introduces no error at all, and the QR code can absorb whatever remains.

4. Experimental Results and Analysis

4.1. Datasets and Evaluation Protocol

Two experimental regimes are used. Natural-image experiments establish the strength of the INN backbone on standard benchmarks, while structured-voucher experiments evaluate the full AR-WeNet framework in the target scenario.

We use three standard natural-image datasets—DIV2K (1000 images), COCO (>330K images), and ImageNet (~14M images)—all uniformly resized to 256 × 256. For the electronic voucher scenario, no public benchmark provides covers with rigid functional structures, so we build E-Voucher-500: 500 voucher–record pairs assembled from a pool of 600 procedurally generated voucher images at 256 × 256, with a fixed seed-controlled split assigning 400 pairs to training and 100 disjoint pairs to testing. Each voucher carries a Version-3 L-level QR descriptor (29 × 29 modules, no quiet zone) encoding a 64-bit image descriptor obtained by thresholding an 8 × 8 downsampled luminance map; the symbol is rendered to 256 × 256 by nearest-neighbor interpolation and finished with a subtle channel-wise tint that mimics a printed voucher. The secret for pair i is a 69–70-byte, six-field regulatory record (registration identifier, verification code, taxpayer identifier, amount, transaction category, and issuance timestamp) generated deterministically per index and encoded as a Version-10 H-level QR symbol (57 × 57 modules). All six fields, including the taxpayer identifier and the verification code, are synthetic placeholders generated deterministically for this benchmark and do not correspond to any real voucher, taxpayer, or transaction.

Evaluation metrics include PSNR, SSIM, MAE, RMSE, BER, and exact QR decoding success, with NPCR, UACI, and information entropy also reported in the security analysis. Unless stated otherwise, BER is the raw pre-correction pattern-level error rate: the recovered 256 × 256 pattern is binarized at 0.5 after the inverse Arnold transform and compared bit by bit with the original expanded pattern before any QR error correction, so it counts every deviation that the error-correction layer later absorbs. MAE and RMSE are reported on the 0–255 scale. Robustness is tested under JPEG compression (quality 50–90), additive Gaussian noise (σ = 5–30; per-image fixed seed), and cropping, implemented as a centered crop keeping 1 − r of each dimension followed by bilinear rescaling back to 256 × 256 (r = 10%, 20%, 30%).

All reported numbers are computed on the 100 held-out voucher pairs using the checkpoint with the highest validation cover–stego PSNR; the model is trained once (seed 42) and reused for every table. The per-pair secret records are pinned by PYTHONHASHSEED=2024 so that the reported digits are exactly reproducible. All experiments run on a single NVIDIA RTX 3090 (24 GB) with PyTorch 2.7.1 and CUDA 11.8.

Comparisons cover traditional methods (4bit-LSB, DWT-SVD, Arnold-DCT) and INN-based methods (HiDDeN [15], DeepMIH [13], ISN [9], HiNet [10], iSCMIS [12], LiDiNet [11], PUSNet [18], NiNet [31]). On E-Voucher-500, the uniform-weighting WeNet backbone—the same INN architecture trained with a uniform steganographic loss and without payload scrambling—serves as the structure-agnostic baseline, isolating the contribution of the structure-aware ingredients.

4.2. INN Backbone Performance on Natural Image Datasets

Table 1 and Table 2 give the cover/stego and secret/recovered image quality on DIV2K, where the backbone is evaluated under the standard natural-image protocol. For cover/stego pairs (Table 1), the WeNet backbone reaches 55.27 dB PSNR with 0.9992 SSIM, 0.18 MAE, and 0.43 RMSE (0–255 scale), achieving the best SSIM and RMSE among all compared methods while its PSNR is second only to NiNet [31] (56.56 dB). For secret/recovered pairs (Table 2), it hits 57.84 dB PSNR with 0.9995 SSIM, the highest values among all compared methods. On COCO and ImageNet (Table 3), it reaches 53.81 dB and 54.10 dB with the best SSIM in both cases, demonstrating solid cross-domain generalization. These results show that the backbone behind AR-WeNet is not a weak base for the structure-aware strategy: it is competitive at the top of the comparison list in the general setting, so the gains on E-Voucher-500 reported in Section 4.3 are due to structure-aware embedding rather than a degraded underlying model.

Table 1. Cover/Stego Image Pair Visual Quality Comparison on DIV2K.

Method	PSNR (dB)	SSIM	MAE	RMSE
4bit-LSB	33.19	0.9453	6.90	7.95
HiDDeN [15]	35.21	0.9691	6.98	6.82
DeepMIH [13]	40.31	0.9785	2.81	3.87
ISN [9]	46.95	0.9938	1.54	2.25
HiNet [10]	44.86	0.9971	1.33	1.94
iSCMIS [12]	50.12	0.9975	1.12	1.78
LiDiNet [11]	51.48	0.9975	1.06	1.75
PUSNet [18]	38.15	0.9792	2.30	3.33
NiNet [31]	56.56	0.9960	0.18	0.77
WeNet backbone (Ours)	55.27	0.9992	0.18	0.43

Table 2. Secret/Recovered Image Pair Reconstruction Quality on DIV2K.

Method	PSNR (dB)	SSIM	MAE	RMSE
4bit-LSB	30.81	0.9020	8.96	8.01
HiDDeN [15]	36.43	0.9696	6.02	5.50
DeepMIH [13]	40.56	0.9848	3.12	3.35
ISN [9]	52.01	0.9981	0.90	1.36
HiNet [10]	52.86	0.9992	0.56	0.86
iSCMIS [12]	50.62	0.9975	1.01	1.53
LiDiNet [11]	55.88	0.9994	0.68	1.14
PUSNet [18]	26.88	0.8363	8.75	11.95
NiNet [31]	57.51	0.9971	0.12	0.43
WeNet backbone (Ours)	57.84	0.9995	0.13	0.35

Table 3. Cover/Stego Visual Quality on COCO and ImageNet.

Method	COCO PSNR	COCO SSIM	ImageNet PSNR	ImageNet SSIM
4bit-LSB	33.79	0.9479	33.68	0.9401
HiDDeN [15]	36.71	0.9076	34.79	0.9380
DeepMIH [13]	36.83	0.9673	36.97	0.9672
ISN [9]	42.08	0.9875	42.09	0.9868
HiNet [10]	46.52	0.9961	44.60	0.9928
iSCMIS [12]	49.35	0.9972	49.02	0.9968
LiDiNet [11]	46.89	0.9939	47.07	0.9935
PUSNet [18]	39.09	0.9772	38.94	0.9756
NiNet [31]	50.26	0.9892	49.18	0.9889
WeNet backbone (Ours)	53.81	0.9989	54.10	0.9988

4.3. Performance on E-Voucher-500

Table 4 gives the comparison on E-Voucher-500. AR-WeNet reaches 63.29 dB PSNR and 0.9999 SSIM, with MAE 0.136 and RMSE 0.175 (0–255 scale), 0.000% raw pre-correction BER, and 100% exact QR decoding success across all 100 test pairs. The uniform-weighting WeNet backbone gets 55.28 dB under the same protocol, so the structure-aware ingredients improve cover fidelity by 8.00 dB; since the backbone architecture, data, and training recipe are shared, this gap comes from the payload scrambling and the region-adaptive loss driven by the structural weight map. HiNet [10], retrained end to end on the same split, reaches 33.80 dB with 0.9473 SSIM and 0.000% BER (100% exact decoding); its uniform distortion allocation, however, spreads the embedding error over the whole symbol—88.0% of all pixel positions carry a modification, with the footprint essentially identical inside the functional modules (60.2%) and in the data region (62.0%)—leaving it nearly 30 dB below AR-WeNet in fidelity. Among traditional methods, 4bit-LSB reaches a high PSNR (73.98 dB) but embeds with no key-based protection and no structural discrimination, while DWT-SVD (45.21 dB) and Arnold-DCT (25.90 dB) trail AR-WeNet by wide margins.

Table 4. Method Comparison on E-Voucher-500 (Cover/Stego).

Method	PSNR (dB)	SSIM	MAE	RMSE	BER (%)	QR Decode (%)
4bit-LSB	73.98	1.0000	—	—	—	—
DWT-SVD	45.21	0.9995	—	—	—	—
Arnold-DCT	25.90	0.9471	—	—	—	—
HiNet [10]	33.80	0.9473	4.017	5.205	0.000	100.0
WeNet backbone (uniform loss)	55.28	0.9992	0.347	0.439	0.000	100.0
AR-WeNet (Ours)	63.29	0.9999	0.136	0.175	0.000	100.0

Where does the gain come from? Figure 3c shows the per-region distortion (1—SSIM, scaled by 10³) on the test set for the uniform-weighting baseline, configuration (c) of the ablation ladder, and the full model. The full model reduces the distortion of every region by a factor of 7.1 to 7.7 relative to the uniform baseline (e.g., finder patterns: 1.849 × 10⁻³ versus 0.244 × 10⁻³, a 7.6-fold reduction), so the modules whose misreading most directly leads to decoding failure are the best protected. The spatial accounting of the distortion agrees: the functional region (finder, separator, and timing/alignment modules) receives 29.73% of the total absolute deviation while occupying 30.68% of the symbol area, whereas the data modules receive 70.27% against their 69.32% area share—distortion is shifted toward the payload-carrying region and away from the geometry that determines decodability. In absolute terms, the mean absolute error is 0.1313 gray levels in the functional region and 0.1379 in the data region, and no region exceeds 0.1379 gray levels on the 0–255 scale.

Figure 5 makes the spatial allocation of the embedding visible. In the three shown pairs, AR-WeNet changes only a sparse subset of the pixels—between 0.25% and 8.6%—and never by more than one gray level, whereas the uniform-loss baseline has to raise its modification footprint to 14.5–31.6% of the pixels, with residual changes reaching two gray levels. The recovered pattern is visually identical to the embedded secret; across the whole test set the raw pre-correction module BER is 0.000%.

Figure 5. Qualitative comparison on E-Voucher-500. Rows: three representative test pairs (the labels give their positions in the test split). Columns: carrier; stego produced by AR-WeNet; residual masks of AR-WeNet and of the uniform-loss WeNet baseline (white marks pixels whose gray level changed by at least one level); the embedded secret pattern; and the secret recovered by AR-WeNet.

4.4. Ablation Study

Table 5 reports the controlled ablation ladder. Configuration (a) is the INN backbone alone with a uniform fidelity loss; (b) adds MSWA and the Arnold transform (k = 5), still with the uniform loss; (c) adds the RAE-weighted fidelity loss; (d) is the full model, in which the same architecture and loss design as (c) are trained with the final strategy of Section 3.3.4 (discriminator-first updates and generator gradient clipping). Configurations (a)–(c) were trained by a controlled harness that differs from the final recipe only in the update policy (generator-first, no clipping); data split, seed, optimizer, learning-rate schedule, and evaluation protocol are identical. All four configurations decode perfectly (0.000% module BER, 100% exact decoding), so the ladder isolates embedding fidelity.

Table 5. Ablation Study on E-Voucher-500.

Config	Component Added	PSNR (dB)	SSIM	BER (%)
(a)	INN backbone, uniform loss	54.00	0.9992	0.000
(b)	+MSWA and Arnold scrambling	52.86	0.9985	0.000
(c)	+RAE fidelity weighting	54.34	0.9991	0.000
(d) AR-WeNet	+D-first training strategy (Section 3.3.4)	63.29	0.9999	0.000

Reading from (a) to (c), the ladder shows that the structure-aware components cost fidelity unless the loss knows where distortion is tolerable. Adding MSWA and scrambling to the uniform-loss backbone drops cover PSNR from 54.00 to 52.86 dB: scrambling spreads the secret over all wavelet subbands, pushing the mean absolute deviation from 0.404 to 0.458 gray levels and widening the stego histogram footprint (entropy 1.893 → 1.980). Adding the RAE weighting to the fidelity term alone—same trainer, same schedule, only the loss changes—recovers +1.48 dB and, more importantly, redirects the distortion: the finder-pattern MAE falls by 18.3% (0.439 → 0.359), noticeably more than the 14.8% drop in the data region (0.462 → 0.393), and the functional modules’ share of the total deviation falls from 30.14% to 29.79% (against a 30.68% area share) while the data modules’ share rises to 70.21%. The histogram footprint narrows too (entropy 1.980 → 1.815). The RAE loss thus does exactly what it was meant to: it moves distortion away from the geometry that governs decodability and into the payload-carrying modules.

The decisive jump is (c) → (d). Configuration (d) shares the architecture and loss design with (c) and differs only in the update policy of Section 3.3.4: the discriminator is updated first in each iteration, and the generator gradients are clipped to unit norm. Cover PSNR rises from 54.34 to 63.29 dB (+8.95 dB), the mean absolute deviation drops from 0.388 to 0.136 gray levels, the fraction of modified pixels (NPCR) falls from 22.55% to 7.38%, and the stego histogram footprint shrinks further (entropy 1.815 → 1.522). Figure 4b traces the four training curves: the three ablated runs improve slowly and noisily and are still oscillating around 52–54 dB at the end of training, whereas the full recipe accelerates markedly once the learning rate decays, peaks at 63.29 dB, and only then slowly degrades. Put simply, the RAE machinery defines where the network may embed; the training strategy is what lets it actually get there. Without it, the same architecture and loss stall below 54.5 dB—which is why the recipe of Section 3.3.4 is used for every headline result in this paper.

4.5. Cross-Version Consistency

The regulatory record of Section 4.1 is fixed-format but can be carried at different QR symbol sizes across a voucher series, and the model is not tied to a single version. With H-level error correction, the 69–70-byte record needs at least version 8 (84-byte capacity); versions 1–7 are below the capacity bound (the largest of them, version 7-H, holds only 64 bytes). Table 6 evaluates the frozen model—the same single checkpoint used everywhere else in this section, with no per-version fine-tuning—on the 100 test carriers with the secret rendered at versions 8, 9, and 10, for 300 embeddings in total, under the protocol of Section 4.1.

Table 6. Cross-Version Consistency (Secret QR at Level H, Versions 8–10).

QR Version	Modules	H-Capacity (B)	Record Occupancy	PSNR (dB)	SSIM	BER (%)	Exact Decode (%)
V8	49 × 49	84	82–83%	63.25	0.9999	0.000	100
V9	53 × 53	98	70–71%	63.26	0.9999	0.000	100
V10	57 × 57	119	58–59%	63.29	0.9999	0.000	100

All 300 embeddings recover the record exactly—zero module errors and 100% exact decoding in every row—and cover fidelity stays within a 0.04 dB band. The record occupies 82–83% of the symbol capacity at V8 but only 58–59% at V10, yet the freed capacity buys almost nothing in fidelity (63.25 → 63.29 dB): the embedding cost is governed by the functional geometry that determines decodability, which is essentially invariant across the tested versions, rather than by the number of payload modules—precisely the modules that the RAE strategy is designed to treat as tolerable (Section 3.3.3). Operationally, one trained model serves the entire voucher series without retraining or per-version calibration.

4.6. Robustness Tests

In the deployment model of Section 3.1, only the issued stego voucher V′ travels through the channel; the auxiliary stream K stays with the authority and is assumed intact at extraction. Every attack below is therefore applied to the stego image alone, and extraction proceeds with the unmodified K. All numbers are means over the 100 test pairs under the protocol of Section 4.1; BER is the raw pre-correction pattern-level error rate, and exact decoding is measured end to end after QR error correction. For reference, an H-level QR code tolerates roughly 30% erroneous codewords before correction fails. Table 7 collects the mean raw BER and the exact-decoding rate for every condition.

Table 7. Robustness of AR-WeNet on E-Voucher-500 (N = 100).

Attack	Mean BER (%)	Max BER (%)	Images with ≥1 Bit Error (%)	Exact Decode (%)
JPEG Q90	0.000	0.000	0	100
JPEG Q80	0.000	0.000	0	100
JPEG Q70	0.000	0.000	0	100
JPEG Q50	0.000	0.000	0	100
Gaussian σ = 5	0.000	0.000	0	100
Gaussian σ = 10	0.0005	0.0031	58	100
Gaussian σ = 12	0.0034	0.0071	100	100
Gaussian σ = 15	0.0192	0.0310	100	100
Gaussian σ = 20	0.0983	0.1394	100	100
Gaussian σ = 25	0.2671	0.3377	100	100
Gaussian σ = 30	0.5329	0.6531	100	100
Cropping 10%	9.148	9.838	100	10
Cropping 20%	10.045	11.177	100	0
Cropping 30%	10.575	12.044	100	0

Compression is transparent to the scheme: from Q90 down to Q50 not a single bit of the recovered pattern differs from the embedded one, and all images decode exactly (Figure 6b). This is consistent with the split-information design of Section 3.1—the extraction-relevant part carried by the issued image is a sparse perturbation of at most two gray levels (Section 4.3, Figure 5), which even coarse quantization preserves—while the auxiliary stream that completes extraction is never exposed to the channel.

Figure 6. Robustness of AR-WeNet on the E-Voucher-500 test set (N = 100). (a) Raw pre-correction BER versus Gaussian noise strength σ; the open marker denotes σ = 5, where no bit errors occur. (b) BER under JPEG compression (quality factors 90–50) and cropping (10–30%); the dashed line marks the 30% correction budget of H-level QR codes.

Under additive Gaussian noise the degradation is gradual and stays well inside the correction budget. Up to σ = 5 the recovery is bit-exact; at σ = 10, 58% of images contain at least one erroneous bit, yet the mean error is only 0.0005%—isolated single-bit flips—and every image still decodes exactly. At σ = 30 the mean error reaches 0.5329% (worst single image 0.6531%), still more than 45 times below the 30% budget, and the exact-decoding rate remains 100%. Figure 6a traces the curve over the full sweep.

Cropping is the one operation that breaks exact decoding, and we report it as such. The raw error under 10–30% cropping (9.15–10.57%) stays below the nominal correction budget, and every single image carries errors, yet decoding succeeds for only 10% of the 10% crops and for none of the larger ones. The reason is that cropping is not a random bit-flip channel: the centered crop removes a border frame and the bilinear rescaling that restores the input size stretches the surviving content, so the recovered pattern is displaced by a systematic shift of the module lattice rather than by scattered bit errors. QR correction handles scattered errors but not a global geometry offset of this kind, which makes lattice recovery—not error count—the binding constraint under cropping. Estimating the module grid from the surviving functional patterns, or storing a synchronization reference in the auxiliary stream, is a natural extension that we leave for future work; the raw BER figures indicate that once the geometry is recovered, the residual error is comfortably correctable.

4.7. Security Analysis

RDH differs from encryption in what ‘security’ means, and the familiar avalanche metrics need reinterpreting. For an image cipher, a near-complete change of the pixel field under a one-bit key change (NPCR close to 100%) proves diffusion [32,33]; for a concealment scheme, a change that large would be a defect, since the carrier must survive as a usable image. We therefore report NPCR, UACI, MAE, RMSE, and entropy as footprint descriptors—measures of how little the embedding disturbs the carrier—rather than as avalanche evidence, and we measure them against the uniform-loss baseline trained on the same data. Table 8 reports the corresponding footprint metrics for AR-WeNet and the uniform-loss baseline.

Table 8. Footprint Metrics on E-Voucher-500 (N = 100).

Metric	AR-WeNet	WeNet Baseline
NPCR (modified pixels, %)	7.38	19.50
UACI (mean absolute change, %)	0.053	0.136
MAE (gray levels)	0.136	0.347
RMSE (gray levels)	0.175	0.439
Stego entropy (bits/pixel)	1.522	1.809

Every distortion measure is 2.5–2.6 times smaller for AR-WeNet, and the amplitude of the modifications is correspondingly modest: an audit over the same test pairs shows that 99.97% of the modified pixels differ by exactly one gray level, and none by more than two. Together with an NPCR of 7.38%, this characterizes the embedding as a low-rate, low-amplitude perturbation: 92.6% of the carrier’s pixels are transmitted bit-exactly, and the remaining 7.38% move within two gray levels.

The stego voucher is issued alone; the auxiliary stream K stays with the authority (Section 3.1). To quantify what K guarantees, we ran a controlled extraction test on ten test pairs with the frozen checkpoint. With the true K, extraction is exact: the raw pattern BER is 0.000000%, the secret-side PSNR is 86.48 dB, and the recovered QR decodes exactly in 10 of 10 cases. With a wrong key—an i.i.d. standard-normal draw, or an all-zeros array—the recovered pattern is statistically independent of the payload: the raw BER rises to 0.4991 and 0.5030 (the 50% of an unbiased coin flip), the secret-side PSNR collapses to 3.25 dB and 4.95 dB, and none of the ten decodes. The auxiliary stream thus acts as a genuine access-control secret: recovering the payload requires both the issued image and the authority-held K, and substituting a plausible-looking key yields chance-level results.

Entropy places the stego within the carrier’s own statistics. A voucher is a bi-level image, so the cover entropy is already low (1.344 bits/pixel); AR-WeNet raises it to 1.522, an increment of 0.179 bits, whereas the uniform-loss baseline reaches 1.809 (increment 0.465). The recovered carrier returns to 1.364, within 0.020 bits of the original. The structure-aware training therefore reduces every statistical footprint we measure; none of the reported quantities points to structured leakage of the payload.

4.8. Efficiency Analysis

Table 9 reports the computational cost. All numbers are measured on a single RTX 3090 at batch size 1 with 256 × 256 inputs; FLOPs are counted over the full forward pass using PyTorch’s FlopCounterMode, and latencies are wall-clock times averaged over 100 runs.

Table 9. Computational Cost (Batch Size 1, 256 × 256, Single RTX 3090).

Model	Params (M)	FLOPs (G)	Embed (ms)	Extract (ms)	Train (h)
HiNet (official)	4.05	132.5	17.97	17.96	≈8.5
WeNet backbone	26.84	788.9	66.40	66.48	≈6.5
AR-WeNet	26.84	788.9	66.54	66.61	≈6.5

Two observations stand out. First, the structure-aware additions cost nothing where it matters. The region weight map of Section 3.3 is computed once per carrier format—0.038 ms for a 256 × 256 voucher—and registered as a model buffer, while the Arnold scrambling is an integer permutation of the module grid. Consequently AR-WeNet has exactly the same parameter count and the same FLOPs as its uniform-loss backbone, and the measured latency difference is at most 0.14 ms (0.2%). The design lever that produces the results of Section 4.3, Section 4.4, Section 4.5 and Section 4.6 therefore adds no measurable inference cost. Second, the one-time costs are bounded: training the full model takes roughly 6.5 h on one RTX 3090—the same budget as the baseline—while the HiNet reference, retrained on the voucher data with its official implementation, took roughly 8.5 h. At 66.5 ms per image, one GPU embeds or extracts about 15 vouchers per second; since embedding is an off-line issuance step, this throughput is comfortable for the target workload.

4.9. Carrier Usability Validation

The remaining requirement of Section 3.1 is that the voucher remains a working voucher after embedding: its functional modules must stay faithful, and its own descriptor must still scan. We validate this at three levels—per-region fidelity (Table 10), exact decoding of the carrier’s 29-module descriptor (Table 11, last column), and exact recovery of the embedded record under representative channel conditions (Table 11, middle columns). Region SSIM is obtained from the same per-pixel SSIM map as the global score, restricted to the masks of the finder, separator, timing/alignment, functional (union), and data regions of the V3-L geometry; the carrier-decode protocol center-samples the 29 × 29 module grid of the stego and requires an exact text match.

Table 10. Region-Aware Fidelity on E-Voucher-500 (SSIM, N = 100).

Configuration	Finder	Separator	Timing/Align	Functional	Data	Overall SSIM	PSNR (dB)
WeNet baseline	0.99815	0.99967	0.99958	0.99888	0.99932	0.99918	55.28
(a) INN backbone	0.99876	0.99954	0.99951	0.99914	0.99918	0.99917	54.00
(b) +MSWA and Arnold	0.99748	0.99939	0.99899	0.99829	0.99859	0.99850	52.86
(c) +RAE weighting	0.99859	0.99956	0.99941	0.99902	0.99911	0.99909	54.34
(d) AR-WeNet	0.99976	0.99996	0.99994	0.99985	0.99991	0.99989	63.29

Table 11. Carrier and Record Integrity Under Representative Conditions (N = 100).

Condition	Raw Record BER (%)	Share of H-Budget (%)	Record Decode (%)	Carrier Decode (%)
No attack	0.000	0.0	100	100
JPEG, Q = 90	0.000	0.0	100	100
JPEG, Q = 50	0.000	0.0	100	100
Gaussian, σ = 20	0.098	0.33	100	100
Cropping, 30%	10.575	35.2	0	0

The module BER is 0.000% in every row (Table 5). Two regularities emerge. The uniform-loss family concentrates its distortion in the functional geometry: across all four ablated and baseline configurations, the finder patterns are the worst region (SSIM 0.99748–0.99876), precisely where the scanner locks on. The full model lifts every region above 0.99976: the finder distortion falls from 1.41–2.52 × 10⁻³ to 0.24 × 10⁻³, and the data modules reach 0.99991. Relative to the uniform-loss baseline, the distortion of every region shrinks by roughly a factor of seven across the five regions, consistent with the functional-module distortion share reported in Section 4.3.

Table 11 completes the picture with representative conditions drawn from the sweeps of Section 4.6. Three regimes emerge. On the lossless channel the carrier’s own descriptor decodes exactly and the record recovers with zero raw error, so embedding is invisible to the voucher pipeline. Under mild degradation—JPEG down to Q50, Gaussian noise up to σ = 20—the record’s raw error stays at or below 0.33% of the H-level budget, everything decodes exactly, and across the full JPEG and Gaussian sweeps the carrier descriptor decodes in 100 of 100 cases. Under geometric corruption both sides fail, for the lattice-shift reason isolated in Section 4.6—a limitation of the current rescaling protocol, shared by every embedder tested. The carrier side behaves identically for AR-WeNet, the WeNet baseline, and the ablated embedder under all five conditions, so carrier usability is not specific to the full model; what the full model adds is a carrier fidelity of 63.29 dB and a region profile that leans away from the functional geometry.

Taken together, Section 4.2, Section 4.3, Section 4.4, Section 4.5, Section 4.6, Section 4.7, Section 4.8 and Section 4.9 close the loop with the four requirements of Section 3.1. (a) Visual indistinguishability: the stego differs from the carrier by a sparse, at-most-two-level perturbation (Section 4.7), yielding 63.29 dB and SSIM 0.99989 (Table 4), with distortion tilted away from the functional modules (Section 4.3 and Section 4.9). (b) Lossless recovery of the record: 0.000% module BER and 100% exact decoding on every test pair (Table 5, Table 6 and Table 7), backed by the float-domain round-trip exactness of Section 3.5. (c) Undetectability to unauthorized parties: the payload is embedded in scrambled form and the inverse pass requires K; without it, extraction degenerates to guessing (Section 4.7). (d) Structural integrity: every functional region keeps SSIM ≥ 0.99976, and the carrier’s own descriptor decodes exactly under compression and noise (Table 11). The one open failure mode—geometric corruption by cropping—is identified, characterized, and left as future work (Section 4.6).

5. Conclusions

This paper has presented AR-WeNet, a structure-aware reversible data hiding framework for electronic voucher supervision. The framework combines the Regulatory Information Encryption Module (RIEM), which scrambles the regulatory record before embedding, with a DWT-domain invertible network enhanced by Multi-Scale Wavelet Subband Attention and a region-adaptive loss driven by the carrier’s structural weight map, so that embedding distortions concentrate in the payload-carrying data modules while the functional geometry that governs decodability is protected. On the self-constructed E-Voucher-500 benchmark, AR-WeNet reaches 63.29 dB PSNR and 0.9999 SSIM with a raw pre-correction BER of 0.000% and 100% exact QR decoding across all test pairs, improving on the uniform-loss backbone by 8.00 dB and beating the official HiNet retrained end to end on the same split by nearly 30 dB, while adding no measurable inference cost—identical parameter count and FLOPs to the backbone, and roughly 15 vouchers per second on a single RTX 3090. The same backbone remains competitive in the general natural-image setting, surpassing HiNet by 10.41 dB on DIV2K.

The audits of Section 4.7, Section 4.8 and Section 4.9 set out exactly what the framework delivers. The embedding is a low-rate, low-amplitude perturbation—NPCR 7.38%, UACI 0.053%, with 99.97% of the modified pixels differing by exactly one gray level—and these avalanche-style statistics are reported as footprint descriptors rather than security evidence; confidentiality rests on the authority-held auxiliary stream K, without which extraction collapses to chance level. Carrier usability is preserved: every functional region keeps SSIM ≥ 0.99976, the voucher’s own descriptor still decodes exactly, and the hidden record survives JPEG compression down to Q = 50 and Gaussian noise up to σ = 20 with 100% exact decoding.

Limitations include the use of synthetic voucher images, manually tuned region weights, and the sensitivity to geometric corruption (e.g., cropping) shared by every embedder tested. Future work will: (1) validate the method on real-world electronic vouchers; (2) introduce learnable structural priors to replace the predefined weight maps; (3) strengthen robustness against geometric attacks through explicit synchronization mechanisms; and (4) extend the framework to PDF/OFD document formats.