Cyber‐Physical Watermarking with Inkjet Edible Bioprinting

Counterfeit medicines are a fundamental healthcare problem, threatening patient safety and public health as well as causing economic damage. Online pharmacies and the ongoing pandemic have promoted medicine counterfeiting. However, the existing anticounterfeit methods are limited because of material toxicity, low security, and complicated fabrication. Here a dosage‐level security method is introduced that combines digital watermarking and physical printing at the material level. A set of requirements is designed to ensure the edibility, printability, imperceptibility, and robustness of cyber‐physical watermarking. An inkjet printer using safe food coloring is adapted to print a watermarked image on a recombinant luminescent silk protein taggant to enhance attack resistance. Machine learning of color accuracy recovers unavoidable color distortions during printing and acquisition, allowing robust smartphone readability. An edible watermarked taggant affixed to each individual medicine can offer anticounterfeit and authentication features at the dosage level, empowering every patient to aid in abating illicit medicines.

of countries. [1] In general, fake drugs can be categorized as substandard, falsified, counterfeit, and diverted drugs, and the World Health Organization (WHO) broadly defines a counterfeit medicine as "one which is deliberately and fraudulently mislabeled with respect to identity and/or source." [2] Pharmaceutical products are the most vulnerable goods that counterfeiters and illicit drug manufacturers deliberately produce for illegal monetary gain worldwide. Notably, counterfeit medicines for malaria and pneumonia are estimated to cause 250 000 child deaths per year. [3] In sub-Saharan Africa, such counterfeit antimalaria drugs are estimated to cost USD 38.5 million. [4] According to WHO and the United Nations Office on Drugs and Crime, counterfeit drugs account for approximately 10% of the global pharmaceutical trade and 20-30% of all medicines in Africa, Asia, and the Middle East. [5] Furthermore, counterfeit medicines pertaining to both lifestyle and lifesaving drugs appear increasingly common in the U.S. [6] Counterfeit opioids have caused deaths in almost all states of the U.S. [7] The bolstered distribution of counterfeit medicines and pharmaceutical products can be attributed to the increased use of online pharmacies in recent years [8] and the ongoing COVID-19 pandemic scenario. Approximately 40 000 online pharmacies are currently active worldwide, with an increase of 600 every month. [9] The operation of nearly 96-97% of these online pharmacies is illegal. [10] In the U.S., the opioid epidemic can also be attributed to the illegal online sales of controlled substances without a prescription. [11] The COVID-19 pandemic has promoted the emergence and use of online pharmacies, [12] resulting in the recent surge in counterfeit pharmaceutical products (e.g., fake chloroquine and hydroxychloroquine) and counterfeit medical supplies (e.g., substandard surgical mask and respirator). [13] This trend is expected to continue as the demand exceeds the supply in part because of lockdowns in many drug-producing countries. Several governments have strengthened legislation and enforcement to deter counterfeit medicines. For example, in the U.S., unit-level traceability will be mandated by 2023, following the Drug Supply Chain Security Act set by the United States Food and Drug Administration (FDA). [14] In Europe, the Falsified Medicines Directive requires the implementation of safety features. [15] Although public resources to avoid the unintentional use of illicit online pharmacies are available, patients and healthcare providers (e.g., physician, nurse, and pharmacist) are not well aware of such information.
In addition to the threat to patient and public health, counterfeit medicines undermine brand names, scientific innovations, and financial rewards. Counterfeit medicines also constitute the infringement of intellectual properties. [6] These aspects can lead to economic damage to pharmaceutical industries and threaten the countries' reputations. Major pharmaceutical companies have been actively implementing brand protection, serialization, and anticounterfeit measures to ensure a chain of custody to a certain extent. [16] The most commonly used method is secondary packaging level protection, for instance, using hologram stickers and logos, and serialization on the package level. Unique markings and coatings on the surface of medicines are rarely implemented. Digital and mobile anticounterfeit technologies, such as package-level barcodes, quick response (QR) codes, and radio frequency identification frameworks, are promising approaches to secure the pharmaceutical supply chain. [16,17] However, these methods exhibit limited security capacities, because packages can easily be duplicated and individual medicines can be sold without the secondary package (medicine-keeping unit). Moreover, these conventional security measures cannot be directly applied to individual medicines.
Traditional methods to identify counterfeit medicines rely on analytical chemistry and spectroscopy. Fluorescence, Raman, infrared, and near-infrared spectrometers represent the first screening tools that can detect counterfeit medicines by analyzing the exact chemical compositions. [1d,16,17] However, these instrument-dependent methods require specialized devices, complicated readers, and trained personnel. Recently, advanced anticounterfeit technologies, including fluorescent ink printing, [18] microprinting, [19] fingerprint-like encoding strategies, [20] organic electronic devices, [21] nanopillar array paper, [22] 3D microstructure films, [23] and invisible photonic printings, [24] have been developed. However, patients and healthcare professionals have limited access to such analytical chemistry methods and sophisticated anticounterfeit technologies to avoid the unintentional use of counterfeit medicines.
In this context, dosage-level (on-dose) anticounterfeit measures and authentication features exhibit multiple advantages and potentially offer the highest protection against anticounterfeit pharmaceutical products. [25] In such a framework, each medicine can be verified and authenticated even if it is separated from the secondary package. Patients can identify their medicines in real time with important dose information at the point of administration. Furthermore, such dosage-level authentication for individual medicines allows patients to serve as the last line of defense and actively participate in combating the prevalence of illicit pharmaceutical products. In addition, pharmaceutical companies can implement serialization directly to individual medicines, thereby enabling the tracking and tracing of medicines to ensure brand protection. Hospital pharmacies can realize the efficient management and administration (e.g., drug procurement, distribution, and dispensing) of individual medicines to hospital inpatients and outpatients. In clinical studies involving trial medication in at-home settings, researchers can ensure that participants are correctly self-administering clinical trial medication following the study guidelines and instructions.
To implement on-dose features, it is necessary to ensure the nontoxicity and edibility (or digestibility) of constituent materials without compromising the safety or introducing interactions with main ingredients. The recent technologies for on-dose applications to medicines include QR-coded microtaggants and sophisticated wrinkle tags, [26] QR code printing of active pharmaceutical ingredients, [18] multifunctional hydrogel microparticles, [27] large-scale microparticle arrays, [28] plasmonic nanomaterial encoding, [29] silica microtags, [30] QR code patterns with lipophilic cannabinoids, [31] and microdiamond-embedded silk fibroin films. [32] These approaches involve the extensive use of exogenous and synthetic materials, including polystyrene, poly(lactic-co-glycolic acid), poly(ethylene glycol) diacrylate, poly(ethylene glycol), silver, gold, silica, and microdiamonds. Such taggant materials may not be ideal for oral intake owing to the hazardous nature and associated concerns (e.g., carcinogenicity and cytotoxicity) of synthetic polymers and artificial additives. [33] In addition, phthalates, which are often used to prepare the pharmaceutical coatings of solid oral medicines, may interfere with hormone production and cause reproductive problems. [34] Another requirement of on-dose features is a physical form because the security measure is directly applied to the solid oral dosage form (e.g., pill, tablet, or capsule) or affixed to the individual medicine. Among encryption and steganography methods, digital watermarking provides an immediately available security solution for copyright protection, identification, and authentication. [35] The use of digital watermarking to protect medical images and diagnostic results has been widely recommended. [36] However, as a purely digital process, digital watermarking does not involve any physical form. Physical watermarking, which has been extensively used for high-value objects (e.g., currency, document, and artwork) to discourage and identify counterfeiting, lacks digital and cyber aspects. An attractive alternative is digital watermark extraction from a printed watermarked image (also known as a print-camera scheme). [37] In this scheme, a watermarked image exists in a physical printout and an embedded digital watermark is extracted using a reader or scanner (e.g., smartphone camera). Print-camera digital watermarking, which has been mainly applied to printed passports and identification cards, can be an ideal cyber-physical security platform to implement on-dose verification and authentication of individual medicines.
In this study, we introduce edible print-camera watermarking by combining the digital and physical properties of watermarking to establish anticounterfeit measures and authentication features at the dosage level instead of the secondary package level. First, we refine an inkjet printing method to use FDA-approved food coloring as edible ink. Inkjet printing is scalable for printing edible materials and can be implemented for additive manufacturing. Second, as an edible and digestible natural biopolymer, we use silk fibroin genetically hybridized with enhanced green fluorescent protein (eGFP) to fabricate an attack-resistant print sheet. Third, we enhance the robustness of digital watermark extraction against significant color distortions that occur during the print-camera process. In particular, an integrated color correction using reference colors printed on a watermark taggant is developed to ensure the reliability of edible watermark taggants under scenarios involving different smartphone models and light conditions. Finally, for the edible watermarked taggants affixed to individual solid oral dosage forms, we investigate the readout repeatability of the watermark www.afm-journal.de www.advancedsciencenews.com extractions and printing reproducibility of statistically identical watermarked taggants. Figure 1 presents the process flow of the proposed edible watermarking scheme. i) A digital watermark image is embedded into a host (or cover) image via discrete wavelet transform (DWT) and singular value decomposition (SVD), thereby generating a digital watermarked image ( Figure 1a). ii) The digital watermarked image is printed on an edible biopolymer print sheet using a commercially available inkjet printer with FDAapproved food coloring (i.e., edible ink) (Figure 1b). To ensure tamper resistance (e.g., copy attack), a protein-based print sheet composed of fluorescent silk fibroin is incorporated into the inkjet printing process. All the constituent materials are safe for oral consumption. iii) Each medicine in a solid oral dosage form (e.g., pill, tablet, or capsule) is integrated with the watermarked taggant by the pharmaceutical manufacturer or hospital pharmacy (Figure 1c). iv) Immediately before oral intake, an end user (e.g., patient) scans the watermarked taggant affixed to the medicine by using a smartphone to authenticate the medicine and access important dose information (e.g., dosage strength, dose frequency, and interactions with other common medicines), manufacturing details (e.g., brand name, manufacturing and expiration date, and lot number), and distribution path (e.g., country, distributor, wholesaler, and supply chain) ( Figure 1d; and Figure S1, Supporting Information).

Results and Discussion
To ensure resistance to a copy (scan-print) attack, we use a fluorescent biopolymer to make a print sheet on which an edible watermarked image is printed. As a safe edible fluorescent biopolymer, silk proteins genetically fused with eGFP demonstrate several advantages. From an edibility standpoint, silk fibroin is not only biocompatible with low immunogenicity and minimal inflammatory responses, but is also generally recognized as safe (also known as GRAS), as designated by FDA. The commonly applied silk fibroin extraction method does not introduce heavy metals and toxic trace elements. [25b,38] Moreover, silk fibroin is easily digestible in the presence of proteolytic enzymes (e.g., pepsin or trypsin) produced in the gastrointestinal tract. [25b,39] Fluorescent proteins are often consumed as genetically modified dietary products. [40] In addition, eGFP does not have common allergen epitopes. [41] From a manufacturing standpoint, the genetic fusion (i.e., eGFP silk fibroin) of silk fibroin and eGFP can be readily realized via the piggyBac www.afm-journal.de www.advancedsciencenews.com transposon method [42] or clustered regularly interspaced short palindromic repeats (CRISPR) methods, [43] which allow mass, scalable, and sustainable production. eGFP silk fibroin can also be easily processed into polymeric materials for fabricating a variety of flexible or rigid structures without the loss of its own optical characteristics. [25b,44] To produce eGFP silk, we fuse the eGFP gene with the N-terminal and C-terminal domains of the silk fibroin heavy (H)chain promoter (pFibH) using the piggyBac method, creating a p3×P3-DsRed2-pFibH-eGFP transformation vector (Figure 2a; and see the Experimental Section). This transition vector is injected with a helper vector into the pre-blastoderm embryos of silkworms to produce transgenic eGFP silkworms that spin eGFP silk fibers (Figure 2b-d). As shown in Figure 2d, the eGFP silk cocoons are processed into an eGFP silk fibroin solution by minimizing the heat-induced denaturation of eGFP in silk proteins (see the Experimental section; and Figure S2, Supporting Information). The natural color of eGFP silk is yellow, and the strong green fluorescence emission can be readily detected using an optical set of excitation (λ ex = 470 nm) and emission (λ em = 525 nm). The intact fluorescence signals also support the idea that the chromophore of eGFP in silk is not damaged during the regeneration process. [45] A large-area print sheet of the eGFP silk fibroin can be easily fabricated with scalability ( Figure 2e). A print sheet with a size of 140 × 140 mm 2 is fed into an inkjet printer to print a large number of edible watermarked taggants ( Figures S2 and S3, Supporting Information). Compared to nonfluorescent white silk fibroin, the reflectance spectral profile of the eGFP silk fibroin print sheet is not monotonous in the visible range owing to its absorption at the blue wavelength and emission at the green wavelength (Figure 2f-h). This spectral characteristic can serve as a tamper-resistant feature for a scan-print attack when a scanner or copier is used to attempt to duplicate a watermarked image.
In addition, to examine the digestibility of edible watermarked taggants, the enzymatic degradation and denaturation of eGFP silk proteins are investigated using two major proteolytic enzymes (i.e., pepsin and trypsin) produced in the gastrointestinal tract under physiologically relevant conditions. [46] Notably, eGFP fluorescence can serve as a biomarker for quantifying protein denaturation and degradation, because the protein unfolding of the eGFP chromophore from proteolytic enzyme exposure or any damage in the tertiary structure results in a loss of fluorescence. [45b,47] After immersing the eGFP silk fibroin print sheets into each enzyme solution, we monitor the fluorescence emission intensity of eGFP at 525 nm upon 470-nm excitation (Figure 2i). Compared to that associated with the pH 2.2 and pH 7.2 buffer solutions ( Figure S4, Supporting Information), the fluorescence of the eGFP silk fibroin print sheets immersed in 0.25% trypsin (pH 7.2) and 0.1% pepsin (pH 2.2) enzymes is considerably decreased after 90 min. In other words, the protein-based print sheet can be easily digested in the gastrointestinal tract after oral intake.
To fabricate safe edible watermarked taggants for on-dose applications, we use commercially available FDA-approved food coloring dyes formulated in a food-grade laboratory (see the Experimental Section). These edible dyes have the appropriate physical properties (e.g., viscosity < 16 mPa•s) to be compatible to inkjet printer ink [48] (Table S1 and Figure S5, Supporting Information). Indeed, inkjet printing is an attractive option to ensure the scalable printing of edible taggants and can potentially be integrated into an additive pharmaceutical manufacturing process. [49] However, it is challenging to print images or patterns using these edible coloring dyes on an eGFP silk fibroin print sheet. Edible coloring dyes were originally developed for frosting sheet printing. The inkjet printing ability is affected by the surface properties of print sheets ( Figure S6, Supporting Information). The surface of eGFP silk fibroin films is water repellent. [50] We determine the optimal density of droplets in the proposed inkjet printing method (also known as halftoning in inkjet printing). A simple square pattern with a green color is printed using the food coloring dyes on eGFP silk fibroin sheets at opacity levels ranging from 20 to 100% in the CIE RGB space (Figure 3a). At the low opacity level of 20%, the droplets jetted through the inkjet printer are partially wetted and maintain their shape; however, the RGB colors are not clear owing to the low density of droplets, as shown in the spectra ( Figure S7c-e, Supporting Information). In contrast, the microscopic examinations above 60% show that the droplets are merged and spontaneously spread to adjacent droplets, resulting in color blots ( Figure S7, Supporting Information). Thus, we set the optimal opacity level as 40% to maintain the unique spectral profiles of 18 test colors (Figure 3b,c), although the chromaticity in the CIE color space reduces when the measured reflection spectra are converted into the CIE RGB values (Figure 3d). A color wheel image printed at an opacity of 40% confirms the printability of the proposed edible inkjet printing for maintaining vivid colors (Figure 3e).
To robustly extract an input watermark image from a digital photograph of a watermarked printout, it is critical to correct color artifacts and geometrical distortions that occur during printing and image acquisition. Although geometrical distortions are commonly corrected by watermark extraction ( Figure S8, Supporting Information), [51] the importance of color consistency and color reproducibility for print-camera digital watermarking has not yet been established. Photographs obtained using a smartphone camera or any digital camera exhibit different colors and brightness depending on the models and ambient light conditions during shooting. In particular, each digital camera and smartphone model (i.e., three-color image sensors or trichromatic cameras) has unique spectral response functions (also known as spectral sensitivity) in the red (R), green (G), and blue (B) channels. [52] A white balance is often used to adjust colors to represent a natural appearance; however, this aspect is not sufficient to compensate for color distortions. Notably, print-camera watermarking involves not only imaging but also printing, both of which are intrinsically lossy processes for color integrity (Figure 4a).
To recover the true RGB color values significantly distorted during printing and image acquisition, we incorporate machine learning of fixed-design regression in which polynomial features capture a nonlinear relationship between the original CIE and acquired RGB color values resulting from diverse spectral responses (or sensitivity) functions of different smartphone models. Specifically, we implement a robust color correction method by adding 32 primary colors into the periphery of a watermarked image (Figure 4b). First, the relationship between www.advancedsciencenews.com where T and M are 3 × m matrices of the original CIE and measured RGB color values for m (=32) primary colors, respectively. By solving Equation (1) for the unknown matrix C, C can be used to convert the measured RGB color values of a watermarked image to the CIE RGB color space. We use the CIE RGB color space as a reference space because the CIE RGB color space defines physiologically perceived colors in the human visual system on the basis of the electromagnetic spectrum, and other color spaces are often derived from the CIE RGB (or XYZ) color space. [53] Second, to incorporate nonlinearity between the original CIE and measured RGB color values, where the p rows in M p × m include the polynomial terms and cross-terms in addition to the RGB color values (see the Experimental Section). [54] Third, an inverse of the expanded conversion matrix C in Equation (2) can be solved using a least-squares method (i.e., l 2 -norm minimization), such as QR decomposition or Moore-Penrose pseudo inverse. We evaluate the color correction ability of representative print-camera cases through leave-one-out cross-validation (Figure 4c-e). C is obtained from the complete dataset (31 colors) excluding one color among the 32 primary colors and a prediction is made for the excluded color to construct Equation (2). This process is repeated 32 (m) times and the predicted RGB color values exhibit excellent agreement with the actual RGB color values, resulting in a determination coefficient (R 2 ) of 0.96 (Figure 4f). The root mean square relative error (RMSRE) between the original CIE RGB and corrected color . Inkjet printability and color characteristics of FDA-approved food coloring on eGFP silk fibroin print sheets. a) Microscopic photographs of inkjet droplet wetting of FDA-approved food coloring (green color) on eGFP silk fibroin print sheets at opacity levels ranging from 20 to 100%. The opacity of 40% is optimal for the proposed inkjet printing owing to the spontaneous spreading and wetting of droplets. b) Representative 18 test colors with an opacity of 100% (left) and 40% (right) in the CIE color space. c) Normalized reflection spectra of 18 test colors printed on an eGFP silk fibroin print sheet at the opacity of 40%. Each color of the lines means the corresponding 18 test colors. d) Chromaticity in the CIE color space of 18 colors at an opacity of 100% and 40%. Although the gamut of the 18 test colors at the opacity of 40% (yellow dotted triangle) is smaller than that at 100% (cyan dotted triangle), this level of opacity ensures a reliable printing quality. e) Photograph of a representative printout for a watermarked image (color wheel) on an eGFP silk fibroin print sheet.
www.afm-journal.de www.advancedsciencenews.com values (see the Experimental Section, Supporting Information) is used to evaluate the color correction performance in a variety of data acquisition conditions, such as diverse light conditions, different levels of color temperature and optical intensity, and different smartphone models (Figure 4g-i; and see the Experimental Section, Supporting Information). Specifically, the color temperature and optical intensity are varied from 3000 to 5800 K at a constant optical intensity of 3.1 W m −2 and from 0.6 to 3.1 W m −2 at a color temperature of 5800 K, respectively, and image acquisition is performed using an Android smartphone (Samsung Galaxy S21) (Figure 4g,h). Moreover, five smartphone models (i.e., Android and iPhone) are used to acquire watermarked images at 5800 K and 3.1 W m −2 (Figure 4i). After the color correction, the averaged RMSRE values are significantly lower than those without the color correction (Table S2, Supporting Information), supporting the reliability of the proposed integrated color correction method under different acquisition conditions.
We examine the intrinsic tradeoff between the robustness of watermark extraction and visible imperceptibility (also known as imperceptibility, invisibility, and fidelity). [35b,55] In digital watermarking, the extraction of an embedded watermark image is subject to lossy compression, additive noise, and imaging filtering. [35e, 55,56] We determine an optimal scale factor of a watermark image when it is merged into a host image. The scale factor controls the relative intensity of the watermark image in the host image. Among several approaches based on spatial or frequency domains, we adopt frequency domainbased approaches, specifically, DWT and SVD. DWT and SVD can effectively balance the image quality and robustness for image watermarking, [57] because frequency components are less affected by typical noise. [51,58] In the embedding step, a host image is processed using 2D DWT with a two-level decomposition ( Figure S9a, Supporting Information). A subband image is decomposed by SVD, resulting in a matrix of [S h Y h U h ]. A watermark image is decomposed by SVD, generating a matrix of [S w Y w U w ]. Subsequently, both images are combined; Y = Y h + αY w with the scale factor α. An inverse 2D DWT-SVD is applied to finally generate a watermarked image. For the proposed print-camera digital watermarking method, the optimal range of α is from 0.8 to 1.0 (Figure S10, Supporting Information); the host image is compromised slightly, but the embedded watermark is perceptually unnoticeable. In this range, the robustness of watermark extraction can be guaranteed under diverse image acquisition conditions. We perform watermark image extraction ( Figure S9b, Supporting Information) after all the steps including the generation of a digital watermarked image, the fabrication of an edible watermarked taggant by inkjet printing, the integration of the taggant with a solid type medicine, and the acquisition of a photograph by a smartphone camera. To evaluate the accuracy of watermark image extraction, we use a structural similarity index that can comprehensively quantify the image luminance, contrast, and structural pattern in comparison with the original watermark (see the Experimental Section). Figure 5a shows representative cases in which different watermark images embedded in the same host image result in undistinguishable watermarked images to the naked eye. In other words, the embedded watermark images are imperceptible to human vision. As shown in Figure 5b, five smartphone models are employed to acquire the identical watermarked taggant under an illumination color temperature of 5800 K and an optical intensity of 3.1 W m -2 ; the image acquisitions are performed 12 times. After applying geometric and color corrections (see the Experimental Section, Supporting Information), the corresponding watermarks embedded in the host images are reliably extracted even when various smartphone cameras are used. The average structural similarity indices between the original and extracted watermark images are high for all the smartphone models, such as Samsung Galaxy A21, Samsung Galaxy S21, Apple iPhone 8, Apple iPhone 11 Pro, and Apple iPhone 12 Pro, showing the structural similarity index values of 0.89 ± 0.02, 0.88 ± 0.02, 0.89 ± 0.02, 0.88 ± 0.02, and 0.88 ± 0.02 (mean ± standard deviation) for the corresponding models, respectively (Figure 5c). This result supports the general and robust smartphone readability regardless of smartphone models.
Furthermore, we simulate a potential scan-print attack, assuming that a counterfeiter has full access to all of the technologies used in this study, including the FDA-approved edible dyes, the inkjet printer, and the eGFP silk fibroin print sheets. Specifically, we presume that a counterfeiter uses a highresolution digital scanner (600 dots per inch, DPI) to obtain a digital watermarked image from the original watermarked taggant and then reprints the scanned digital watermarked image on an eGFP silk fibroin print sheet. In this simulated case, the average structural similarity indices between the original and extracted watermark images duplicated by the scan-print processes are drastically low, with structural similarity index values of 0.20 ± 0.04, 0.21 ± 0.03, 0.21 ± 0.04, 0.20 ± 0.02, and 0.20 ± 0.03 (mean ± standard deviation) for the five smartphone models (Figure 5d). Specifically, the fluorescent print sheet plays an important role in enhancing resistance to a copy (scanprint) attack. The eGFP silk fibroin print sheet absorbs blue light in the wavelength range of 400-500 nm while emitting green light at 500-600 nm (Figure 2h). This unique spectral property induces significant color artifacts and distortions when exposed to white light illumination from a scanner or a copier in an attempt to duplicate a watermarked taggant (Figure S11, Supporting Information). As a result, the eGFP silk fibroin print sheet makes it difficult to reliably extract the original watermark image after the simulated copy attack ( Figure S12, Supporting Information).
We examine the practicality and scalability of on-dose anticounterfeit measures or authentication features for immediate applications. In particular, the readout repeatability and printing reproducibility of the edible watermarked taggants are quantified. First, we define the readout repeatability to quantify the degree of reliability of an edible watermarked taggant in extracting the same watermark image if it is read multiple times. Under 100 repeated camera acquisitions of a given edible watermarked taggant (Figure 6a), the 2D correlation coefficient and structural similarity index between the original and extracted watermark images are 0.98 ± 0.01 (Figure 6b) and 0.89 ± 0.02 (Figure 6c) on average, respectively. Second, we assess the print reproducibility, which is defined as the ability of producing a large number of identical watermarked taggants. Using the same digital watermarked image, we fabricate 50 edible watermarked taggants in the same inkjet printing www.advancedsciencenews.com conditions (Figure 6d). The pairwise comparison map of the 2D correlation coefficient analyses shows that the 50 different taggants are highly indistinguishable (Figure 6e), and the average structural similarity index is 0.89 ± 0.05 (Figure 6f). In addition, the edible watermarked taggants show a long-term stability for 110 days without a protective package ( Figure S13, Supporting Information). These results support the highly consistent and scalable readout and printing performance of the proposed edible watermarking technology.
We have demonstrated that the print-camera scheme of watermarking is a promising approach for combining digital watermarking and a physical (edible) entity (printed taggant) at the dosage level. First, the reported cyber-physical hybridization can ensure safe oral consumption of FDA-approved edible materials and offer the convenience of using a common smartphone under diverse light conditions for end users (e.g., patient) without compromising security. In particular, although the advanced anticounterfeiting technologies proposed recently are promising, a key limitation is the material toxicity associated with the adverse effects of artificial and synthetic materials. The proposed on-dose applications rely on edible constituent materials (food coloring and protein) to ensure safe oral consumption. Second, the permanent coexistence of a watermark in a host image imposes the fundamental tradeoff between the watermark imperceptibility (or invisibility) and robust extraction. The optimal combination of color correction and scale A Samsung Galaxy S21 smartphone is used for image acquisition under an illumination color temperature is 5800 K and an optical intensity of 3.1 W m −2 . b) Photographs of acquired and corrected watermarked images and extracted watermark images for five smartphone models (Samsung Galaxy S21, Samsung Galaxy A21, Apple iPhone 8, Apple iPhone 11 Pro, and Apple iPhone 12 Pro) at a color temperature of 5800 K and an optical intensity of 3.1 W m -2 . Each acquired watermarked image is processed via the geometric and color correction methods. The watermark image (i.e., the number 8) is extracted from the corrected image. c) Scatter plots of structural similarity indices between the original digital (input) watermark image and the extracted watermark image from the edible watermarked taggant via the print-camera scheme for the five smartphone models. The image acquisition processes are repeated 12 times for each smartphone model. d) Scatter plots of structural similarity indices between the original digital (input) watermark image and the extracted watermark image from an edible watermarked taggant produced by a simulated copy (scan-print) attack. A counterfeit watermarked taggant is produced by scanning the original edible watermarked taggant using a scanner with a scanning resolution of 600 dots per inch (DPI) and reprinting the scanned watermarked image on the identical eGFP silk fibroin print sheet by using the same inkjet printer. The threshold value of structural similarity index can be set as 0.8 (black dotted line) for verification or authentication. The error bars represent a standard deviation.
www.afm-journal.de www.advancedsciencenews.com factor ensures the robustness of watermark image extraction to unintentional attacks (e.g., noise and filtering) and the imperceptibility is maintained with only minor degradation in the host image quality. Third, the major limitation in physical watermarking is the vulnerability to copy (scan-print) attacks that involve a digital scanner and printer to duplicate the watermarked image. The unique optical absorption and emission of fluorescent silk fibroin create severe color artifacts and distortions during digital scanning, thereby enhancing resistance to attacks.

Conclusion
In conclusion, we have revisited the concept of print-camera watermarking for developing a cyber-physical security solution for anticounterfeit measures and authentication features at the dosage level. The reported on-dose watermarking method combines digital watermarking and edible printing to ensure edibility, printability, imperceptibility, tamper resistance, robustness, and usability. In the refined inkjet printing method using FDA-approved food coloring on an eGFP silk fibroin print sheet, all the constituent materials are edible and tamper-resistant. The color-correction-assisted extraction of watermark images is resilient and robust to different types of smartphone model and light condition. The proposed on-dose printing method can facilitate the development and production of single-unit packages or unit-dose packages in hospital pharmacy settings to lower the risk of dispensing errors, improve inventory tracking, enhance security, and minimize labor costs. The reported edible watermarked taggant can allow patients to actively participate in combating anticounterfeit medicines. The reported edible watermarking method can potentially be used for other cryptographic and security protocols in which information representation and data storage must be obliterated immediately after being accessed.
Fabrication of eGFP Silk Fibroin Print Sheets: eGFP silk fibroin print sheets were fabricated as follows ( Figures S2 and S3, Supporting Information): small pieces of eGFP silk cocoons were completely dissolved in an aqueous salt solution of 9.5-M lithium bromide (LiBr) for 12 h with stirring of 400 rpm. To avoid heat-induced denaturation of fluorescent proteins in silk, [59] a dissolution process of eGFP silk was performed at a low temperature of 50 °C. Then, the eGFP silk fibroindissolved solution was filtered through a miracloth. To remove any residual salt in the eGFP silk fibroin solution, a dialysis process was carried out using a cellulose semipermeable tube with deionized water at room temperature for two days. The pure eGFP silk fibroin solution with a final concentration of 5-6% (w v −1 ) was obtained and stored at 4 °C in the dark before use. An eGFP silk fibroin print sheet with a thickness of 75 ± 5 µm was fabricated by pouring the eGFP silk fibroin solution into a plastic petri dish with a diameter of 150 mm and subsequently drying it in a dark room under ambient conditions: 22 ± 2 °C and 50 ± 10% relative humidity.
Fabrication of Edible Watermarked Taggants: A watermarked image was printed on an eGFP silk fibroin print sheet using an inkjet printer (PX-8220, Cannon, Tokyo, Japan). Commercially available food coloring dyes (Icing Images, Winchester, VA, USA) were taken advantage of, which are typically used for decorating cakes.  (Table S1, Supporting Information). After printing out, the watermarked taggants were dried with a heat gun and were cut in different sizes of 3 × 3, 5 × 5, 7 × 7, 9 × 9, 11 × 11, 13 × 13, and 15 × 15 mm 2 . Although the minimum taggant size can be as small as 5 × 5 mm 2 ( Figure S14, Supporting Information), the size of 15 × 15 mm 2 was typically used for the analyses. To affix a taggant to a solid-type medicine (e.g., tablet or pill), a glucose syrup-based edible glue (FONDX America Corp., Northridge, CA, USA) was utilized.
Enzymatic Digestibility of eGFP Silk Fibroin Print Sheets: To characterize the enzymatic denaturation and degradation, gastric proteolytic enzymes were used: pepsin (P7000, Sigma) and trypsin (15090046, Gibco). An eGFP silk fibroin print sheet with a size of 9 × 9 mm 2 with a thickness of 75 ± 5 µm was immersed in pH 2.2 phosphate buffer solutions (4-M urea, 3-M guanidine HCl, and 0.25% pepsin) and pH 7.2 phosphate buffer solutions including 0.25% trypsin. For comparisons, the same pH 2.2 and pH 7.2 phosphate buffer solutions without proteolytic enzymes were used. All solutions were prewarmed to 37 °C prior to the digestibility tests. Fluorescence images were captured under 470-nm LED light illumination through an optical filter at 525 nm at two timepoints of 0 and 90 min.
Digital Watermark Image Embedding and Extraction: To generate a digital watermarked image for inkjet printing, a watermark image was embedded into a host image as follows ( Figure S9, Supporting Information): A host image for each RGB channel was processed by 2D DWT with a two-level decomposition using the Haar wavelet. The decomposed image array resulted in four frequency subbands: LL 2 (low-low), LH 2 (low-high), HL 2 (high-low), and HH 2 (high-high). The decomposed image of the LL 2 subband was processed by SVD, generating a matrix of [S h Y h U h ]. The watermark image in each RGB channel was also transformed by SVD, generating a matrix of [S w Y w U w ]. Then, Y h and Y w were merged to create a digital watermarked image: where α is the scale factor. After forming [S h Y U h ] by replacing Y h with Y, an inverse 2D DWT-SVD was applied to generate a digital watermarked image in each RGB channel. To extract the watermark image from the edible watermarked taggant after the print-camera process, the color and geometric corrections were conducted. The corrected watermarked image in each RGB channel was transformed into the subbands by 2D DWT with the two-level decomposition. The decomposed image of the LL 2 subband was processed by SVD, resulting in [S Y Ûˆˆ]. Then, [S Y Û w w w ] was obtained by replacing Y w with Ŷ w : Finally, an inverse SVD of [ S Y Û w w w ] returns an extracted watermark in each RGB channel.
Color Correction Method: A simple linear relationship between the original and measured RGB color values is significantly limited. Fixeddesign regression with polynomial (or root-polynomial) expansions is an effective machine learning approach in the machine vision. To maximize the accuracy of color correction by taking nonlinearity into account, the authors expanded M 3 × m to M p × m that can be expressed explicitly:  (5) where R, G, and B are three color intensity values in the red (R), green (G), and blue (B) channels. Among numerous combinations, polynomial expansions of the 2nd degree were used. [54] In other words, a simple 3 × m linear transform is not sufficient to generate a reliable transformation from measured RGB values and CIE RBG values under diverse light conditions and devices.
Structural Similarity Index Calculation: Structural similarity index was used to quantitatively compare the extracted watermark images with the original watermark image. Specifically, structural similarity index is useful to capture image luminance (L), contrast (C), and structural (S) information in a comprehensive manner. [60] The individual comparison functions can be expressed: www.advancedsciencenews.com  +  +  +  =  +  +  +  =  +  +  ,  2  ,  ,  2 , and , where k 1 = 0.01, k 2 = 0.03, and L is the dynamic range in each pixel defined as L = 2 (color depth = 8 bits) − 1. Finally, structural similarity index between A and B is defined: where α, β, and γ assign the relative importance among the three functions and α = β = γ = 1 were chosen in the case.

Supporting Information
Supporting Information is available from the Wiley Online Library or from the author. www.advancedsciencenews.com