# AWEncoder: Adversarial Watermarking Pre-Trained Encoders in Contrastive Learning
## 5 Conclusions  
In this paper, we proposed AWEncoder, an effective copyright protection technique for the pre-trained encoder in contrastive learning, which cannot only be applied in both white-box and black-box scenarios, but also transferred to several downstream tasks. Compared to the existing encoder watermarking, AWEncoder significantly improves the effectiveness and robustness. In the future, we will extend the proposed method to federated learning and ensemble learning, which are another two popular learning strategies widely applied in deep learning.  
Conceptualization, T.Z.; methodology, T.Z., G.S. and H.W.; software, T.Z. and G.S.; validation, G.S. and X.L.; supervision, H.W.; project administration, G.H. and H.W.; funding acquisition, H.W., X.L. and G.H. All authors have read and agreed to the published version of the manuscript.  
This research was funded by the National Natural Science Foundation of China (NSFC) under Grant No. 61902235, the Scientific and Technological Innovation Plan of Shanghai STC, No. 21511102605 Wuxi Municipal Health Commission Translational Medicine Research Project, No. ZH202102.  
Not applicable.  
The authors declare no conflict of interest.  
\begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline \multirow{2}{*}{\begin{tabular}{c} **Fine-10 \\ **Tuning** \\ \end{tabular} } & \multirow{2}{*}{\
\begin{tabular}{c} **Downstream** \\ **Dataset** \\ \end{tabular} } & \multirow{2}{*}{**Method**} & \multicolumn{4}{c}{**SimCLR (ImageNet)**} \\ \cline{5-8}  & & & \multicolumn{2}{c}{**Accuracy**} & \multicolumn{2}{c}{**\(T_{\text{cls}}\)**} & \\  & & & \multicolumn{2}{c}{**CE/WE**} & \multicolumn{2}{c}{**CE/WE**} & \\ \hline \multirow{4}{*}{FTAL} & \multirow{2}{*}{ImageNet} & WPE & 74.8\% & 74.3\% & 22.3\% & 74.0\% & 51.7\% \\  & & AWEncoder & 74.8\% & 72.1\% & 30.6\% & 92.4\% & **61.8\%** \\ \cline{2-8}  & \multirow{2}{*}{GTSRB} & WPE & 65.7\% & 66.2\% & 32.8\% & 61.7\% & 28.9\% \\  & & AWEncoder & 65.7\% & 63.2\% & 23.9\% & 82.4\% & **58.5\%** \\ \cline{2-8}  & \multirow{2}{*}{STL-10} & WPE & 63.4\% & 62.7\% & 31.0\% & 86.7\% & 55.7\% \\  & & AWEncoder & 63.4\% & 60.8\% & 14.6\% & 89.3\% & **74.7\%** \\ \hline \multirow{4}{*}{RTAL} & \multirow{2}{*}{ImageNet} & WPE & 94.5\% & 94.3\% & 21.6\% & 60.5\% & 38.9\% \\  & & AWEncoder & 94.5\% & 92.7\% & 39.8\% & 81.4\% & **41.6\%** \\ \cline{2-8}  & \multirow{2}{*}{GTSRB} & WPE & 98.5\% & 98.9\% & 29.7\% & 55.0\% & 25.3\% \\  & & AWEncoder & 98.5\% & 97.6\% & 37.6\% & 78.4\% & **40.8\%** \\ \cline{2-8}  & \multirow{2}{*}{STL-10} & WPE & 83.1\% & 82.2\% & 24.6\% & 50.3\% & 25.7\% \\  & & AWEncoder & 83.1\% & 82.7\% & 34.1\% & 80.0\% & **45.9\%** \\ \hline \multirow{4}{*}{
\begin{tabular}{c} Fine-10 \\ tuning \\ \end{tabular} } & Downstream & Method & \multicolumn{4}{c}{MoCo v2 ( CIFAR-10 )} \\  & \multirow{2}{*}{ImageNet} & WPE & 78.3\% & 77.2\% & 18.2\% & 77.6\% & 59.4\% \\  & & AWEncoder & 78.3\% & 76.9\% & 30.1\% & 90.9\% & **60.8\%** \\ \cline{2-8}  & \multirow{2}{*}{GTSRB} & WPE & 89.1\% & 87.5\% & 15.9\% & 55.8\% & 39.9\% \\  & & AWEncoder & 89.1\% & 87.7\% & 19.3\% & 85.8\% & **66.5\%** \\ \cline{2-8}  & \multirow{2}{*}{STL-10} & WPE & 71.3\% & 70.5\% & 13.2\% & 67.9\% & 54.7\% \\  & & AWEncoder & 71.3\% & 70.1\% & 18.8\% & 81.1\% & **62.3\%** \\ \hline \multirow{4}{*}{RTAL} & \multirow{2}{*}{ImageNet} & WPE & 97.1\% & 96.6\% & 22.3\% & 61.8\% & 39.5\% \\  & & AWEncoder & 97.1\% & 96.9\% & 35.2\% & 75.8\% & **40.6\%** \\ \cline{1-1} \cline{2-8}  & \multirow{2}{*}{GTSRB} & WPE & 98.0\% & 97.3\% & 16.0\% & 50.7\% & 34.7\% \\  & & AWEncoder & 98.0\% & 97.1\% & 33.8\% & 82.1\% & **48.3\%** \\ \cline{1-1} \cline{2-8}  & \multirow{2}{*}{STL-10} & WPE & 89.2\% & 87.5\% & 18.7\% & 43.5\% & 24.8\% \\ \cline{1-1}  & & AWEncoder & 89.2\% & 85.2\% & 34.1\% & 75.2\% & **41.1\%** \\ \hline \hline \end{tabular}
\end{table}
Table 8: Robustness in black-box verification against fine-tuning.