## 3 Results
### The Model's Ability to Restore (Retrieve) Watermarks in Different Situations  
To verify the safety of this research method, in the experimental design of this section we mainly explore whether the trained model can only restore (retrieve) the watermark for  
\begin{table}
\begin{tabular}{c c c c c c c c c c} \hline \hline \multirow{2}{*}{Epoch} & \multicolumn{3}{c}{QF = 10} & \multicolumn{3}{c}{QF = 20} & \multicolumn{3}{c}{QF = 30} \\ \cline{2-10}  & PSNR & SSIM & BER & PSNR & SSIM & BER & PSNR & SSIM & BER \\ \hline
50 & 41.890 & 0.851 & 0.028 & 43.776 & 0.909 & 0.015 & 43.108 & 0.897 & 0.017 \\
100 & 41.269 & 0.800 & 0.041 & 47.032 & 0.951 & 0.007 & 44.480 & 0.907 & 0.016 \\
150 & 44.561 & 0.904 & 0.016 & 48.359 & 0.963 & 0.005 & 50.405 & 0.979 & 0.003 \\
200 & 44.528 & 0.878 & 0.022 & 47.667 & 0.957 & 0.006 & 49.001 & 0.967 & 0.004 \\
250 & 45.618 & 0.903 & 0.017 & 46.887 & 0.941 & 0.009 & 49.421 & 0.966 & 0.005 \\
300 & 46.063 & 0.902 & 0.017 & 45.761 & 0.924 & 0.011 & 47.543 & 0.938 & 0.009 \\
350 & 48.839 & 0.938 & 0.010 & 46.333 & 0.929 & 0.011 & 45.581 & 0.906 & 0.016 \\
400 & 49.158 & 0.931 & 0.012 & 47.853 & 0.949 & 0.008 & 51.324 & 0.970 & 0.003 \\
450 & 49.093 & 0.922 & 0.014 & 49.013 & 0.960 & 0.006 & 50.477 & 0.965 & 0.004 \\
500 & 51.756 & 0.947 & 0.008 & 49.037 & 0.958 & 0.006 & 49.071 & 0.954 & 0.007 \\ \hline \multirow{2}{*}{Epoch} & \multicolumn{3}{c}{QF = 40} & \multicolumn{3}{c}{QF = 50} & \multicolumn{3}{c}{QF = 60} \\ \cline{2-10}  & PSNR & SSIM & BER & PSNR & SSIM & BER & PSNR & SSIM & BER \\ \hline
50 & 43.807 & 0.914 & 0.013 & 40.872 & 0.816 & 0.035 & 41.910 & 0.873 & 0.022 \\
100 & 47.251 & 0.954 & 0.007 & 44.068 & 0.921 & 0.012 & 45.728 & 0.943 & 0.009 \\
150 & 47.426 & 0.956 & 0.006 & 47.052 the image with the watermark embedded at the beginning, and whether, in other situations, the original hidden watermark should not be restored (retrieved). We assume the following 6 situations:  
1. The same original image and the same watermark used in the training phase are also embedded with the same secret key. 2. The same original image and the same watermark are used in the training phase, but using a different secret key to embed. 3. The same original image and the same secret key are used in the training phase but with a different watermark embedded. 4. The same original image is used in the training phase, but no watermark is embedded. 5. The original image is different from the one used in the training phase, but the same secret key is used and the same watermark is embedded. 6. The original image is different from the one used in the training phase, and no watermark is embedded. The visualization results of the experimental settings in 6 cases are presented in Figure 9. Only in situation 1 will the trained model generate a restored watermark that is sufficiently similar to the original watermark. In the other cases (situations 2-6), the original watermark cannot be restored. Even if it is seen by human eyes, it has an outline similar to the original watermark, but the difference in the details is still very large. Figure 9: Visualized results of restored (retrieved) watermarks in different situations. Table 2 shows the PSNR, SSIM, or BER values of the restored (retrieved) watermark in different situations compared to the original watermark. The watermark restored (retrieved) by the model we designed in Situation 1 is indeed significantly different from the watermark restored (retrieved) by the model in the other situations (Situations 2-6). The PSNR value of Situation 1 in Table 3 is 49.832 dB, and the PSNR value of the other situations (Situations 2-6) is approximately 38.5 dB; the SSIM of Situation 1 in Table 3 is as high as 0.974, while the SSIM of the other situations (Situations 2-6) is only about 0.3 to 0.4. In Table 3, the BER of Situation 1 is 0.003, and the BER of the other situations (Situations 2-6) is about 0.2. In addition, Situation 2 used different secret keys to train the generator network, but the watermark could not be restored (retrieved) correctly.