# Review of Image Forensic Techniques Based on Deep Learning
## 4 Robust Image Watermarking Based on Deep Learning
### Robust Image Watermark against Non-Differentiable Attack
#### 4.2.2 Robust Image Watermark against Screen-Shooting Attack
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Ref.**} & \
\begin{tabular}{c} **Watermark Size** \\ **(Container Size)** \\ \end{tabular} & \multirow{2}{*}{**Category**} & \multirow{2}{*}{**Method (Effect)**} & \multicolumn{2}{c}{**Robustness**} & \multicolumn{1}{c}{**Imperceptibility**} & \multirow{2}{*}{**Dataset**} \\  & & & & (BER (\%)) & & (PSNR (dB)) & \\ \hline [PERSON] et al. [108] & 1024 & Differentiable & CNN, Residual & 1.2 (50), & 35.93 & CIFAR 10 [130], \\  & (512 \(\times\) 512) & approximation & convolution & 0 (90) & & Pascal VOC [119] \\ [PERSON] et al. [122] & 30 & Specific decoder & CNN, GAN & 23.8 (50) & 33.5 & COCO [90], CIFAR 10 [103] \\ [PERSON] et al. [123] & 1024 & Network structure & CNN, JSNet & 0.097 (90), & ImageNet [124], \\  & (256 \(\times\) 256) & improvement & CNN, JSNet & 32.421(80) & – & Boss Base [102] \\ [PERSON] et al. [125] & 4 & Network structure & CNN, Residual & 4.14 (50) & 39.32 & COCO [90] \\  & (128 \(\times\) 128) & improvement & connection & & & \\ [PERSON] et al. [126] & 30 & One-stage & Backward ASL & 12.64 & – & Self-datasets \\  & (128 \(\times\) 128) & end-to-end &
\begin{tabular}{c} DEM, \\ Non-invertible \\ attention module \\ \end{tabular} & 0.76 (50) & 38.51 & COCO [90] \\ \hline \hline \end{tabular}
\end{table} 
Table 5: A comparison of deep learning-based image watermarking against JPEG attack. networks were used to correct the values of pixels on the image formed by the geometric attacks before extracting the watermark. Considering that conventional CNN-based algorithms introduce noise in the convolution operation, [PERSON] et al. [140] used DWT and IDWT instead of down-sampling and up-sampling operations in CNN to enable the network to learn a more stable feature representation from the noisy samples and introduced a residual regularization loss containing the image texture to improve the image quality and watermark capacity. The Fourier transform is invariant to rotation and translation; [PERSON] et al. [141] improved the Fourier transform-based watermarking method using a frame-based transmission correction of the captured image in the distortion correction process. **Distortion Simulation:** [PERSON] et al. [142] introduced a 3D rendering distortion network to improve the robustness of the model to camera photography and introduced a human visual system-based loss function to supervise the training of the encoder, which mainly contained the just notice difference (JND) loss and learned perceptual image patch similarity (LPIPS) loss of the original and watermarked images to improve the quality of the watermarked images. [PERSON] et al. [143] modeled the three components of distortion with the greatest impacts: transmission distortion, luminance distortion, and Moire distortion and further differentiated the operation so that the network can be trained end-to-end. The network was trained with end-to-end parameters and the residual noise was simply simulated with Gaussian noise. For imperceptibility, a mask-based edge loss was proposed to limit the embedding region which improved the watermarked image quality. This was performed to address the difficulty of conventional 3D watermarking algorithms to achieve watermark extraction from 2D meshes. [PERSON] et al. [144] proposed an end-to-end framework containing an encoder, a distortion simulator (i.e., a differentiable rendering layer that simulated the results of a 3D watermarked target after different camera angles), and a decoder to decode from 2D meshes. [PERSON] et al. [145] proposed the stegastamp steganography model to implement the encoding and decoding of hyperlinks. The encoder used a U-Net-like [146] structure to transform a 400 x 400 tensor with 4 channels (including the input RGB image and watermark information) into a tensor of residual image features. However, the algorithm had a small embedding capacity. The state-of-the-art deep learning-based image watermarking against screen-shooting attack algorithms and performance comparison are described in Tables 6 and 7.