# AWEncoder: Adversarial Watermarking Pre-Trained Encoders in Contrastive Learning
## 4 Experimental Results and Analysis
### Effectiveness  
We first provide examples for the adversarial image in Figure 1 Phase III. As shown in Figure 2, due to the diversity, different images result in different degradation of the adversarial image, but the visual quality is all satisfactory, verifying the applicability of adversarial perturbation. It is admitted that one may use other perturbation strategies, which is not our main focus. Then, we evaluate the effectiveness of the watermarked encoder in both black-box and white-box scenarios. The encoders are pre-trained on two kinds of training datasets and contrastive learning algorithms. We compare WPE [26] and the proposed AWEncoder in three downstream tasks with black-box access. The results are shown in Table 1, where \"CE\" is short for clean encoder and \"WE\" is short for watermarked encoder. The fifth column shows the classification accuracy on the downstream task before and after watermarking. The last column gives \(T_{\text{cls}}\) before/after watermarking. It is inferred that although there is a slight decrease in classification accuracy for the downstream task after watermarking, by assessing the difference between \(T_{\text{cls}}\) for CE and WE, AWEncoder is more discriminative. In the white-box scenario, we verify the ownership by contrasting the embedding similarity of clean images and watermarked images. Table 2 presents how the similarity score of WE is much higher than that of CE, which indicates that the similarity score can be used for reliable verification. When the watermark is generated with an incorrect key image (\"dog\" in Figure 1 is used in our experiment), \(T_{\text{sim}}\) is much lower than the correct one. It indicates that AWEncoder has high security. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Pred-Trained Dataset**} & \multirow{2}{*}{**Encoder**} & \multirow{2}{*}{**Downstream Dataset**} & \multirow{2}{*}{**Method**} & \multicolumn{2}{c}{**Accuracy**} & \multicolumn{2}{c}{\(T_{\text{cls}}\)} \\  & & & & **CE/WE** & & **CE/WE** & **CE-WE** & \\ \hline \multirow{4}{*}{ImageNet} & \multirow{4}{*}{ImageNet} & WPE & 74.5\% & 73.4\% & 25.5\% & 86.4\% & 60.9\% \\  & & AWEncoder & 74.5\% & 71.1\% & 30.5\% & 96.1\% & **65.6\%** \\ \cline{2-8}  & SimCLR & \multirow{2}{*}{GTSRB} & WPE & 77.8\% & 77.5\% & 31.7\% & 90.4\% & 58.7\% \\  & & AWEncoder & 77.8\% & 75.5\% & 16.8\% & 88.9\% & **72.1\%** \\ \cline{2-8}  & & \multirow{2}{*}{STL-10} & WPE & 64.7\% & 64.1\% & 27.3\% & 91.6\% & 64.3\% \\  & & AWEncoder & 64.7\% & 61.2\% & 13.7\% & 93.9\% & **80.2\%** \\ \hline \multirow{4}{*}{CIFAR-10} & \multirow{4}{*}{MoCo v2 (ResNet-50)} & \multirow{4}{*}{ImageNet} & WPE & 73.0\% & 72.9\% & 19.3\% & 80.1\% & 60.8\% \\  & & AWEncoder & 73.0\% & 70.5\% & 30.9\% & 94.9\% & **64.0\%** \\ \cline{1-1} \cline{2-8}  & \multirow{2}{*}{MoCo v2 (ResNet-50)} & \multirow{2}{*}{GTSRB} & WPE & 84.5\% & 83.7\% & 14.9\% & 84.2\% & 69.3\% \\  & & AWEncoder & 84.5\% & 84.0\% & 12.8\% & 90.2\% & **77.4\%** \\ \cline{1-1} \cline{2-8}  & & STL-10 & WPE & 70.5\% & 68.9\% & 11.5\% & 80.9\% & 69.4\% \\ \cline{1-1} \cline{2-8}  & & AWEncoder & 70.5\% & 68.2\% & 17.6\% & 92.7\% & **75.1\%** \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Effectiveness evaluation under the black-box condition. \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Model**} & \multicolumn{3}{c}{\(T_{\text{sim}}\)} \\  & & \multicolumn{3}{c}{**Correct Watermark**} & \multicolumn{2}{c}{**Incorrect Watermark**} \\ \hline \multirow{2}{*}{SimCLR} & CE & 0.14 & 0.11 \\  & WE & **0.89** & 0.27 \\ \hline \multirow{2}{*}{MoCo v2} & CE & 0.26 & 0.25 \\  & WE & **0.98** & 0.33 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Effectiveness evaluation under the white-box condition. Figure 2: Some examples for the adversarial image: (**a**,**d**,**g**) are clean images randomly selected from GTSRB, ImageNet, and STL-10, respectively; (**b**,**e**,**h**) are adversarial with SimCLR; (**c**,**f**,**i**) are adversarial with MoCo v2.