## 3 Results
### Model Accuracy Indicators for Different Thresholds  
According to the results in Table 3, the watermark restored (retrieved) in Situation 1 is indeed significantly different from the other situations (Situations 2 to 6). Among the three evaluation indicators, the value of SSIM is closer to the recognition of the human eye. Therefore, we calculated the SSIM value of the original watermark and the restored (retrieved) watermark, and used SSIM as the threshold value to determine whether the restored (retrieved) watermark was similar to the original watermark. If the SSIM value is greater than the threshold value, it means that the restored (retrieved) watermark is very similar to the original watermark. In other words, if an image can be restored (retrieved) by the generator to produce a generated image that is sufficiently similar to the original watermark, it means that the image is one of the original protected images. To verify the classification accuracy of different threshold values, in this section we use a confusion matrix and four other indicators to evaluate the effect of the model. Table 4 shows the confusion matrix and evaluation indicators presented by experiments with different SSIMs as the threshold values. The TP in the confusion matrix indicates that the model must be restored (retrieved) to produce a watermark and is judged to be sufficiently similar to the original watermark; FN means that the model must restore (retrieve) the watermark, but the watermark is judged to be wrong, which is a missed judgment; FP means that the model should not restore (retrieve) the watermark but is judged to be similar to the original watermark, which is a false alarm; TN indicates that the model should not restore (retrieve) the watermark and is judged to be an erroneous watermark. It can be seen from Table 4 that under different thresholds, the performance of Accuracy, Precision, Recall, and F1 Score are all very good with little difference, so we can focus on how to reduce missed judgments and false alarms. From the perspective of the application of intellectual property rights protection, it is most important that a model can \begin{table}
\begin{tabular}{c c c c} \hline \hline Test Situation & PSNR & SSIM & BER \\ \hline Situation 1 & 49.556 & 0.962 & 0.005 \\ Situation 2 & 38.586 & 0.391 & 0.188 \\ Situation 3 & 38.464 & 0.364 & 0.199 \\ Situation 4 & 38.453 & 0.355 & 0.202 \\ Situation 5 & 38.602 & 0.394 & 0.187 \\ Situation 6 & 38.447 & 0.345 & 0.206 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: The evaluation indicators of the original watermark and the restored (retrieved) watermark in different situations. completely protect the watermarked images. Therefore, in the two error situations, FN is more important than FP. It can be seen from Table 4 that when the Threshold is 0.90, the TP is 1598 and the FN is 2, which means that the watermark should be restored (retrieved) correctly in the image; 1598 images are restored (retrieved) by the model we designed to produce a high-quality watermark, but 2 images are judged to be watermarks with lower image quality. The TN is 13,339 and the FP is 5, which means that in the image that should not be restored (retrieved) to produce the correct watermark, 13,339 images have not been restored (retrieved) with high-quality watermarks, but 5 images have been restored (retrieved) by our designed model to produce high-quality watermarks. It is important to note that the dataset was imbalanced, with 1600 watermarked images (positive cases) and 13,344 non-watermarked images (negative cases). On the whole, when the Threshold is smaller, the FN decreases, which means that the number of missed judgments is reduced, and the relative FP will increase accordingly, which means that the number of misjudgments increases. When the Threshold is 0.87-0.90, although the FP is less, the FN increases, indicating that the original protected image has missed judgment.