## 4 Experiments
### Perceptual Robustness  
To validate the perceptual robustness of proposed algorithm, we applied twelve types of content preserving operations: (a) Gaussian noise addition with the variance of 0.005. (b) Salt and pepper noise addition with a density of 0.005. (c) Gaussian blurring with the standard deviation of the filter 10. (d) Circular blurring with a radius of 2. (e) Motion blurring with the amount of the linear motion 3 and the angle of the motion blurring filter 45. (f) Average filtering with filter size of 5. (g) Median filtering with filter size of 5. (h) Wiener filtering with filter size of 5. (i) Image sharpening with the parameter alpha of 0.49. (j) Image scaling with the percentage 1.2. (k) Illumination correction with parameter gamma 1.18. (l) JPEG compression with quality factor 20.  
We extracted the reference hashing code based on the original image (ORH) and our proposed multi-attack reference hashing (MRH). For the content-preserving distorted images, we calculated the corresponding distances between reference hashing codes and content-preserving images' hashing codes. The statistical results under different attacks are presented in Table 1. Just as shown, the hashing distances for the four baseline methods were small enough. In our experiments, we set the threshold \(\tau\) = 0.12 to distinguish the similar images and forgery images from the CASIA dataset for the PRIVD method. Similarly, for the other three methods, we set the thresholds as 1.2, 0.0012 and 0.008 correspondingly for their best results.  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Method**} & \multirow{2}{*}{**Manipulation**} & \multicolumn{3}{c}{**ORH**} & \multicolumn{3}{c}{**MRH**} \\ \cline{3-8}  & & **Max** & **Min** & **Mean** & **Max** & **Min** & **Mean** \\ \hline \multirow{8}{*}{Wavelet} & Gaussian noise & 0.02828 & 0.00015 & 0.00197 & 0.02847 & 0.00014 & 0.00196 \\  & Salt\&Pepper & 0.01918 & 0.00021 & 0.00252 & 0.01918 & 0.00024 & 0.00251 \\  & Gaussian blurring & 0.00038 & 0.00005 & 0.00017 & 0.00067 & 0.00006 & 0.00019 \\  & Circular blurring & 0.00048 & 0.00006 & 0.00022 & 0.00069 & 0.00006 & 0.00021 \\  & Motion blurring & 0.00034 & 0.00006 & 0.00015 & 0.00065 & 0.00005 & 0.00016 \\  & Average filtering & 0.00071 & 0.00007 & 0.00033 & 0.00071 & 0.00009 & 0.00030 \\  & Median filtering & 0.00704 & 0.00006 & 0.00099 & 0.00753 & 0.00007 & 0.00099 \\  & Wiener filtering & 0.00101 & 0.00008 & 0.00028 & 0.00087 & 0.00008 & 0.00028 \\  & Image sharpening & 0.00906 & 0.00009 & 0.00115 & 0.00906 & 0.00010 & 0.00114 \\  & Image scaling & 0.00039 & 0.00005 & 0.00013 & 0.00064 & 0.00006 & 0.00018 \\  & Illumination correction & 0.08458 & 0.00447 & 0.02759 & 0.08458 & 0.00443 & 0.02757 \\  & JPEG compression & 0.00143 & 0.00009 & 0.00026 & 0.00275 & 0.00013 & 0.00051 \\ \hline \multirow{8}{*}{SVD} & Gaussian noise & 0.00616 & 0.00007 & 0.00031 & 0.00616 & 0.00007 & 0.00030 \\  & Salt\&Pepper & 0.00339 & 0.00008 & 0.00034 & 0.00338 & 0.00007 & 0.00033 \\  & Gaussian blurring & 0.00017 & 0.00007 & 0.00010 & 0.00113 & 0.00007 & 0.00011 \\  & Circular blurring & 0.00018 & 0.00006 & 0.00010 & 0.00114 & 0.00006 & 0.00011 \\  & Motion blurring & 0.00017 & 0.00007 & 0.000010 & 0.00113 & 0.00006 & 0.00011 \\  & Average filtering & 0.00025 & 0.00007 & 0.00011 & 0.00111 & 0.00006 & 0.00012 \\  & Median filtering & 0.00166 & 0.00007 & 0.00015 & 0.00190 & 0.00007 & 0.00016 \\  & Wiener filtering & 0.00035 & 0.00005 & 0.00011 & 0.00113 & 0.00007 & 0.00012 \\  & Image sharpening & 0.00104 & 0.00007 & 0.00018 & 0.00099 & 0.00007 & 0.00018 \\  & Image scaling & 0.00016 & 0.00007 & 0.00010 & 0.00114 & 0.00007 & 0.00011 \\  & Illumination correction & 0.0062 & 0.00014 & 0.00149 & 0.00674 & 0.00014 & 0.00150 \\  & JPEG compression & 0.00031 & 0.00007 & 0.00010 & 0.00053 & 0.00008 & 0.00012 \\ \hline \hline \end{tabular}
\end{table}
Table 1: Hashing distances under different content-preserving manipulations.