# DARI-Mark: Deep Learning and Attention Network for Robust Image Watermarking
## 4 Experimental Results and Analysis
### Results  
We used all images in the Granada dataset as cover images to test the performance of DARI-Mark. To test imperceptibility, we embedded a watermark in each image, then computed the values of PSNR and SSIM, and averageed the results as the final result. To show the impact on the imperceptibility of \(\alpha\), we used a variety of embedding intensities (\(\alpha\in[0.2,0.4,0.6,0.8,1.0]\)) in the test stage. Figure 6 takes the gray-scale images Lena and Cameraman as examples, and visually shows watermarked images generated under different strength factors \(\alpha\) and the difference from cover images. The PSNR of watermarked images generated by the Lena image under different strength factors \(\alpha\) were: 48.24 dB, 44.40 dB, 42.43 dB, 40.14 dB, and 38.30 dB; the SSIM values were 0.9957, 0.9899, 0.9807, 0.9692, and 0.956. The PSNR of watermarked images generated by the cameraman image under different strength factors \(\alpha\) were 48.29 dB, 44.10 dB, 42.89 dB, 40.61 dB, and 38.77 dB; the SSIM values were 0.9981, 0.9938, 0.9868, 0.9773, and 0.9656. Since the difference between the cover image and the watermarked image was not obvious, to facilitate observation, the pixel value of the local block of the difference image was multiplied by 30 and placed in the lower right corner. It can be seen  
that DARI-Mark adaptively selected pixel points to embed the watermarking according to the attention network during watermark embedding. Figure 7 intuitively shows the distribution of PSNR and SSIM values of the watermark images generated under different strength factors \(\alpha\) in all images of the test set in the form of boxplots. The experimental results show that with the increase of \(\alpha\), the PSNR and SSIM of watermarked images decreased, that is, the quality of the watermarked images decreased. However, even in the case of \(\alpha=1.0\), the PSNR was greater than 35 dB and the normal viewing was not affected. Therefore, in this paper, we selected \(\alpha=1.0\) when testing robustness. Figure 6: The watermarked images generated under different cases of strength factors \(\alpha\) and the difference with the cover images: (**a**) \(\alpha=0.2\), (**b**) \(\alpha=0.4\), (**c**) \(\alpha=0.6\), (**d**) \(\alpha=0.8\), and (**e**) \(\alpha=1.0\). Figure 7: Boxplots for quality evaluation of watermarked images generated under different strength factors \(\alpha\): (**a**) PSNR and (**b**) SSIM. To assess DARI-Mark's robustness, we conducted six attacks on watermarked images: JPEG compression, sharpening, cropping (cropping ratio \(c\)), Gaussian noise, scaling (scaling ratio \(r\)), and salt-and-pepper noise. The BER and NCC of the extracted watermark are shown in Figures 8 and 9, respectively. It can be seen from the graph that as the value of \(\alpha\) increased, the BER of the watermark extraction decreased and the NCC increased, that is, the robustness of DARI-Mark increased. When \(\alpha=1.0\), DARI-Mark was very robust against sharpening, salt-and-pepper noise, and image upscaling in the scaling attack. When \(Q\) was 90, 70, 60, and 50, the BER of the watermark extraction was about 0.00, and the NCC was about 1.0000, which shows that the robustness was very good. When \(Q=30\), that is, the image was overcompressed, the BER of the watermark was 0.11, the NCC of the watermark was 0.8632, and the watermark information was partially damaged. The robustness was good when the cropping ratio \(c\) of the cropping attack was between 0.05 and 0.10. As \(c\) increased, the BER increased, but it was still within the acceptable range for the human eye to be able to see the watermark information. When the standard deviation \(\sigma\) was less than 0.10 in the Gaussian noise attack, the BER was approximately equal to 0.00 and the NCC is approximately equal to 1.0000, and as \(\sigma\) increased, the BER increased, and the NCC decreased.