# AWEncoder: Adversarial Watermarking Pre-Trained Encoders in Contrastive Learning
## 4 Experimental Results and Analysis
### Robustness  
In practice, adversaries may perform removal attacks, such as fine-tuning and pruning, to erase the watermark. To quantify the robustness of AWEncoder, we consider two common removal methods, that is, fine-tuning all layers (FTAL) and retraining all layers (RTAL). FTAL fine-tunes the entire encoder with the training dataset and RTAL retrains the entire encoder with the downstream training dataset. In addition, we remove the parameters with the smallest L1-norms to prune the encoder. We also verify the robustness of AWEncoder  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Downstream Dataset**} & \multirow{2}{*}{**Encoder**} & \multirow{2}{*}{**Setting**} & \multicolumn{2}{c}{**SimCLR ( ImageNet )**} & \multicolumn{2}{c}{**MoCo v2 ( CIFAR-10 )**} \\ \cline{4-6}  & & & \(T_{\text{cls}}\) & \(T_{\text{sim}}\) & \(T_{\text{cls}}\) & \(T_{\text{sim}}\) \\ \hline \multirow{4}{*}{GTSRB} & Pre-trained encoder & \begin{tabular}{c} _Plane_, \(\epsilon=15\) \\ _Plane_, \(\epsilon=20\) \\ _Dog_, \(\epsilon=15\) \\ \end{tabular} & **88.9\%** & **0.89** & **90.2\%** & **0.98** \\  & \
\begin{tabular}{c} _Plane_, \(\epsilon=20\) \\ _Dog_, \(\epsilon=15\) \\ \end{tabular} & 29.4\% & 0.17 & 24.6\% & 0.25 \\ \cline{1-1} \cline{2-6}  & Surrogate encoder &
\begin{tabular}{c} _Plane_, \(\epsilon=15\) \\ \end{tabular} & 33.3\% & 0.27 & 37.1\% & 0.31 \\ \hline \hline \end{tabular}
\end{table}
Table 4: Uniqueness evaluation due to different settings.  
Figure 3: Some examples of the key images: (**a**,**c**,**d**) are different key images randomly selected in “Plane” and (**b**,**e**) are the key images selected in “Cat” and “Dog”.  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Downstream Dataset**} & \multirow{2}{*}{**Setting**} & \multicolumn{2}{c}{**SimCLR**} & \multicolumn{2}{c}{**MoCo v2**} \\  & & & **WE** & & **WE** \\ \cline{3-6}  & & \(T_{\text{cls}}\) & \(T_{\text{sim}}\) & \(T_{\text{cls}}\) & \(T_{\text{sim}}\) \\ \hline \multirow{4}{*}{GTSRB} & _Plane 1_ & **88.9\%** & **0.89** & **90.2\%** & **0.98** \\  & _Plane 2_ & 87.8\% & 0.89 & 89.6\% & 0.97 \\ \cline{1-1}  & _Plane 3_ & 87.7\% & 0.88 & 90.0\% & 0.98 \\ \cline{1-1}  & _Dog_ & 87.4\% & 0.86 & 89.5\% & 0.97 \\ \cline{1-1}  & _Cat_ & 88.0\% & 0.88 & 90.1\% & 0.98 \\ \hline \hline \end{tabular}
\end{table}
Table 3: Effectiveness valuation of different images as the key image.  
in both white-box and black-box settings. The results in Tables 5 and 6 demonstrate that in the white-box setting, pruning has a small effect on the watermarked encoder. Although fine-tuning increases \(T_{\text{sim}}\) to a certain extent, AWEncoder can still effectively verify the ownership by applying a suitable threshold. In brief summary, AWEncoder is capable of resisting common attacks.  
For the black-box scenario, we compare AWEncoder with WPE by applying different attacks. The results are shown in Tables 7 and 8. It can be easily inferred that both pruning and fine-tuning will compromise the watermarking performance; however, AWEncoder is more robust than WPE against the removal attacks, which verifies the superiority of AWEncoder.