# An Audio Watermarking Algorithm Based on Adversarial Perturbation +
## 4 Experiments and Discussion
### Ablation Studies  
This subsection shows the influence of the proposed attack simulation layer (ASL) and whitening layer (WL). Herein, the experiments that did not adopt ASL were realized by substituting all the attack types with CLP. Moreover, the experiments that did not use WL were realized by using only the first 320 dimensions of the 512-dimensional PTM features to calculate the loss function. The experimental results are shown in Table 2.  
As can be seen from Table 2, the ASL decreases the imperceptibility of the watermark, but the SWR of up to 37.53 dB (the worst) still demonstrates superior imperceptibility. However, the improvement of algorithm robustness by ASL cannot be ignored. Across the multiple attacks involved in this paper, the ASL improves the BDR of extracted watermarks to different degrees, from the lowest of 5.96% (WGN) to the highest of 18.09% (HPF). Interestingly, the BDR for extracting the watermark is slightly decreased in the absence of an attack. This is because the AAW algorithm with ASL needs to consider more attacks; however, there is only one scenario, CLP, considered in the experiments without ASL. Therefore, it can be argued that the ASL significantly improves the robustness of watermarking while maintaining the imperceptibility at an extremely optimal level. On the other hand, it can be seen that the WL substantially improves the BDR of the extracted watermark when the watermark is not under attack (CLP). However, in other attacks, it only marginally improves the BDR and also marginally decreases the imperceptibility of the watermark. In fact, the WL is not proposed to improve the robustness of watermarking. The main purpose of WL is to make the elements of the audio feature mutually independent and to keep these elements from affecting each other during the watermark embedding. It is argued that the WL decreases the failure rate of watermark embedding, which is reflected in the improvement in BDR when the watermarked audio is not attacked. In addition, as mentioned before, there is another important role of the WL, which is that it makes it easier to adjust the quantity of watermark bits. The different PTMs (CN or CL) have an influence on the robustness of the AAW algorithm, which is more pronounced in scenarios with attacks than in CLP. It can be argued that the audio representations extracted by CL are more instance-focused, whereas CN is more category-focused. Therefore, AAW-CL is more robust than that of CN, which is why CL performs slightly weaker in the classification task. In a nutshell, the effectiveness of the AAW algorithm was validated for two different pre-trained modules, CN and CL. Furthermore, it is also demonstrated experimentally that \begin{table}
\begin{tabular}{c c c c c c c c c c c c} \hline \hline \multirow{2}{*}{**PTM**} & \multirow{2}{*}{**ASL**} & \multirow{2}{*}{**WL**} & \multirow{2}{*}{**SWR (dB)**} & \multicolumn{8}{c}{**BDR (\%)**} \\ \cline{4-14}  & & & & **CLP** & **WGN** & **LPF** & **HPF** & **CRP** & **RVB** & **DEN** & **REC** \\ \hline \multirow{4}{*}{CN} & & & 43.10 & 92.78 & 50.52 & 74.82 & 77.50 & 81.19 & 80.92 & 67.46 & 64.08 \\  & ✓ & & 38.43 & 90.41 & 57.37 & 92.91 & 94.00 & 88.50 & 91.30 & 82.73 & 79.47 \\  & & ✓ & 42.87 & 99.56 & 52.31 & 80.55 & 81.17 & 82.88 & 83.27 & 69.64 & 66.79 \\  & ✓ & ✓ & 37.64 & 98.62 & 58.27 & 94.78 & 96.29 & 90.97 & 94.11 & 86.02 & 81.43 \\ \hline \multirow{4}{*}{CL} & & & 42.93 & 93.04 & 51.62 & 76.72 & 79.46 & 84.59 & 84.81 & 69.40 & 66.29 \\  & ✓ & & 38.23 & 89.95 & 58.59 & 93.30 & 95.27 & 92.86 & 92.52 & 85.26 & 81.11 \\ \cline{1-1}  & & ✓ & 41.79 & 99.87 & 50.91 & 79.39 & 82.25 & 86.06 & 86.57 & 71.51 & 68.25 \\ \cline{1-1}  & ✓ & ✓ & 37.53 & 98.93 & 58.75 & 95.20 & 97.13 & 93.47 & 95.19 & 89.22 & 83.29 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: The influence of the attack simulation layer (ASL) and whitening layer (WL). The ✓ indicates that the corresponding module was used in the experiment.