# Deep Watermarking Based on Swin Transformer for Deep Model Protection
## 3 Materials and Methods  
### Overall Organizational Structure  
This study builds upon the watermarking framework proposed by [PERSON] et al. [25], whose core idea is embedding watermarks into the processed image O generated by an image processing model, such as deraining and denoising, to protect authorship. This design helps prevent surrogate attacks because, if someone trains their own model using watermarked images, their model will also learn the watermark, making it traceable. As illustrated in Figure 2, the framework consists of two stages: the initial training stage, which jointly trains the embedding and extraction networks, and the adversarial training stage, designed to enhance robustness through simulated attacks. The dashed regions in the figure indicate two critical improvements proposed in this work, which involve upgrading the embedding network architecture and integrating adversarial data augmentation strategies. The watermark framework operates in two sequential phases. During the initial stage, the following components are prepared: the watermark W, the processed image O generated by the image processing model, and the original image I. The embedding network, Swin-UNet, takes O and the watermark image as inputs to produce the watermarked image O\({}^{\prime}\), which is constrained to maintain high visual fidelity with O. To enhance watermark invisibility, a discriminator D is introduced to classify whether an image contains a watermark, thereby guiding the embedder to minimize perceptual distortions. Concurrently, the extraction network is trained on three types of inputs: O\({}^{\prime}\), I, and O, ensuring it distinguishes between watermarked and non-watermarked images. Specifically, when fed with I or O, the extractor outputs a blank image, ensuring it does not attempt to extract nonexistent watermarks. After initial training, the extractor achieves near-lossless watermark extraction from O\({}^{\prime}\) under noise-free conditions. In practice, surrogate attacks may result in noisy and compromised watermarked images. To address this, the adversarial training stage simulates such attacks by perturbing O\({}^{\prime}\) using a surrogate model, such as UNet with L2 loss. The generated attacked watermarked images O\({}^{\prime\prime}\) is further augmented with composite distortions, including Gaussian  
Figure 2: The framework of proposed watermarking method. The optimized section is highlighted with a dashed box. noise, motion blur, and JPEG compression, to broaden the attack coverage and improve the extractor's generalization capabilities. Crucially, the extractor is retrained on a mixed dataset containing both watermarked images O\({}^{\prime}\) and attacked watermarked images O\({}^{\prime\prime}\), alongside non-watermarked images I and O. This approach ensures that the extractor maintains high accuracy on unaltered watermarked images O\({}^{\prime}\) while adapting to diverse noise patterns, enabling robust watermark extraction, even from attacked watermarked images. The above outlines the overall process of the architecture. This work focuses on optimizing the following two aspects:  
1. Embedding Network Upgrade by Replacing UNet with Swin-UNet  
[PERSON]'s [25] framework employs a UNet as the embedding network. However, due to the limited receptive field of convolutional operations, it struggles to capture the global context, resulting in reduced similarity between the watermarked and processed images. To overcome this, we adopt Swin-UNet, which enhances feature representation through window-based self-attention and multiscale fusion. This design better preserves local details while capturing long-range dependencies, improving overall structural consistency. 2. Data Augmentation to Enhance Robustness Against Surrogate Attacks  
While the upgraded embedding network enhances visual quality, it inadvertently reduces the extractor's robustness against attacked watermarked images.