# Deep Watermarking Based on Swin Transformer for Deep Model Protection
## 2 Literature Review  
As mentioned in the introduction, the method proposed by [PERSON] et al. [25] performs exceptionally well in preserving visual quality and effectively resisting surrogate model attacks. [PERSON]'s [25] watermark embedding architecture, as shown in Figure 1, is structured into two main stages: the initial training stage and the adversarial training stage. In the initial training stage, the required images include the original image I, the processed image O obtained by inputting I into the image processing model, and the watermark W. First, the embedder learns to embed the W into the O through an embedding network. To enhance the perceptual quality and invisibility of watermarked images, a discriminator D is introduced during training. The discriminator is designed to distinguish between unwatermarked and watermarked images. It takes both unwatermarked images and watermarked images O' as input and produces a probability score between 0 and 1, representing the likelihood that the input image is unwatermarked. The discriminator is trained using binary cross-entropy loss, where unwatermarked images are labeled as 1, and watermarked images are labeled as 0. Simultaneously, the embedding network is trained adversarially to generate watermarked images that the discriminator classifies as unwatermarked, thus improving the invisibility of the watermark. In this adversarialsetup, the embedding network aims to maximize the discriminator's misclassification, encouraging it to assign a probability close to 1 for watermarked images. The output of the discriminator serves not only to compute the loss but also as a guiding signal for the embedding network to produce more visually indistinguishable results. Subsequently, the training of the extractor network takes place. In this phase, the inputs include three types of images the watermarked image O\({}^{\prime}\), along with the original image I and the processed image O, where neither I nor O contain the watermark. Incorporating unwatermarked images into the extractor's training helps the network differentiate whether an image contains a watermark. Without this ability to distinguish, the extractor might attempt to extract a watermark from an image that does not have one, which would be meaningless. Therefore, it is specified that, when the extractor receives I or O, the output should be a blank image. Only when the input is O\({}^{\prime}\) should the extractor attempt to extract the watermark. However, when faced with surrogate model attacks, the extractor's watermark extraction performance significantly decreases due to the introduction of noise. In the adversarial training of the second stage, surrogate attacks are simulated. During training, the surrogate attack learns to transform I into O\({}^{\prime}\). However, due to differences in the training process, the generated images do not perfectly match O\({}^{\prime}\) and instead contain additional noise. In this work, we refer to these images as attacked watermarked images O\({}^{\prime\prime}\). This added noise alters image details and affects the extractor's performance, so the extractor fine-tuned from the initial stage undergoes further independent training. In this phase, three types of images, I, O\({}^{\prime}\), and O\({}^{\prime\prime}\), are used. O\({}^{\prime\prime}\) is included to help the extractor adapt to extracting watermarks from attacked watermarked images. Meanwhile, I and O\({}^{\prime}\) are included to ensure that the extractor retains its original capabilities, including distinguishing whether an image contains a watermark and extracting watermarks from clean watermarked images. The final embedder and extractor constitute the complete watermarking solution, capable of reliably extracting watermark information under complex conditions. The experimental results demonstrate that this watermarking strategy effectively prevents the degradation of image quality, ensuring that the watermarked image closely resembles the processed image.