# An Audio Watermarking Algorithm Based on Adversarial Perturbation +
## 2 Related Works  
**Traditional audio watermarking algorithms** can be categorized according to their embedding domains, a few of which are time domain algorithms [25] and the majority of which are transform domain ones. Audio watermarking algorithms in the time domain generally provide straightforward solutions since they directly change audio samples. Although there has not been solid evidence to confirm the performance shortcomings of time domain algorithms, researchers generally agree that more careful designs are needed to improve the performance of time domain algorithms than transform domain ones [3]. The transform domain algorithms, which adhere to the transform, embedding, and inverse-transform pipeline, apply a transformation before embedding the watermark. Transforms that are often applied to watermarking algorithms are singular-value decomposition (SVD) [26], DCT [12; 13], STFT [27], DWT [15; 16], FFT [17], and FSVC [14], etc. Researchers sometimes manually design invertible transformations to take advantage of the properties of the transform domain. The popular transform domain algorithms include spread-spectrum-based [28] and quantization-based [29]. Among them, spread-spectrum-based algorithms have more anti-interference capability, but there is host signal interference. Quantization-based algorithms avoid host signal interference but are not robust against common attacks such as requantization, scale enlarging/diminishing, etc. Therefore, researchers have proposed many auxiliary techniques to enhance the ability of traditional algorithms, such as diversity reception [13], synchronization codes [30], sliding windows [31], robust features [14], pre-correlation whitening [11], and polarization embedding [12]. These auxiliary techniques are designed for specific attacks. Thus, the types of attacks that these techniques can withstand are limited. Combining these auxiliary techniques to deal with multiple attack types is a nontrivial task, and the number of attacks the algorithms can withstand increases only a little. **Deep learning-based watermarking algorithms** have emerged as a potential alternative to traditional algorithms in image watermarking. These algorithms solve two pivotal problems of traditional algorithms. Firstly, neural networks can fit arbitrary functions. Therefore, researchers no longer need to design sophisticated transformation functions and embedding approaches. Next, the attack simulation layer enables the neural network to learn robustness against most differentiable attacks. The model is frequently constructed using encoder-decoder architecture, where the encoder embeds the watermark into a host material and the decoder accomplishes the extraction. For example, HiDDeN [18] cascaded the encoder, noise layer, and decoder and enhanced the perceptual quality using a parallel-connection adversarial discriminator. [PERSON] et al. [19] proposed a two-stage learning method to address the constraint that the noise layer in HiDDeN must be differentiable. MBRS [20]adopted adversarial training for JPEG attacks to provide additional robustness. Distortion Agnostic [21] considers the decoder as a discriminator in the adversarial network. At the same time, another generator was constructed to attack the watermarked image to improve the model's robustness against unknown attacks. IGA [22] and [PERSON] [23] introduced attention mechanisms to improve the robustness and imperceptibility of watermarking. ReDMark [24] and [PERSON] et al. [32] integrated conventional DCT or DWT with deep learning to improve the performance. Some algorithms use adversarial perturbations to watermark images. [PERSON] et al. [33] investigated a new family of transformation based on a deep neural network trained with supervision for a classification task. [PERSON] et al. [34] used a pre-trained DINO model [35] to conduct the zero-bit and multi-bit image watermarking. [PERSON] et al. [36] embedded watermark by a black-box model.