# Image Watermarking between Conventional and Learning-Based Techniques: A Literature Review
## 5 Deep Learning-Based Image Watermarking Schemes
### End-to-End Learning-Based Watermarking Techniques
Specifically, the Y channels of the selected regions are concatenated with the normalized watermark, and the result is fed to the embedding network to obtain the marked Y channels. Then, the watermarked regions are obtained via the concatenation of the marked Y channels and the original CbCr channels. After that, the original regions are replaced with the watermarked regions to produce the marked high-definition image. For watermark extraction, as in the embedding stage, the embedding regions are segmented on the marked image with the same method, and their Y channels are input to the extraction network, which is called the revealing network, to retrieve the watermark. Together, the revealing network and the embedding network are trained, and as a result, the total loss backpropagation function is defined by combining SSIM, mean square error (MSE) and binary cross-entropy (BCE) as:  
\[I=MSE(C,S)+1-SSIM(C,S)+BCE(W,W^{\prime}) \tag{16}\]  
where \(C\) and \(S\) represent the input original image and the output watermarked image. The \(W\) and \(W^{\prime}\) represent the original watermark and the output of the revealing network. The results show how resistant the suggested approach is to geometric distortions and signal-processing flaws. However, it shows a high complexity for the embedding process. In [131], a universal image watermarking scheme was introduced using CNN without restrictions on the cover image and watermark information. The proposed system consists of three principal stages, including a pre-processing network, an embedding network, and an extraction network. Here, normalized host image and scrambled watermarks are pre-processed using the first two networks, respectively, and the outputs are concatenated to generate the input of the second network. In addition, the strength-scaling factor is multiplied by the watermark data to achieve the trade-off between invisibility and robustness. After that, the concatenation result is used as the input of the embedding network to produce the watermarked data, which is re-normalized to generate the watermarked image. Finally, the watermark information produced by the extraction network is unscrambled to obtain the final extracted watermark. Two loss functions were used in this work \(L_{emb}\) and \(L_{ext}\) for embedding and extraction, respectively, as follows:  
\[L_{emb}=\lambda_{1}L_{1}+\lambda_{2}L_{2} \tag{17}\]  
\[L_{ext}=\lambda_{3}L_{2} \tag{18}\]where \(L_{1}\) represents the MSE between the watermarked image and the original image and \(L_{2}\) is the MSE between the extracted and the original watermark. In these two equations, \(\lambda_{1}\), \(\lambda_{2}\), and \(\lambda_{3}\) are set to the hyper-parameters that control invisibility and robustness. The proposed technique has high robustness against various pixel-value and geometric attacks, as well as good invisibility for the watermark. Additionally, providing complexity analysis may help to improve the scientific value of this work. The CNN model is further adopted in [132]. In this case, it takes image blocks as input and learns to detect one-bit messages from each block. The image is updated so that the model recognizes the blocks as the message bit. For that purpose, the gradient-descent method (SGD) is adopted. The loss function from the SGD method is used to protect the embedding invisibility, and the message is properly inserted into the block when the loss is close to zero. Finally, the blocks are combined to generate the watermarked image. A set of simulated attacks was applied on the watermarked covers and images to enhance the CNN efficiency in capturing invariant features for various attacks, as well as to use the attacked watermark as the true label for supervised learning in the next stage. In the extraction process, the CNN weights are updated to extract the watermark correctly. Hence, the message bit is extracted from every block of the distorted image and the watermark can be completely extracted based on a threshold value.