# A Brief, In-Depth Survey of Deep Learning-Based Image Watermarking
## 3 Comprehensive Survey of Deep Learning-Based Image Watermarking
### Embedder-Extractor Joint Training Methods
Notably, the backpropagation is structured to bypass the JPEG compression phase, thereby mitigating the impediments associated with non-differentiability. Certain studies incorporate specialized noise into the noise layer to address special challenges in image watermarking. One intricate area involves extracting watermarks from images that have undergone resampling via a camera, which introduces multifarious noise types including JPEG artifacts, variations in lighting, and optical distortions. In response to this, [PERSON] et al. [33] and [PERSON] et al. [34] advanced approaches that incorporate a screen-shooting noise layer simulation. This adaptation enables the simulation of camera resampling noises like geometric distortions, optical bends, and RGB ripples within the training of deep learning-based image watermarking models, fostering a more robust system capable of counteracting these specific noise introductions. Existing joint training paradigms necessitate the explicit identification and enumeration of training noise. Models tend to exhibit enhanced robustness to noises encountered during training than those not included. However, in real-world scenarios, anticipating and listing all potential noises can be impracticable. As such, a strand of research is dedicated to forging robust deep learning-based image watermarking models without prior noise knowledge. [PERSON] et al. [35] introduced an invariance layer designed to sieve out extraneous information during the watermark extraction phase. Within the training ambit, the Frobenius norm of the Jacobian matrix of the invariance layer's outputs with regard to its inputs is computed and employed as a regularization term. The dual objective of minimizing this term, alongside ensuring watermarking requisites (pertaining to the marked image's quality and watermark extraction efficacy), ensures the output of the invariance layer remains largely invariant to alterations in its input images, hence instilling robustness sans explicit noise enumeration. Furthermore, the embedding network employs multi-scale inception networks, facilitating an intricate fusion of the cover image and watermark. Another strategy to achieve robustness without resorting to manual noise layer introduction entails the deployment of an adversarial network, serving as an automated assistant. [PERSON] et al. [36] illustrated this by amalgamating an adversarial network within their architecture, functioning as a noise module. During training, this adversarial entity, interfaced with the extractor, evolves in proficiency, adept at hampering watermark extraction. In counteraction, the extractor strives to mitigate the perturbations induced by the adversarial entity. A nuanced calibration of the training process, accentuating the fortification of the extractor against the adversarial network, culminates in a model characterized by enhanced robustness and reliability. The joint embedder-extractor paradigm is as a notably effective approach within the existing body of literature. Enhanced performance has been a focal point, with innovations in architectural design and training methodologies spearheading advancements. [PERSON] et al. [37] enriched their noise layer with a variety of disturbances including Gaussian, white noise, random cropping, smoothing, and JPEG compression. Each training iteration involves a stochastic selection of one specific noise type, ensuring that each assault singularly influences the training loss. In another development, [PERSON] et al. [38] unveiled a pre-processor termed a 'propagator', engineered to disseminate the watermark across the image's spatial domain. The researchers stratified assorted attacks and corroborated that integrating specific distortions during training augments robustness against an entire category of distortions. Echoing the two-stage training approach of [PERSON] et al. [29] and mirroring the noise influences highlighted in HiDDeN [7], [PERSON] et al.