# Image Watermarking between Conventional and Learning-Based Techniques: A Literature Review
## 5 Deep Learning-Based Image Watermarking Schemes
### End-to-End Learning-Based Watermarking Techniques  
To date, the previous two categories only focus on one stage of the watermarking system. In contrast, there are many watermarking methods that embed and extract the watermark with the help of neural networks. Here, the learning framework aims to improve performance in both the embedding and extraction phases. Firstly, [PERSON] et al. [127] proposed a robust and blind image watermarking based on the mapping ability of deep neural networks. The designed framework was trained in an unsupervised manner to generalize both watermark embedding and extracting processes. It consists of five neural network components trained as a single deep neural network. The first is applied to encode the watermark image, which brings randomness and redundancy to enhance information protection and robustness. The second is called the embedder, it takes the feature space of the cover image with the encoded watermark and produces the watermarked image in a fusion way. Before watermark extraction, another network is adopted called the invariance layer, which converts the watermarked image to its redundant transformed space, wherein this layer rejects irrelevant information about the watermark and preserves the most important information, thus providing a high tolerance of errors on the watermarked image, which enhances robustness. Finally, two neural network components are used to fit the watermark reconstruction, the first extracts the watermark feature space from the output of the invariance layer, and the second decodes the watermark. The reconstruction is blind since it requires only the watermarked image without the need for the watermark and the original image. Moreover, the recovery ability of auto-encoders with appropriate features secures the feasibility of the watermark extraction in the proposed scheme. Experimental results reveal the system's good performance against typical attacks and its applicability in challenging camera applications. However, image fusion slows down data processing and results in huge data losses. Furthermore, geometric attacks should be studied. In order to deal with rotation attacks and JPEG compression, a blind learning network was developed in [128], which consists of a stego-image generator, an attack simulator, a watermark extractor, and a stego-image discriminator. The generator network learns to embed the watermark image into the cover image, and during the training, a generative adversarial network (GAN) is used to improve the quality of the stego-image. The attack simulator consists of two layers, namely a rotation layer to simulate the rotation attack and an additive layer to simulate the JPEG attack. Therefore, the watermark extractor can extract watermarks without rotation synchronization since it receives rotated and noised images in the training phase. In addition, the weight parameters and the additive noise's strength could be used to adjust the robustness and the image quality of the present scheme. The evaluation test revealed strong resistance to rotation and JPEG compression. However, an attack simulator with a variety of attacks can be used.