# A Neural-Network-Based Watermarking Method Approximating JPEG Quantization
## 5 Computer Simulations
### Evaluation of the Proposed Attack Layer
#### 5.2.3 Evaluation of the BER  
The robustness of our network against the JPEG compression was evaluated. The estimated watermark obtained by (8) was evaluated by using the BER. The BER of the estimated watermark \(\mathbf{p}_{e}\) can be defined by  
\[\text{BER}=\frac{1}{hw}\sum_{i=0}^{h-1}\sum_{j=0}^{w-1}p(i,j)\oplus p_{e}(i,j), \tag{25}\]  
where \(\mathbf{p}\) is the original watermark, and \(\oplus\) represents the exclusive OR.  
First, we compared the robustness of our network with that of the JT-Net and constant QAF-Net using the same embedding intensity \(\alpha\). Figure 13 shows the BER of the estimated watermark for the embedding intensity \(\alpha\). The horizontal and vertical axes represent the intensity \(\alpha\) and BER, respectively. For different compression levels \(Q\), the dashed lines with circles represent the BER for the QT-QAF-Net, the solid lines with squares represent the BER for the JT-Net, and the dotted lines with triangles represent the BER for the constant QAF-Net. When the watermark was strongly embedded, it was extracted correctly. Therefore, the BER decreased as the intensity \(\alpha\) increased. The lowest BER was obtained when \(\alpha=1.0\). At compression level \(Q\leq 70\), the BER of the proposed network was lower than that of the JT-Net. Also, at \(Q=80\), they had almost the same BER. Furthermore, at \(Q=90\), the BER of our network was larger than that of the JT-Net. The BER of the constant QAF-Net was always larger than that of the other two networks.  
Figure 12: Images cropped to \(128\times 128\) pixels.  
Figure 13: BER for embedding intensity \(\alpha\).  
Even with the same embedding intensity, the image quality of our network differs from that of the JT-Net and the constant QAF-Net. Therefore, we next adjusted the embedding intensity so that the PSNRs of these three networks were approximately the same, and we compared the BERs of the networks under this condition. Figure 14 shows the histograms of PSNRs for the QT-QAF-Net with embedding intensity \(\alpha=1.0\). Figure 14a shows the histograms for the embedding intensity \(\alpha=1.0\) for the JT-Net and \(\alpha=0.55\) for the constant QAF-Net, respectively. Figure 14b shows histograms for these embedding intensities \(\alpha=0.95\) and \(\alpha=0.50\), respectively. The intensities of the three networks were chosen so that the histograms shown look similar. To measure the robustness against JPEG compression, we set the intensity \(\alpha\) to ensure that the PSNR obtained from these networks is approximately the same. Specifically, we set the intensity for the JT-Net and QT-QAF-Net to \(\alpha=0.95\) (average \(\text{PSNR}=37.58\) dB) and \(\alpha=1.0\) (average \(\text{PSNR}=37.81\) dB), respectively. Figure 15 is the BER for the compression level \(Q\). The error bars are the standard deviation of the BERs. The BER of the estimated watermark for QT-QAF-Net is lower than that for the JT-Net and constant QAF-Net. Thus, we can say that our network can generate watermarks with fewer errors under the given PSNR.