# Deep Watermarking Based on Swin Transformer for Deep Model Protection
## 4 Results
### Robustness Against Surrogate Attacks
A more detailed comparison can be found in Table 4.  
Figure 7 presents the watermark extraction performance on the grayscale denoising task under attacks from surrogate models: (a) shows the original image without an embedded watermark, resulting in blank extraction; (b) illustrates the watermark extraction performance without attacks, where the watermark is extracted with minimal distortion; (c)-(j) unlike the deraining task, the extracted watermarks in the denoising task remain consistent across different network and loss function combinations. Regardless of the surrogate attack used, the extracted watermarks exhibit blurriness in the same regions,  
Figure 6: Watermark extraction results on the deraining task with surrogate models using different networks and loss functions. (**a**) Original image. (**b**) Watermarked image without noise. (**c–f**) Results from CNet, ResNet9, ResNet16, and UNet with L2 loss. (**g–l**) Results from UNet with L2 + Ladv, L1, L1 + Ladv, and Lperc + Ladv losses. Figure 7: Watermark extraction results on the denoising task with surrogate models using different networks and loss functions. (**a**) Original image. (**b**) Watermarked image without noise. (**c–f**) Results from CNet, ResNet9, ResNet16, and UNet with L2 loss. (**g–j**) Results from UNet with L2 + Ladv, L1, L1 + Ladv, and Lperc + Ladv losses. particularly on the leaves. This can be attributed to the inherent differences in the characteristics of the tasks. The denoising task involves removing global noise, leading to more uniform processing across the image, while the deraining task requires the handling of structured, localized streaks. As a result, surrogate models in denoising tend to produce more consistent watermark extraction patterns, whereas in deraining, the variations in learned features across different networks and loss functions lead to differences in the extracted watermark quality. Figure 8 illustrates several cases where the watermark extraction results are suboptimal. Typically, when the surrogate attack incorporates adversarial loss (Ladv) during training, the performance of the extractor declines. This is expected, as the adversarial loss encourages the surrogate model to learn transformations that are less direct and more perturbation-driven, thereby diminishing the recognizability of the embedded watermark and increasing the extraction difficulty. As shown in Table 4, the success rates of watermark extraction are evaluated using \(SR_{NC}\) and \(SR_{C}\). \(SR_{NC}\) considers a watermark extraction successful if the NC value exceeds 0.95, while \(SR_{C}\) measures the proportion of successfully extracted watermarks based on a 0.5 threshold. The comparisons included three methods: [PERSON]'s method [PERSON] (2015), Ourst, and Ours. Ours refers to the version without data augmentation during the adversarial training phase of the extractor, while Ours indicates the version that incorporates data augmentation. Incorporating data augmentation during training provides more diverse samples, which helps improve the generalization ability of the extractor. The results in Ourt demonstrate that UNet_L2 exhibits a certain level of generalizability. Even though the extractor was trained only with noise generated by UNet_L2, it still demonstrated a certain degree of robustness against other untrained network-loss combinations. However, compared