# An Audio Watermarking Algorithm Based on Adversarial Perturbation +
## 3 The Proposed Methodology
### Watermark Embedding and Attack Simulation Layer
#### 3.4.2 Loss Function and Attack Simulation Layer  
The embedded watermark \(\mathbf{w}\) is a binary string, which facilitates content encoding but has some inconveniences in the AAW algorithm. Therefore, the watermark is polarized by  
\[\text{polar}(\mathbf{w})=\left\{ \begin{aligned} & 1,&& w_{i}=1\\ -1,&& w_{i}=0\end{aligned} \right. \tag{10}\]  
where \(w_{i}\) is a bit in the watermark binary string. Embedding a watermark requires a loss function \(\mathcal{L}\) to guide the optimization of tiny perturbations. The loss function consists of two parts, including \(\mathcal{L}_{w}\) that guides the watermark embedding and \(\mathcal{L}_{a}\) that constrains imperceptibility. The \(\mathcal{L}_{w}\) measures the distance between the extracted feature and the polarized watermark. We perform a sigmoid-like transform on the extracted feature and then compute the Euclidean distance between it and the polarized watermark. Since the loss function will introduce a component about attacks later, \(\mathcal{L}_{w}^{\prime}\) is used here first to denote the distance between vectors. \[\mathcal{L}_{w}^{\prime}(\mathbf{x},\delta,\mathbf{w}) =\|0.8\mathrm{polar}(\mathbf{w})-\mathrm{s}(\mathbf{o}_{wl})\|_{2}^{2} \tag{11}\] \[=\|0.8\mathrm{polar}(\mathbf{w})-\mathrm{s}(f_{\Theta}(\mathbf{x }+\delta))\|_{2}^{2}\]  
where \(\mathrm{s}(\mathbf{a})=\frac{1-\exp(-\mathbf{a})}{1+\exp(-\mathbf{a})}\) maps the output of whitening layer \(\mathbf{o}_{wl}\) into the interval \((-1,1)\), where \(\mathbf{a}\) is the dummy element representing the input to the function. The polarized watermark is diminished by a factor of 0.8 in order to avoid the gradient vanishing during the iteration process. As mentioned before, in order to make the extracted features invariant against various audio attacks, the pre-trained PTM (both the classification model and the contrastive learning model) introduce multiple audio transformations as data augmentation. The watermarking system can also use an attack simulation layer to transform the audio to improve the robustness of the watermark. We consider a set \(\mathcal{T}\) of audio attacks that contains combinations of attacks in addition to the transformations included in Table 1, as described in more detail in Section 4.1. The attack simulation layer will randomly select a transformation/attack from this set and apply it to the sum of the host audio and tiny perturbation \(\mathbf{x}(n)+\delta(n)\). Considering the attack simulation layer, the loss function can be stated as  
\[\mathcal{L}_{w,t}=\|0.8\mathrm{polar}(\mathbf{w})-\mathrm{s}(f_{\Theta}(f_{sl }(\mathbf{x}+\delta;t)))\|_{2}^{2} \tag{12}\]  
where \(f_{sl}(\mathbf{a},t)\) denotes the application of an attack \(t\in\mathcal{T}\) to the audio \(\mathbf{a}\). Since the attacks are randomly chosen by ASL, \(\mathcal{L}_{w,t}\) needs to be averaged according to various attacks \(t\in\mathcal{T}\). \[\mathcal{L}_{w}=\mathbb{E}_{t\in\mathcal{T}}[\mathcal{L}_{w,t}] \tag{13}\]  
If an attack is considered important or more frequent, it can be assigned a greater sampling probability. However, in this paper, all attacks in \(\mathcal{T}\) are assumed to be equally probable. On the other hand, it is anticipated that the difference between original and watermarked audio will be imperceptible. Therefore, a loss function \(\mathcal{L}_{a}\), which measures the difference between the watermarked audio and the host audio, is proposed. To make this difference more accurate to the audio quality, a frequency-weighted segmental signal-to-noise ratio (fwsSNR) [59] is adopted as the loss function. \[\mathcal{L}_{a}=\frac{10}{N_{s}}\sum_{i=1}^{N_{s}}\frac{\sum_{k}\left|X_{i}(k )\right|^{2}\log_{10}\frac{\left|\Delta_{i}(k)\right|^{2}}{\left|X_{i}(k) \right|^{2}}}{\sum_{k}\left|X_{i}(k)\right|^{2}} \tag{14}\]  
where \(X_{i}(k)\) and \(\Delta_{i}(k)\) are the FFT amplitudes corresponding to the host audio and tiny perturbation, \(N_{s}\) is the number of non-overlapped frames, and \(i\) is the index of the frames.