# Deep Watermarking Based on Swin Transformer for Deep Model Protection
## 4 Results
### Robustness Against Surrogate Attacks
\begin{table}
\begin{tabular}{c c c c c c c c c c} \hline \hline
**Task** & **Task** & **CNet** & **Res9** & **Res16** & **UNet** & **L2 + Ladv** & **L1** & **L1 + Lady** & **Lperc + Lady** \\ \hline \multirow{3}{*}{\
\begin{tabular}{c} Dearin \\ [32] \\ \end{tabular} } & [PERSON] [25] & 100\%/100\% & 100\%/100\% & 100\%/100\% & 100\%/100\% & 99\%/100\% & 100\%/100\% & 100\%/100\% & 100\%/100\% & 100\%/100\% \\  & Ourst & 100\%/100\% & 100\%/100\% & 100\%/100\% & 99\%/100\% & 93\%/100\% & 100\%/100\% & 100\%/100\% & 100\%/100\% \\  & Ours & 100\%/100\% & 100\%/100\% & 100\%/100\% & 100\%/100\% & 99\%/100\% & 100\%/100\% & 100\%/100\% & 100\%/100\% \\ \hline \multirow{3}{*}{
\begin{tabular}{c} [PERSON] \\ [33] \\ \end{tabular} } & [PERSON] [25] & 99\%/100\% & 100\%/100\% & 99\%/100\% & 100\%/100\% & 97\%/100\% & 100\%/100\% & 97\%/100\% & 97\%/100\% & 99\%/100\% \\  & Ourst & 100\%/100\% & 100\%/100\% & 100\%/100\% & 100\%/100\% & 99\%/100\% & 100\%/100\% & 100\%/100\% & 100\%/100\% \\  & Ours & 100\%/100\% & 100\%/100\% & 100\%/100\% & 100\%/100\% & 100\%/100\% & 100\%/100\% & 100\%/100\% & 100\%/100\% \\ \hline \hline \end{tabular}
\end{table} 
Table 4: The success rate (\(SR_{NC}/SR_{C}\)) of Ours method resisting the attack from surrogate models. Figure 8: Examples of watermarks extracted after surrogate attack, showing cases where the extraction quality is significantly degraded. to [PERSON]'s method [25], the extraction success rate was slightly reduced. Specifically, the UNet_L2_Ladv combination exhibited noticeable declines in extraction performance. In the deraining task, the success rate dropped to 93%, whereas, in the denoising task, it remained at 99%. This difference can be attributed to the varying complexity of the tasks. The denoising task primarily removes random noise while preserving the overall structure, allowing the surrogate attack model to better approximate the original model's transformation, including the embedded watermark. Consequently, the watermarked features are more likely to be retained, facilitating extraction. In contrast, the deraining task involves structured rain streaks and complex transformations, which may inadvertently distort the watermark, reducing the extraction performance after a surrogate attack. To mitigate the decline in extraction performance, data augmentation techniques were introduced during adversarial training. These augmentations simulate various interference scenarios, helping the model better adapt to different attack conditions. As shown in Ours, data augmentation significantly improved the surrogate attack robustness and extraction performance of the model. Notably, the UNet_L2_Ladv combination, which had the most significant drop in Ours\(\dagger\), showed improved extraction performance after augmentation, reaching 99% in deraining and 100% in denoising, closely resembling [PERSON]'s findings [25]. This highlights that data augmentation helps the extractor better adapt to untrained network-loss combinations in surrogate attacks. These results confirm that \(SR_{\text{NC}}\) and \(SR_{\text{C}}\) remain consistently high under different network attacks, with the lowest success rate still reaching 99%. This demonstrates the reliability of the proposed method in maintaining robustness against surrogate attacks. Overall, this showcases the effectiveness of data augmentation in enhancing both the robustness and training efficiency of watermark extraction, particularly in more challenging tasks.