# Deep Watermarking Based on Swin Transformer for Deep Model Protection
## 3 Materials and Methods
### Data Augmentation for Adversarial Training Stage  
In the design of the adversarial training strategy, this study first draws on [PERSON] et al.'s methods [25], using UNet_L2 as a surrogate model to simulate attacks by generating attacked watermarked images for training the extractor. However, after replacing the embedding network with Swin-UNet, although the visual quality of the watermarked image improved, the method experienced a significant drop in extraction robustness when subjected to surrogate attacks with specific loss combinations (e.g., L2 + Ladv). The lowest extraction success rate dropped to 93%, which is notably lower than the 99% success rate of [PERSON]'s approach [25]. This phenomenon can be attributed to the visual quality optimization process driven by the Ladv loss, where the discriminator tends to suppress watermark features, treating them as secondary information, thus leading to insufficient embedding strength.  
To enhance the system's robustness against surrogate attacks, this study applies a data augmentation strategy. Compared to directly increasing the embedding strength or adjusting the loss function, data augmentation enables the extractor to adapt to a variety of potential attack methods without compromising visual quality. This approach is particularly beneficial in real-world scenarios, where different surrogate models may introduce various damage patterns.  
Initial attempts to apply augmentation in the initial training stage, where both the embedding network and the extractor are trained together, showed that it forced the embedding network to excessively reinforce watermark features in response to interference, significantly increasing the watermark visibility and compromising the visual quality. Therefore, the final strategy limits augmentation to the adversarial training stage, applying interference simulation training only to the attacked watermarked images to enhance the extractor's robustness without compromising visual quality.  
The augmentation methods include five basic disturbance modes: Gaussian blur to simulate image detail loss; Gaussian noise to simulate training error accumulation; JPEGcompression to simulate lossy storage effects; random occlusion to simulate partial information loss; and color distortion to simulate data distribution shifts. These augmentation methods effectively simulate the noise that different surrogate models may introduce during training, improving the extractor's ability to adapt to surrogate attacks.  
Furthermore, this study introduces a probability-triggered augmentation mechanism, where each type of augmentation is assigned an independent Usage Probability. During training, for each incoming image, each augmentation independently determines whether to be applied based on its assigned probability. This ensures that different samples undergo varying combinations of augmentations, creating a more diverse training set. By exposing the extractor to a wide range of watermark degradations, this approach improves its generalization ability against various attack scenarios. Experimental results demonstrate that the probability-triggered mechanism, which better reflects real-world conditions, effectively reduces extraction loss and improves the extraction success rate compared to a non-probability-triggered approach.