# Deep Watermarking Based on Swin Transformer for Deep Model Protection
###### Abstract  
This study improves existing protection strategies for image processing models by embedding invisible watermarks into model outputs to verify the sources of images. Most current methods rely on CNN-based architectures, which are limited by their local perception capabilities and struggle to effectively capture global information. To address this, we introduce the Swin-UNet, originally designed for medical image segmentation tasks, into the watermark embedding process. The Swin Transformer's ability to capture global information enhances the visual quality of the embedded image compared to CNN-based approaches. To defend against surrogate attacks, data augmentation techniques are incorporated into the training process, enhancing the watermark extractor's robustness specifically against surrogate attacks. Experimental results show that the proposed watermarking approach reduces the impact of watermark embedding on visual quality. On a deraining task with color images, the average PSNR reaches 45.85 dB, while on a denoising task with grayscale images, the average PSNR reaches 56.60 dB. Additionally, watermarks extracted from surrogate attacks closely match those from the original framework, with an accuracy of 99% to 100%. These results confirm the Swin Transformer's effectiveness in preserving visual quality. w +
Footnote †: journal: Applied Sciences  
e1  
To address the aforementioned issues, various model copyright protection strategies have been proposed, such as weight matching [9], trigger-based watermarking [10], and visible watermarking [11]. Weight matching compares model parameters to identify ownership, while trigger-based watermarking embeds specific triggers into the model to verify its source. These methods are primarily designed for deep learning classification tasks, where the model analyzes input data and outputs a corresponding category. However, they can still be applied to other deep learning tasks, such as image processing. Due to the nature of image output, however, these methods can significantly degrade the resulting visual quality. For image processing models, visible watermarking is a more common approach, involving embedding logo information directly into output images. However, this method clearly impacts visual quality, making it unsuitable for applications that require high-quality results. As a result, researchers have begun exploring alternative methods to balance copyright protection with visual quality [12], particularly in image processing tasks like denoising [13], super-resolution [14], and style transfer [15]. Traditional copyright protection methods for images often involve digital watermarking, which embeds imperceptible watermark information, such as a logo or the author's name, within the image to achieve copyright protection. Common traditional watermarking techniques include discrete cosine transform (DCT) [16] and discrete wavelet transform (DWT) [17]. DCT embeds watermarks by transforming image data into the frequency domain, while DWT decomposes the image into sub-bands at different scales and orientations. These methods use spatial transformation techniques to achieve the high invisibility of the watermark and can withstand certain types of attacks on the image. However, the watermark capacity in these methods is limited, as the amount of information that can be embedded usually depends on the size of the original image. Moreover, these methods primarily protect the image itself rather than the model. To overcome limitations related to watermark capacity and robustness, researchers have started applying digital watermarking technology to safeguard the copyright of deep learning models [18; 19]. [PERSON] [20] introduced the trigger-based watermarking method mentioned earlier into image processing tasks, generating a watermark output based on a predefined input. [PERSON] [21] proposes an invertible neural network that embeds watermarks in the wavelet domain, leveraging neural networks for both embedding and extraction.