# Image Watermarking between Conventional and Learning-Based Techniques: A Literature Review
## 5 Deep Learning-Based Image Watermarking Schemes
### End-to-End Learning-Based Watermarking Techniques
The performance was improved during model training, including the embedding process, attacks, and extraction. Experiments show robustness against common signal/image operations, such as noise, JPEG compression, Gaussian filtering, and affine transformation. However, the proposed framework provides a uniform local embedding as the traditional methods. In [133], an end-to-end deep learning network has been used to create a robust and secure image watermarking scheme. Within the transform domain, the embedding layers calculate the watermarking mask/pattern. Then, the residual mask is computed in the spatial domain via the inverse transform to be added to the host image with the weight of a strength factor. The following loss function is used for network end-to-end training:  
\[L=\gamma L_{1}+(1-\gamma)L_{2} \tag{19}\]  
where \(\gamma\) is the loss ratio, and \(L_{1}\) and \(L_{2}\) are the embedding and extraction networks' loss functions, respectively. \(L_{1}\) represents the imperceptibility of the watermarked image, expressed by the SSIM metric, while \(L_{2}\) reflects the watermark extraction rate and robustness using the binary cross-entropy. In the experimental tests, various simulation attacks are employed as part of the network to govern resistance to specific attacks. The extraction network consists of a copy of the transform layer used in the embedding phase to represent the watermark image in the transform domain, and then other layers learn to extract the watermark. The framework maintains the trade-off between robustness and imperceptibility by adjusting the training and testing parameters of the network. Although the model performs well against known attacks included in the training phase, it may suffer from poor robustness against unknown attacks. On the other hand, [PERSON] et al. [134] presented a convolutional neural network-based template architecture for recovering watermark synchronization. The block-based watermark is concealed in the image blocks through the watermark-embedder network. Then, the template generation network produces a noisy template to be added to the image. The extraction network finds spatial locations where the template is inserted in the image. The resulting resized and original watermarks are input to the template-matching network to estimate the RST parameters, which are used to further recover the image with geometric distortions as a step for image synchronization. Finally, the watermark decoder is adopted to extract the watermark based on the block size and the position information used in the embedding step. The proposed scheme exhibits good resistance to strong geometric and simultaneous attacks. However, the processing complexity of the template-matching network increases as robustness improves. In this approach, only half of the image blocks are used to insert information bits; therefore, processing large-scale images may be a weakness. Similar to the zero watermarking schemes, the proposed network in [135] consists of two stages: the master share generation and image verification, and it learns to recognize two classes: image target and no-image target. The CNN architecture consists of 13 convolutional layers and 2 fully connected layers. First, the inherent image features are extracted through these convolutional layers, and the fully connected layers are used to encode these image features and generate robust ones. These features are then converted into binary data and the secret key is used to permute the watermark pattern. After that, the master share is generated by the XOR operation between the binary data and the permuted binary watermark. Using the same secret key, the watermark pattern is obtained from the extracted permuted watermark pattern retrieved in the same manner as in the sharing phase. From experiments, the proposed scheme is robust against common image-processing attacks, such as JPEG compression and filtering. However, it is still weak to synchronization attacks in terms of robustness and imperceptibility.