# A Brief, In-Depth Survey of Deep Learning-Based Image Watermarking
## 3 Comprehensive Survey of Deep Learning-Based Image Watermarking
### Embedder-Extractor Joint Training Methods
The authors aimed to integrate the embedder-extractor paradigm to streamline and unify the processes of image steganography and watermarking. Several innovative and practical designs are incorporated in HiDDeN. The embedder replicates the watermark, and its integration with the cover image occurs at the embedder's final layer to maintain the visual quality. Discriminator networks are deployed to determine the presence of watermarks in images, thereby ensuring that the embedder generates visually coherent marked images. Robustness is bolstered in HiDDeN through the introduction of a noise layer that incorporates noise-inducing operations, including dropout, Gaussian blur, and JPEG compression during the training phase. To navigate the challenges posed by the non-differentiability of the original JPEG incorporated within the noise layer, HiDDeN introduces a differentiable JPEG variant, ensuring the continuity of the gradient flow. Beyond HiDDeN, [PERSON] et al. [28] introduced universal deep hiding (UDH), another seminal work rooted in the joint embedder-extractor paradigm, applicable to both image watermarking and steganography. UDH is distinguished as one of the pioneering works to embed entire images as watermarks within embedder-decoder frameworks. It introduces an approach to watermark encoding that facilitates disentanglement during the extraction process. In this methodology, the encoded watermark is generated independently of the cover image and subsequently integrated, ensuring a systematic and efficient extraction process while preserving the integrity of the cover image. A potential challenge associated with joint training for robust image watermarking stems from the necessity of the noise layer being differentiable to facilitate gradient flow. In addressing this issue, [PERSON] et al. [29] proposed a two-stage training methodology. In the initial phase, both the embedder and extractor are collaboratively trained without any noise intervention, ensuring a seamless and undisturbed gradient flow. In the second stage, the embedder's parameters are fixed, rendering it non-adaptable to further training iterations. The focus is then channeled exclusively toward the training of the extractor. This bifurcated training approach allows the integration of non-differentiable noise layers into the extractor's training without compromising the effectiveness of the whole training process. This paper has tested its robustness against a spectrum of prevalent attacks, such as resizing, salt and pepper noise, dropout, crop-out, Gaussian blur, and JPEG compression. Numerous endeavors aim to circumvent the challenge posed by the non-differentiable nature of the JPEG operation within the noise layer. [PERSON] et al. [30] proposed the employment of simulation networks to emulate JPEG lossy compression, accommodating various quality factors. The model employs the max-pooling layer, convolution layer, and a noise mask to, respectively, represent the sampling, DCT, and quantization processes inherent in JPEG compression. In a related vein, [PERSON] et al. [31] advocated for the incorporation of batches that amalgamate both actual and simulated JPEG compressions. Within the training's noise layer, each batch is configured to randomly incorporate either an actual JPEG compression layer, a differentiable simulation of a JPEG layer, or a layer without noise. In scenarios employing momentum-based optimization strategies, there is no strict requirement for the joint training of the embedder and extractor. However, the embedder is still tailored to generate high-quality images robust to JPEG compression, while the extractor is engineered to retrieve features post-JPEG noise. Moreover, [PERSON] et al. [32] introduced a pseudo-differentiable methodology, designed to accommodate JPEG compression as a specialized noise variant. This approach features distinctive forward and backward paths during the training process.