# Deep Watermarking Based on Swin Transformer for Deep Model Protection
###### Abstract
[PERSON] [22] adopts a similar invertible neural network framework, extending it to multiple watermarks by analyzing inter-watermark relationships to optimize embedding locations and prevent excessive intensity in any single area. [PERSON] [23] designs an end-to-end trainable neural network architecture that embeds and extracts digital watermarks directly in the pixel space, using adversarial training to enhance robustness against geometric transformations and image distortions. [PERSON]'s [24] method follows a similar idea to [PERSON]'s [23], using convolutional neural networks (CNNs) to embed and extract watermarks directly in the pixel space. However, [PERSON] further integrates the watermark embedding process into the primary image processing task, making it more seamless. Additionally, a key-based mechanism is introduced in the extractor to conceal the presence of the watermark, reducing the risk of unauthorized detection and removal. Compared to traditional methods, deep learning models show greater potential for watermark embedding capacity and robustness. Despite the advancements in deep learning watermarking strategies, many existing methods rely on custom-designed neural networks for embedding and extraction. In contrast, [PERSON]'s method [25] adopts a more generalizable approach by leveraging UNet, a well-established architecture for image segmentation, to achieve effective watermark embedding with minimal degradation to visual quality. Additionally, [PERSON]'s [25] method incorporates noise augmentation during the training of the extractor, improving its robustness against surrogate attacks. This combination of high-quality image preservation and improved resistance to surrogate attacks makes [PERSON]'s [25] method a solid foundation for watermarking tasks. However, while [PERSON]'s [25] method achieves impressive performance, CNN architectures are inherently limited in capturing long-range dependencies due to their localized receptive fields. This shortcoming can compromise the invisibility of embedded watermarks and degrade overall visual quality, as critical global information may be lost during feature extraction. To overcome this limitation, we introduce the Swin Transformer into our framework. The Swin Transformer utilizes a hierarchical structure and shifted window-based self-attention, enabling it to model both local and global relationships more effectively. It has demonstrated strong performance in various vision tasks. For example, in iNatAg [26], it is used for the large-scale image classification of over 2900 crop and weed species. Similarly, in medical image segmentation, such as retinal vessel delineation [27], it achieves pixel-level precision in distinguishing microvascular and macrovascular structures. These applications highlight the Swin Transformer's capability to maintain fine-grained detail while capturing global context, making it particularly suitable for complex image tasks. Building on this, we adopt Swin-UNet as our watermark embedding backbone. This architecture integrates Swin Transformer blocks into the encoder-decoder framework of UNet, which is well suited for image-to-image translation tasks requiring consistent input-output resolution. The Swin-UNet reconnects spatially fragmented patches, effectively overcoming the locality constraints of CNNs. This not only reduces the information loss during processing, but also enhances visual fidelity, resulting in a more seamless and imperceptible watermark embedding. Although replacing the original CNN-based UNet with Swin-UNet initially resulted in decreased robustness against surrogate models, this was because adversaries could use different architectures or objective functions to approximate the original model. To address this issue, we employed extensive training with data augmentation, which significantly improved the model's robustness and extraction success rate under various adversarial conditions.