## 2 Background and Related Work
### Digital Watermarking for Data Authentication  
As a well-established research area, digital watermarking continues to attract significant interest from both academia and industry. Digital watermarking offers practical copyright protection, source tracking, and data integrity verification applications. By embedding imperceptible information within digital content, digital watermarking is widely recognized as a reliable technique for enhancing data security, including forensics, content identification, and copyright protection [5]. Traditional digital watermarking methods can be categorized into spatial-domain and frequency-domain techniques. The spatial-domain techniques involve directly modifying the pixel values of the host image. One common approach is using Least Significant Bit (LSB) replacement algorithms to embed binary strings of watermarks. The frequency-domain techniques embed the watermark in the frequency coefficients of the host image, obtained through transformations such as Discrete Cosine Transform (DCT) [16], Discrete Wavelet Transform (DWT) [17], and Discrete Fourier Transform (DFT) [18]. However, these works normally demand extensive prior experience and involve complex operations, including preprocessing and postprocessing. In recent years, deep learning has made remarkable strides in computer vision tasks, such as image classification and segmentation, due to its powerful ability to represent complex patterns [19; 20; 21]. Unlike traditional machine learning models, deep learning models can automatically extract more intricate features from images and offer improved generalization across a wide range of scenarios by training on large-scale datasets. Existing deep network models for digital watermarking are generally classified into two main types: convolutional neural networks (CNNs) and generative adversarial networks(GANs) [22]. By extending the frequency domain commonly utilized in traditional watermarking methods, a robust image watermarking model based on CNNs incorporated an architecture consisting of the spatial spread encoder and decoder to enhance watermark resilience and robustness given particular attacks in comparison [23]. As a deep end-to-end diffusion watermarking framework, ReDMark can learn watermarking models in any desired transform domain [7]. ReDMark consists of two fully convolutional networks with a residual structure, simulating various attacks through a differentiable network layer, enabling end-to-end training. Compared to CNN-based models, GANs offer an alternative approach to deep learning on images. A GAN comprises a generator and a discriminator that performs training cycles in an adversarial process [24]. This adversarial dynamic makes GANs inherently well-suited for robust image watermarking, balancing capacity, invisibility, and resilience. In recent years, several GAN-based image watermarking models have emerged. Notably, a pioneered model called HiDDeN [8] leverages the adversarial interplay between the generator and the discriminator to achieve robust digital watermarking. HiDDeN adopts an encoder-noise-decoder architecture, wherein the encoder generates an imperceptible encoded image, and the decoder effectively retrieves the original watermark. To reduce the local bits per pixel capacity and increase robustness, a Robust spatial-spread deep neural image watermarking model is proposed by integrating adversarial training and noise layers between the encoder and the decoder [25]. By using GAN training cycles, ABDH, an attention-based data hiding framework, is proposed to robustly hide data in cover images or videos in an end-to-end manner [26]. ABDH introduced an attention module to generate the attention mask, which can identify inconspicuous areas for embedding the watermark. Therefore, this attention mask can generate a better target image without perturbation of the spotlight. The aforementioned deep learning-based models for watermarking focus on image feature extraction for robustness. However, they are insufficient and vulnerable to image noise attacks.