# Deep Watermarking Based on Swin Transformer for Deep Model Protection
## 4 Results
### Robustness Against Surrogate Attacks  
As mentioned earlier, while the quality of the images is indeed very important, it is equally crucial to ensure that the model effectively protects the watermarks. This section focuses on the robustness of the watermark. Referring to the surrogate model attacks discussed in the first chapter, an adversary can use their own dataset to generate input-output pairs by accessing the original image processing model through an API. They can then use these generated pairs to train their own model. To simulate these scenarios, this study selected several commonly used models in image processing, including CNet, ResNet, and UNet. Various combinations of loss functions, such as L1, L2, perceptual, and adversarial, were also tested to closely mimic the behavior of the adversary. As shown in Figures 6 and 7, the performance of watermark extraction using different surrogate models and loss function combinations is presented. The first image represents the original image I, a rainy image, where the extracted watermark appears as a blank image. This is because the original image I itself does not contain any embedded watermark. The second image corresponds to the watermarked image O\({}^{\prime}\), where the watermark is perfectly extracted in the absence of additional noise. Subsequent images depict the extraction results after surrogate attacks using different networks, which are employed to evaluate the robustness of the proposed watermark extraction method. Due to limited computational resources, not all model and loss function combinations were tested. Specifically, CNet, ResNet9, and ResNet16 were evaluated using only the L2 loss to establish a consistent baseline for comparison. This ensures that variations in extraction performance are attributed to the differences in network architectures rather than the influence of different loss functions. In contrast, UNet was tested with multiple loss combinations because different loss functions introduce varying levels of noise, helping to demonstrate the robustness of the watermark extraction process. The results demonstrate that, although noise introduced by the surrogate models affected the extraction process, the overall contours of the watermark were successfully extracted, allowing the presence of the watermark to be clearly identified. Figure 6 illustrates the watermark extraction performance on the deraining task under attacks from surrogate models. For each pair from (a) to (j), the watermarked image (left) is juxtaposed with its extracted watermark (right): (a) represents the original image without an embedded watermark, resulting in a blank image when extraction is performed; (b) illustrates the watermark extraction performance in the absence of attacks, showing that the watermark can be extracted with minimal distortion; (c)-(j) showcase the extraction results after applying surrogate attacks, where different network architectures and loss function configurations are used. These variations lead to subtle differences in the extracted watermarks, resulting in varying degrees of degradation in quality. For instance, in case (c),  
the watermark extracted by the model trained under the CNet attack exhibits noticeable blurring artifacts on the leaf regions. Similarly, in (g), UNet with L2 + Ladv loss also produces a blurry watermark on the leaves, but the blurriness is less pronounced compared to (c). Other combinations, however, yield extracted watermarks on the leaves that are much closer to the original image in quality. While the presence of noise causes some loss of watermark details, the overall contours of the watermark are still accurately extracted. The extracted NC values across all tested combinations remain consistently high, ranging from 0.96 to 0.99, indicating a near-perfect extraction success rate. Since NC values above 0.95 are considered successful extractions, the \(SR_{NC}\) can be regarded as 100%.