# An Audio Watermarking Algorithm Based on Adversarial Perturbation +
## 4 Experiments and Discussion
### Comparison with Existing Works  
We compare the imperceptibility and robustness of the AAW algorithm with other existing works. Since deep learning-based audio watermarking algorithms are scarce in the literature, we only found the work by [PERSON] et al. [38] and [PERSON] et al. [9]. In this paper, we replace the 2D convolution layers in the network structure of HiDDeN [18], a landmark work for deep learning-based image watermarking, with 1D convolution layers that enable it to be applied to audio watermarking, and we call it HiDDeN-A. The experiments use the FMA-medium dataset to train HiDDeN-A and then compare its performance with that of the AAW algorithm. In addition, we compare the algorithm of [PERSON] et al. [13], which is a traditional audio watermarking algorithm.  
The comparisons are shown in Table 4. The SWR of the AAW algorithm is larger than any of the other compared algorithms, indicating that the introduced perturbation has a very small magnitude. This is facilitated by the larger \(\lambda\) used in the third stage of the optimization for tiny perturbations \(\hat{\delta}\). On the other hand, the AAW algorithm uses fswSNR as a loss, i.e., it is optimized accordingly for the human auditory system. Therefore, the AAW algorithm can be argued to have improved imperceptibility over comparison algorithms, which prevents embedded watermarks from damaging the usage of the audio or from being detected.  
Figure 11: The robustness (BDR) of AAW-CN when embedding watermark into different audio categories.  
Figure 12: The robustness (BDR) of AAW-CL when embedding watermark into different audio categories.  
The robustness of the AAW algorithm also yielded good results. Our algorithm achieved a superior BDR than the comparison algorithms except in the WGN attack. The data embedded in the algorithm of [PERSON] et al. [38] comprise a piece of text which can hardly be extracted accurately after being attacked. This is due to the fact that the algorithm is applied in the field of information hiding; hence, it does not use any robustness enhancement strategy, so its robustness is very poor. The performance of HiddeN-A is worse than that of HiDDeN in the image domain, indicating that additional efforts are needed for directly transferring the image watermarking to audio. [PERSON] et al. [9] converted the audio into 2D features and then used the HiDDeN framework. However, they only modeled the audio recording attack and did not pay enough attention to other attacks, so the robustness against the attacks such as CRP, RVB, and WGN+LPF is worse than that of the AAW algorithm. The AAW algorithm also provides more comprehensive robustness against multiple attacks than traditional algorithms [13].  
We argue that the performance advantage of the AAW algorithm is due to two factors. One is that the whitening layer contributes to robustness, with uncorrelated elements making it easier to embed watermarks into deep features. The other is that the attack simulation layer makes AAW possible to incorporate other differentiable attacks. It allows AAW to deal with a wider range of attacks rather than hand-designing strategies for each attack.