# Deep Watermarking Based on Swin Transformer for Deep Model Protection
## 4 Results
### Comparison with Existing Works  
The previous sections primarily compared the proposed method with [PERSON]'s approach [25], as it builds upon his framework. This section presents a comprehensive comparison with other watermarking methods, focusing on image quality and robustness against surrogate model attacks, with testing conducted on the denoising task. Four models were selected for comparison. [PERSON]'s HiDDeN [34] is one of the pioneering deep learning-based watermarking methods, designed to embed a predefined number of bits as binary data. It has two versions, differing by the inclusion of a noise layer during training. The noise layer improves watermark extraction fidelity but degrades the image quality. Despite embedding binary data instead of images, HiDDeN [34] serves as a fundamental benchmark for evaluating deep learning-based watermarking strategies. [PERSON]'s HiNet [21] integrates traditional watermarking algorithms with neural networks. It applies discrete wavelet transform (DWT) to convert the image into the frequency domain before performing watermark embedding and extraction via a neural network. Currently, open source watermarking strategies explicitly designed for surrogate attacks are very limited. Although HiNet [21] does not specifically address surrogate attacks, it is trained against other types of attacks. More importantly, it embeds a watermark image of the same size as the host image, making it structurally aligned with our approach and a suitable baseline for comparison. [PERSON]'s method [25] is described in detail in Section 2 and will not be reiterated here. Since HiDDeN [34] is limited to embedding binary data, a 64-bit randomly generated binary sequence was used as the watermark for fair comparison. For models that embed an entire image as a watermark, this binary sequence was repeatedly expanded to form a 256 \(\times\) 256 binary image before embedding. Figure 9 illustrates the watermark extraction performance of different methods under the surrogate attacks applied to the same image. HiDDeN [34] is excluded from the figure since it does not embed an image watermark but instead embeds binary data. Processed refers to the image after denoising, watermarked indicates the processed image with an embedded watermark, and watermark represents the embedded watermark itself. The columns labeled CNet, Res9, Res16, and UNet represent the extraction results after surrogate model attacks. The red box in the extracted watermark from Res16 is enlarged for better visibility. The results indicate that HiNet [21] fails to recover the watermark after an attack. This can be attributed to its frequency-domain-embedding strategy, which does not directly map to spatial domain features. If the surrogate model learns only pixel-level spatial mappings, it may fail to capture the frequency-domain watermark structure, leading to the loss of watermark information during training. In contrast, [PERSON]'s method [25] and the proposed approach embed the watermark in the spatial domain and incorporate noise resilience training to counter surrogate attacks. As a result, both methods can still extract the watermark after attacks, albeit with some minor distortions. The extracted watermarks achieve a normalized correlation (NC) score exceeding 0.95 in most cases, meeting the criteria for successful extraction. Upon observing [PERSON]'s method, it can be seen that the extracted watermark exhibits slight distortions compared to the original watermark after the surrogate attack. However, the distortions in the proposed approach are less noticeable. This is due to the introduction of data augmentation during the extraction training process in the proposed approach, which helps the extractor adapt to more challenging conditions, thereby improving its generalization and robustness in watermark extraction. In addition to using repeated 64-bit binary data as a watermark, we also experimented with enlarging each bit to form a watermark.