## 2 Analysis of Previous Methods
[PERSON] used the same network structure as [PERSON] [10] but incorporated an adaptive attack simulation such that it selects more the attacks for which the network shows weak robustness [14]. The method to consider the weak robustness is to include the extractor loss for the worst-case attack result. However, in a mini-batch, only one kind of attack with different strengths is included. It processes in the spatial domain and uses the FC layer to extract the WM. For WM embedding, it uses an adversarial loss, not only for the steganography layer, for training with using random patterns as the WM data. [PERSON] proposed a two-stage training scheme TSDL, two-stage separable deep learning), in which the entire NN with adversary network is trained without any attack (FEAT, free end-to-end adversary training), at first, then in the next train only the extractor without the adversary network is re-trained (ADOT, noise-aware decoder-only training) by adding the attack simulation [15]. In this scheme, the duplicated binary (here, \(1\), and \(-1\)) to the resolution of the host image is concatenated in each convolution layer in the embedder network except the last two layers performing 3 \(\times\) 3 convolution and 1 \(\times\) 1 convolution, in order. WM extraction network and the adversary network also consist of 1 \(\times\) 1 and 3 \(\times\) 3 convolution layers. The final layer of the extractor network consists of a FC layer after average pooing and ReLU activation. The loss function for the embedder network and the extractor network are MSE (mean square error) loos, but the adversary network uses an adversarial loss. For each of the two training processes, the appropriate combinations of the loss functions are used by multiplying scaling factors determined empirically. In training, it included only one kind of attack that is included in a mini-batch. It also used specific kinds and strengths of attacks in training and showed the test results for only the kinds and strengths of attacks used in training. Most of the methods are blind schemes [10; 11; 12; 13; 14; 15], use spatial domain data [9; 10; 11; 12; 13; 14; 15], and target a specific resolution of host images and WM information [9; 10; 11; 12; 13; 14; 15]. Through analysis of previous studies that performed watermarking using deep learning, we drew three as follows. * When a specific WM is used for training, additional training is essential whenever one wants to use a new WM [9; 10; 12]. * Using FC layer(s) restricts the applicable resolution of the host images [10; 14; 15]. These methods cannot guarantee their usefulness in general applications with other host image resolution. * Some methods did not realize the controllability of the tradeoff relationship between invisibility and robustness [9; 10; 13; 14]. Because they cannot provide options for the user's preference, their practicality may be restricted. Therefore, for the three problems we have raised, we propose a new neural network structure with three goals, which are resolution adaptability of host images, content adaptability of watermark, and controllability of invisibility and robustness, for deep learning as follows. * Resolution adaptability of host image: Deep learning network capable of embedding watermarks in host images of all resolutions. * Content adaptability of watermark: Deep learning network that can change the content of the watermark to be inserted without re-training. * Controllability of invisibility and robustness: Deep learning network with controllable visual visibility and watermarking intensity. Accordingly, we propose a blind, invisible, and robust watermarking NN that adapts to the resolution of the host image and WM information. This method uses spatial domain data and consists