# An Audio Watermarking Algorithm Based on Adversarial Perturbation +
## 4 Experiments and Discussion  
### Experimental Settings and Implementation Details  
**Dataset:** The classification network was trained and evaluated in the FMA-medium dataset [60]. The dataset contains 25,000 audio tracks, of which 19,922 belong to the training set, 2505 tracks to the validation set, and 2573 tracks to the test set. The dataset consists of 16 categories; however, the quantities of tracks in each category are unbalanced. The  
Figure 6: Diagram of the AAW algorithm (extraction stage), where PTM, WL, and \(\lessgtr\) denote the pre-trained module, whitening layer, and a binary decision maker, respectively.  
training set and test set was used for training the PTM, and the validation set were used for the watermark embedding experiments. In addition, we also collected 100 speech clips taken from movies' dialog for watermark embedding, containing 60 Chinese and 40 English clips. All tracks are two-channel stereo audio with a sample rate of 44.1 kHz and a duration time of 30 s.  
**Experimental settings:** During watermark embedding, the Adam [61] optimizer with a learning rate of 0.001 was used to solve Equation (16) over 300 iterations. The parameter \(\lambda\) in Equation (15) was set dynamically as mentioned in Section 3.4.3.  
**Transformations for data augmentations and attack simulation layer:** Audio transforms are widely applied to several scenarios of AAW algorithms, including data augmentation during PTM training, the attack simulation layer during watermark embedding, and attack during the evaluation of algorithm performance. The transformations adopted in this paper are shown in Table 1.  
It is noted that the reverberation was simulated by Pyroomacoustics [62] in a 9 m \(\times\) 7.5 m \(\times\) 3.5 m rectangular room. To avoid the difficulty of gradient computation, we used masking with zeros instead of the random crop when training the network and watermark embedding. When evaluating the proposed method, the actual random crop was applied.  
In addition, we also tested the robustness of the AAW to two combinations of transforms, which are the combination of Gaussian white noise with low-pass filter and the pipeline of reverberation-Gaussian noise-band-pass filter, where the band-pass filter was obtained by joining the low-pass and high-pass filters in cascade. The former takes into account the fact that most of the audio attacked by Gaussian noise degrades significantly in quality, and low-pass filter has good denoising ability, so this combination is often used; the latter simulates audio propagating over air and a recording. It is noted that these two combined attacks are not applied to the PTM's training.  
**Metrics:** The imperceptibility of the watermark is evaluated by the signal-to-watermark ratio (SWR), which means the energy ratio of perturbation to audio,  
\[\text{SWR}=-10\log_{10}\frac{\|\phi\|_{2}^{2}}{\|\mathbf{x}\|_{2}^{2}} \tag{18}\]  
The larger the SWR, the better the imperceptibility of the watermark.  
The bit detection rate (BDR) is used to evaluate the robustness of the proposed algorithm,  
\[\text{BDR}=\frac{\#\ of\ bits\ extracted}{\#\ of\ total\ bits}\times 100\% \tag{19}\]  
where the symbol \(\#\) indicates the quantity. A higher BDR indicates that more bits of the watermark were accurately extracted. In the experiments, the quantity of total bits was set to 320 bits unless otherwise specified. This means that the transform parameter \(\mathbf{W}_{wl}\) of the whitening layer has a shape of \(512\times 320\).