# Deep Watermarking Based on Swin Transformer for Deep Model Protection
## 4 Results
### Comparison with Existing Works
The main purpose of this approach was to create watermarks that resemble QR codes, enabling us to test the watermark extractor's ability to recover high-frequency data, particularly the boundary regions, after the image has been subjected to attacks. As it has already been demonstrated that HiNet lacks robustness when handling images subjected to surrogate attacks, we limit the comparison in this part to [PERSON]'s method. By observing Figure 10, it can be seen that the black blocks corresponding to each bit are largely extracted accurately. However, the primary issue arises at the boundaries. This result is straightforward to interpret: since the surrogate model primarily learns image  
Figure 9: Comparison of the extraction performance across different watermarking strategies [21; 25] under surrogate attacks with repeated 64-bit binary watermarks. to-image transformations, its focus is on low-frequency components, such as structure or contours. High-frequency components, like the boundaries, are more easily neglected, leading to the less accurate extraction of watermark boundary information compared to other parts of the image. Table 5 provides a quantitative comparison of different watermarking strategies. Peak signal-to-noise ratio (PSNR) and structural similarity index (SSIM) are used to measure the visual quality degradation caused by watermark embedding. The proposed method achieves the highest PSNR in denoising tasks, indicating minimal impact on image quality. The NC value measures watermark extraction performance in the absence of attacks. As mentioned earlier, the only difference between HiDDeN [34] and HiDDeNt [34] is the inclusion of the noise layer. HiDDeN [34] refers to the version trained without a noise layer, while HiDDeN+ [34] includes the noise layer during training. From the table, it can be observed that, without the noise layer, the watermark is easier to extract, making HiDDeN [34] more advantageous in terms of image quality. However, adding the noise layer enhances the extraction capability, meaning that HiDDeN+ [34] provides superior watermark extraction performance, albeit with a slight reduction in image quality. Next, when compared to other methods, all methods, except HiDDeN [34] and HiDDeN+ [34], achieve an NC of 0.9999, signifying nearly lossless watermark extraction. The columns labeled CNet, Res9, Res16, and UNet represent different surrogate attack models trained with L2 loss. The results demonstrate that only [PERSON]'s method [24] and the proposed approach remain robust against such attacks, while other watermarking strategies fail to recover the watermark. It is worth noting that HiNet [21] exhibits lower PSNR and SSIM scores. Further analysis suggests that this is due to the nature of the watermark image. HiNet [21] performs  
Figure 10: Comparison of the extraction performance across different watermarking strategy [25] under surrogate attacks. The embedded watermark consists of a 64-bit binary sequence, where each bit is expanded into a 256 \(\times\) 256 image. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Method** & **PSNR** & **SSIM** & **NC** & **CNet** & **Res9** & **Res16** & **UNet** \\ \hline HiNet [21] & 21.71 & 0.4562 & 0.9999 & 0\% & 0\% & 0\% & 0\% \\ HiDDeN [34] & 39.19 & 0.97 & 0.7182 & 0\% & 0\% & 0\% & 0\% \\ HiDDeN+ [34] & 37.81 & 0.96 & 0.9109 & 0\% & 0\% & 0\% & 0\% \\ Zhang [25] & 39.74 & 0.99 & 0.9999 & 99\% & 99\% & 100\% & 99\% \\ Ours & 53.23 & 0.99 & 0.9999 & 100\% & 100\% & 100\% & 100\% \\ \hline \hline \end{tabular}
\end{table} 
Table 5: The comparison of image quality and watermark extraction performance of different watermarking strategies under surrogate model attacks. better with natural images, as their structure and frequency characteristics align with those of the host image. However, the binary watermark used in this study consists of high-frequency noise, which affects HiNet's [21] embedding performance.