# Deep Watermarking Based on Swin Transformer for Deep Model Protection
## 4 Results  
### Implementation Details  
The dataset consisted of 12,200 images for both deraining and denoising tasks. For deraining, 6100 images were sampled from PASCAL VOC 2012 and paired with synthetic rainy versions using a rain synthesis algorithm, following [PERSON]'s [25] protocol, with 6000 images used for training and 100 for testing.  
To train the surrogate model, 6100 images from COCO 2017 were embedded with watermarks via a pretrained network, generating watermarked images O\({}^{\prime}\). These were used to train a surrogate attack model, which was then applied to the 6100 PASCAL images to produce attacked versions O\({}^{\prime\prime}\). This resulted in two parallel datasets: COCO-derived O\({}^{\prime}\) and PASCAL-derived O\({}^{\prime\prime}\).  
For adversarial training, 6000 samples from each dataset were combined into a 12,000-image training set with a 1:1 ratio, and 100 samples from each formed a 200-image validation set. All images were resized to 256 \(\times\) 256. The denoising task followed the same pipeline, but images were converted to grayscale to evaluate robustness under monochrome input.  
The embedder and extractor were trained jointly for 150 epochs using a batch size of 4, followed by 50 epochs of fine-tuning for the denoising task using transfer learning. The Swin-UNet embedder was set with a depth of 4. Training was conducted using the Adam optimizer. The learning rate was dynamically reduced by a factor of 0.2 if the validation performance did not improve for three consecutive epochs.  
To improve the robustness against surrogate model attacks, we applied targeted data augmentations during training, simulating common distortions introduced by such attacks. These included moderate color jittering (\(\pm\)20% brightness/contrast), Gaussian noise, partial masking, JPEG compression, and Gaussian blur, all with controlled probabilities (see Table 2). These transformations were carefully calibrated to maintain perceptual quality while enhancing model robustness.  
To assess visual quality, we used two common metrics: PSNR and SSIM. PSNR reflects overall image quality, with higher values indicating better results. SSIM measures structural similarity between images, aligning more closely with human perception, where values closer to 1 indicate higher similarity. These metrics compare watermarked images to the originals to evaluate visual impact.  
In addition to evaluating the quality of the watermark, its robustness also needs to be verified. To ensure fairness, we adopted two methods used by [PERSON] [25]: a classifier and normalized correlation (NC). The classifier, implemented as a three-layer convolutional neural network (CNN), is responsible for determining the presence of watermarks in an image. It is trained using binary cross-entropy loss, where the output is a probability value between 0 and 1. A threshold of 0.5 is applied: if the output exceeds 0.5, the image is classified as containing a watermark; otherwise, it is classified as watermark-free. This classifier does not require extracting the watermark itself, and thus its judgment is likely to be more accurate than the normalized classifier (NC), especially in robust attack scenarios. The success rate of the classifier \(SR_{C}\) and the normalized classifier \(SR_{NC}\) are used to evaluate the effectiveness of the watermark detection mechanism.