|
| Improvements | References | Techniques | Attacks | Capacity |
|
| Attacking simulation | Zhu [11] | The first work to simulate attacks by inserting the noise layers | Crop, Gaussian, dropout, and JPEG | 90 bits |
| Mellimi [12] | Simulation of noise layers against agnostic attacks | JPEG, noise, and noise | 1024 bits |
| Ahmadi [13] | Simulation of noise layers to resist mixture attacks | Crop, Gaussian, resize, and JPEG | 1024 bits |
| Chen [14] | Simulation of differentiable JPEG quantization | JPEG | 1024 bits |
| Jia [15] | Combination of simulated and real JPEG in noise layer | JPEG, crop, and Gaussian | 1024 bits |
| Ying [16] | Training a network to simulate JPEG compression | JPEG, scaling, and Gaussian | A whole image |
| Model architecture design | Dhaya [17] | Lightweight CNN scheme | JPEG, Gaussian, and median | 512 bits |
| Fang [18] | U-net architecture | Transparency, JPEG, and crop | 128 bits |
| Cun [19] | Combination of SplitNet and RefineNet | Crop and color | A whole image |
| Mun [20] | Attention mechanism | JPEG, crop, filtering, and noise | 512 bits |
| Yu [21] | Generative adversarial network with attention mask | Noise, crop, and shift | A whole image |
| Hao [22] | Generative adversarial network with a high-pass filter | Crop, Gaussian, and flip | 30 bits |
| Li [23] | Generative adversarial network with perceptual losses | Noise, filtering, and sharpen | 1024 bits |
|
