Embedding Guided End-to-End Framework for Robust Image Watermarking

Table 5

Comparison of robustness against different types of attacks.

Attacks	Algorithms	Encoded image		Extracted watermark
		PSNR	SSIM	Logo		MNIST		ImageNet
				PSNR	SSIM	PSNR	SSIM	PSNR	SSIM
Gaussian blur (ω = 9)	Luo [39]	33.79	0.9213	31.49	0.9109	32.76	0.9267	30.38	0.9015
	Ding [40]	32.56	0.9146	30.24	0.8937	31.95	0.9086	28.89	0.8812
	Baluja [41]	34.24	0.9322	32.62	0.9148	33.97	0.9275	31.04	0.9068
	Ours	41.11	0.9751	36.24	0.9641	37.87	0.9753	34.92	0.9549
JPEG compression (QF = 60)	Luo [39]	33.08	0.9225	30.37	0.9021	31.43	0.9078	29.12	0.8994
	Ding [40]	32.67	0.9114	29.73	0.8864	30.82	0.9026	28.23	0.8801
	Baluja [41]	34.49	0.9511	31.39	0.9115	32.74	0.9248	30.59	0.9082
	Ours	38.35	0.9657	34.17	0.9512	35.86	0.9573	33.11	0.9448
Crop (p = 0.4)	Luo [39]	32.93	0.9325	31.37	0.9121	32.66	0.9264	30.25	0.9027
	Ding [40]	32.20	0.9007	30.88	0.8964	32.05	0.9128	30.08	0.8901
	Baluja [41]	34.36	0.9461	32.59	0.9323	33.74	0.9456	31.23	0.9119
	Ours	39.45	0.9727	37.06	0.9605	38.85	0.9773	36.39	0.9597
Dropout (p = 0.45)	Luo [39]	34.16	0.9321	32.45	0.9409	33.76	0.9487	31.07	0.9339
	Ding [40]	32.64	0.9145	30.36	0.9047	31.83	0.9102	29.99	0.8995
	Baluja [41]	33.97	0.9343	32.82	0.9222	33.75	0.9298	32.01	0.9186
	Ours	39.18	0.9710	35.64	0.9586	36.83	0.9642	34.75	0.9503
Combined	Luo [39]	32.17	0.9189	30.01	0.8832	30.95	0.9045	28.67	0.8974
	Ding [40]	31.01	0.9013	28.47	0.8813	31.08	0.8942	27.84	0.8757
	Baluja [41]	33.12	0.9387	30.96	0.9102	31.89	0.9211	30.22	0.9032
	Ours	37.64	0.9724	34.11	0.9505	35.79	0.9568	34.68	0.9501