can this model be used for document images

[SunYiLing123]

can this watermark model resist printing and taking photos

[ZJZAC]

Physical attacks are not considered, because the adversary often wants to utilize high-quality data pairs to train his surrogate model for good performance. Nevertheless, physical distortion can be involved in the training stage of the proposed framework, which can be regarded as an extra noise layer.