Closed SunYiLing123 closed 2 years ago
Physical attacks are not considered, because the adversary often wants to utilize high-quality data pairs to train his surrogate model for good performance. Nevertheless, physical distortion can be involved in the training stage of the proposed framework, which can be regarded as an extra noise layer.
can this watermark model resist printing and taking photos