FAWA: Fast Adversarial Watermark Attack on Optical Character Recognition (OCR) Systems

Deep neural networks (DNNs) significantly improved the accuracy of optical character recognition (OCR) and inspired many important applications. Unfortunately, OCRs also inherit the vulnerabilities of DNNs under adversarial examples. Different from colorful vanilla images, text images usually have clear backgrounds. Adversarial examples generated by most existing adversarial attacks are unnatural and pollute the background severely. To address this issue, we propose the Fast Adversarial Watermark Attack (FAWA) against sequence-based OCR models in the white-box manner. By disguising the perturbations as watermarks, we can make the resulting adversarial images appear natural to human eyes and achieve a perfect attack success rate. FAWA works with either gradient-based or optimization-based perturbation generation. In both letter-level and word-level attacks, our experiments show that in addition to natural appearance, FAWA achieves a 100% attack success rate with 60% less perturbations and 78% fewer iterations on average. In addition, we further extend FAWA to support full-color watermarks, other languages, and even the OCR accuracy-enhancing mechanism.


Introduction
Optical Character Recognition (OCR) has been an important component in text processing applications, such as license-plate recognition, street sign recognition and financial data analysis. Deep neural networks (DNNs) significantly improve OCR's performance. Unfortunately, OCR inherits all counter-intuitive security problems of DNNs. OCR models are also vulnerable to adversarial examples, which are crafted by making human-imperceptible perturbations on original images to mislead the models. The wide application of OCR provides incentives for adversaries to attack OCR models, thus damaging downstream applications, resulting in fake ID information, incorrect metrics readings and financial data.
Prior works have shown that we can change the prediction of DNNs in image classification tasks only by applying carefully-designed perturbations [8,19,20,22], or adding a small patch [3,13] to original images. But these methods are not directly applicable to OCR attacks. 1) Most text images are on white backgrounds. Perturbations added by existing methods appear too evident for human eyes to hide, and pollute clean backgrounds. 2) Instead of classifying characters individually, modern OCR models are segmentation-free, inputting entire variable-sized image and outputting a sequence of labels. It is called the sequential labeling task [9]. Since modern OCR models use the CNN [15] and the LSTM [12] as feature extractors, the internal feature representation also relies on contexts (i.e., nearby characters). Therefore, besides perturbing the target character, we also need to perturb its context, resulting in more perturbations. 3) Since text images are usually dense, there is no open space to add a patch.
In this paper, we propose a new attack method, Fast Adversarial Watermark Attack (FAWA), against modern OCR models. Watermarks are images or patterns commonly used in documents as backgrounds to identify things, such as marking a document proprietary, urgent, or merely for decoration. Human readers are so used to the watermark that they naturally ignore it. We generate natural watermark-style adversarial perturbations in text images. Such images appear natural to human eyes but misguide OCR models. Watermark perturbations are similar to patch-based attacks [3,13] where perturbations are confined to a region. Different from patches occupying a separate region, watermarks overlay on texts but not hinder the text readability. Laplace attack [10] and HAAM [11] try to generate seemingly smooth perturbations, which work well on colored photos. However, they do not solve the problem of background pollution.
FAWA is a white-box and targeted attack. We assume adversaries have perfect knowledge of the DNN architecture and parameters (white-box model) and generate specific recognition results (targeted). There are three steps in the perturbation generation. 1) We find a good position over the target character to add an initial watermark. 2) We generate perturbations inside the watermark. 3) Optionally, we convert the gray watermark into a colored one. To generate perturbations, we leverage either gradient-based or optimization-based methods. We evaluate FAWA on a state-of-the-art open-source OCR model, Calamari-OCR [26] for English texts with five fonts. FAWA generates adversarial images with 60% less perturbations and 78% fewer iterations than existing methods, while maintaining a 100% attack success rate. Our adversarial images also look quite similar to natural watermarked images. We evaluate the effects of colored watermarks and other languages under real-world application settings. Last, we propose a positive application of the FAWA, i.e., using the perturbations to enhance the accuracy of OCR models. The contributions of this paper include: 1. We propose an attack method, FAWA, of hiding adversarial perturbations in watermarks from human eyes. We implemented FAWA as the efficient adversarial attacks against the DNN-based OCR in sequential labeling tasks; 2. Extensive experiments show that FAWA performs targeted attacks perfectly, and generate natural watermarked images with imperceptible perturbations; 3. We demonstrate several applications of FAWA, such as colored watermarks as an attack mechanism, using FAWA as an accuracy-enhancing mechanism.

Background and Related Work
Optical Character Recognition (OCR). We can roughly categorize existing OCR models into character-based models and end-to-end models. Characterbased recognition models segment the image into character images first, before passing them into the recognition engine. Obviously, the OCR performance heavily relies on the character segmentation. End-to-end recognition models apply an unsegmented recognition engine, which recognizes the entire sequence of characters in a variable-sized image. [1,7] adopt sequential models such as Markov models and [2,24] utilize DNNs as feature extractors for sequential recognition.
[9] introduces a segmentation-free approach, connectionist temporal classification (CTC), which provides a sort of loss function of enabling us to recognize variable-length sequences without explicit segmentation while training DNN models. Thus, many state-of-the-art OCR models use CTC as the loss function.
Attacking DNN-based Computer Vision Models. Attacking DNN-based models is a popular topic in both computer vision and security fields. Existing attack methods use the following two ways to generate perturbations. 1) Making perturbations small enough for evading human perception. For example, many projects aim at generating minor L p -norm perturbations for the purpose of making them visually imperceptible. FGSM [8], L-BFGS [22], DeepFool [18], C&W L 2 /L ∞ [4], PGD [17] and EAD [5], all perform modifications at the pixel level by a small amount bounded by . 2) Making perturbations in a small region of an image. For example, JSMA [20], C&W L 0 [4], Adversarial Patch [3] and LaVAN [13], all perturb a small region of pixels in an image, but their perturbations are not limited by at the pixel level. Though FAWA is similar to patches, in the text images, watermarks overlay on the text instead of covering the text.
Generating minimal adversarial perturbations. FAWA generates adversarial perturbations using the either gradient-based or optimization-based methods. Gradient-based methods add perturbations generated from gradient against input pixels. FGSM [8] is a L ∞ -norm one-step attack. It is efficient but only provides a coarse approximation of the optimal perturbations. BIM [16] takes multiple smaller steps and the resulting image is clipped by the same bound . Thus BIM produces superior results to FGSM. MI-FGSM [6] extends BIM with momentum. MI-FGSM can not only stabilize update directions but also escape from poor local maxima during iterations, and thus generates more transferable adversarial examples. Considering the efficiency, we adopt MI-FGSM in FAWA.
Optimization-based methods directly solve the box-constrained optimization problem to minimize the L p -norm distance between the original and adversarial image, while yielding the targeted result. Box-constraint L-BFGS [22] seeks adversarial examples with L-BFGS. Though L-BFGS constructs subtle perturbations, it is inefficient. Instead of applying cross-entropy as loss function, C&W L 2 attack [4] constructs a new loss function and solves it with gradient descent. OCR attack [21] is the only available work of attacking sequence-based OCRs as far as we know, which generates adversarial examples using the CTC loss for sequential labeling tasks. In FAWA, we use the same setting as OCR attack.
Perturbations with other optimization goals. Besides minimizing the perturbation level, many works make efforts to produce smooth and natural perturbations. Laplace attack [10] smooths perturbations relying on Laplacian smoothing. HAAM [11] creates edge-free perturbations using harmonic functions for disguising natural shadows or lighting. However, the smoothing and disguising are for photos but not for text images. Instead of manipulating pixel values directly, [27] produces perceptually realistic perturbations with spatial transformation. Though avoiding background pollution, it cannot guarantee the readability of text when the attack needs large deformation. [23] also utilizes the watermark idea but performs attacks only by scaling and rotating plain watermarks. Without adding pixel-level perturbations, it does not offer a high attack success rate.

Fast Adversarial Watermark Attack
In this section, we introduce fast adversarial watermark attacks (FAWA). FAWA consists of three steps. 1) We automatically determine a good position to add the initial watermark in the text image so that we can confine the perturbation generation to that region. 2) We generate the watermark-style perturbations with either the gradient-based method or optimization-based method. 3) Optionally, we convert gray watermarks into full-color ones to improve the text readability.

Preliminaries
Problem definition of adversarial image generation. Given a text image x = [x 1 , x 2 , ..., x n ] T for any x i ∈ [0, 1], where n is the number of pixels in the image, our goal is to generate an adversarial example x with minimum L p -norm perturbations x −x p against the white-box model f with intent to trick model f into outputting the targeted result t, f (x ) = t. Formally, the problem of adversarial image generation is min x x − x p s.t. f (x ) = t and x ∈ [0, 1] n . Also, we define the CTC loss function with respect to the image x as CTC (x, t) and the target labels t = [t 1 , t 2 , ..., t N ] for t i ∈ T , where T is the character set.
Saliency map. The saliency map [20] is a versatile tool that not only provides us valuable information to cause the targeted misclassification in the threat model but also assists us in intuitively explaining some attack behaviors as a visualization tool. The saliency map indicates the output sensitivity, relevant to the adversarial targets, to the input features. In the saliency map, a larger value indicates a higher likelihood of fooling the model f to output the target t instead of the ground-truth f (x). We can construct a saliency map of an image using the forward derivative with respect to each input component in the text image.
L p -norms. L p -norms are commonly-used metrics to measure the perceptual similarity between the clean image x and the adversarial image x , denoted by In gradient-based methods, we apply L p -norms to prune the saliency map for generating L p -norm perturbations. In optimization-based methods, L p -norms are usually as an optimization term in the objective function. Particularly, L 2 -norm is greatly useful to enhance the visual quality. L ∞ -norm is to measure the maximum variation of perturbations.

Finding the Position of Watermarks
To automatically determine a good position of watermarks, as shown in Fig. 1, we perform the following steps. 1) We produce adversarial perturbations of the basic attack (i.e., Grad-Basic or Opt-Basic in Section 3.3) in the text image. 2) We binarize such adversarial image, and get its perturbed regions r = [r 1 , r 2 , ..., r n ] T , where r i = 1 if x i = x i and 0 otherwise. 3) In order to find relatively complete perturbed regions r , we apply a combination of erosion ⊕ and dilation operations twice in the perturbed regions r, r = ((r ⊕ K) K) 2 , where we set the kernel K = 1 3×3 . 4) After sorting the perturbed regions in r by their area, we obtain the largest perturbed region in r . We can find that our target texts locate in the same position as the largest found region. 5) Last, in the text image, we place a watermark big enough to cover the found position, and obtain an initial watermarked image x 0 and a binary watermark mask Ω w with the same shape of x, where Ω w,i = 1 if the position i is inside the watermark and 0 otherwise.

Generating Adversarial Watermarks
After finding the position of watermarks, we need to generate the perturbations within the watermarks to mislead the OCR models to output target texts. Integrated with two popular methods, we use the following methods to attack. Gradient-based Watermark Attack (Grad-WM). Considering the high efficiency of MI-FGSM [6], we apply it as our gradient-based method (we refer to as Grad-Basic). Each iterative update of the Grad-Basic is to 1) get the saliency map normalized by L 1 -norm with the cross-entropy loss, 2) adjust the update direction in the saliency map and update the momentum, and 3) update a new L p -norm adversarial image x i+1 bounded by using the updated momentum.
There are two main differences between Grad-WM and Grad-Basic. 1) Different from off-the-shelf MI-FGSM, where it applies the cross-entropy as loss function in the image classification tasks, in our Grad-WM, we use the CTC loss function to compute the saliency map. CTC loss function fits better because it is widely used in OCR models to handle the sequential labeling tasks. 2) In Grad-WM, to hide perturbations in the watermarks, we confine the perturbations

Algorithm 1 Gradient-based Watermark Attack
Input: A text image x, OCR model f with CTC loss CTC, targeted text t, -bounded perturbation, attack step size α, # of maximum iterations I, decay factor µ. Output: An adversarial example x with x − x p ≤ or attack failure ⊥.
1: Initialization: g 0 = 0; x 0 = x0 2: for all each iteration i = 0 to I − 1 do 3: Input x i to f and obtain the saliency map ∇x CTC(x i , t) 4: Update g i+1 by accumulating g i in the saliency map normalized by L1-norm as 5: Update x i+1 by applying watermark-bounded Lp-norm perturbations as end if 9: end for 10: return attack failure ⊥ within the boundary of the watermark Ω w , rather than spreading perturbations over the entire image in the result of the background pollution like Grad-Basic.
Algorithm 1 summarizes the Grad-WM generation procedure. Notably, input images are the initial watermarked images x 0 created in Section 3.2. Then the saliency map is produced with the CTC loss function relevant to the adversarial targets t. Through element-wisely multiplying the watermark mask Ω w with the updated L p -norm g i+1 , we get rid of the perturbations outside the watermark to maintain the clean background. We gain a significant visual improvement in the Grad-WM than the Grad-Basic. Besides, for further improving the attack efficiency, we determine whether to stop the attacks in every few iterations.
Optimization-based Watermark Attack (Opt-WM). We employ OCR attack [21] as our basic optimization-based method (Opt-Basic). Opt-Basic solves the following optimization problem: min where c is a hyper-parameter. To improve the visual quality of adversarial images, Opt-Basic adopts L 2 -norm for penalizing perturbations. To eliminate the box-constraint [0, 1] of x , it reformulates the problem using the change of variables [4] as min ω c· CTC ( tanh(ω)+1 satisfies the box-constraint [0, 1] automatically. Intuitively, we treat the variable ω as the adversarial example x without the box-constraint.
Similar to Grad-WM, we first get the initial watermarked input image x 0 and the watermark mask Ω w . To confine perturbations in watermarks more conveniently, we separate the perturbation term from w, and rewrite the original w to w +x 0 that represents the adversarial image of combining the perturbation term w and the initial watermarked image term x 0 . The objective function changes to min ω c · CTC ( tanh(ω+x0)+1 To constrain the manipulation region in the watermark fashion, we perform the elementwisely multiplication between the perturbation variable ω and the watermark mask Ω w . Formally, we reformulate the optimization problem as We adopt the Adam optimizer [14] for both Opt-Basic and Opt-WM to seek the watermark-style adversarial images. We utilize the binary search to adapt the tradeoff hyper-parameter c between the loss function and the L 2 -norm distance.

Improving Efficiency
To improve attack efficiency, we employ batch attack and early stopping by increasing the number of parallel attacks and reducing redundant attack iterations. Batch attack. Because OCR models only support batch image processing with the same size, when we attack a large number of variable-size text images, it will be time-consuming to attack them one by one. To improve attack parallelism (i.e., attack multiple images simultaneously), we 1) resize the variable-size images into the same height, 2) pad them into the maximum width among these images, 3) put the same-size images into a matrix. After the preprocessing, we could perform batch adversarial attacks in a single matrix to improve attack efficiency. Early stopping. For avoiding redundant attack iterations, we insert the earlystop mechanism in the attack iterations. We evaluate attack success rate (ASR) every few iterations. We stop attack iteration once ASR achieves 100%, indicating that all adversarial images are misidentified as the targeted texts by the threat model. To a certain extent, early stopping reduces the attack efficiency as it takes time to check attack status during iterations. This is a basic tradeoff between the cycle of ASR evaluation and the maximum attack iteration setting.

Improving Readability
Sometimes the gray watermarks still hinder the readability of the text as it reduces the contrast. To achieve better readability of the text, we employ the following two effective strategies: adding text masks and full-color watermark. Adding Text Masks. When generating the initial watermarked image x 0 in Section 3.2, to prevent the text from being obscured by the watermarks, we add in watermarks outside the text. To achieve this, we binarize the text images x by a threshold τ to get text masks Ω t with the same size of x, where Ω t,i = 1 if x i > τ and 0 otherwise. Then we get the initial watermarked images Generate text images. After processing the corpus in the IMDB dataset, we generate a dataset with 97 paragraph, 1479 sentence and 1092 word images using the Text Recognition Data Generator 2 . We use five fonts to generate these images: Courier, Georgia, Helvetica, Times and Arial. We set the font size to 32 pixels. We verify the Calamari-OCR can achieve 100% accuracy on these images.
Generating letter-level attacks targets. We choose a target word that is 1) a valid word, and 2) with edit distance 1 from the original. We evaluate replacement, insertion and deletion. More similar the replacement target is to the original, the easier the attack is. For example, replacing letter t with letter f is easier than replacing t with letter j. We use the logit value from the output of the last hidden layer, as the similarity metric between a pair of letters. Given the logit value, we assign replacement attacks into easy, random and hard case.
Generating word-level attacks targets. In this task, we replace the entire word in word, sentence and paragraph images. Different from letter-level attacks, we randomly choose a word in the English dictionary which has the same length as the original. However, we don't constrain the edit distance between them.
Attack implementation and settings. We implemented Grad-WM and Opt-WM attacks 3   decay factor µ is 1.0. For the optimization-based methods, we use the Adam optimizer [14] for 1000 steps with mini-batch size 100 and learning rate 0.01. We choose c = 10 as the tradeoff between the targeted loss and perturbation level.
Evaluation metrics. We evaluate attack capability from the following aspects.
1) Perturbation level. We quantify the perturbation level with three metrics: MSE = 1 n x − x 2 2 , evaluates the difference between two images. PSNR = 10 log D 2 MSE , where D is the range of pixel intensities. SSIM [25] captures structural information and measures the similarity between two images. For these metrics, we take the average of all images in the following results. Smaller MSE, larger PSNR and SSIM closer to 1 indicate less perturbations.

#(x)
, is the proportion of adversarial images of fooling OCR models to output targeted text.
3) Attack efficiency. I avg is average iterations of images to reach 100% ASR. Table 1 illustrates generated adversarial examples. We find that the perturbations of basic attacks are quite obvious, especially when we want to replace the entire word, while the watermarks help hide the perturbations from human eyes.

Letter-level Attack Performance
To intuitively analyze the effects of watermarks on our attacks, in Fig. 2, we first illustrate the saliency map that highlights the influence of each pixel on the target output t. In replacement cases, we observe that the white background needs more perturbations, both positive (+) and negative (-), while the gray background requires 72% less perturbations due to reduced contrast. Watermarks approximate the gray background and look more natural. Specifically, the attack of the white background also adds significant a-shaped negative perturbations to weaken the letter a, while the other two require negative perturbations less than 50% due to lower contrast. In addition, the attacks add perturbations to neighboring letters, as the sequence-based OCR models also consider them. Table 2 and Fig. 3 show the quantitative analysis of attack performance and use different targets in letter-level attacks. In Fig. 3 a higher efficiency, that reaches a higher ASR in a fixed number of iterations. ASRs of all attacks are 100%. We observe that: 1) MSEs of watermark attacks are only 40% of basic attacks' on average, confirming to the intuitive analysis above. 2) Watermark attacks only require 78% fewer I avg on average, and have around 3 to 8 times sharper slope than basic attacks, showing the significant improvement of attack efficiency. 3) Not surprisingly, hard cases require both more perturbations (higher MSE) and more iterations (larger I avg ) with lower efficiency (flatter slope), due to lack of similarity between two letters. 4) In addition, deletions are easier than insertions and replacements. This is because OCR models are sensitive to perturbations, and classify fuzzy letters into blank tokens that will be ignored by CTC in the output. Intuitively, in the saliency map of Fig. 2, perturbations of deletion are much slighter than other cases. Thus few perturbations can achieve deletion. 5) Courier font is easier to attack because it is thinner than other fonts. Thus it requires less perturbations. 6) Comparing gradient-based and optimization-based methods, the perturbation level is higher in gradient-based methods, no matter if they have watermarks or not. Because perturbations of optimization-based methods are not constrained by .

Word-Level Attack Performance
We can still achieve 100% ASR in the word-level attacks, but both MSE and I avg of word-level attacks are significantly higher than those of letter-level attacks. We perform word-level attacks in word, sentence and paragraph images. Table 3 and Fig. 3(c) summarize results in word-level attacks. Due to limited space, we only show results of gradient-based methods. The optimization-based methods have similar insights. In word-level attacks, we have similar observations as letter-level attacks. 1) Watermark attacks spend 50% less I avg with higher efficiency (sharper slope) generating adversarial images than basic attacks. 2) We observe 56% lower MSE with watermarks averagely. 3) It is easier to attack Table 2. Letter-level attacks using Grad-Basic, Grad-WM, Opt-Basic, Opt-WM attacks. Last line is the target output. We denote each font with their first letter.

Gradient-based
Optimization-based replacement insertion deletion replacement insertion deletion easy random hard easy random hard Courier font than other fonts for less MSE and I avg . 4) Due to a larger number of pixels in sentence and paragraph images, their MSEs are much lower than MSE of word images, but the absolute number of affected pixels stays the same.

Effects of Hyper-parameter Settings
To better understand these attacks, we evaluate the effects of hyper-parameter settings, such as tradeoff c, L p -norms, font-weight, position of watermarks, etc.
Effects of plain watermarks. First, we evaluate the effects of plain watermarks, i.e., initial watermarks without perturbations. The accuracy of Courier, Georgia, Helvetica, Times, Arial drop to 0.066, 0.768, 0.531, 0.753 and 0.715, respectively, showing that it is quite trivial to launch untargeted attacks on OCR. Also, it further confirms that thinner font, Courier, is highly sensitive to plain watermarks. In samples of incorrect recognition, we count the percentage of output text shorter than the ground-truth text, Courier(0.65), Georgia(0.12), Helvetica(0.08), Times(0.09), Arial(0.14). It's easy to induce that thinner font is more sensitive to perturbations resulting in losing letters like the deletion case.
Tradeoff between efficiency and visual quality. In both gradient-based and optimization-based methods, we need to set tradeoff parameters to balance between efficiency (I avg ) and visual quality (MSE). In Fig. 4, we plot the change of I avg and MSE along with distinct tradeoff settings. In gradient-based methods, we can reduce perturbation level with smaller step size α, at the cost of attack efficiency (raised I avg ). In optimization-based methods, the main quality-efficiency tradeoff parameter c balances the targeted loss and the L p -norm distance. We find that a smaller c makes the optimized objective function pay more attention to reduce the perturbation level with larger I avg . Thus we can use the binary search for c to find adversarial examples with a lower perturbation level under  the premise of maintaining perfect ASR. In addition, in various hyperparameter settings, the performance of watermark attacks is better than the basic attacks.
Setting L p -norms. L ∞ -norm for measuring the maximum variation of perturbations has the same perturbed value at each perturbed pixel, and thus significantly narrows down operation space. Even more, observing L ∞ -norm examples in Table 4, L ∞ -norm causes severe background noise. L 2 -norm yields perturbed values varying in perturbed pixels, and thus offers better flexibility to perform stronger adversarial attacks. Although L 2 -norm is lower efficient than L ∞ -norm in Fig. 3(c), L 2 -norm's image quality metrics, MSE, PSNR and SSIM, in Table 4, all are better than those of L ∞ -norm. Intuitively, L 2 -norm examples also have better visual quality. Therefore, we choose the L 2 -norm in our experiments.
Bold fonts settings. We also investigate the bold version of the five fonts. Table 4 shows most bold fonts require slightly more MSE and I avg to attack successfully, except for Courier requiring doubling MSE. This is not surprising, as bold fonts contain more useful pixels per letter. So they need more perturbations.  Attacking sequence-based OCRs. As OCR recognizes entire sequences rather than individual characters, we demonstrate that we can replace a letter even the watermark does not overlap with the letter, indicating we will not add perturbations over it. In this experiment, we shift the watermark about 10 pixels right to the target letter when generating initial watermarked images. Table 5 summarizes results that the attacks require 18 times MSE and 34 times I avg , and ASRs drop to less than 50% except for the simplest Courier case. It confirms the fact that in sequential-based OCRs, the influence around the letter is not as important as that overlaying the letter. Also, it reveals the necessity of finding the position of watermarks accurately to perform strong adversarial attacks.

Extensions and Applications of Watermark Attacks
Full-color watermarks. Sometimes adding gray watermarks still hurts human readability. We use the fact that modern OCR first transforms colored images into gray ones before recognition. Colored watermarks significantly improve overall readability when mixed with black texts. Fig. 5 shows a colored-watermark  Table 6. Protection mechanism. Acc and Acc* are the prediction accuracy with and without protection, respectively.
MSE Iavg Acc Acc* example Courier 0. 6   example of altering a positive movie review into a negative one by replacing and inserting words in it. Note that not all watermarks are malicious (e.g., the watermark on "I have ever seen" of Fig. 5 does not include adversarial perturbations). We evenly distribute watermarks over the paragraph image to make it look more similar to a naturally watermarked paragraph image in the real-world scenario.
Attacking Chinese Characters. In addition to English, we show that the method is applicable to other languages. Fig. 6 shows a Chinese example where we almost altered all important information, and its perturbation level is much larger than that in Fig. 5, because of the complex structure of Chinese characters.
Using FAWA to enhance the OCR readability of watermarked contents. Sometimes we want people to notice vital watermarks (e.g., urgent, confidential), but we do not want them to affect OCR's accuracy. In such case, we generate accuracy-enhancing watermarks by setting the ground-truth as the target. In Table 6, with few I avg and MSEs, Acc (accuracy with protection mechanism) increases to 1.0 compared with the low Acc* (accuracy of initial watermarked images). It works because protective perturbations strengthen the features of the ground-truth and boost the confidence of the original, making it more "similar" to the target (i.e., the ground-truth). As the target is the same as  the original, both MSE and I avg stay low. So we can use FAWA as a protection mechanism to produce both human-friendly images and OCR-friendly images.