Could we transform the watermark in randomized distances (X and Y) to avoid the subtraction? If the training on the pattern itself isn't as robust, the method starts to fall apart a bit more.