CNN-Based Adversarial Embedding for Image Steganography

Abstract

Historically, steganographic schemes were designed in a way to preserve image statistics or steganalytic features. Since most of the state-of-the-art steganalytic methods employ a machine learning (ML) based classifier, it is reasonable to consider countering steganalysis by trying to fool the ML classifiers. However, simply applying perturbations on stego images as adversarial examples may lead to the failure of data extraction and introduce unexpected artefacts detectable by other classifiers. In this paper, we present a steganographic scheme with a novel operation called adversarial embedding, which achieves the goal of hiding a stego message while at the same time fooling a convolutional neural network (CNN) based steganalyzer. The proposed method works under the conventional framework of distortion minimization. Adversarial embedding is achieved by adjusting the costs of image element modifications according to the gradients backpropagated from the CNN classifier targeted by the attack. Therefore, modification direction has a higher probability to be the same as the sign of the gradient. In this way, the so called adversarial stego images are generated. Experiments demonstrate that the proposed steganographic scheme is secure against the targeted adversary-unaware steganalyzer. In addition, it deteriorates the performance of other adversary-aware steganalyzers opening the way to a new class of modern steganographic schemes capable to overcome powerful CNN-based steganalysis. Index TermsSteganography, steganalysis, adversarial machine learning. I. INTRODUCTIONImage steganography is the art and science of concealing covert information within images. It is usually achieved by modifying image elements, such as pixels or DCT coefficients. On the other side of the game, steganalysis aims to reveal the presence of secret information by detecting whether there are abnormal artefacts left by data embedding.The developing history of steganography and steganalysis is rich of interesting stories, as they compete with each other and they benefit and evolve from the competition [1]. The earliest steganographic method was implemented by substituting the least significant bits of image elements with message bits. The stego artefacts introduced by this method can be effectively detected by Chi-squared attack [2], or steganalytic features based on first-order statistics [3]. In this initial phase of the competition, statistical hypothesis testing or a simple linear classifier such as FLD (Fisher Linear Discriminant) could serve the need of steganalysis.The first-order statistics can be restored after data embedding, as done in [4]. The abnormal artefacts in the first-order statistics can also be avoided as in [5], [6]. As a consequence, more powerful steganalytic features based on the second-order statistics [7], [8] were proposed. In this period, advanced machine learning (ML) tools, such as SVM (Support Vector Machine), were operated on high-dimensional features (where the dimension is typically several hundreds). These met...

Recent Advances of Image Steganography With Generative Adversarial Networks

“…However, simply adding perturbations directly to a stego images can also result in instability of message extraction. Tang et al [88] proposed a steganography scheme called adversarial embedding (ADV-EMB),…”

“…[82]and [14] train a generator of modification probabilities matrix for minimizing a suitably defined additive distortion function. [15,78,88,89] learning a whole cover modification steganographic algorithm using GAN. They focus on the adversarial game between steganography and steganalysis.…”

A Survey on Deep Convolutional Neural Networks for Image Steganography and Steganalysis

“…Beyond this limit, they produce artifacts that can be easily detected by deep learning based steganalysis framework and, in extreme cases, it can also be detected by the human eyes. Advances in deep learning over the last few decades a new class of image steganographic frameworks based on deep learning are emerging [62][63][64][65]. In 2018, Zhu et al [66] proposed end to end deep learning framework for data hiding in digital images.…”

Enhancing JPEG Steganography using Iterative Adversarial Examples

“…WIFS'2019, December, [9][10][11][12]2019, Delft, Netherlands. XXX-X-XXXX-XXXX-X/XX/$XX.00 c 2019 IEEE.…”

“…Experimental results show that the proposed framework can significantly enhance the existing JPEG steganography evaluated on both deep learning based steganalyzers and the conventional ones. Please note that although both our method and the method in [10] aim to enhance J-UNIWARD based on adversarial examples, there are some important differences between them: 1) With iterative adversarial attacks, we aim to update embedding costs multiple times, while the method [10] aims to find a proper amount of adjust elements; 2) We embed the whole secret message into JPEG directly, while the method [ We just update those embedding costs with larger gradient amplitudes rather than a random way in [10]; 4) For updating embedding cost, we use an additive way instead of multiplicative one in [10]. The rest of this paper is arranged as follows.…”