Hide and Speak: Towards Deep Neural Networks for Speech Steganography

Abstract

Steganography is the science of hiding a secret message within an ordinary public message, which referred to as Carrier. Traditionally, digital signal processing techniques, such as least significant bit encoding, were used for hiding messages. In this paper, we explore the use of deep neural networks as steganographic functions for speech data. To this end, we propose to jointly optimize two neural networks: the first network encodes the message inside a carrier, while the second network decodes the message from the modified carrier. We demonstrated the effectiveness of our method on several speech data-sets and analyzed the results quantitatively and qualitatively. Moreover, we showed that our approach could be applied to conceal multiple messages in a single carrier using multiple decoders or a single conditional decoder. Qualitative experiments suggest that modifications to the carrier are unnoticeable by human listeners and that the decoded messages are highly intelligible.

FoolHD: Fooling Speaker Identification by Highly Imperceptible Adversarial Disturbances

“…We propose to generate imperceptible adversarial perturbations by training a Gated Convolutional Autoencoder (GCA) composed of an encoder and a decoder, operating in the frequency domain (see Figure 1). The architecture of our GCA is inspired by the steganographic method of [14] in the sense of the encoder and decoder. The encoder, E(•), creates a latent representation of the spectral representation s of the original audio file, h = E(s) through three gated convolutional layers.…”

“…The decoder, D(•), takesḣ and generates the adversarial spectral representation of the audio asṡ = D(ḣ) through four gated convolutional layers. Each gated convolutional layer of encoder and decoder, similarly to [14], is composed of 64 3 × 3 kernels, followed by a batch normalization and a dropout layer. However, our GCA has two main differences from [14].…”

“…Each gated convolutional layer of encoder and decoder, similarly to [14], is composed of 64 3 × 3 kernels, followed by a batch normalization and a dropout layer. However, our GCA has two main differences from [14]. First, our GCA operates in a variation of the DCT type IV, called the Modified Discrete Cosine Transform (MDCT) [16], as opposed to the Short-time Fourier Transform (STFT) domain.…”

“…The STFT is a complex-valued transformation that represents an audio file with its magnitude and phase. Therefore, the phase and magnitude of the signal are processed separately resulting in reconstruction errors during the STFT inversion [14]. This reconstruction error can be avoided by using the MDCT, as the MDCT is a real-valued transform, whose frequency coefficients encode both the phase and magnitude of the signal [17].…”

“…Even though adversarial examples and steganography have different goals, both try to hide a message in a carrier, such that this message does not perceptually affect the carrier. To this end, our proposed attack, FoolHD, adapts the speech steganography method proposed by [14], where a frequency-domain Gated Convolutional Autoencoder [15] is exploited to embed one or more audio files (i.e. messages) in another audio file (i.e.…”