PaperlayerView exact revision on arXiv

Source-linked AI summary

CNN Based Adversarial Embedding with Minimum Alteration for Image Steganography

Weixuan Tang, Bin Li, Shunquan Tan, Mauro Barni, Jiwu Huang

arXiv:1803.09043v1cs.MM

TL;DR

Powerful ML-based steganalyzers challenge schemes that rely on preserving image statistics, while direct adversarial perturbations can impair extraction and create detectable artefacts. The paper introduces AMA, which jointly embeds messages and targets a CNN steganalyzer through gradient-guided cost adjustment under distortion minimization. Experiments report strong resistance against adversary-unaware targeted analysis and degraded performance of adversary-aware steganalyzers.

  • Problem

    Existing statistical-preservation strategies face powerful ML-based steganalyzers, while directly perturbing stego images may impair extraction and create artefacts detectable by other classifiers.

  • Method

    AMA performs adversarial embedding by adjusting image-element modification costs according to gradients from a targeted CNN steganalyzer within distortion minimization.

  • Results

    AMA achieves a high missed detection rate against targeted adversary-unaware steganalyzers and a higher detection error rate than the state-of-the-art baseline against targeted and non-targeted adversary-aware steganalyzers.

  • Takeaways & Limitations

    Adversarial embedding provides a promising way to enhance steganography against powerful CNN-based steganalysis while retaining secret-message embedding.

Abstract

from arXiv · show

Historically, steganographic schemes were designed in a way to preserve image statistics or steganalytic features. Since most of the state-of-the-art steganalytic methods employ a machine learning (ML) based classifier, it is reasonable to consider countering steganalysis by trying to fool the ML classifiers. However, simply applying perturbations on stego images as adversarial examples may lead to the failure of data extraction and introduce unexpected artefacts detectable by other classifiers. In this paper, we present a steganographic scheme with a novel operation called adversarial embedding, which achieves the goal of hiding a stego message while at the same time fooling a convolutional neural network (CNN) based steganalyzer. The proposed method works under the conventional framework of distortion minimization. Adversarial embedding is achieved by adjusting the costs of image element modifications according to the gradients backpropagated from the CNN classifier targeted by the attack. Therefore, modification direction has a higher probability to be the same as the sign of the gradient. In this way, the so called adversarial stego images are generated. Experiments demonstrate that the proposed steganographic scheme is secure against the targeted adversary-unaware steganalyzer. In addition, it deteriorates the performance of other adversary-aware steganalyzers opening the way to a new class of modern steganographic schemes capable to overcome powerful CNN-based steganalysis.

I. INTRODUCTION

Steganography has evolved from preserving low-order statistics toward distortion-minimization schemes facing increasingly powerful ML- and CNN-based steganalyzers. This paper proposes AMA, which embeds messages while adjusting modification costs to fool a targeted classifier and minimize alteration.

  • Early schemes replacing least significant bits produced artefacts detectable through chi-squared attacks and first-order statistical features.
  • Preserving first-order statistics prompted steganalysis based on second-order statistics and high-dimensional SVM features.
  • Modern distortion-minimization schemes assign costs to image-element changes and use coding to convey messages while minimizing total modification cost.
  • CNN-based steganalyzers increasingly automate feature extraction and classification, often incorporating high-pass filtering for strong performance.
  • Limited availability of camera-sensor or compression side information motivates schemes suitable for more general cover-image conditions.
  • AMA adjusts a portion of embedding costs using backpropagated classifier gradients, while minimizing adjustable elements to generate message-carrying adversarial stego images.

B. Steganographer’s Knowledge about Steganalyzer

The proposed scheme assumes access to gradients from a targeted ML steganalyzer, while considering adversary-aware analysts that retrain on adversarial samples or use unknown advanced analyzers.

  • The steganographer is assumed to access loss gradients with respect to the input, backpropagated from the targeted ML-based steganalyzer.
  • The experiments also consider advanced steganalyzers whose knowledge is unavailable to the steganographer.
  • An adversary-unaware steganalyst has no knowledge of adversarial operations, whereas an adversary-aware steganalyst can retrain using adversarial stego samples.

III. THE PROPOSED AMA STEGANOGRAPHIC SCHEME

AMA is a distortion-minimization steganographic scheme that embeds a message while steering a targeted steganalyzer toward an incorrect label. It uses gradient-informed asymmetric embedding costs while preserving data-carrying functionality.

  • Scheme overview: AMA counters a targeted steganalyzer through adversarial embedding within a practical steganographic scheme.The method combines adversarial embedding and minimum alteration under a conventional framework.
  • Adversarial embedding: The steganalyzer loss uses a binary label, with network output F(X) representing the probability that X is stego.The paper gives a cross-entropy loss for this binary classification setting.
  • Adversarial embedding: Direct adversarial perturbation is unsuitable because modifying stego images can cause message-extraction failure.AMA therefore gives equal importance to fooling the classifier and embedding the secret message.
  • Distortion minimization: Distortion minimization embeds a payload by minimizing total modification cost under a payload constraint.The distortion is computed from modified elements and their embedding costs.
  • Cost assignment: Conventional schemes assign larger costs to modifications more likely to introduce abnormal artefacts, whereas CMD asymmetrically favors synchronized neighborhood directions.AMA builds on this cost-based embedding framework while using classifier gradients to guide adversarial modifications.
  • Adversarial embedding: Adversarial embedding adjusts modification direction so it tends to follow the gradient effect associated with the targeted label.Asymmetric costs create unequal probabilities for increasing and decreasing image elements while still allowing data embedding.

C. Minimum Alteration of Adjustable Elements

AMA minimizes adversarial intervention by restricting gradient-guided embedding to an adjustable subset of elements. It searches for the smallest subset that fools the targeted steganalyzer while carrying the full payload.

  • Minimum alteration: Asymmetric adversarial costs can increase the image change rate because equal increase and decrease probabilities maximize entropy under a payload constraint.Minimum alteration is introduced to reduce this cost of adversarial embedding.
  • Minimum alteration: AMA separates elements into a common group for conventional embedding and an adjustable group for adversarial embedding.The design minimizes adjustable elements while requiring the targeted steganalyzer to output a wrong class label.
  • Minimum alteration: The ratio β denotes the fraction of all image elements assigned to the adjustable group, and the targeted steganalyzer numerically searches for a sufficient value.There is no explicit solution, so AMA searches for a “just enough” adjustable subset.
  • Practical implementation: In the practical implementation, JPEG covers use J-UNIWARD for initial costs and Xu-CNN as the targeted steganalyzer.The framework is described as applicable to other formats, steganalyzers, and conventional embedding schemes.
  • Practical implementation: AMA embeds k1 = [k × (1 −β)] bits in common elements before embedding the remaining message bits in adjustable elements.The adjustable costs are updated before the second embedding phase.
  • Practical implementation: If the targeted steganalyzer still detects the result, AMA increases β by ∆β and repeats the process until β = 1.The output is accepted when the classifier returns 0, indicating that the adversarial stego image fools it.

IV. EXPERIMENTS

The experiments evaluate AMA against adversary-unaware and adversary-aware steganalysts, iterative knowledge updates, design choices, randomization, and a second image set. The study uses two JPEG cover datasets.

  • Experimental design: The evaluation includes adversary-unaware and adversary-aware steganalysts, alternating iterative conditions, and analyses of gradients, minimum alteration, and adjustable-element randomization.The experiments also test another image set.
  • Datasets: The study uses Basic500k and JPEG-BOSSBase as the two JPEG cover image sets.Basic500k is the default set, while JPEG-BOSSBase tests performance on a distinct image collection.
  • Datasets: Basic500k contains 5 × 10^5 grayscale 256×256 JPEG images derived from ImageNet and compressed at quality factor 75.The images are split into subsets of 2.5 × 10^5 images.
  • Datasets: JPEG-BOSSBase contains 10000 BOSSBase images resized to 256×256 with Lanczos2 and compressed at quality factor 75.The experiments use subsets of 5000 images.

2) Steganalyzers:

The evaluation uses CNN and hand-crafted-feature steganalyzers with J-UNIWARD as the baseline and AMA targeting Xu-CNN. Reported results show evasion of the targeted detector and degradation of other detectors on adversarial stego images.

  • Steganalyzers: Three steganalyzers are evaluated: Xu-CNN, GFR, and DCTR.Xu-CNN is a 20-layer JPEG CNN, while GFR and DCTR use hand-crafted residual or histogram features with FLD ensemble classifiers.
  • Steganographic schemes: J-UNIWARD provides the baseline stego images, while AMA uses J-UNIWARD initially and targets the Xu-CNN steganalyzer.AMA adversarial stego sets are denoted Z0 and Z1 in the experimental notation.
  • Implementation: The scaling parameter is α = 2, and the authors report only minor performance differences across the tested α values.Both schemes use the optimal embedding simulator, with AMA implemented in TensorFlow on a NVIDIA Tesla K80 GPU.
  • Adversary-unaware evaluation: AMA adversarial stego images effectively evade detection by the targeted Xu-CNN steganalyzer.The reported missed detection rate is much higher for the adversarial stego set in the described experiment.
  • Other steganalyzers: Against non-targeted GFR and DCTR steganalyzers, adversarial stego images perform at least somewhat worse than J-UNIWARD stego images.The authors describe this as a certain effectiveness beyond the targeted steganalyzer.
  • Interpretation: The paper speculates that resisting a powerful, data-driven Xu-CNN may implicitly preserve cover-image statistics and weaken other advanced steganalyzers.This explanation is explicitly presented as speculation.

C. Performance against an Adversary-aware Steganalyst

AMA remains more secure than J-UNIWARD when the steganalyzer is retrained on adversarial stego images, although retraining improves detection. It also transfers against non-targeted steganalyzers.

  • Retraining the targeted steganalyzer detects adversarial embedding better than the targeted adversary-unaware steganalyzer.
  • 25.8% total error at 0.4 bpnzAC is comparable to J-UNIWARD’s 25.3% at 0.3 bpnzAC, giving AMA 0.1 bpnzAC more payload at the same detection risk.
  • AMA achieves higher total error rates than the baseline when evaluated with two non-targeted steganalyzers.

D. Sequential Iterative Game between Steganographer and Steganalyst

The iterative game alternates adaptation between steganographer and steganalyst across five rounds. In each round, targeted attacks remain effective, while the player moving last gains an advantage.

  • Five iterative rounds alternate adversary-unaware training, targeted adversarial embedding, and adversary-aware retraining at 0.4 bpnzAC.
  • In each round, the adversary-unaware steganalyzer has a higher total error rate, mainly because of its higher missed detection rate.
  • The targeted steganalyzer is consistently fooled, whereas the adversary-aware steganalyst exploits knowledge of the adversarial operations.
  • Across five rounds, the missed-detection gap fluctuates from 75.4% to 76.1%, while the false-alarm gap narrows from 9.9% to 0.4%.
  • The total-error-rate gap widens from 32.7% to 38.3%, indicating an advantage for the player with adversary information who moves last.

E. Investigation on Two Important Components in AMA

Component experiments show that inverse-gradient adjustment and minimum alteration are both central to AMA’s security trade-offs.

  • Adversarial embedding: Reversing inverse-gradient adjustment reduces total error from 58.5% to 21.6% for the adversary-unaware steganalyzer and from 25.8% to 19.3% for the adversary-aware steganalyzer.
  • Adversarial embedding: The degraded performance shows that gradient-sign information contributes importantly to the adversarial effect.
  • Minimum alteration: Increasing β raises missed detection for the adversary-unaware steganalyzer but lowers total error for the adversary-aware steganalyzer.
  • Minimum alteration: AMA therefore seeks the minimum β that provides enough adjustable elements to balance targeted evasion against detection by an aware steganalyzer.

F. Supplementary Statistical Information

Supplementary statistics describe how adversarial embedding and modification rates vary with payload. Higher payloads require adversarial embedding more often and reduce embedding failures, but β-frequency patterns are image- and configuration-dependent.

  • At low payload, adversarial embedding is unnecessary for many images; as payload increases, more images require β ≠ 0.
  • 7.52% to 0.47%: adversarial-embedding failure decreases as payload rises from 0.1 to 0.5 bpnzAC.
  • Modification rises from less than 2% of elements at 0.1 bpnzAC to more than 11% at 0.5 bpnzAC.
  • Larger β values occur less frequently than smaller values across payloads, but this pattern may reflect the images, baseline scheme, targeted steganalyzer, or Δβ search step.

2) Modification rate:

AMA slightly increases modification rates relative to J-UNIWARD, with the gap widening at higher payloads, while achieving lower MMD on GFR features. Randomized embedding order is considered because fixed positions can affect security performance.

  • Modification rate: AMA has slightly higher modification rates than J-UNIWARD, and the gap widens across the five tested payloads.The gaps are 0.04%, 0.07%, 0.11%, 0.15%, and 0.2%, respectively.
  • Feature preservation: AMA achieves a lower MMD than J-UNIWARD under the same payload, indicating better preservation of 17000-D GFR features despite higher modification rates.The comparison uses 10,000 randomly selected images from C1B.
  • Embedding-order analysis: The experiments compare randomized and fixed embedding orders to investigate whether randomizing adjustable-element positions affects security performance.Fixed embedding order produces fixed adjustable-element positions.
  • Embedding-order analysis: With fixed embedding order and β = 0.3, performance changes little for adversary-unaware steganalyzers but degrades greatly for adversary-aware steganalyzers.This experiment uses a payload of 0.4 bpnzAC and compares against randomized embedding order.
  • Implementation trade-off: Random embedding order may improve stego-image security but can require transmitting a secret key or embedding side information in the stego media.A robust image hash is also discussed as a possible source of a secret key.

H. Performance on JPEG-BOSSBase Image Set

AMA is evaluated on JPEG-BOSSBase against adversary-aware steganalyzers using J-UNIWARD as the baseline. It outperforms J-UNIWARD at 0.4 bpnzAC, suggesting its performance is not strongly tied to one image set.

  • Evaluation setup: AMA is assessed with the Xu-CNN steganalyzer trained on Basic500k as the targeted steganalyzer.Three adversary-aware steganalyzers are used for detection.
  • Performance on JPEG-BOSSBase Image Set: On JPEG-BOSSBase, AMA performs better than J-UNIWARD at a payload of 0.4 bpnzAC.The evaluation uses three adversary-aware steganalyzers, while Xu-CNN remains the targeted steganalyzer.
  • Performance on JPEG-BOSSBase Image Set: The JPEG-BOSSBase results indicate that AMA's good performance does not rely much on a specific image set.The comparison uses J-UNIWARD as the baseline.
  • Method context: The paper frames AMA as adversarial embedding that hides a message while accounting for the need to counter a targeted CNN-based steganalyzer.The scheme generates adversarial stego images with minimum alteration.
  • Conclusions: The conclusions report high missed detection against a targeted adversary-unaware steganalyzer and higher detection error after adversary-aware retraining.The latter comparison holds for both targeted and non-targeted steganalyzers.
Loading 1803.09043v1…