Source-linked AI summary
HiDDeN: Hiding Data With Deep Networks
Jiren Zhu, Russell Kaplan, Justin Johnson, Li Fei-Fei
TL;DR
HiDDeN asks whether neural networks’ sensitivity to tiny, invisible perturbations can support useful data hiding. It jointly trains an encoder, decoder, noise layer, and adversary to create visually similar images that recover messages under distortions, including JPEG. The method demonstrates robust recovery and flexible adaptation across steganography and watermarking settings.
Problem
Existing data-hiding methods use static heuristics or partial neural components, motivating an end-to-end approach that can address secrecy, capacity, and robustness together.
Method
HiDDeN jointly trains encoder, decoder, noise, and adversarial discriminator networks to hide binary messages in cover images while optimizing image similarity, message recovery, and detectability.
Results
The models recover hidden information under Gaussian blur, pixel dropout, cropping, and JPEG compression, reaching 85% bit accuracy under simulated JPEG noise versus 50% without noise training.
Takeaways & Limitations
End-to-end training lets HiDDeN trade off capacity, secrecy, and robustness and incorporate new distortions directly into training rather than designing specialized algorithms.
Takeaways & Limitations
Comparison with Digimarc is limited because it is closed source and reports only success or failure for decoding a fixed-size watermark, not bit error rate.
Abstract
from arXiv · showhide
Recent work has shown that deep neural networks are highly sensitive to tiny perturbations of input images, giving rise to adversarial examples. Though this property is usually considered a weakness of learned models, we explore whether it can be beneficial. We find that neural networks can learn to use invisible perturbations to encode a rich amount of useful information. In fact, one can exploit this capability for the task of data hiding. We jointly train encoder and decoder networks, where given an input message and cover image, the encoder produces a visually indistinguishable encoded image, from which the decoder can recover the original message. We show that these encodings are competitive with existing data hiding algorithms, and further that they can be made robust to noise: our models learn to reconstruct hidden information in an encoded image despite the presence of Gaussian blurring, pixel-wise dropout, cropping, and JPEG compression. Even though JPEG is non-differentiable, we show that a robust model can be trained using differentiable approximations. Finally, we demonstrate that adversarial training improves the visual quality of encoded images.
1 Introduction
HiDDeN treats neural networks’ sensitivity to imperceptible image perturbations as an opportunity for data hiding. It jointly learns visually indistinguishable encodings that recover messages and can withstand diverse distortions.
- 1 Introduction: Steganography hides messages from steganalysis, whereas watermarking prioritizes recovering fingerprints after image distortions such as cropping or blurring.Watermarking can support image-ownership claims even when posted images are modified.
- 1 Introduction: HiDDeN jointly trains encoder, decoder, and adversary networks to hide messages while preserving image similarity, message recovery, and secrecy.Optional noise layers model distortions between sender and recipient.
- 1 Introduction: The approach is evaluated by capacity, secrecy, and robustness, with hidden information recovered despite Gaussian blur, pixel dropout, cropping, and JPEG compression.Differentiable approximations enable training for non-differentiable JPEG perturbations.
- 1 Introduction: Unlike static heuristic methods, HiDDeN adapts to new data-hiding requirements by directly optimizing objectives and retraining against new noise types.The same learned framework can be adjusted for steganography or watermarking.
2 Related Work
Prior work uses handcrafted or partial neural components for steganography and watermarking. HiDDeN instead trains the entire blind data-hiding pipeline end-to-end and targets both secrecy and distortion robustness.
- 2 Related Work: Adversarial examples motivate using imperceptible perturbations as carriers of information that neural networks can detect despite human invisibility.Prior work also found adversarial examples can remain effective through image transformations.
- 2 Related Work: Classical steganography includes LSB and frequency-domain schemes, while learned methods often optimize specialized distortion metrics or heuristics.These approaches differ in how they allocate image modifications.
- 2 Related Work: Watermarking emphasizes robustness for ownership or copyright protection, with blind methods decoding without access to the original cover image.This distinguishes watermarking’s priority from steganography’s secrecy goal.
- 2 Related Work: Earlier neural systems typically handled one pipeline stage, whereas HiDDeN models and trains the complete data-hiding pipeline end-to-end.HiDDeN is blind, encodes in one forward pass, and addresses robustness beyond prior end-to-end steganography work.
- 2 Related Work: HiDDeN differs from related neural hiding systems by supporting both steganography and watermarking while incorporating encoding robustness.The cited prior approaches focus on steganography or omit robustness.
3 Method
HiDDeN comprises an encoder, noise layer, decoder, and adversarial discriminator trained end-to-end for visually similar, accurately decoded, distortion-robust image encodings. Differentiable noise simulations allow training against JPEG despite its non-differentiable quantization.
- 3 Method: The encoder maps a cover image and binary message to an encoded image, the noise layer distorts it, the decoder reconstructs the message, and the discriminator detects encoding.The discriminator outputs the probability that an input image is encoded.
- 3 Method: Training minimizes cover-to-encoded image difference, input-to-decoded message difference, and encoded-image detectability by the adversary.The discriminator is trained with its own classification loss.
- 3 Method: The encoder spatially replicates the message and concatenates it with an intermediate image representation so convolutional filters can access the full message.The decoder uses global average pooling to accommodate different spatial dimensions.
- 3 Method: Noise layers include dropout, cropout, Gaussian blur, crop, and JPEG, with distortion intensity controlled by parameters such as retained-pixel fraction, blur width, or JPEG quality.Spatial distortions include dropout and cropping; Gaussian and JPEG operate through frequency-domain effects.
- 3 Method: JPEG-Mask zeros selected high-frequency DCT coefficients, while JPEG-Drop progressively drops coefficients according to their JPEG quantization severity.Both approximations produce models robust to actual JPEG compression.
- 3 Method: Models trained with JPEG approximations become robust to true JPEG compression at test time, including quality Q = 50.Figure 5 compares approximation-trained curves with actual-JPEG curves.
- 3 Method: Experiments train on 10,000 COCO cover images and evaluate on 1,000 unseen test images using randomly sampled binary messages.Optimization uses Adam with learning rate 10^-3 and batch size 12.
4 Experiments
HiDDeN is evaluated across capacity, secrecy, robustness, and image quality in steganography and watermarking settings. It matches or improves on baselines while learning robustness to distortions and benefiting visually from adversarial training.
- Steganography: Capacity and Secrecy: HiDDeN matches classical steganography baselines at 0.203 BPP versus 0.200 while reconstructing messages with error rate < 10^-5.The model is evaluated on 512×512 BOSS images after training on COCO images.
- Steganography: Capacity and Secrecy: Without access to trained weights, ATS detects HiDDeN at 50%, compared with 70% for HUGO and 68% for WOW and S-UNIWARD.When model weights are known, HiDDeN detection rises to 98%.
- Steganography: Capacity and Secrecy: Compared with, HiDDeN encodes twice the bit rate while achieving lower decoding error and better encoded-image quality.At 0.2 BPP, HiDDeN's reported error is < 10^-5, versus 2 × 10^-3 for at 0.1 BPP.
- Watermarking: Robustness: Training with distortion layers makes HiDDeN robust to multiple image distortions, including Gaussian blur, dropout, cropping, and JPEG compression.Models trained without noise fail completely on Crop and JPEG at 50% bit accuracy.
- Watermarking: Robustness: Against true JPEG compression, simulated JPEG training raises bit accuracy from 50% without noise to 85%.The result uses differentiable simulated JPEG noise during training despite JPEG being non-differentiable at test time.
- Watermarking: Robustness: The Combined model reaches 94% accuracy against Cropout, close to the specialized model's 97%, while remaining robust across noise types.Encoded images are reported as visually indistinguishable from covers, and adversarial training removes visible artifacts caused by l2 loss alone.
- Watermarking: Robustness: Against spatial-domain noise, HiDDeN can outperform Digimarc, while it performs worse on frequency-domain noise.For Dropout and Crop at p = 0.1, HiDDeN reaches bit accuracy ≥95% where Digimarc fails; the authors relate the frequency-domain gap to architectural assumptions.
5 Conclusion
HiDDeN is an end-to-end neural framework for image data hiding that flexibly trades off capacity, secrecy, and robustness. It improves deep-learning steganography and supports robust watermarking while leaving broader distortion coverage and other domains for future work.
- HiDDeN trains neural networks end-to-end for image data hiding.
- The framework flexibly trades off capacity, secrecy, and robustness by varying training parameters or noise layers.
- HiDDeN demonstrates improved quantitative and qualitative performance over deep-learning steganography methods.
- For robust watermarking, HiDDeN is presented as the first end-to-end neural-network method to the authors’ knowledge.
- Future work targets higher capacity, more diverse image distortions, and data hiding in audio and video.
HiDDeN: Hiding Data
The supplied passage contains only the supplementary-material title, identifying the work as involving deep networks.
- The supplementary material is titled “with Deep Networks Supplementary Material.”
A Model Architecture
HiDDeN uses convolutional building blocks to encode cover images and messages, process distorted encoded images, decode messages, and adversarially classify image contents.
- A Conv-BN-ReLU block combines convolution, batch normalization, and ReLU activation.
- The encoder combines cover-image activations, a spatially replicated message volume, and the original image before producing the encoded image.
- The noise layer transforms the encoded image into an output that may have different spatial dimensions, supporting cropping.
- The decoder uses convolutional blocks, spatial average pooling, and a linear layer to predict the message without assuming fixed spatial dimensions.
- The adversary averages convolutional activations spatially and classifies images with a two-output linear layer.
B Digimarc Baseline
The Digimarc comparison uses a closed-source watermarking package with an estimated 64-bit encoding and coarse whole-message success measurements. Bit-rate matching uses error-correction assumptions linking bit accuracy to full code-word reconstruction.
- Digimarc is a closed-source commercial digital-watermarking baseline.
- The authors estimate that Digimarc’s required identification and integrity information fits a 64-bit encoding.
- Because Digimarc exposes only success or failure, evaluation measures the fraction of images whose full message is decoded correctly.
- Digimarc recommends images at least 256 × 256, while HiDDeN is trained with 30 bits in 128 × 128 images.
- An LDPC-36-128 code is used to match the methods’ bit rate, with full code-word reconstruction reported at channel bit error rates ≤5%.
C Combined Model Training Details
The Combined model is trained by swapping different noise layers in each minibatch to learn robustness against multiple distortions simultaneously.
- The Combined model swaps a collection of noise layers in each minibatch during training.The collection includes dropout, cropout, cropping, Gaussian blur, JPEG-related layers, and an identity layer.
D More examples of encoded images
The supplied passages list image categories used to compare encoded-image examples, including individual distortions and the Combined model.
- The examples are organized across Cover, Identity, Dropout, Cropout, Crop, Gaussian, JPEG-mask, JPEG-drop, and Combined categories.