PaperlayerView exact revision on arXiv

Source-linked AI summary

Data Hiding with Deep Learning: A Survey Unifying Digital Watermarking and Steganography

Zihan Wang, Olivia Byrnes, Hu Wang, Ruoxi Sun, Congbo Ma, Huaming Chen, Qi Wu, Minhui Xue

arXiv:2107.09287v3cs.CV

TL;DR

Traditional surveys focus mainly on traditional algorithms, while a comprehensive survey unifying deep-learning watermarking and steganography is lacking. This survey organizes methods and summarizes their objectives, metrics, datasets, and future directions; it identifies GANs as promising for robustness and secrecy, while noting that reported evaluations are not directly comparable.

  • Problem

    Existing surveys primarily cover traditional algorithms, and a comprehensive review unifying deep-learning watermarking and steganography is lacking.

    Source: §I · p. 2

  • Method

    The survey categorizes deep-learning data-hiding models by watermarking or steganography application and by network architecture and noise-injection methods, while reviewing objectives, metrics, and datasets.

    Source: §I · p. 3

  • Results

    The survey considers GAN frameworks promising for robustness and secrecy, while attention mechanisms that target robust pixels improve GAN-based robustness.

    Source: 3) Discussion · p. 8

  • Takeaways & Limitations

    The survey concludes that deep learning can benefit watermarking and steganography for digital intellectual-property protection and communication security in Responsible AI software industries.

    Source: §IX · p. 21

    Reported results are not directly comparable because studies use different cover images, watermark dimensions, and attack pools.

    Source: D. Results · p. 12

Abstract

from arXiv · show

The advancement of secure communication and identity verification fields has significantly increased through the use of deep learning techniques for data hiding. By embedding information into a noise-tolerant signal such as audio, video, or images, digital watermarking and steganography techniques can be used to protect sensitive intellectual property and enable confidential communication, ensuring that the information embedded is only accessible to authorized parties. This survey provides an overview of recent developments in deep learning techniques deployed for data hiding, categorized systematically according to model architectures and noise injection methods. The objective functions, evaluation metrics, and datasets used for training these data hiding models are comprehensively summarised. Additionally, potential future research directions that unite digital watermarking and steganography on software engineering to enhance security and mitigate risks are suggested and deliberated. This contribution furthers the creation of a more trustworthy digital world and advances Responsible AI.

I. INTRODUCTION

Data hiding can support secure communication and intellectual-property protection, but traditional methods have narrow applications and may be vulnerable to increasingly sophisticated attacks. This survey addresses the lack of a comprehensive review unifying deep-learning watermarking and steganography by organizing methods and summarizing their evaluation and future directions.

I. INTRODUCTION

  • Data hiding embeds information in media; watermarking identifies an asset’s owner, whereas steganography conceals messages to avoid detection.The survey focuses on these two forms, which it describes as useful for protecting sensitive data.Source: §I · p. 1
  • Traditional data-hiding algorithms are narrow, require embedding expertise, and may be compromised by increasingly sophisticated removal and degradation attacks.Spatial methods are computationally simple but more susceptible to removal and distortion, while frequency-domain methods are more robust but more complex.Source: §I · pp. 1–2
  • Deep learning offers adaptable data-hiding frameworks that can resist varied attacks and be retrained for new attacks or goals such as capacity and imperceptibility.The survey notes that most compared works are image-based and attributes security benefits in part to neural models’ high non-linearity.Source: §I · p. 2
  • Deep data hiding maps embedding and extraction to encoder-decoder networks trained to balance cover-image distortion against message-recovery error.The encoder embeds a message in an image; the decoder extracts it after distortions such as blurring, cropping, or compression.Source: §I · p. 2
  • The survey fills a gap in comprehensive coverage of deep watermarking and steganography by categorizing models according to application, network architecture, and noise-injection methods.It also summarizes objective strategies, evaluation metrics, and training datasets.Source: §I · pp. 2–3
  • The survey draws on more than 30 papers and outlines future research avenues for deep-learning data hiding.Its review covers methods, noise injection, objective functions, evaluation metrics, datasets, and open questions.Source: §I · p. 3

II. PROBLEM STATEMENT

Data-hiding systems balance capacity, imperceptibility, and robustness, with different applications favoring different properties. The survey defines terminology and reviews deep-learning encoder-decoder and GAN approaches for embedding and extracting data.

II. PROBLEM STATEMENT

  • Robustness, imperceptibility, and capacity trade off; watermarking generally favors robustness, while steganography favors imperceptibility, and deep learning can let users control the balance.The figure presents the trade-off and the applications that favor each property.Source: §II · p. 3, Figure 2 · p. 3

A. Digital Watermarking and Steganography Terminology

  • Data-hiding methods are classified by extraction blindness, fragility to attacks, visibility, invertibility, robustness, and security.Blind extraction needs neither the original cover nor original data; semi-blind and non-blind extraction require progressively more original information.Source: A. Digital Watermarking and… · pp. 3–4

III. DEEP LEARNING-BASED DATA HIDING TECHNIQUES

  • Deep-learning data hiding uses encoder-decoder networks to embed and extract information, with attack simulation during training and retraining for different applications or attacks.CNNs are common in watermarking and U-Net is common in steganography; training can improve resistance to simulated attacks and message extraction.Source: §III · p. 4
  • CNN adversarial training simulates attacks using trained CNNs for noise injection, whereas GAN-based methods use a discriminator to scrutinize encoded and cover images.The survey distinguishes these approaches despite their related terminology.Source: §III · p. 4
  • GANs train a generator to produce less detectable encoded images and a discriminator to distinguish encoded from unaltered images.The described training endpoint is when the discriminator identifies legitimately encoded images only 50% of the time; CycleGANs can translate images without paired examples.Source: §III · p. 4

A. Deep Learning-based Watermarking Techniques

Deep watermarking models are organized around encoder-decoder and GAN architectures. Across these approaches, researchers adapt embedding, attack simulation, and extraction to balance robustness, image quality, and payload capacity.

1) Encoder-decoder Framework:

  • The early auto-encoder CNN method outperformed robust traditional frequency-domain methods on robustness and imperceptibility, but was non-blind.Later encoder-decoder models include WMNet, which achieves blind, robust watermarking through embedding, attack simulation, and updating stages.Source: 1) Encoder-decoder Framework · p. 5
  • DA uses a trained CNN to generate distortions and outperforms HiDDeN on robustness to distortions unseen during training.Channel coding adds redundancy to the watermark message before embedding and decodes it before extraction.Source: 1) Encoder-decoder Framework · p. 6

2) Generative Adversarial Networks:

  • HiDDeN achieves higher payload capacity than HUGO, WOW, and S-UNIWARD, but performs best when trained against one attack type.Its decoding loss is minimized more effectively with a specific attack than with a mixture of attack types.Source: 2) Generative Adversarial Networks · p. 6
  • Hamamoto et al. improve image quality after embedding and robustness to JPEG compression over HiDDeN, while also addressing geometric rotation attacks.Their approach uses a neural network for attack simulation and a noise-strength factor to control the robustness–imperceptibility trade-off.Source: 2) Generative Adversarial Networks · p. 6
  • Inverse Gradient Attention [30] identifies robust pixels and improves payload capacity and robustness over HiDDeN, DA, and SteganoGAN [38].Its attention mask uses cover-image gradient values to identify pixels for message reconstruction.Source: 2) Generative Adversarial Networks · pp. 6–7
  • TSDL achieves superior robustness to HiDDeN and ReDMark in all but crop attacks, and also resists untested black-box noise attacks.It trains an encoder without noise, then trains the decoder against noise attacks, including non-differentiable attacks such as JPEG compression.Source: 2) Generative Adversarial Networks · p. 7
  • 4.4 BPP, 10 times higher than competing deep learning methods, is SteganoGAN [38]'s relative payload.Its high payload capacity and low detection rate also make it applicable to watermarking.Source: 2) Generative Adversarial Networks · p. 7
  • The CycleGAN-based secret-image method's attention model, cycle discriminators, and inconsistent loss each improved image quality and robustness when tested in isolation.It hides a secret image rather than a binary watermark message.Source: 2) Generative Adversarial Networks · p. 8

3) Discussion:

The discussion favors adversarial losses and attention-based embedding for secrecy and robustness, while identifying attack diversity and adaptability as priorities for future models. Combining these features may introduce practical overhead.

3) Discussion:

  • Including an adversary greatly improved HiDDeN, producing an invisible watermark where tests without the adversary showed perceptible alterations.GAN-based models performed well on robustness, with further gains reported for attention-based robust-pixel targeting in Attention-based Data Hiding and IGA [30].Source: 3) Discussion · p. 8
  • Training across a wider range of attack types increases general robustness; true non-differentiable noise in Liu et al. also outperformed differentiable approximations for JPEG compression.The discussion also identifies geometric attacks and CNN-generated attacks as ways to diversify training distortions,,.Source: 3) Discussion · p. 8
  • A proposed adaptable watermarking framework combines attention, geometric-attack robustness, resolution and robustness controls, and handling of worst-case distortions.The suggested features draw on techniques discussed in and [28].Source: 3) Discussion · p. 8
  • The discussion notes that the overhead of combining these features could be an issue in practice.Table I summarizes reviewed watermarking models by embedding domain, network design, host-resolution adaptability, and imperceptibility–robustness controls.Source: 3) Discussion · p. 9

B. Deep Learning-based Steganography Techniques

Deep steganography commonly uses CNN encoder-decoder models, with methods varying in how they select embedding regions, encode secrets, and address robustness or reversibility. The reviewed approaches show trade-offs among invisibility, robustness, image constraints, distortion, and capacity.

B. Deep Learning-based Steganography Techniques

1) Encoder-decoder Framework:

  • StegNet combines autoencoder and GAN structures with variance loss to distribute perceptual loss; it resists StegExpose [54], but requires equal image sizes and leaves noise in smooth regions.Compared with Baluja et al., it represents an improvement in image hiding and robustness, though quality, size restrictions, and noise remain limitations.Source: 1) Encoder-decoder Framework · p. 9
  • The faster R-CNN fusion method selects regions and steganography algorithms for imperceptible, robust embedding; combining it with StegNet could reduce noise in smooth areas but lower capacity.The proposed combination uses less of the cover image for embedding.Source: 1) Encoder-decoder Framework · p. 9
  • Sharma et al. [50] add scrambling and permutation for secure hiding, including audio use; Chang et al. use LSTM residual prediction and histogram shifting for reversible, high-capacity, low-noise images.Chang et al.'s method can recover the cover image through its invertible design.Source: 1) Encoder-decoder Framework · pp. 9–10
  • ADV-EMB adjusts image costs using a CNN steganalyser to evade detection and can target a local analyser against unknown analysers, but has a weak pixel domain.The passage also warns that increasing payload capacity would increase steganalyser detection.Source: 1) Encoder-decoder Framework · p. 10
  • U-Net segmentation can guide embedding areas; Ni et al. concatenate the secret image into a six-channel tensor for reversible hiding, but high embedding rates increase distortion more than in robustness-focused methods.Their technique is less affected by high- or low-frequency areas and generally offers better capacity than cover-selection or cover-synthesis approaches.Source: 1) Encoder-decoder Framework · p. 10
  • UDH hides images independently of the cover and is robust in low-frequency covers, but cannot adapt to smoother areas and performs poorly under severe uniform random noise.Chen et al. offer basic, secure, and secure-robust variants, but the approach accepts only grayscale images.Source: 1) Encoder-decoder Framework · pp. 10–11
  • The secure model had the best invisibility against all models and remained best against and; the secure-and-robust model performed less well but still improved.Its visual results were similar to ISGAN.Source: 1) Encoder-decoder Framework · p. 11

2) Generative Adversarial Networks based models:

GAN architectures support diverse steganography strategies, from grayscale secret-image hiding to coverless and invertible methods. Their reported trade-offs involve robustness, detectability, image quality, and the complexity of the hidden image.

ISGAN

  • ISGAN residuals were less obvious and its extracted secret image closer to the original than, while grayscale hiding traded image complexity for greater invisibility.ISGAN uses the cover image’s Y luminance channel to hide a grayscale secret image.Source: 2) Generative Adversarial Networks… · p. 11

Texture-image models

  • Li et al.’s two texture-image models had near-zero steganalysis detection rates, but generated covers were limited to textures and the integrated model could distort colors when images differed substantially.The separate generation-and-embedding model is easier to train and applicable to more settings than the integrated model.Source: 2) Generative Adversarial Networks… · p. 11

Coverless steganography

  • Quin et al.’s coverless basic model improved image quality and payload capacity over [38], while its dense version matched SteganoGAN and its decoder was more accurate.The comparison differs in payload type: the coverless method encodes binary strings, whereas SteganoGAN encodes images.Source: 2) Generative Adversarial Networks… · p. 11

Invertible steganography

  • Chang et al. achieved invertible steganography by combining the Regular-Singular method with conditional GANs, improving on earlier RS-based models.The method uses regular, singular, and unusable blocks to form an RS map and a U-Net generator.Source: 2) Generative Adversarial Networks… · p. 11

CycleGAN

  • S-CycleGAN uses image translation, LSB matching, and reconstruction, with adversarial and cycle-consistency losses; it was reported as more resistant to detection.Its three discriminators include an added steganalysis module.Source: 2) Generative Adversarial Networks… · pp. 11–12
  • S-CycleGAN was reported as more robust than SGAN, with 2.6x the Inception Score and 7x the Frechet Inception Distance of SGAN.The reported approach combines the original CycleGAN framework with S-UNIWARD.Source: 2) Generative Adversarial Networks… · p. 12

C. Data Hiding Detection and Removal Mechanisms

The section distinguishes steganalysis from watermark removal and describes attack assumptions relevant to each. It also compares model results while warning that differing test conditions limit direct comparisons.

C. Data Hiding Detection and Removal Mechanisms

1) Steganlysis:

  • Steganalysis detects covert messages; signature methods may be specific to a known embedding method or universal across several techniques, and evolving detection methods help assess robustness.Universal signature steganalysis does not require knowledge of the embedding method.Source: 1) Steganlysis · p. 12

2) Watermark Removal Strategies:

  • Watermark removal includes blind, key-estimation, and tampering attacks; deep-learning watermarking is described as a black box, so it currently needs to defend against blind attacks, though that boundary may change.Blind attacks assume no knowledge of the watermarking process; key-estimation and tampering attacks assume increasing knowledge.Source: 2) Watermark Removal Strategies · p. 12

D. Results

  • Result comparisons use COCO, BER for robustness, and PSNR for encoded-image quality, but differing cover images, watermark dimensions, and attack pools mean results are only general indicators.Table III reports BER and Table IV reports PSNR; the passage does not provide their cell values.Source: D. Results · p. 12, Table III · p. 13, Table IV · p. 13

IV. NOISE INJECTION TECHNIQUES

  • Noise-injection methods simulate attacks during training, commonly using predefined attacks with differentiable noise and geometric layers, or trained CNN-generated distortions and two-stage training.Source: §IV · pp. 12–13

A. Identity

The section surveys attack simulation strategies for training deep data-hiding models, from identity-only controls and predefined attack pools to adversarially generated distortions and two-stage training. It also outlines the loss trade-offs used to optimize robustness and imperceptibility.

A. Identity

  • HiDDeN trained only with an Identity layer achieved a 50% success rate under JPEG and Crop distortions and performed considerably worse against other attacks.Earlier techniques without attack simulation were primarily proof-of-concept demonstrations.Source: A. Identity · p. 13

B. Pre-defined Attack Pool

  • A predefined attack pool exposes models to selected attack types and intensities; differentiable approximations allow non-differentiable attacks such as JPEG to be included in training.ROMarK [28] generates distortions with the largest decoding error to optimize model parameters across attacks.Source: B. Pre-defined Attack Pool · p. 13

C. Adversarial Training

  • The Distortion Agnostic model outperformed HiDDeN on unseen saturation, hue, and resizing attacks, though it did not surpass HiDDeN trained for a single specific attack.A trained CNN generates distortions explicitly to foil the decoder during adversarial training.Source: C. Adversarial Training · pp. 13–14

D. Two-stage Training for Noise Injection

  • Two-Stage Separable Deep Learning (TSDL) uses decoder second-stage training to handle varied attacks and true non-differentiable distortions, improving robustness to GIF and JPEG compression, though its overhead trade-off is unclear.Source: D. Two-stage Training for Noise… · p. 14

V. OBJECTIVE FUNCTIONS

  • Encoder-decoder objectives commonly weight cover-to-encoded-image loss for imperceptibility and secret-to-extracted-message loss for robustness, adding adversarial loss when the architecture includes an adversarial network.The survey also notes novel strategies outside this encoder-decoder framework.Source: §V · p. 14

A. Mean Squared Error (MSE)

The survey reviews loss functions for image and watermark data hiding, including pixel differences, probability-distribution differences, and losses that spread error across an image. It also describes how these functions are used in encoder and decoder training.

A. Mean Squared Error (MSE)

  • MSE squares pixel differences to compare cover and encoded images, highlighting concentrated perceptual errors; some works also apply it to watermark comparison.It is used for encoder loss in,, [38],, [41], –, and for both encoder and decoder loss in,,,,,,, [50],,.Source: A. Mean Squared Error (MSE) · p. 14

B. Mean Absolute Error (MAE)

  • MAE uses absolute rather than squared differences, giving outliers no special weight; it is used for decoder loss in and encoder and decoder losses in,,,.The passage describes MAE as suitable for discrete binary messages and as supporting balanced encoder-decoder training.Source: B. Mean Absolute Error (MAE) · p. 14

C. Cross Entropy Loss

  • Cross-entropy compares true and estimated watermark-bit distributions, penalizing predictions that assign high probability away from the true distribution.It is used for decoder loss in,, [38],, and for adversarial loss in,.Source: C. Cross Entropy Loss · p. 15

D. Mean-Variance Loss

  • Mean-variance loss spreads error across image regions to avoid perceptible concentrations, and combines it with MAE for encoder and decoder losses.Works, [41] use a joint mean-variance decoder loss because redundant watermark data need not be extracted identically; b counts replicated message slices and k counts sequence tuples.Source: D. Mean-Variance Loss · p. 15

E. Adversarial Loss

The survey describes adversarial losses and alternative optimization approaches for data hiding. These include distribution-based and cycle-consistency objectives, Wasserstein critics, image-fusion correlation, distortion constraints, and inconsistent loss.

E. Adversarial Loss

  • Adversarial loss adds a discriminator objective to optimization and can be combined with encoder loss to improve encoded-watermark imperceptibility.In, [28],, the cover and encoded images form the inputs to the combined encoder objective.Source: E. Adversarial Loss · p. 15

F. KL Divergence

  • KL divergence measures differences between probability distributions and is used with JS divergence for adversarial loss in.The distributions are those of cover images and generated steganographic images.Source: F. KL Divergence · p. 15

G. Cycle Consistency Loss

  • Cycle consistency supports unpaired translation between cover-image and secret-image domains, but the learned mapping does not guarantee exact recovery of the original watermark.The framework in, uses two generators and two discriminators; its cycle adversarial loss evaluates extracted watermarks.Source: G. Cycle Consistency Loss · p. 15

H. Wasserstein Loss

  • WGAN-based models [38], –, use a critic that scores encoded images rather than classifying examples as real or fake.The critic’s cover-image and encoded-image outputs define Wasserstein loss.Source: H. Wasserstein Loss · p. 16

I. Novel Approaches

  • Image fusion in maps watermark features with cover-image features into a fused latent space and uses correlation loss between feature spaces.The account also notes an independently developed similar approach in.Source: §I · p. 16
  • The distortion-minimization framework [55] constrains payload while assigning higher modification costs to pixels likely to create perceptible differences.CycleGAN work also uses inconsistent loss so unencoded cover images should not yield the real secret watermark, alongside adversarial and cycle-adversarial losses.Source: §I · p. 16

VI. EVALUATION METRICS

The survey groups evaluation metrics into robustness, encoded-image quality, and information capacity. Robustness metrics compare original embedded data with extracted data after attacks or other distortions.

VI. EVALUATION METRICS

  • Evaluation metrics cover robustness, encoded-image quality, and information capacity.Robustness is assessed after attacks by comparing original message data with data extracted from the encoded image.Source: §VI · p. 16, A. Robustness · p. 16

1) Bit Error Rate (BER):

  • BER measures the percentage of erroneous bits by comparing the original binary message with the extracted binary message.The equation divides bit errors by total transmitted bits.Source: 1) Bit Error Rate (BER) · p. 16

2) Normalised Correlation (NC):

  • Normalised correlation measures similarity between the original and extracted messages, with values from 0 to 1 and higher values indicating greater similarity.Source: 2) Normalised Correlation (NC) · p. 16

B. Quality

The survey describes image-quality metrics used to assess encoded-image imperceptibility. It covers signal-based, structural, learned perceptual, and synthetic-image measures.

B. Quality

  • Encoded-image quality metrics assess imperceptibility, since embedded data should not create detectable image perturbations.Source: B. Quality · pp. 16–17

1) Peak Signal to Noise Ratio (PSNR):

  • PSNR measures cover-to-encoded-image difference in decibels, with values above 30 dB generally indicating differences invisible to the human eye.It is calculated using the mean square error of the cover and watermarked images.Source: 1) Peak Signal to Noise Ratio (PSNR) · p. 17

2) Structural Similarity Index (SSIM):

  • SSIM measures perceived structural degradation using luminance, contrast, variance, and covariance; a score of 1 indicates identical images.Unlike MSE and PSNR, it accounts for dependencies between spatially close pixels.Source: 2) Structural Similarity Index (SSIM) · p. 17

3) Learned Perceptual Image Patch Similarity (LPIPS):

  • LPIPS estimates perceptual distance between image patches using a model trained on distortions and real algorithm outputs; lower scores indicate greater similarity.The survey presents it as going beyond simpler SSIM and PSNR metrics.Source: 3) Learned Perceptual Image Patch… · p. 17

4) Frechet Inception Distance (FID):

  • FID evaluates synthetic-image quality using Inception v3 features; lower scores indicate higher image quality.The comparison is between feature distributions for generated images and real images.Source: 4) Frechet Inception Distance (FID) · p. 17

C. Capacity

Capacity describes how much information can be embedded in cover media. The survey discusses BPP and RS-BPP measures and catalogs image datasets used to train deep data-hiding models.

C. Capacity

  • Capacity measures the amount of information that can be embedded in cover media.Source: C. Capacity · p. 17

1) Bits Per Pixel (BPP):

2) Reed Solomon Bits Per Pixel (RS-BPP):

  • RS-BPP uses Reed-Solomon correction capacity to compare deep data-hiding techniques with traditional algorithms.It addresses the difficulty of measuring embedded bits per pixel when capacity depends on the model and cover image.Source: 2) Reed Solomon Bits Per Pixel (RS-BPP) · p. 17

VII. DATASETS

  • The datasets section catalogs training image databases, including COCO, which contains 330 thousand complex everyday-scene images.COCO is used to train and test surveyed models.Source: §VII · p. 17, Table V · p. 18

VIII. OPEN QUESTIONS AND FUTURE WORK

The survey identifies open research directions across media, watermark removal, and misuse. It highlights unmet needs in deep watermarking beyond images and in training against realistic attacks.

VIII. OPEN QUESTIONS AND FUTURE WORK

  • Future work spans watermarking other media and machine-learning models, removal attacks, synthetic-media identification, and steganography-enabled malware risks.Source: §VIII · p. 18

A. Expanding Applications for Deep Learning Digital Watermarking Models

B. Text Watermarking for Combating Misinformation

  • Language watermarking must preserve text quality; the AWT approach works effectively on long texts, while shorter texts risk noticeable degradation.The survey suggests combining AWT with automated or human fact-checking to reduce false positives.Source: B. Text Watermarking for Combating… · p. 19

C. Mitigating Watermark Removal Attacks

  • A CNN removal technique can erase watermarks from images watermarked by frequency-domain algorithms while preserving cover-image quality, underscoring an evolving attacker-defender contest.Source: C. Mitigating Watermark Removal Attacks · p. 19
  • Differentiable attack layers do not represent many real-world attacks, motivating training with adversarially generated attacks rather than fixed differentiable pools.The survey also notes differentiable approximations can simulate JPEG compression and identifies adversarial examples and black-box noise as promising approaches.Source: C. Mitigating Watermark Removal Attacks · p. 19

D. Watermarking for Protecting Machine Learning Models

The survey considers model watermarking for intellectual-property protection alongside risks from malicious watermark use. It concludes that deep-learning data hiding spans watermarking and steganography, with future potential for digital security.

D. Watermarking for Protecting Machine Learning Models

  • Model watermarking can protect costly models and private training data, but dataset-based schemes may sacrifice classification accuracy.DeepSigns is described as robust to compression, fine-tuning, and watermark overwriting; Entangled Watermarking Embeddings entangle watermark and legitimate data, while REFIT can remove watermarks without knowing them.Source: D. Watermarking for Protecting Machine… · pp. 19–20

E. Watermarking for Launching Backdoor Attacks

F. Deepfake Detection and Identification

G. Malware using Steganography

IX. CONCLUSION

  • The survey synthesizes deep-learning watermarking and steganography research and identifies potential for digital IP protection and communication security in Responsible AI.Source: §IX · p. 21
Loading 2107.09287v3…