research-article

CNN-Based Adversarial Embedding for Image Steganography

Authors:

Jiwu HuangAuthors Info & Claims

IEEE Transactions on Information Forensics and Security, Volume 14, Issue 8

Pages 2074 - 2087

https://doi.org/10.1109/TIFS.2019.2891237

Published: 01 August 2019 Publication History

Abstract

Steganographic schemes are commonly designed in a way to preserve image statistics or steganalytic features. Since most of the state-of-the-art steganalytic methods employ a machine learning (ML)-based classifier, it is reasonable to consider countering steganalysis by trying to fool the ML classifiers. However, simply applying perturbations on stego images as adversarial examples may lead to the failure of data extraction and introduce unexpected artifacts detectable by other classifiers. In this paper, we present a steganographic scheme with a novel operation called adversarial embedding (ADV-EMB), which achieves the goal of hiding a stego message while at the same time fooling a convolutional neural network (CNN)-based steganalyzer. The proposed method works under the conventional framework of distortion minimization. In particular, ADV-EMB adjusts the costs of image elements modifications according to the gradients back propagated from the target CNN steganalyzer. Therefore, modification direction has a higher probability to be the same as the inverse sign of the gradient. In this way, the so-called adversarial stego images are generated. Experiments demonstrate that the proposed steganographic scheme achieves better security performance against the target adversary-unaware steganalyzer by increasing its missed detection rate. In addition, it deteriorates the performance of other adversary-aware steganalyzers, opening the way to a new class of modern steganographic schemes capable of overcoming powerful CNN-based steganalysis.

References

[1]

B. Li, J. He, J. Huang, and Y. Q. Shi, “ A survey on image steganography and steganalysis,” J. Inf. Hiding Multimedia Signal Process., vol. Volume 2, no. Issue 2, pp. 142–172, 2011.

[2]

A. Westfeld and A. Pfitzmann, “ Attacks on steganographic systems: Breaking the steganographic utilities EzStego, Jsteg, Steganos, and S-Tools-and some lessons learned,” in Proc. Int. Workshop Inf. Hiding, 1999, pp. 61–75.

Digital Library

[3]

J. Fridrich and M. Goljan, “ On estimation of secret message length in LSB steganography in spatial domain,” in Proc. SPIE, vol. Volume 5306, pp. 23–36, Jun. 2004.

[4]

N. Provos, “ Defending against statistical steganalysis,” in Proc. 10th Conf. USENIX Secur. Symp., vol. Volume 10, 2001, pp. 323–336.

Digital Library

[5]

J. Mielikainen, “ LSB matching revisited,” IEEE Signal Process. Lett., vol. Volume 13, no. Issue 5, pp. 285–287, 2006.

[6]

W. Luo, F. Huang, and J. Huang, “ Edge adaptive image steganography based on LSB matching revisited,” IEEE Trans. Inf. Forensics Security, vol. Volume 5, no. Issue 2, pp. 201–214, 2010.

Digital Library

[7]

T. Pevný, P. Bas, and J. Fridrich, “ Steganalysis by subtractive pixel adjacency matrix,” IEEE Trans. Inf. Forensics Security, vol. Volume 5, no. Issue 2, pp. 215–224, 2010.

Digital Library

[8]

C. Chen and Y. Q. Shi, “ JPEG image steganalysis utilizing both intrablock and interblock correlations,” in Proc. IEEE Int. Symp. Circuits Syst., May 2008, pp. 3029–3032.

[9]

J. Fridrich and T. Filler, “ Practical methods for minimizing embedding impact in steganography,” Proc. SPIE, vol. Volume 6505, pp. 650502-1–650502-15, Jan. 2007.

[10]

T. Pevný, T. Filler, and P. Bas, “ Using high-dimensional image models to perform highly undetectable steganography,” in Proc. Int. Workshop Inf. Hiding, 2010, pp. 161–177.

Digital Library

[11]

V. Holub and J. Fridrich, “ Designing steganographic distortion using directional filters,” in Proc. IEEE Int. Workshop Inf. Forensics Secur. (WIFS), Dec. 2012, pp. 234–239.

[12]

V. Holub, J. Fridrich, and T. Denemark, “ Universal distortion function for steganography in an arbitrary domain,” EURASIP J. Inf. Secur., vol. Volume 2014, no. Issue 1, pp. 1–13, 2014.

[13]

B. Li, M. Wang, J. Huang, and X. Li, “ A new cost function for spatial image steganography,” in Proc. IEEE Int. Conf. Image Process., Oct. 2014, pp. 4206–4210.

[14]

L. Guo, J. Ni, and Y. Q. Shi, “ Uniform embedding for efficient JPEG steganography,” IEEE Trans. Inf. Forensics Security, vol. Volume 9, no. Issue 5, pp. 814–825, 2014.

Digital Library

[15]

W. Zhou, W. Zhang, and N. Yu, “ A new rule for cost reassignment in adaptive steganography,” IEEE Trans. Inf. Forensics Security, vol. Volume 12, no. Issue 11, pp. 2654–2667, 2017.

[16]

J. Fridrich and J. Kodovský, “ Rich models for steganalysis of digital images,” IEEE Trans. Inf. Forensics Security, vol. Volume 7, no. Issue 3, pp. 868–882, 2012.

Digital Library

[17]

B. Li, Z. Li, S. Zhou, S. Tan, and X. Zhang, “ New steganalytic features for spatial image steganography based on derivative filters and threshold LBP operator,” IEEE Trans. Inf. Forensics Security, vol. Volume 13, no. Issue 5, pp. 1242–1257, 2018.

Digital Library

[18]

J. Kodovský and J. Fridrich, “ Steganalysis of JPEG images using rich models,” in Proc. SPIE, vol. Volume 8303, p. pp.83030A, Feb. 2012.

[19]

V. Holub and J. Fridrich, “ Low-complexity features for JPEG steganalysis using undecimated DCT,” IEEE Trans. Inf. Forensics Security, vol. Volume 10, no. Issue 2, pp. 219–228, 2015.

[20]

X. Song, F. Liu, C. Yang, X. Luo, and Y. Zhang, “ Steganalysis of adaptive JPEG steganography using 2D Gabor filters,” in Proc. 3rd ACM Workshop Inf. Hiding Multimedia Secur., 2015, pp. 15–23.

Digital Library

[21]

J. Kodovský, J. Fridrich, and V. Holub, “ Ensemble classifiers for steganalysis of digital media,” IEEE Trans. Inf. Forensics Security, vol. Volume 7, no. Issue 2, pp. 432–444, 2012.

Digital Library

[22]

S. Tan and B. Li, “ Stacked convolutional auto-encoders for steganalysis of digital images,” in Proc. Asia-Pacific Signal Inf. Process. Assoc. Annu. Summit Conf. (APSIPA), Dec. 2014, pp. 1–4.

[23]

Y. Qian, J. Dong, W. Wang, and T. Tan, “ Deep learning for steganalysis via convolutional neural networks,” Proc. SPIE, vol. Volume 9409, p. pp.94090J, Mar. 2015.

[24]

G. Xu, H.-Z. Wu, and Y.-Q. Shi, “ Structural design of convolutional neural networks for steganalysis,” IEEE Signal Process. Lett., vol. Volume 23, no. Issue 5, pp. 708–712, 2016.

[25]

G. Xu, H.-Z. Wu, and Y.-Q. Shi, “ Ensemble of CNNs for steganalysis: An empirical study,” in Proc. 4th ACM Workshop Inf. Hiding Multimedia Secur., 2016, pp. 103–107.

Digital Library

[26]

G. Xu, “ Deep convolutional neural network to detect J-UNIWARD,” in Proc. 5th ACM Workshop Inf. Hiding Multimedia Secur., 2017, pp. 67–73.

Digital Library

[27]

J. Zeng, S. Tan, B. Li, and J. Huang, “ Large-scale JPEG image steganalysis using hybrid deep-learning framework,” IEEE Trans. Inf. Forensics Security, vol. Volume 13, no. Issue 5, pp. 1200–1214, 2017.

Digital Library

[28]

T. Denemark, P. Bas, and J. Fridrich, “ Natural steganography in JPEG compressed images,” in Proc. Electron. Imag., Jan. 2018, pp. 1–10.

[29]

A. Nguyen, J. Yosinski, and J. Clune, “ Deep neural networks are easily fooled: High confidence predictions for unrecognizable images,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit., Jun. 2015, pp. 427–436.

[30]

J. Bruna, “ Intriguing properties of neural networks,” in Proc. Int. Conf. Learn. Represent., 2014, pp. 1–10.

[31]

T.-T. Do, E. Kijak, L. Amsaleg, and T. Furon, “ Enlarging hacker's toolbox: Deluding image recognition by attacking keypoint orientations,” in Proc. IEEE Int. Conf. Acoust., Speech Signal Process., Mar. 2012, pp. 1817–1820.

[32]

Z. Chen, B. Tondi, X. Li, R. Ni, Y. Zhao, and M. Barni, “ A gradient-based pixel-domain attack against SVM detection of global image manipulations,” in Proc. IEEE Int. Workshop Inf. Forensics Secur., Dec. 2017, pp. 1–6.

[33]

I. Goodfellow, J. Shlens, and C. Szegedy, “ Explaining and harnessing adversarial examples,” in Proc. Int. Conf. Learn. Represent., 2015, pp. 1–11.

[34]

S.-M. Moosavi-Dezfooli, A. Fawzi, and P. Frossard, “ DeepFool: A simple and accurate method to fool deep neural networks,” in Proc. IEEE Conf Comput. Vis. Pattern Recognit., Jun. 2016, pp. 2574–2582.

[35]

A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu. (2017). “ Towards deep learning models resistant to adversarial attacks .” {Online}. Available: https://arxiv.org/abs/1706.06083

[36]

G. F. Elsayed (2018). “ Adversarial examples that fool both computer vision and time-limited humans .” {Online}. Available: https://arxiv.org/abs/1802.08195

Digital Library

[37]

A. Kurakin, I. Goodfellow, and S. Bengio. (2016). “ Adversarial examples in the physical world .” {Online}. Available: https://arxiv.org/abs/1607.02533

[38]

M. Barni and F. Pérez-González, “ Coping with the enemy: Advances in adversary-aware signal processing,” in Proc. IEEE Int. Conf. Acoust., Speech Signal Process., May 2013, pp. 8682–8686.

[39]

S. Kouider, M. Chaumont, and W. Puech, “ Adaptive steganography by oracle (ASO),” in Proc. IEEE Int. Conf. Multimedia Expo, Jul. 2013, pp. 1–6.

[40]

S. Kouider, M. Chaumont, and W. Puech, “ Technical points about adaptive steganography by oracle (ASO),” in Proc. 20th Eur. Signal Process. Conf., Apr. 2012, pp. 1703–1707.

[41]

Y. Zhang, W. Zhang, K. Chen, J. Liu, Y. Liu, and N. Yu, “ Adversarial examples against deep neural network based steganalysis,” in Proc. 6th ACM Workshop Inf. Hiding Multimedia Secur., 2018, pp. 67–72.

Digital Library

[42]

B. Li, M. Wang, X. Li, S. Tan, and J. Huang, “ A strategy of clustering modification directions in spatial image steganography,” IEEE Trans. Inf. Forensics Security, vol. Volume 10, no. Issue 9, pp. 1905–1917, 2015.

[43]

T. Denemark and J. Fridrich, “ Improving steganographic security by synchronizing the selection channel,” in Proc. 3rd ACM Workshop Inf. Hiding Multimedia Secur., 2015, pp. 5–14.

Digital Library

[44]

N. Papernot, P. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, and A. Swami, “ The limitations of deep learning in adversarial settings,” in Proc. IEEE Eur. Symp. Secur. Privacy, Mar. 2016, pp. 372–387.

[45]

T. Filler, J. Judas, and J. Fridrich, “ Minimizing additive distortion in steganography using syndrome-trellis codes,” IEEE Trans. Inf. Forensics Security, vol. Volume 6, no. Issue 3, pp. 920–935, 2011.

Digital Library

[46]

P. Bas, T. Filler, and T. Pevný, “ 'Break our steganographic system': The ins and outs of organizing BOSS,” in Proc. Int. Workshop Inf. Hiding, 2011, pp. 59–70.

Digital Library

[47]

N. Papernot, P. McDaniel, and I. Goodfellow. (2016). “ Transferability in machine learning: from phenomena to black-box attacks using adversarial samples .” {Online}. Available: https://arxiv.org/abs/1605.07277

[48]

L. Pibre, J. Pasquet, D. Ienco, and M. Chaumont, “ Deep learning is a good steganalysis tool when embedding key is reused for different images, even if there is a cover sourcemismatch,” in Proc. Media Watermarking, Secur., Forensics, 2016, pp. 1–11.

[49]

J. H. Metzen, M. C. Kumar, T. Brox, and V. Fischer. (2017). “ Universal adversarial perturbations against semantic image segmentation .” {Online}. Available: https://arxiv.org/abs/1704.05712

[50]

M. Barni and B. Tondi, “ The source identification game: An information-theoretic perspective,” IEEE Trans. Inf. Forensics Security, vol. Volume 8, no. Issue 3, pp. 450–463, 2013.

Digital Library

[51]

M. Barni and B. Tondi, “ Binary hypothesis testing game with training data,” IEEE Trans. Inf. Theory, vol. Volume 60, no. Issue 8, pp. 4848–4866, 2014.

Cited By

Al-Obaidi SLighvan MAsadpour M(2024)Enhanced image steganalysis through reinforcement learning and generative adversarial networksIntelligent Decision Technologies10.3233/IDT-24007518:2(1077-1100)Online publication date: 1-Jan-2024
https://dl.acm.org/doi/10.3233/IDT-240075
Kombrink MGeradts ZWorring M(2024)Image Steganography Approaches and Their Detection Strategies: A SurveyACM Computing Surveys10.1145/369496557:2(1-40)Online publication date: 10-Oct-2024
https://dl.acm.org/doi/10.1145/3694965
Tang WYang HRao YZhou ZPeng FCai JKankanhalli MPrabhakaran BBoll SSubramanian RZheng LSingh VCesar PXie LXu D(2024)Dig a Hole and Fill in Sand: Adversary and Hiding Decoupled SteganographyProceedings of the 32nd ACM International Conference on Multimedia10.1145/3664647.3681330(10440-10448)Online publication date: 28-Oct-2024
https://dl.acm.org/doi/10.1145/3664647.3681330
Show More Cited By

Recommendations

Adversarial Steganography Embedding via Stego Generation and Selection
The recent literature has shown that adversarial embedding has promise for enhancing the security of steganography. However, existing methods achieve the final stego mainly based on a pre-trained Convolutional Neural Network (CNN)-based steganalyzer ...
A New Steganography Without Embedding Based on Adversarial Training
ACM TURC '20: Proceedings of the ACM Turing Celebration Conference - China

Steganography is an art to hide information in the carriers to prevent from being detected, while steganalysis is the opposite art to detect the presence of the hidden information. With the development of deep learning, several state-of-the-art ...
Enhancing Adversarial Embedding based Image Steganography via Clustering Modification Directions
Image steganography is a technique used to conceal secret information within cover images without being detected. However, the advent of convolutional neural networks (CNNs) has threatened the security of image steganography. Due to the inherent ...

Comments

Information & Contributors

Information

Published In

cover image IEEE Transactions on Information Forensics and Security

IEEE Transactions on Information Forensics and Security Volume 14, Issue 8

August 2019

280 pages

ISSN:1556-6013

Issue’s Table of Contents

Copyright © 2019.

Publisher

IEEE Press

Publication History

Published: 01 August 2019

Qualifiers

Research-article

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

78
Total Citations
View Citations
0
Total Downloads

Downloads (Last 12 months)0
Downloads (Last 6 weeks)0

Reflects downloads up to 01 Nov 2024

Other Metrics

View Author Metrics

Citations

Cited By

Al-Obaidi SLighvan MAsadpour M(2024)Enhanced image steganalysis through reinforcement learning and generative adversarial networksIntelligent Decision Technologies10.3233/IDT-24007518:2(1077-1100)Online publication date: 1-Jan-2024
https://dl.acm.org/doi/10.3233/IDT-240075
Kombrink MGeradts ZWorring M(2024)Image Steganography Approaches and Their Detection Strategies: A SurveyACM Computing Surveys10.1145/369496557:2(1-40)Online publication date: 10-Oct-2024
https://dl.acm.org/doi/10.1145/3694965
Tang WYang HRao YZhou ZPeng FCai JKankanhalli MPrabhakaran BBoll SSubramanian RZheng LSingh VCesar PXie LXu D(2024)Dig a Hole and Fill in Sand: Adversary and Hiding Decoupled SteganographyProceedings of the 32nd ACM International Conference on Multimedia10.1145/3664647.3681330(10440-10448)Online publication date: 28-Oct-2024
https://dl.acm.org/doi/10.1145/3664647.3681330
Ye MZhou SLuo WTan SHuang JCai JKankanhalli MPrabhakaran BBoll SSubramanian RZheng LSingh VCesar PXie LXu D(2024)GAN-based Symmetric Embedding Costs Adjustment for Enhancing Image Steganographic SecurityProceedings of the 32nd ACM International Conference on Multimedia10.1145/3664647.3681311(7046-7054)Online publication date: 28-Oct-2024
https://dl.acm.org/doi/10.1145/3664647.3681311
Cui QZhou ZMeng RWang SYan HWu Q(2024)ARES: On Adversarial Robustness Enhancement for Image Steganographic Cost LearningIEEE Transactions on Multimedia10.1109/TMM.2024.335354326(6542-6553)Online publication date: 12-Jan-2024
https://dl.acm.org/doi/10.1109/TMM.2024.3353543
Qin CLi XZhang ZLi FZhang XFeng G(2024)Print-Camera Resistant Image Watermarking With Deep Noise Simulation and Constrained LearningIEEE Transactions on Multimedia10.1109/TMM.2023.329327226(2164-2177)Online publication date: 1-Jan-2024
https://dl.acm.org/doi/10.1109/TMM.2023.3293272
Lin KLi BLi WBarni MTondi BLiu X(2024)Constructing an Intrinsically Robust Steganalyzer via Learning Neighboring Feature Relationships and Self-Adversarial AdjustmentIEEE Transactions on Information Forensics and Security10.1109/TIFS.2024.347065119(9390-9405)Online publication date: 1-Jan-2024
https://dl.acm.org/doi/10.1109/TIFS.2024.3470651
Yang HXu XXu CZhang HQin JWang YHeng PHe S(2024)G²Face: High-Fidelity Reversible Face Anonymization via Generative and Geometric PriorsIEEE Transactions on Information Forensics and Security10.1109/TIFS.2024.344910419(8773-8785)Online publication date: 1-Jan-2024
https://dl.acm.org/doi/10.1109/TIFS.2024.3449104
Fan ZChen KZeng KZhang JZhang WYu N(2024)Natias: Neuron Attribution-Based Transferable Image Adversarial SteganographyIEEE Transactions on Information Forensics and Security10.1109/TIFS.2024.342189319(6636-6649)Online publication date: 1-Jan-2024
https://dl.acm.org/doi/10.1109/TIFS.2024.3421893
Tang WZhou ZLi BChoo KHuang J(2024)Joint Cost Learning and Payload Allocation With Image-Wise Attention for Batch SteganographyIEEE Transactions on Information Forensics and Security10.1109/TIFS.2024.335441119(2826-2839)Online publication date: 1-Jan-2024
https://dl.acm.org/doi/10.1109/TIFS.2024.3354411
Show More Cited By

View Options

View options

Get Access

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

Media

Figures

Other

Tables

View Issue’s Table of Contents