Year: 2018

Abstract:
Recently, generative adversarial network is the hotspot in research areas and industrial application areas. Its application on data generation in computer vision is most common usage. This paper extends its application to data hiding and security area. In this paper, we propose the novel framework to integrate steganography and steganalysis processes. The proposed framework applies generative adversarial networks as the core structure. The discriminative model simulate the steganalysis process, which can help us understand the sensitivity of cover images to semantic changes. The steganography generative model is to generate stego image which is aligned with the original cover image, and attempts to confuse steganalysis discriminative model. The introduction of cycle discriminative model and inconsistent loss can help to enhance the quality and security of generated stego image in the iterative training process. Training dataset is mixed with intact images as well as intentional attacked images. The mix training process can further improve the robustness and security of new framework. Through the qualitative, quantitative experiments and analysis, this novel framework shows compelling performance and advantages over the current state-of-the-art methods in steganography and steganalysis benchmarks.

heading: 1 INTRODUCTION
text: Steganography literally means “covered writing” and is usually interpreted to hide information in other information. As the counterpart, the main idea of steganalysis is to analyze whether the received information contains any hidden information, and to recover the hidden information if possible (Volkhonskiy et al., 2017). Since their birth, steganography and steganalysis have complementary progress. Steganography is widely used in secret information transmission (Shi et al., 2017), watermark (Yu, 2016), copyright certification (Mun et al., 2017), forgery detection (Wolfgang & Delp, 1996) applications.
In this paper, we propose an integrated steganography and steganalysis framework with generative adversarial networks, and use ISS-GAN to represent the method in this paper. (ISS is the acronym of integrated steganography and steganalysis.) ISS-GAN combines the steganalysis’s evaluation metrics of secure steganography with the advantages in latest GAN principle, and integrate the counterparts into single framework. Firstly, we will simulate the steganalysis process with discriminative model. It will help us to dynamically change the capacity of cover images, and understand their sensitivity to semantic change. Then with the fine-tuning adversarial training process of steganography generative model and steganalysis discriminative model, ISS-GAN can iteratively reduce the consistent loss between original cover images and generated stego images. Finally, when ISS-GAN gets the minimal consistent differences, the generated stego images can hardly be distinguished from original cover images. In the training process, we also involve some intentional attacks (noise, compression, etc.) in dataset. The mixture of training dataset can further improve the security of ISS-GAN. By comparing ISS-GAN with the state-of-the-art steganography methods in benchmark datasets, we can conclude that ISS-GAN has the advantages in improving the quality and security of generated stego images.
In Figure 1, can you differentiate between Van Gogh’s paintings in (a) and (b)? Or Monet’s paintings in (e) and (f)? Actually, the images in (a) and (e) are the original version of drawing masters’ works. The images in (b) and (f) are the stego version with ISS-GAN framework. The embedded
secret images are emblems of painters’ nations: Netherland and France. The embedded info is kept imperceptible to ensure there is no influence on audience to appreciate paintings from fidelity aspect.

heading: 2 RELATED WORK
text: State-of-the-art steganography approaches can be categorized into three types.
Least Significant Bit Steganography The main strength of this category is that algorithms are theoretically simple and have low computational complexities. Secret information is embedded into cover image with the operations like shifting or replacing of pixels. In typical Least Significant Bit (LSB) algorithm, pixel values of cover image and secret messages are represented by binary form. Stego image generation process is implemented by replacing the least significant bits of cover image with the most significant bits of secret information. In (Das et al., 2018), authors proposed to generate a LSB based hash function for image authentication process, which can provide good imperceptibility between original image and stego image with hash bits. Moreover, it can successfully identify tamper by a process of tamper localization.
Content Adaptive Steganography In this category, some sophisticated steganographic algorithms design a hand-crafted distortion function which is used for selecting the embedding localization of the image. These algorithms are the most secure image steganography in spatial domain, such as Wavelet Obtained Weights (WOW), Highly Undetectable Steganography (HUGO), S-UNIWARD, etc. WOW (Holub & Fridrich, 2012) embeds information into the cover image according to textural complexity of regions. In WOW algorithm, the more texturally complex the image region is, the more pixel values will be modified in this region. HUGO (Pevnỳ et al., 2010) defines a distortion function domain by assigning costs to pixels based on the effect of embedding some information within a pixel. It uses a weighted norm function to represent the feature space. S-UNIWARD (Holub et al., 2014) proposes a universal distortion function that is independent of the embedded domain. Despite the diverse implementation details, the ultimate goals are identical in this category. They are all devoted to minimize distortion functions, to embed the secret into the noisy area or complex textures, and to avoid the smooth regions of the cover images.
Deep Learning based Steganography As deep learning has brilliant capability in image processing and generation, researchers also attempt to utilize it in steganography. (Volkhonskiy et al., 2017)
introduces a new model for generating more steganalysis-secure cover images based on deep convolutional generative adversarial networks. (Dong et al., 2018) proposes a steganography model which can conceal a gray secret image into a color cover image with the same size, and generate stego image which seems quite similar to cover image in semantics and color. (Shi et al., 2017) wants to generate more secure covers for steganography. Based on Wasserstein GAN (Arjovsky et al., 2017), the proposed algorithm is efficient to generate cover images with higher visual quality.

heading: 3 FRAMEWORK OF ISS-GAN

heading: 3.1 PRINCIPLE OF ISS-GAN
text: In the proposal, ISS-GAN is a steganography framework to embed secret message into the source cover image. So here are two essential metrics to evaluate the steganographic algorithm.
• Secret info should remain imperceptible until it is extracted by specific authorized receiver. • Stego image should be secure and intact to resist tampering and attacks.
In traditional state-of-the-art frameworks, the imperceptibility is achieved by carefully choosing the LSB in pixel domain, or relied on hand-crafted distortion function in traditional steganography. So the features and algorithms need meticulous artificial design. Moreover, these designs heavily rely on the characteristics of target images. So it is very hard for these schemes to become general solutions in various applications. The artificial designed features are also vulnerable to intentional and hybrid attacks. For deep learning based steganography, the main focus is to generate the steganalysis-secure cover images. But in many real applications, the cover images are given. So how to fully utilize the given images to hide secret, and to improve the security of generated stego images are not answered.
After analysing the drawbacks of state-of-the-art algorithms, we find GAN is very suitable for integrated steganography and steganalysis framework. Instead of artificial design, the generative network can learn from training samples and generate the suitable imperceptible features by itself. The discriminative network can simulate the function of steganalysis. The iterative adversarial training process can strength the capability if steganalysis model as well as steganography model. The stronger steganalysis model will stimulate the boost of steganography model, and vice versa. Moreover, how to resist the tampering can also be learned from attacked training samples.
For the first evaluation metric, let’s imagine the following situation. An eavesdropper wants to check whether the image he obtained from public media contains secret info. So he needs to discriminate the original cover image and received stego image. If these two images are perceptibly same, then the eavesdropper can hardly differentiate the stego image from the cover image.
For the purpose of steganography, we can accumulate the visual and statistic differences between cover and stego images. If the difference for each evaluation metric is small enough, we can regard this stego image as a high-quality steganography result. This aligns with the imperceptible evaluation criterion of steganography.
For the second evaluation metric, let’s imagine the following situation. The eavesdropper wants to destroy the secret communication. So he makes intentional changes to the stego image, like rotate, clip, add noises and JPEG compression. Because he assume that even the image he obtained contains secret, these intentional changes will make the secret extraction method disabled. If the steganography framework is secure, and steganalysis algorithm is robust enough, the intentional changes are in vain. This aligns with the secure evaluation criterion of steganography.
GAN (Goodfellow et al., 2014) consists of the generative model and the discriminative model. The purpose of the generative model is to generate new samples which are very similar to the real samples, and attempts to confuse the discriminator. While the purpose of the discriminative model is to classify samples synthesized by the generative model and the real ones. The discriminative model will also estimate the probability that a specific sample comes from the generative model rather than the real ones. When the whole GAN model achieves Nash Equilibrium, that is to say, the generative model can generate the samples which exactly align with the character and distribution of real samples. And at the same time, the discriminative model returns the classification probability 0.5 for each pair of generated and real samples. Then this GAN model is well-trained and converged.
To combine the purpose of steganography, steganalysis and GAN model, we propose novel ISSGAN framework. ISS-GAN also consists of the steganography generative and steganalysis discriminative model. The purpose of steganography generative model is to generate stego image which is aligned with the original cover image, and attempts to confuse steganalysis discriminative model. While the purpose of the discriminative model is to distinguish generated stego image from the cover image. When ISS-GAN achieves Nash Equilibrium, i.e., the generative model can generate stego image which exactly aligns with the character and distribution of cover image. And at the same time, the discriminative model returns the classification probability 0.5 for each pair of stego and cover image. This also aligns with the evaluation criterion of steganography and steganalysis. In conclusion, designing steganography and steganalysis framework is equal to make the ISS-GAN model well-trained and converged. The overall framework of ISS-GAN is shown in Figure. 2.
In ISS-GAN, there are two generative models and two discriminative models. Because steganography and steganalysis framework should contain secret info embedding and extraction processes, so it needs to learn the bijective mapping relationship between two image collections. For ISS-GAN, one image collection contains the original cover images, the other collection contains the secret images for embedding.
In the left part of Figure 2, the original cover image (CI) and the original secret image (STI) go through the stego image generative model GSOI , to produce the stego image (SOI). This is the secret embedding and stego image generation process, which can be expressed as follows.
SOI = GSOI(CI, STI) (1)
In the right part of Figure 2, the stego image (SOI) go through the secret image generative model GSTI , to get the extracted secret image (ESTI). This is the secret image extraction process, which can be expressed as follows.
ESTI = GSTI(SOI) (2)
The cover image discriminative model DCI ensures that the distribution of images from CI is indistinguishable from the distribution SOI using an adversarial loss. This is the guarantee of the imperceptible evaluation criterion in steganography.
For the purpose of refining secret extraction, we introduce the secret image cycle discriminative model DSTI . Because generative model is learned to transform from a source image domain to a target image domain. Take the secret image generative model GSTI as an example, the learned mapping relation is highly under-constrained, and cannot ensure the generated ESTI is indistinguishable from original STI (Zhu et al., 2017). So we couple this mapping relation with its inverse mapping GSOI , and introduce a cycle adversarial loss:
DSTI(STI,ESTI)→ 0 (3) That is equal to GSTI(SOI) = GSTI(GSOI(CI, STI)) ≈ STI (4) Its goal is to ensure that the distribution of images from ESTI is indistinguishable from the distribution STI using cycle adversarial loss DSTI . This is the guarantee of the secure and robust extraction criterion in steganography and steganalysis.
To refine steganalysis scheme, we introduce the extra inconsistent loss. To make the whole ISSGAN framework useable, we should ensure the secret can only be extracted from SOI. If we apply the secret extraction process to CI, secret image should not be recovered. The inconsistent loss can be expressed as follows:
max GSTI
|GSTI(CI)− GSTI(SOI)| (5)

heading: 3.2 LOSS FUNCTION DEFINITION
text: The overall loss function of ISS-GAN consists of three parts: the adversarial loss LGAN (GSOI , DCI ), the cycle adversarial loss LGAN (GSTI , DSTI ) and the inconsistent loss LIC . So the loss function is written as follows:
LOverall = LGAN (GSOI ,DCI) + LGAN (GSTI ,DSTI) + λLIC [GSTI(CI),GSTI(SOI)], (6)
where λ is the parameter to adjust the percentages between adversarial loss and inconsistent loss. The inconsistent loss needs to change to the minimization format as follows.
min GSTI
1
|GSTI(CI)− GSTI(SOI)| (7)
In ISS-GAN framework, the quality of generated stego image SOI and extracted secret image ESTI is judged by the difference from original cover image CI and original secret image STI, respectively. In this paper, two quantitative image effect indicators are applied to measure the differences (Yu, 2017). Peak Signal to Noise Ratio (PSNR) indicator is applied to assess the effect difference from the gray-level fidelity aspect. Structural Similarity (SSIM) (Wang et al., 2004) indicator which is an image quality assessment indicator based on the human vision system is applied to assess the effect difference from the structure-level fidelity aspect. The definitions of these two evaluation indicators are as follows.
PSNR(x, y) = 10 log10
( (MAXI )2
MSE (x, y)
) , (8)
where MAXI is the maximum possible pixel value of images: x and y. MSE(x,y) represents the Mean Squared Error (MSE) between images: x and y.
SSIM(x, y) = (2µxµy + C1) (2σxy + C2)(
µ2x + µ 2 y + C1 ) ( σ2x + σ 2 y + C2 ) , (9) where µx and µy represent the average grey values of images. Symbol σx and σy represent the variances of images. Symbol σxy represents covariance between images. C1 and C1 are two constants which are used to prevent unstable results when either µ2x + µ 2 y or σ 2 x + σ 2 y is very close to 0.

heading: 3.3 ISS-GAN NETWORK STRUCTURE
text: For ISS-GAN, the resolution of cover image CI and secret image STI is 256×256. The network structure of stego image generative model GSOI includes a convolution layer (kernel size = 7, stride = 0, pad = 0), two convolution layers (kernel size = 3, stride = 2, pad = 1), nine residual blocks (He et al., 2016), and two deconvolution layers (kernel size = 3, stride = 2, pad = 1, outside pad = 1), and a convolution layer (kernel size = 7, stride = 0, pad = 0). Each convolution and deconvolution layer follows with an instance normalization layer and a ReLU layer. The structure of secret image generative model GSTI is identical with GSOI .
The network structure of cover image discriminative model DCI is similar with PatchGAN model (Isola et al., 2017). Each time, it operates a image patch with 70×70 size, and classifies whether this patch is real or fake. The model will run across the whole image, and average all results in the 70×70 overlapping patches to provide the ensemble output. The architecture of such a patch-level discriminative model requires fewer parameters and runs faster than a full-image discriminator (Yi et al., 2017). Moreover, it has no constraints over the size of the input image. DC contains a convolution layer (kernel size = 4, stride = 2, pad = 1) follows with a leaky ReLU layer, three convolution layers (kernel size = 4, stride = 2, pad = 1) follows with an instance normalization layer and a leaky ReLU layer, a convolution layer (kernel size = 4, stride = 1, pad = 1) follows with an instance normalization layer and a leaky ReLU layer, a convolution layer (kernel size = 4, stride = 1, pad = 1)
follows with a sigmoid layer to output a scalar output between [0, 1]. The structure of secret image cycle discriminative model DSTI is identical with DCI .
Moreover, to improve the convergence performance, we use Adam optimizer (Kinga & Adam, 2015) instead of stochastic gradient descent (SGD) optimizer. In practice, Adam optimizer can be adaptive to the training of ISS-GAN. It is computationally efficient and has little memory requirements. The hyper-parameters of Adam optimizer are: β1=0.5, β2=0.999. The base learning rate is 0.0002.

heading: 4 EXPERIMENTAL RESULTS

heading: 4.1 STEGANOGRAPHY PERFORMANCE EXPERIMENTS
text: In the secret embedding and stego image generation performance experiments, we adopt the benchmark images as the cover images CI shown in the first row of Figure 3 to test the performance of proposed ISS-GAN framework. The embedded secret image used is the Barbara benchmark image. We use PyTorch as the framework and train ISS-GAN with 150 epochs.
The generated stego images SOI are shown in the second row of Figure 3. For illustration purpose, the residual differences between cover and stego images are shown in the third row of Figure 3. The PSNR and SSIM metrics for generated stego images SOI versus cover images CI are shown in Table 1. (SOI is used as image x, and CI is used as image y for PSNR and SSIM metrics calculation equations (8) and (9).) The results shown in Figure 3 and Table. 1 can prove the high quality and difference imperceptibility of SOI in qualitative and quantitative aspects.
Let’s have a further analysis of the obtained results. If we magnify Figure 3 to see the residual differences, we can find they are mainly on the marginal and textural parts of objects. For example, the hat of Lena, the edges of F16 plane, the skin and whiskers of baboon, the profile of fruits and peppers, etc. It means ISS-GAN tends to hide the secret info into marginal parts of the object in
original cover images. In information theory, textures and edges represent the high frequency parts of the image, while smooth regions represent the low frequency parts of the image. If we change the low frequency parts, it is easy to be detected by steganalysis method. So many state-of-theart steganography algorithms transform the cover image from spatial domain to frequency domain. Change the tiny part in high frequency parts, and transform it back to spatial domain. Moreover, when we discuss the state-of-the-art content adaptive steganography algorithms, we find the ultimate goal is trying to embed the secret image into the parts with complex edges and textures, and avoiding the smooth regions of the cover images. The behavior of ISS-GAN is very similar to the state-ofthe-art steganography algorithms. But the state-of-the-art algorithms need to design a hand-crafted distortion function to achieve the goal, while ISS-GAN learns from the discriminative network which simulates the behaviors of steganalysis. From the learning process, the generative network in ISSGAN finds steganalysis method are very sensitive to the low frequency parts, and not so sensitive to the high frequency parts. So the stego images generated by ISS-GAN generative network mainly hide their secret info into marginal and textural parts to ensure the best imperceptibility.

heading: 4.2 STEGANALYSIS QUALITATIVE PERFORMANCE EXPERIMENTS
text: In the steganalysis qualitative experiments, we adopt the world-renowned art paintings shown in Figure 1 to test the performance of proposed ISS-GAN and its robustness to different patterns of noise attack. Several patterns of noises are adopted respectively to imitate real-world noise attacks. We use PyTorch as the framework and train ISS-GAN with 200 epochs. The extracted secret image ESTI are shown in Figure 4 and Appendix Figure 8. The results shown in Figure 4 and 8 can prove the high quality of ESTI in qualitative aspect.

heading: 4.3 STEGANALYSIS QUANTITATIVE COMPARATIVE EXPERIMENTS
text: We compare ISS-GAN with the state-of-the-art steganography methods in various image benchmarks. Here we use steganalysis process to extract secret images from stego images, and evaluate the security criteria of steganography algorithms. For LSB steganography algorithms, we choose LSB-TLH Das et al. (2018). For content adaptive steganography algorithms, we choose WOW Holub & Fridrich (2012), HUGO (Pevnỳ et al., 2010) and S-UNIWARD (Holub et al., 2014). For deep learning based steganography algorithms, we choose ISGAN Dong et al. (2018) and SSGAN Shi et al. (2017) for comparation. We make two group experiments. In the first group experiment, we use Lena as the original cover image, and the trolleybus image as the secret image. The results are shown in Figure 5. In the second group experiment, we use Lena as the original cover image, and the headline of ICLR conference as the secret image. The results are shown in Figure 6. In quantitative experiments, we add the JPEG compression to simulate the coding and decoding processes in real
secure information transmission system. We need to ensure ISS-GAN can work well against coding and decoding algorithms.
The PSNR and SSIM metrics for extracted secret image of trolleybus and ICLR conference headline are shown in Table 2∼ 5, respectively. In Table 2∼ 5, extracted secret image is used as image x, and original secret image is used as image y for PSNR and SSIM metrics calculation equations (8) and (9). According to these metrics, the security of ISS-GAN outperforms all other state-of-the-art steganography algorithms in quantitative aspect.
In these two group experiments, PSNR and SSIM metrics, the closest competitors are content adaptive steganography algorithms. WOW, HUGO and S-UNIWARD have quite good performance on steganography security. But for PSNR metric, ISS-GAN can still achieve 1.01X∼1.12X relative improvement over the second highest PSNR algorithms with trolleybus secret image embedded, and
achieve 1.01X∼1.81X relative improvement over the second highest PSNR algorithms with ICLR conference headline secret image embedded. For SSIM metric, ISS-GAN can achieve 1.01X∼1.11X relative improvement over the second highest SSIM algorithms with trolleybus secret image embedded, and achieve 1.01X∼1.46X relative improvement over the second highest SSIM algorithms with ICLR conference headline secret image embedded.
To have a further analysis of the obtained results, we can find the performance of state-of-theart deep learning steganography algorithms is not as good as expected. The main reason is the authors are more focus on generating the new cover images which are steganalysis-secure. But in our experiments, the cover images are fixed. So we can see the performance of state-of-the-art deep learning steganography algorithms is just at the same level of LSB steganography algorithms, and is worse than content adaptive steganography algorithms.
Compare the results of first and second group experiments, we find ISS-GAN has better performance with the ICLR conference headline secret image. The amount of meaningful pixels and semantic info in ICLR conference headline image is much less than trolleybus image. This aligns with the principle of steganography, i.e., if more pixels are concealed into the cover image, then the security of stego image will be worse.
To further illustrate the effect of embedding secret info amount on the security and imperceptibility of stego image, we make the curve plots to show the quantitative experiment results of generated
stego images SOI versus cover images CI as shown in Figure 7. Here, we use the pixel-ratio to control the amount of embedding secret info. It is defined as the ratio of valid pixels amount in secret image versus those in cover images. For example, if the amount of valid pixels in 256×256 size cover image is 63000, and the amount of valid pixels in secret image is 15000, then pixel-ratio is 0.2381.
From the curve plots shown above, we can see PSNR and SSIM metrics decline with the increase of pixel-ratio. Under the noise attack or image compression, PSNR and SSIM metrics are worse than the situations without attack, and also decline with the increase of pixel-ratio. The detailed results further prove the inherent contradiction between embedded secret amount and security of stego image. So in the real applications, ISS-GAN should make the trade-off between embedding capacity, imperceptibility and security according to real requirements, just like all state-of-the-art steganography methods. This curve can tell user the largest embedded secret capacity at certain imperceptibility and security level. So it is helpful for user to choose the most suitable embedded secret image in real secure information transmission systems. For example, if the user want to generate a stego image with no less than 25dB PSNR and 0.97 SSIM versus cover image. Considering the noise attacks and image compression possibility, the largest embedded secret pixel-ratio should be less than 0.5.

heading: 5 CONCLUSION AND FUTURE WORKS
text: In this paper, we integrate steganography and steganalysis into single framework. The good performance of ISS-GAN derives from the following factors.
• The discriminative network simulates the features of steganalysis. It helps to understand the sensitivity of cover images to semantic changes.
• The introduction of cycle discriminative model and inconsistent loss helps to enhance the quality and security of generated stego image.
• The mixture training dataset can further improve the robustness and security of ISS-GAN framework. How to resist the tampering can be learned from attacked training samples.
• The iterative adversarial training process can strength the capability if steganalysis model and steganography model at the same time. The stronger steganalysis model will stimulate the improvement of steganography model, and vice versa.
In the future, we will study the influence of color cover/secret image and gray cover/secret image to the proposed ISS-GAN framework.

heading: 6 APPENDIX

heading: 6.1 INTRODUCTION OF STEGANOGRAPHY AND STEGANALYSIS
text: Imagine that you are an enthusiastic shutterbug. You are on trip to New Orleans and took a nice photo of St. Louis Cathedral. You want to send the beautiful photo and reveal the romantic feelings to your girlfriend. As your girlfriend is the Ph.D candidate of computer vision, so you want to share the romantic words in her professional manner. You embed the words by changing the least significant bits of the photograph, because this method can hide the romantic words in nearly invisible way. As a social media network fan, you share this photo on Facebook. Many friends leave the messages to express their love of this photo. And your girlfriend write the following sentence under your photo. “Wonderful photo. By the way, I like the clever idea. I think I am the first audience who have read the hidden words. I love you, too.” You will be in a cheerful mood, and appreciate the clever communication method that only you and your girlfriend can “see” the secret information inside the photograph.
This is a simple scenario to show the basic workflow of steganography and steganalysis. Steganography is defined as the art and science of hiding information in ways that prevent the detection of hidden messages (Obaid, 2015). Steganography literally means “covered writing” and is usually interpreted to hide information in other information. In the simple scenario aforementioned, you apply steganography to hide the romantic information into the photo of New Orleans. The romantic information is called the secret message, while the original photo of New Orleans is called the cover image. As the counterpart, the main idea of steganalysis is to analyze whether the received information contains any hidden information, and to recover the hidden information if possible (Volkhonskiy et al., 2017). In the simple scenario aforementioned, the social network plays the role of the public channel (Hayes & Danezis, 2017), and the posted photo is called stego image (Dong et al., 2018), which contains the secret message. Your girlfriend applies steganalysis to discover and recover the secret information you embedded. Since their birth, steganography and steganalysis have complementary progress.

heading: 6.2 EXPERIMENT RESULTS

Review summaries:
The paper is on applying GAN to steganography, and it is especially suited for people who does not know steganography. In fact, 1/4 of the paper is spent on introducing (in a very clear and catchy way) the basics. State of the art section nonetheless shows that the authors are grounded with the very last related work. The novel GAN framework is called ISS-GAN. Simply speaking, ISS-GAN is built by the combo: <steganography generative, steganalysis discriminative>. In the details, the implementation is not straightforward, and embeds interesting ideas. Two generative and two discriminative models are intertwined: one generative for the stego image generation process, the other generative for the secret image extraction process. The two discriminative models are for ensuring that the distribution of cover images is indistinguishable from the stego distribution and to ensure that the distribution of extracted secret images is indistinguishable from the distribution of the original secret images. In rough terms, the adversarial double loop serves to ensure that the embedding and the extraction function preserve both the aspect of the original and the secret images. PSNR and SSIM metrics are employed to give a quantitative check of the approach.