FIXED NEURAL NETWORK STEGANOGRAPHY: TRAIN
Year: 2021

Abstract:
Recent attempts at image steganography make use of advances in deep learning to train an encoder-decoder network pair to hide and retrieve secret messages in images. These methods are able to hide large amounts of data, but also incur high decoding error rates (around 20%). In this paper, we propose a novel algorithm for steganography that takes advantage of the fact that neural networks are sensitive to tiny perturbations. Our method, Fixed Neural Network Steganography (FNNS), achieves 0% error reliably for hiding up to 3 bits per pixel (bpp) of secret information in images and yields significantly lower error rates when compared to prior state of the art methods for hiding more than 3 bpp. FNNS also successfully evades existing statistical steganalysis systems and can be modified to evade neural steganalysis systems as well. Recovering every bit correctly, up to 3 bpp, enables novel applications, e.g. those requiring encryption. We introduce one specific use case for facilitating anonymized and safe image sharing.

heading: 1 INTRODUCTION
text: Image steganography aims to hide a secret digital message within a cover image (Morkel et al., 2005) — ideally, through minimal alterations, such that only intended recipients are aware of the hidden secret. Steganography has been widely used in applications such as watermarking (Wolfgang & Delp, 1996), copyright certification (Lu, 2004) or private information storage (Srinivasan et al., 2004). Classic steganography tools use image pixel statistics to hide information in images (Pevnỳ et al., 2010). Secret messages hidden with these methods can be recovered with 0% error, but to evade detection by steganalysis tools, they can only hide up to 0.4 bits per pixel (bpp) of information (Pevnỳ et al., 2010; Holub & Fridrich, 2012; Holub et al., 2014). Encouraged by data-driven deep learning techniques, recent works propose training deep encoder-decoder networks to hide and recover a larger number of bits per pixel in image (Zhang et al., 2019a; Zhu et al., 2018; Baluja, 2017; Wu et al., 2018; Hayes & Danezis, 2017). These methods do indeed achieve higher bpp rates, but they also result in high error rates for the retrieved message (Zhang et al., 2019a).
Many applications have stricter requirements for the steganography algorithm. In some scenarios, the hidden message has no redundancy, and there is zero tolerance for even a single incorrectly recovered bit. For example, if the secret message is encrypted, it will be a random bit string that must be recovered 100% intact for successful decryption. In this paper, we propose a novel approach for image steganography that aims to simultaneously achieve high steganographic capacity and reliably low error rates. Notably, we achieve 0.0% error when encoding up to 3 bpp. We make no assumptions on the secret message and allow it to be any arbitrary bit string. We show that our method can be used with randomly initialized neural networks or in conjunction with pre-trained networks.
Unlike previous steganography methods that train deep networks to hide and recover messages in a specific dataset (Zhang et al., 2019a; Zhu et al., 2018; Baluja, 2017), our method is based upon a very different approach, which originated in the context of adversarial attacks on neural networks (Szegedy et al., 2013). Adversarial attacks are based on the key insight that deep neural networks are highly sensitive to small changes to the input. An adversary can therefore manipulate an image with imperceptible perturbations to influence the prediction of a neural network that uses this image as input. The last eight years have witnessed an outpouring of analysis (Kurakin et al., 2016b; Carlini & Wagner, 2016; Xu et al., 2017; Shafahi et al., 2018; Meng & Chen, 2017; Li & Li, 2017; Lu et al., 2017a; Graese et al., 2016; Dziugaite et al., 2016; Lu et al., 2017b; Gu & Rigazio,
2015; Kurakin et al., 2016a; Miyato et al., 2015; Nokland, 2015; Cisse et al., 2017; Hu et al., 2019; Guo et al., 2020; 2017) and methods (Liu et al., 2016; Moosavi-Dezfooli et al., 2016; Carlini & Wagner, 2017; Tramèr et al., 2017; Papernot et al., 2017; 2016; Biggio et al., 2013) to understand and create adversarial perturbations. Notably, it is fair to say that vulnerability to adversarial attacks is generally considered inevitable in most settings (Shafahi et al., 2018) and frustratingly hard to defend against (Carlini & Wagner, 2017; Dziugaite et al., 2016), especially when the target network architecture is known to the adversary (which is generally referred to as white-box setting).
Adversarial attacks are typically considered a nuisance, or a limitation of machine learning. However, in this paper we utilize their persistence and reliability as a desired feature for what we refer to as Fixed Neural Network Steganography (FNNS). In a nutshell, FNNS is based on the following procedure (see Figure 1): We initialize a neural network (decoder) that takes as input an image and produces sufficient binary outputs. Given a secret message and a cover image, the sender (Alice) perturbs the original image in a fashion similar to adversarial perturbations (Madry et al., 2017). However, instead of targeting a single prediction bit (e.g. the classification of an image), the sender manipulates thousands or even millions of output bits simultaneously. The intended recipient (Bob) can use the same decoder network and recover the hidden message.
We show that FNNS reliably yields 0% error rate for up to 3 bpp and lower error rates than current state-of-the art methods for higher bit rates on multiple datasets. FNNS can also be used in conjunction with existing trained encoder-decoder methods (like SteganoGAN (Zhang et al., 2019a)) to further reduce the error rates obtained by the trained methods. Additionally, we show that FNNS evades existing statistical steganalysis methods (Boehm, 2014; Dumitrescu et al., 2002a;b; Böhme & Westfeld, 2004; Zhang & Ping, 2003) and can be made resistant to JPEG compression (Wallace, 1992) for low bpp. Finally, we introduce an example application of error-free steganography for anonymized image sharing: We replace faces in images with GAN generated substitutes that contain the original faces encrypted and hidden through FNNS — ensuring that only intended recipients (with the secret key) can recover the original images.

heading: 2 RELATED WORK
text: Statistical image steganography methods (Pevnỳ et al., 2010) typically pre-date the use of neural networks. Least-Significant Bit (LSB) methods modify the lowest-order bits of each image pixel to encode a secret message (Van Schyndel et al., 1994; Wolfgang & Delp, 1996; Katzenbeisser & Petitcolas, 2000). Although compellingly simple and lossless, these methods are easily detectable (Dumitrescu et al., 2002a;b; Böhme & Westfeld, 2004; Zhang & Ping, 2003) and often lack robustness (Qin et al., 2010). Many statistical image steganography methods were proposed to evade detection by stegoanalysis algorithms. Highly Undetectable Steganography (HUGO) (Pevnỳ et al., 2010) use hand crafted features to measure distortion caused by modifying pixels. Pixels that cause the least amount of distortion are then modified. Wavelet Obtained Weights (WOW) (Holub & Fridrich, 2012) use directional high-pass filters to find regions of the cover image with high texture and penalize changes in low textured regions. S-UNIWARD (Holub et al., 2014) is similar to WOW but is designed to work with non-spatial domains (for e.g. frequency domain). The main limitation of statistical methods is that the number of bits they encode is relatively low (≤ 0.4 bpp).
Deep learning image steganography methods have recently achieved impressive results in terms of bpp payload (Zhang et al., 2020; Baluja, 2017; Rahim et al., 2018; Zhang et al., 2019b). In general, they mostly share a similar pipeline that can be trained end-to-end: An encoder network takes as input a cover image and a message that should be concealed within it. From these inputs it generates a steganographic image that has hidden information but is visually similar to the cover image. A subsequent decoder network recovers the hidden message from the steganographic image. Multiple loss functions ensure that 1) the generated image is close to the original one; 2) the decoder’s output matches the secret message. Zhu et al. (2018)’s HiddenNet pioneered such an encoder-decoder pipeline, and their HiddenNet can hide up to 0.2 bpp with error rate 10−5. SteganoGAN (Zhang et al., 2019a) introduces an additional critic that ensures the produced image looks realistic, like a natural image, which enables much higher bit rates. The authors show experiments of hiding up to 6 bpp with an error rate of 5-30% (depending on how many bits are hidden). In a similar vein, AdvSGAN (Li et al., 2021) achieves up to 1.0 bpp by learning an image steganography scheme that plays an adversarial game between a restricted neural coder and a critic. Deep Steganography (Baluja,
Fixed Decoder Network 0, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 0, 0, 0, 0, 1, 1, 1, 0, 0, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 1, 1, 1, 0, 1, 0, 1, 1, 0, 1, 0, 1, 1, 1, 1, 1, 1, 0, 1, 0, 1, 0, 0, 1, 1, 1, 0, 1, 1, 0, 1, 1, 1, 0, 1, 0, 0, 1, 0, 0, 0, 1, 1, 0, 1, 1, 1, 0, 0, 0, 0, 0, 1, 1, 1, 0, 1, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, 0, 0, 1, 1, 1, 1, 0, 0, 1, 0, 1, 1, 1, 0, 0, 0, 0, 1, 0, 1, 0, 1, 1, 0, 0, 1, 1, 1, 1, 1, 0, 1, 0, 1, 0, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 0, 0, 1, 0, 1, 1, 1, 0, 1, 1, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 1, 0, 1, 1, 1, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 1, 0, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 1, 0, 0, 1, 1, 1, 0, 0, 1, 0, 0, 0, 1, 1, 1, 0, 0, 1, 0, 1, 0, 0, 0, 1, 1, 0, 1, 1, 1, 0, 0, 0, 0, 1, 0, 1, 0, 1, 1, 0, 0, 1, 0, 1, 1, 1, 0, 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 0, 0, 1, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 0, 1, 1, 1, 0, 1, 1, 0, 1, 0, 1, 1, 1, 1, 0, 0, 1, 1, 0, 0, 1, 0, 0, 1, 1, 1, 0, 1, 0, 1, 1, 1, 1, 1, 0, 0, 0, 0, 1, 1, 1, 0, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 1, 0, 1, 0, 1, 1, 0, 0, 0, 1, 1, 1, 1, 1, 1, 0, 1, 1, 1, 0, 0, 0, 0, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 1, 0, 1, 1, 1, 1, 1, 0, 1, 0, 0, 1, 0, 1, 0, 1, 1, 1, 0, 0, 1, 1, 0, 1, 0, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 1, 1, 0, 1, 0, 0, 1, 0, 0, 1, 0, 1, 0, 1, 1, 1, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 1, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1, 1, 1, 0, 0, 1, 1, 1, 1, 1, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 1, 1, 1, 1, 0, 1, 1, 0, 1, 0, 0, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 0, 0, 1, 1, 1, 0, 0, 0, 0, 0, 0, 1, 1, 1, 0, 1, 1, 1, 1, 1, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 1, 0, 1, 1, 1, 1, 1, 0, 1, 0, 0, 1, 0, 1, 0, 1, 1, 1, 0, 0, 1, 1, 0, 1, 0, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 1, 1, 0, 1, 0, 0, 1, 0, 0, 1, 0, 1, 0, 1, 1, 1, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 1, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1, 1, 1, 0, 0, 1, 1, 1, 1, 1, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 1, 1, 1, 1, 0, 1, 1, 0, 1, 0, 0, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 0, 0, 1, 1, 1, 0, 0, 0, 0, 0, 0, 1, 1, 1, 0, 1, 1, 1, 1, 1, 1, 1, 0, 1, 0, 0, 0, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 1, 0, 1, 1, 1, 0, 0, 1, 1, 1, 1, 0, 0, 1, 0, 0, 0, 0, 1, 1, 1, 0, 0, 0, 0, 1, 1, 0, 1, 1, 0, 0, 1, 0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 1, 0, 0, 1, 1, 1, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 1, 1, 1, 0, 0, 1, 1, 1, 1, 0, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 0, 1, 0, 1, 1, 1, 0, 1, 1, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 1, 0, 1, 0, 1, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 1, 1, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 1, 1, 1, 1, 0, 1, 0, 1, 1, 0, 0, 1, 1, 1, 0, 0, 0, 0, 0, 0, 1, 1, 0, 1, 1, 1, 0, 0, 1, 1, 1, 1, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 1, 0, 1, 0, 0, 0, 0, 1, 1, 0, 1, 0, 0, 0, 1, 1, 0, 0, 0, 1, 1, 1, 0, 1, 0, 1, 0, 1, 1, 1, 0, 1, 1, 1, 0, 0, 1, 1, 1, 0, 1, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 1, 0, 0, 1, 1, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 1, 1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 1, 1, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 0, 0, 1, 1, 1, 1, 0, 0, 0, 1, 1, 0, 1, 0, 1, 1, 1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 0, 0, 0, 0, 1, 1, 1, 0, 0, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 1, 1, 1, 0, 1, 0, 1, 1, 0, 1, 0, 1, 1, 1, 1, 1, 1, 0, 1, 0, 1, 0, 0, 1, 1, 1, 0, 1, 1, 0, 1, 1, 1, 0, 1, 0, 0, 1, 0, 0, 0, 1, 1, 0, 1, 1, 1, 0, 0, 0, 0, 0, 1, 1, 1, 0, 1, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, 0, 0, 1, 1, 1, 1, 0, 0, 1, 0, 1, 1, 1, 0, 0, 0, 0, 1, 0, 1, 0, 1, 1, 0, 0, 1, 1, 1, 1, 1, 0, 1, 0, 1, 0, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 0, 0, 1, 0, 1, 1, 1, 0, 1, 1, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 1, 0, 1, 1, 1, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 1, 0, 0, 1, 0, 1, 0, , 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, , , , 1, , 0, 1, 1, 1, 0, 0, 1, 0, 0, 0, 1, 1, 1, 0, 0, 1, 0, 1, 0, 0, 0, 1, , , 1, 1, 1, 0, 0, 0, 0, 1, 0, 1, 0, 1 , 1, 0, 1, 1, 1, 0, 1, 0, 1, 1, 1, 1, 0 0, 1, 0, 0, 0, 1, 1, 0, 0, , 1, 1, 0, 0, 1, 1, 0, 1, 1, 1, 0, 1, 0 1 , 1, 1, 1, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0, 1, 0, 1, 1, 1, 1, 1, 0, 0, 0, 0, 1, 1, 1, 0, 0, 1, 0, 1, , 1, 0, , , 1, 0, 1, 1, 1, 1, 1, 1, 1, 1, , 0, , 1, 0, 1, 0, 0, 1, 0, 1, 0, 1, 0, 1, 1, 0, 0, 0, 1, 1, 1, 1, 1, 1, 0, 1, 1, 1, 0, 0, 0, 0, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 1, 0, 1, 1, 1, 1, 1, 0, 1, 0, 0, 1, 0, 1, 0, 1, 1, 1, 0, 0, 1, 1, 0, 1, 0, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 1, 1, 0, 1, 0, 0, 1, 0, 0, 1, 0, 1, 0, 1, 1, 1, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 1, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1, 1, 1, 0, 0, 1, 1, 1, 1, 1, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 1, 1, 1, 1, 0, 1, 1, 0, 1, 0, 0, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 0, 0, 1, 1, 1, 0, 0, 0, 0, 0, 0, 1, 1, 1, 0, 1, 1, 1, 1, 1, 1, 1, 0, 1, 0, 0, 0, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 1, 0, 1, 1, 1, 0, 0, 1, 1, 1, 1, 0, 0, 1, 0, 0, 0, 0, 1, 1, 1, 0, 0, 0, 0, 1, 1, 0, 1, 1, 0, 0, 1, 0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 1, 0, 0, 1, 1, 1, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 1, 1, 1, 0, 0, 1, 1, 1, 1, 0, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 0, 1, 0, 1, 1, 1, 0, 1, 1, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 1, 0, 1, 0, 1, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 1, 1, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 1, 1, 1, 1, 0, 1, 0, 1, 1, 0, 0, 1, 1, 1, 0, 0, 0, 0, 0, 0, 1, 1, 0, 1, 1, 1, 0, 0, 1, 1, 1, 1, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 1, 0, 1, 0, 0, 0, 0, 1, 1, 0, 1, 0, 0, 0, 1, 1, 0, 0, 0, 1, 1, 1, 0, 1, 0, 1, 0, 1, 1, 1, 0, 1, 1, 1, 0, 0, 1, 1, 1, 0, 1, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 1, 0, 0, 1, 1, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 1, 1,
0, 1, 1, 1, 0, 1, 1, 0, 0, 1, 1, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1,
0, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 0, 0, 1, 1, 1, 1, 0, 0, 0, 1, 1, 0, 1, 0, 1, 1, 1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 1, 1,
0, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 0, 0, 0, 0, 1, 1, 1, 0, 0, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 1, 1, 1,
0, 1, 0, 1, 1, 0, 1, 0, 1, 1, 1, 1, 1, 1, 0, 1, 0, 1, 0, 0, 1, 1, 1, 0, 1, 1, 0, 1, 1, 1, 0, 1, 0, 0, 1, 0, 0, 0, 1, 1,
0, 1, 1, 1, 0, 0, 0, 0, 0, 1, 1, 1, 0, 1, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, 0, 0, 1, 1, 1, 1, 0, 0, 1, 0, 1, 1, 1, 0, 0, 0,
0, 1, 0, 1, 0, 1, 1, 0, 0, 1, 1, 1, 1, 1, 0, 1, 0, 1, 0, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 0, 0, 1, 0, 1, 1, 1, 0, 1, 1, 1,
1, 1, 1, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 1, 0, 1, 1, 1, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0,
1, 0, 1, 0, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 1, 0, 0, 1, 1, 1, 0, 0, 1, 0, 0, 0, 1, 1, 1,
0, 0, 1, 0, 1, 0, 0, 0, 1, 1, 0, 1, 1, 1, 0, 0, 0, 0, 1, 0, 1, 0, 1, 1, 0, 0, 1, 0, 1, 1, 1, 0, 1, 0, 1, 1, 1, 1, 0, 0,
0, 1, 0, 0, 0, 1, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 0, 1, 1, 1, 0, 1, 1, 0, 1, 0, 1, 1, 1, 1, 0, 0, 1, 1, 0, 0, 1, 0, 0, 1, 1, 1, 0, 1, 0, 1, 1, 1, 1, 1, 0, 0, 0, 0, 1, 1, 1, 0, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 1, 0, 1, 0, 1, 1, 0, 0, 0, 1, 1, 1, 1, 1, 1, 0, 1, 1, 1, 0, 0, 0, 0, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0,
0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 1, 1, 0, 1, 0, 0, 1, 0, 0, 1, 0, 1, 0, 1, 1, 1, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 1, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1, 1, 1, 0, 0, 1, 1, 1, 1, 1, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 1, 1, 1, 1, 0, 1, 1, 0, 1, 0, 0, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 0, 0, 1, 1, 1, 0, 0, 0, 0, 0, 0, 1, 1, 1, 0, 1, 1, 1, 1, 1, 1, 1, 0, 1, 0, 0, 0, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 1, 0, 1, 1, 1, 0, 0, 1, 1, 1, 1, 0, 0, 1, 0, 0, 0, 0, 1, 1, 1, 0, 0, 0, 0, 1, 1, 0, 1, 1, 0, 0, 1, 0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 1, 0, 0, 1, 1, 1, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 1, 1, 1, 0, 0, 1, 1, 1, 1, 0, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 0, 1, 0, 1, 1, 1, 0, 1, 1, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 1, 0, 1, 0, 1, 1, 1, , , 0, , 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, , 0, , , 1, 1, 0, 1, 1, 0, 0, 1, 1, 0, , , 1, , , 1, 1, 0, 1, 0, 1, 1, , , , , 1, 0, 0, 0, 0, 0, 0, 1, 1, 0, , , 1, 0, 0, 1, 1, 1, 1, 0, 0, 0, 1, 1, 0, 0, , 0, , 0, 1, 0, 1, 0, 0, 1, 1 , , 0, 0, 1, 1, 0, 1, 0, 0, 0, , 1 0 , 1, 1, 1, 0, 1, 0, 1, 0, 1, 1, 1 1, 1, 0, 0, 1, 1, 1, 0, , 0 0 , 0, 0, 0, 0, 1, 1, 0, 1, 0, 0, , 1 , 0, 1, 0, 1, 0, 1, 0, 0, 1, 1, 0 1 0, , 1, 0, 1, 1, 0, 1, 1, , , 1, , 0, 0, 1, 1, 1, 0, 1, 0, 0, 0, 1, 0, 0, , 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, , , 1, 0, 1, 0, 1, 0, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 0, 0, 1, 1, 1, 1, 0, 0, 0, 1, 1, 0, 1, 0, 1, 1, 1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 0, 0, 0, 0, 1, 1, 1, 0, 0, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 1, 1, 1, 0, 1, 0, 1, 1, 0, 1, 0, 1, 1, 1, 1, 1, 1, 0, 1, 0, 1, 0, 0, 1, 1, 1, 0, 1, 1, 0, 1, 1, 1, 0, 1, 0, 0, 1, 0, 0, 0, 1, 1, Decoding BCE Loss LBCE Fixed Decoder Network
Encoding
Input
Decoding Gradient
Cover Image X Perturbed Image X̃ Decoder Output F(X̃)
Secret Message MPerturbations δ F
F
Figure 1: FNNS workflow: Alice (sender) encodes the messageM into image X̃ such that F (X̃) = M ; Bob (receiver) decodes the message with the same decoder F . Alice generates perturbed image X̃ by optimizing the difference between decoder output F (X̃) and secret messageM . After FNNS, the perturbed image X̃ is visually indistinguishable from the cover imageX .
2017), ISGAN (Dong et al., 2018), Attention Based Data Hiding (Yu, 2020) and End-to-end CNN for Image Steganography (Rahim et al., 2018) use similar encoder-decoder architectures to hide and recover structured images instead of random bits. These methods assume the secret message is an image, which allows them to learn image priors that aid in hiding the secret image. Despite handling a large number of bits, these end-to-end neural approaches also share a set of disadvantages: 1) the error rate for the recovered messages is very high, 2) they assume access to hundreds or even thousands of training images from the target domain to train encoder and decoder pairs, and 3) there is little recourse if the model produces an image with high error rate or strong distortions.
Imperceptible image perturbations. Adversarial examples (Goodfellow et al., 2014) are inputs to machine learning models that an attacker has intentionally designed to cause the model to make a mistake. Many approaches (Szegedy et al., 2013; Goodfellow et al., 2014; Guo et al., 2019; Xu et al., 2020; De Palma et al., 2021; Yuan et al., 2019) try to construct adversarial examples by perturbing image pixels. Moosavi-Dezfooli et al. (2017) propose a systematic algorithm for computing universal perturbations that many deep neural networks are highly vulnerable to. Su et al. (2019) propose a differential evolution method to generate low dimensional one-pixel adversarial perturbations that change the output of a classification network. Athalye et al. (2018b) create adversarial examples that are robust to affine image transformations, noise, and other distortions. Projected gradient descent (PGD) (Madry et al., 2017) is one of the most widely used algorithms to generate adversarial examples by adding small perturbations to the input. This method iteratively updates the input with gradient descent until a desired output is obtained. The input is projected, or more precisely clipped to be within [− , ] at the end of every step. This precaution ensures that the perturbations stay reasonably small for all pixels and remain imperceptible. Ghamizi et al. (2019) propose performing stenography by finding perturbations using PGD with a classification network. However, the amount of information they are able to hide is low and they need multiple images to hide long messages.

heading: 3 FIXED NEURAL NETWORK STEGANOGRAPHY
text: Setting. Let X ∈ [0, 1]H×W×3 be an RGB color image with height H and width W . Further, let M ∈ {0, 1}H×W×D be a message that we are trying to conceal inX , whereD specifies the number of bits we need to hide per pixel.1 We assume there are two parties involved – the sender, Alice,
1For convenience we assume the message is of length H×W ×D. In practice, if the message length is not a multiple of H ×W we can simply ignore the unused output bits during optimization.
Algorithm 1 Adversarial Attack for Message hiding 1: Inputs: decoder network F , cover imageX , secret messageM 2: Hyper-parameters: learning rate α > 0, perturbation bound > 0, optimization steps n > 0,
max L-BFGS iterations k > 0 3: X̃ ←X 4: for n iterations do 5: X̃ = LBFGS(F (X̃),M , LBCE, k) . Take k steps to optimize LBCE(F (X̃),M). 6: δ ← clip − {X̃ −X} . Clip pixel value changes exceeding ± . 7: X̃ ← clip10{X + δ} . Clip pixel values to [0, 1]. 8: end for 9: return X̃
who hides M inX , creating X̃; and the receiver, Bob, who extractsM out of X̃ . Given a decoder network F : [0, 1]H×W×3 → [0, 1]H×W×D, our goal is to generate a perturbed image X̃ , which is close toX (according to metrics specified in the subsequent section) such that F (X̃) =M .
Encoding and Decoding. In order to generate image X̃ , we use an approach similar to adversarial perturbations (Madry et al., 2017). Given the cover image X and the ground truth message M , the sender (Alice) solves the following optimization problem over the perturbed image X̃:
min X̃ 〈M , logF (X̃)〉+ 〈(1−M), log(1− F (X̃))〉︸ ︷︷ ︸
LBCE
,
s.t.‖X − X̃‖∞ ≤ and 0 ≤ X̃ ≤ 1, (1)
where 〈, 〉 denotes inner-product across all H ×W ×D dimensions and the objective function is the binary cross entropy (BCE) loss. The first of the two linear constraints enforces that the maximum perturbation does not exceed a value of and stays imperceptible. The second constraint enforces that the perturbed image, X̃ , is a well-defined image, with pixel values ranging within [0, 1].
Our optimization algorithm is outlined in Algorithm 1, where clip10(x) = max(min(x, 1), 0). We use the unconstrained L-BFGS (Fletcher, 2013) algorithm to optimize the objective with respect to X̃ . To ensure that we do not violate any of the constraints, we project the solution back into the feasible region after k steps. We assume that the recipient (Bob) has access to the same network F as the sender (Alice). He can then recover the concealed messageM by computing F (X̃).
Decoder weights and initialization. Our encoding procedure optimizes the image X̃ directly and considers the weights of F fixed throughout. This gives us the freedom to explore multiple ways to obtain weights for decoder F , yielding three distinct variants of our method: 1) FNNS-R: F is a random network and X̃ is initialized to be the cover image X . When a random network is used, the sender and receiver only need to share the architecture hyper-parameters of the decoder network, and the random seed used to initialize its weights but the actual weights of the network do not have to be shared. Additionally, if the image quality of the perturbed image is low, a different random decoder network can easily be initialized with a new random seed and the optimization can be repeated. 2) FNNS-DE: Given a trained encoder, decoder pair (from any of the prior work mentioned in section 2), we can define F as such a decoder and initialize X̃ as Enc(X,M), where Enc is the trained encoder that is paired with the decoder F . With this initialization, a part of the message M is already encoded into X̃ such that F (X̃) ≈ M . As a result, its optimization is much faster. However, the encoding step sometimes deteriorates image quality, and it is hard for the optimization algorithm to “recover” in terms of quality in such cases. 3) FNNS-D: F is a trained decoder and X̃ is initialized to be the cover image X . With a trained decoder, messages can be hidden in images using both perturbations and by training weights conducive to hiding information in the images. As a result, the output image quality is often better and the optimization does not suffer from getting stuck in bad local optima.
Decoder architecture. Prior work on adversarial attacks has explored network designs that are especially robust to small perturbations (Xu et al., 2020). In contrast, for our decoder we want network architectures that are particularly susceptible in that regard. We develop our method based on the basic decoder of SteganoGAN (Zhang et al., 2019a), a 4-layer convolutional neural network that takes an H ×W × 3 RGB image as input and outputs a bit string {0, 1}H×W×D (after rounding). We choose SteganoGAN because it has been shown to achieve state-of-the-art performance for hiding arbitrary messages in images. For our experiments, we set the trained encoder and decoder for FNNS-D and FNNS-DE, to be the trained SteganoGAN encoder and decoder. For the random FNNS-R we empirically explore many variations with different depths, widths, normalization layers, and activation functions, and evaluate them w.r.t. bit error rates, PSNR, and SSIM.2 Due to space constraints, we summarize our results in Appendix B. Throughout, we use 128 hidden channels in FNNS-R and 32 in FNNS-D and FNNS-DE. This is because for trained SteganoGAN models, increasing the number of hidden units leads to no significant improvements in accuracy or image quality (see Appendix C), but slows down the optimization process.
3.1 EVALUATION METRICS
We use three popular metrics to evaluate our results. 1. The bit error rate, ‖M − bF (X̃)e‖1, where b·e denotes rounding function, measures how many bits are incorrectly recovered. 2. Peak signal-to-noise ratio (PSNR) is a common metric used to measure image distortions between X and X̃ and has been shown to be correlated with human evaluation scores (Isola et al., 2017). 3. Structural Similarity Index (SSIM) is another metric used to measure the similarity between two images. SSIM differs
from PSNR in that it tries to capture the change in structural information as opposed to considering absolute errors. PSNR and SSIM between two images X and X̃ with maximum possible pixel value maxX , averages µ, µ̃, standard deviation σ, σ̃ and co-variance σXX̃ is defined in Table 1.

heading: 4 STEGANOGRAPHY RESULTS AND DISCUSSION
text: Experimental Setup We evaluate FNNS on three diverse datasets – a scenic image dataset Div2k (Agustsson & Timofte, 2017), a 2D object detection dataset COCO (Lin et al., 2014) and a hu-
2We have also explored the use of fully connected networks but found them to yield far higher error rates, while being slower to be optimized.
man face dataset CelebA (Liu et al., 2015). For each dataset, we use the provided test/validation images (if unavailable, we use the first 100 images in the dataset for validation). The hyper-parameters used for Algorithm 1 are as follows: perturbation bound = 0.3, optimization steps n = 100, and L-BFGS iterations k = 10 with early stopping if the output has zero error. 3 In cases where the image quality of X̃ is poor, we restart optimization with a different learning rate α. Concretely, we set the learning rate to 0.1 and change it to 0.05 or 0.5 if the output image gets a PSNR lower than 20. We train SteganoGAN models for only one epoch for FNNS-D and FNNS-DE, as we observe that a fully-trained (32 epochs) SteganoGAN decoder over-fits to its training objective such that it’s hard to use it for FNNS. Appendix E shows the result of using 32 epochs SteganoGAN models.
Quantitative Comparison. We compare FNNS with SteganoGAN (the current state of the art method) in Table 2. 4 In addition (not shown in the table), we also compare with HUGO (Pevnỳ et al., 2010) and HiDDeN (Zhu et al., 2018). Both methods can achieve an error rate of 0% but only for 0.4 and 0.2 bpp respectively. In contrast, FNNS also achieves 0% error for significantly higher bit rates as shown in Table 2. FNNS-D achieves the best performance in terms of both low error rates and good image quality. FNNS-DE is also able to achieve error rates of 0%, but the corresponding image quality is worse when compared to FNNS-D. From Table 2, we also see that for Div2k it is hard to achieve 0% error with 3 bpp. We find that this is because Div2k is a small dataset with only 800 images and as a result there is not enough diversity to train a flexible SteganoGAN model. This is evidenced by the fact that 0% error for Div2k with 3 bpp can be achieved by using a model trained on MS-COCO.
Qualitative Comparison. Several qualitative examples are presented in Figure 2 (more images from all the method variants can be found in Appendix A). We see that even with 4 bpp, the cover and stenographic images look very similar visually. There are a few examples where the stenographic images look pixelated, especially when a random network is used. This is either because the image is over-optimized to get a low bit error rate or because of a bad random seed. To produce a better stenographic image, the random network can be re-initialized (if using a random network), the optimization can be stopped earlier or the hyper-parameters of FNNS can be changed slightly (in order to change the optimization problem).
Domain independence. The performance of trained encoder-decoder models like SteganoGAN degrade for out-of-domain cover images. For example, a SteganoGAN (Zhang et al., 2019a) model trained on Div2k images (which contains primarily landscapes) produces noticeable artefacts when tested on facial images from CelebA (Figure 3). The only recourse to correcting artifacts or quality would be to train another model with in-domain data. In contrast, FNNS-R is completely do-
3We continue optimizing for 25 steps after achieving 0 error in order to ensure that even after converting X̃ into integer color values (integers between 0 to 255), F (X̃) = M .
4Results with higher bpp are shown in Appendix D.
main independent. Although FNNS-D uses a trained decoder, we find it to be just as robust against domain shift. We explain these findings by the fact that the secret message is hidden through an optimization procedure that is very robust to the exact filter values of the decoder network.
Optimization time. Most encoder-decoder deep stenography methods require many hours of training of hundreds of images. However, once trained, it takes less than a second for inference with the model with any given cover image and message. For FNNS-D and FNNS-DE, no network training is required; the optimization for encoding a message in an image at test time takes on average 30 seconds for 1-2bpp and 1min for 3-4bpp. For FNNS-R encoding a message takes about 3 min because optimizing the random network is a harder task.
JPEG Compression. A desirable property for any steganography system is robustness against lossy image compression. Unfortunately the goal of imperceptibility is inherently at odds with most image compression methods, which by design aim to remove imperceptible, and therefore unnecessary, information. JPEG (Wallace, 1992) is a lossy compression method for digital images that transforms an image into frequency space and removes high frequency components via quantization and rounding. Past work has shown that adversarial perturba-
tions can be removed via JPEG compression (Dziugaite et al., 2016) and trained encoder-decoder steganography networks also fail to be resistant to JPEG compression. Modifications to the loss functions can improve resistance to compression, but significantly increase error rates. We can improve the robustness of FNNS to JPEG compression by adding a JPEG layer in our optimization pipeline, in which the back-propagated gradients are approximated with identity transformation (Athalye et al., 2018a). We evaluate on MS-COCO and show results in Table 3. Although we can successfully encode 0.1 bpp at only 0.06% error, it is fair to say that bit-rates beyond 0.5 bpp are currently still out of reach. Alternative approaches that we may explore in the future include adopting the Shadow Attack approach from Ghiasi et al. (2020) to find larger semantically meaningful perturbations and to incorporate global smoothness constraints.

heading: 5 STEGANALYSIS
text: Steganalysis tools are used to identify whether a message is hidden in an image. Broadly, these tools can be divided into two categories – statistical steganalysis and neural steganalysis. The former makes use of statistical methods and tools to detect steganography, while the latter trains a neural network to distinguish between natural images and steganographic images.
Statistical steganalysis methods were developed to detect LSB (least significant bit) steganography (Gupta et al., 2012) in lossless images such as PNG and BMP. Boehm (2014) presents StegExpose, a library combining many existing steganalysis techniques including Sample Pairs (Dumitrescu et al., 2002b), RS Analysis (Fridrich et al., 2001), Chi Squared Attack (Westfeld & Pfitzmann, 1999), and Primary Sets Dumitrescu et al. (2002a). We
show the detection rate of StegExpose for the Div2K dataset in in Table 4. As seen in the table, some images are detected, but the detection rates are low in comparison with traditional methods that are detected with an accuracy of over 75% (Zhu et al., 2018). It is worth noting that even if the image is detected as stegnographic, messages cannot be accessed if they are encrypted.
Neural steganalysis makes use of recent advances in deep learning to detect images with hidden information (Ye et al., 2017; You et al., 2020; Lerch-Hostalot, 2021). Neural networks are quite powerful and are capable of accurately detecting steganographic images with bpp as low as 0.5. Assuming that we have white box access to the steganalysis network, we can include its classification score as an auxiliary detection loss in FNNS optimization, and find perturbations such that the neural model does not classify the image as steganographic. We evaluate this method’s feasibility and compare results in Table 5. The detection rates are shown in the very right section of the table.
With 2 bpp, FNNS still achieves 0.0% error rates while only 5 out of 1000 images are detected. In
the future, we would like to further investigate the transferability of such steganalysis networks and more robust defenses against them.

heading: 6 APPLICATION - FACE ANONYMIZATION
text: As shown in table 2, we can reliably obtain 0% error rates for hiding up to 3 bpp. The ability to recover the bit string with no errors allows us to encrypt the message, currently the only provably way to preclude unauthorized access of the hidden information. This property enables us to create a protocol where an encrypted message or image is sent from one party to another, and the file is itself an indistinct looking image — allowing users to use photo sharing webpages or social media as a medium of transmission. Below, we describe how FNNS can be used to create a protocol to share images that are anonymized to the public but not to the trusted recipients.
Motivation. Social media platforms have become a central part of our communication, with photo sharing as one of the center activities (e.g. Instagram, Facebook). There are however well documented dangers with such practices. If photos become publicly available, the owner loses control. Snapshots intended to amuse friends or grandparents can “go viral”, with traumatic consequences for individuals portrait in the photos. Further, public photos
are quickly indexed by image search engines (e.g. https://clearview.ai/) and can haunt individuals decades later. We use FNNS to facilitate a mechanism that allows users to share pictures with their friends on social media, but if these are leaked (e.g. through wrong privacy settings on social media pages, or careless behavior), the identity of the people in the images is preserved.
FNNS face anonymization. Current methods for face anonymization either significantly alter the image by using modifications (like blurring or masking) (Neustaedter et al., 2006; Boyle et al., 2000), or remove the sensitive face completely and replace it with a “fake” face (Hukkelås et al., 2019). The former approach can still leak sensitive information and cause the quality of the image to degrade, and the latter approach non-reversibly changes the image. We propose a novel approach for face anonymization using FNNS (see Figure 4). We make use of DeepPrivacy (Hukkelås et al., 2019) to detect faces in the original image (left) and replace them with plausible looking GANgenerated faces to obtain an anonymized public image (middle image). Note that the original face
is cut before a fake face is generated. As a result, this public image leaks no information about the sensitive face and can safely be shared.
In contrast to prior work, the perfect message reconstruction from FNNS allows us to hide each original private face inside its corresponding fake face in the public image. To ensure the private face is secure, we first compress it (e.g. using JPEG (Wallace, 1992)) and then encrypt it into a cryptographically secure bit string (e.g. using AES (Standard, 2001)). The intended recipient can decode this bit-string, using the decoder network and decrypt the image with a private key to obtain the recovered image (right image). Any third party will only observe the public image without any access to private information. See Figure 6 for a layout of the application pipeline. Because all information is hidden inside the faces in the public image, it is naturally compatible with existing image sharing pages, and the encryption / decryption portion can be realized easily in practice e.g. through a simple browser plugin. As each fake face contains all the information required to reconstruct the original private face, this approach can be applied to an arbitrary number of (non-overlapping) faces in an image. An example is presented in Figure 5.

heading: 7 CONCLUSION
text: In this paper, we propose a novel and effective algorithm for image steganography based on techniques known from the adversarial attacks literature. We show that our method can achieve superior performance while making visually unnoticeable changes to the input image. In contrast to prior work, we are able to achieve error rates of 0% for up to 3 bpp, which in turn enables new applications. In the future we plan to explore other variants and extension of FNNS. One useful variant would be to explore new spaces in which to conduct the optimization. Currently we use RGB space, but other color spaces like YCbCr or non-spatial spaces like the frequency space can be used as well with FNNS. Using different spaces could result in better image quality and could allow for easier encoding of constraints. For instance, to find perturbations robust to JPEG compression, FNNS can be used in only the low frequency region. In the future, we would also like to explore meta-learning algorithms for finding networks that are conducive to FNNS optimization.
ETHICS STATEMENT
Steganography is a tool and it’s usage depends on the user. Steganography can potentially be used for activities with negative societal impact, such as hidden communication for criminal activities,
or espionage. But it can also be used for beneficial applications like preventing copyright infringements through watermarking, tracing illegal images on social media or anonymizing publicly shared images (as shown in the paper).
REPRODUCIBILITY STATEMENT
For our experiments, we use three publicly available datasets as mentioned in section 4. Our method is outlined in Algorithm 1 and we plan to release our code (with both scripts to obtain the results shown in our experiments and general purpose code to use our method) along with the camera ready version. We have also clearly described all the hyper-parameter values we used to obtain our results in section 4.

heading: A ADDITIONAL QUALITATIVE EXAMPLES
text: A.1 EXAMPLES FROM FNNS-R
Cover Image
Error: 0.14%, PSNR: 36.61
Steganographic Image (1 bpp)
Error: 1.29%, PSNR: 31.67
Steganographic Image (2 bpp)
Error: 0.79%, PSNR: 21.67
Steganographic Image (3 bpp)
Error: 24.93%, PSNR: 35.1
Steganographic Image (4 bpp)
A.2 EXAMPLES FROM FNNS-D
Cover Image
Error: 0.0%, PSNR: 35.71
Steganographic Image (1 bpp)
Error: 0.0%, PSNR: 32.33
Steganographic Image (2 bpp)
Error: 0.0%, PSNR: 27.2
Steganographic Image (3 bpp)
Error: 3.11%, PSNR: 29.39
Steganographic Image (4 bpp)
A.3 EXAMPLES FROM FNNS-DE
Cover Image
Error: 0.0%, PSNR: 22.0
Steganographic Image (1 bpp)
Error: 0.0%, PSNR: 22.22
Steganographic Image (2 bpp)
Error: 0.0%, PSNR: 21.72
Steganographic Image (3 bpp)
Error: 2.13%, PSNR: 22.59
Steganographic Image (4 bpp)

heading: B RANDOM DECODER ARCHITECTURE
text: The decoder introduced in section 3 can be any network that takes an image as input and produces sufficiently many binary outputs, but some architectures are better suited for the task at hand. Unlike most prior work, that explores networks that are robust to adversarial attack Xu et al. (2020), we find ourselves looking for architectures that are susceptible to it. Consequently, in our search for a suitable decoder, we empirically explore many network architectures with different network depth, width, normalization and activation functions and evaluate them w.r.t. pixel error rates, PSNR, and SSIM. For the experiments in this sections, we test different architectures using 100 images from the training set of the Div2K Agustsson & Timofte (2017) dataset, with dimensions 512×512×3 unless otherwise noted. Since, our input consists of
images, we focus on convolutional networks (CNN) Goodfellow et al. (2016).5
Network depth and width. Figure 10 presents results of convolutional networks with varying height and width, and their respective error rates. Similar to the finding in Wu et al. (2020), we observe that wider networks are less robust and that increasing the width can lead to networks that are more sensitive to perturbations. However, we notice that the opposite is true for depth; the deeper the network, the less sensitive it is to perturbations. Although a width of 256 seems clearly superior, it is fair to say that the optimization is also slower. Finding a perturbed version of a 512× 512× 3 image with 3 bpp takes 1 minute for network with a width of 32, but 6 minutes with width 256 (NVIDIA GTX 1080 GPU).
Normalization. As the weights of the decoder network are set randomly, the gradients can have high variance. In Table 6 experiment with tow types of normalization layers that do not require mini-batch statistics. We include Positional
Normalization (PONO) Li et al. (2019) and Instance normalization (IN) Ulyanov et al. (2016) in our model. the results show that both normalization methods improve the error rates and both visual metrics, but IN performs the best in this setting. We hypothesize this is because normalization stabilizes the gradients and brings activations near the activation tipping points, which eases the optimization process. Unlike IN, PONO removes the structural statistics Li et al. (2019), which might be informative to create small perturbations.
Activation. One important design choice for neural networks are the activation functions. In Table 7 shows results for various popular choices. We observe that LeakyReLu results in better performance when compared to other activations like sigmoid or tanh. The PSNR and SSIM values for sigmoid or tanh are (trivially) high because the optimization fails and very few changes are made
5We have also explored the use of fully connected networks but found them to yield far higher error rates, while being slower to optimize for.
to the input image. Omitting the activation layer, despite having low error rates, produces images of inferior quality. Adding the ReLU non-linearity makes the optimization easier and more stable.
The different architectures have different tradeoffs in terms of memory, time, and performance. Wider and deeper networks require more time and memory. For our experiments, we settled on four convolutional layers (three intermediate layers and one output layer) with 128 hidden units each, along with instance normalization and ReLU activation.

heading: C STEGANOGAN HIDDEN LAYER SIZE
text: Table 8 shows difference in performance when using 32 hidden channels vs 128 hidden channels. As seen in the table the difference is quite small. However, using networks with a smaller hidden size speeds up both the training of the network and using it for FNNS. Hence, for FNNS we use networks with 32 hidden channels.

heading: D HIGHER BITS PER PIXEL

heading: E OPTIMIZE FULLY TRAINED STEGANOGAN
text: For FNNS-D and FNNS-DE we used SteganoGAN models trained for 1 epoch as mentioned in section 4. This ensured that the model was flexible enough to achieve 0% error. Table 10 shows the result of using SteganoGAN models trained to completion for 32 epochs. As seen in the table, that the error rate decreases significantly when FNNSD is used without the image quality getting significantly worse. The learning rate was set to 0.5 and the number of optimization steps was set to 200 when using a SteganoGAN model trained for 32 epochs. All other hyper-parameters were the same as listed in section 4.

Review summaries:
The paper proposes a novel neural image steganography method. The fundamental idea is that the sensitivity of neural networks to adversarial perturbations can be leveraged to encode an arbitrary hidden message into imperceptible perturbations. The authors' method heavily outperforms current classical and neural image steganography methods. They also perform several relevant experiments, such as robustness of the method to lossy compression and avoiding steganalysis.  The authors also propose to apply their method to protect persons' identities in pictures by detecting all faces present in a picture, in-painting them with a GAN and hiding the picture of the original face in the GAN-generated image. 

This paper proposes a method for image steganography based on adversarial attacks. Unlike previous works such as SteganoGAN, the proposed method fixes the decoder and performs an inference-time attack to produce a perturbation which maps to the correct message. Empirical results show the proposed method out-performs existing encoder decoder based design, and is also more robust in out-of-domain applications. 

This submission deals with steganographic paradigm : hiding a secret message in a cover content while remaining undetectable. The authors use a purely ML-based pipeline. They intend to achieve zero message-retrieval-error (which is normally a must-have for steganographic approaches). They use a neural network decoder and exploit adversarial perturbations to compute the stego version of the cover image. The loss from which gradients originate is the sum of binary cross-entropies between decoder output and message to embed.