Integrated Steganography and Steganalysis with Generative Adversarial Networks

1 INTRODUCTION . Steganography literally means “ covered writing ” and is usually interpreted to hide information in other information . As the counterpart , the main idea of steganalysis is to analyze whether the received information contains any hidden information , and to recover the hidden information if possible ( Volkhonskiy et al. , 2017 ) . Since their birth , steganography and steganalysis have complementary progress . Steganography is widely used in secret information transmission ( Shi et al. , 2017 ) , watermark ( Yu , 2016 ) , copyright certification ( Mun et al. , 2017 ) , forgery detection ( Wolfgang & Delp , 1996 ) applications . In this paper , we propose an integrated steganography and steganalysis framework with generative adversarial networks , and use ISS-GAN to represent the method in this paper . ( ISS is the acronym of integrated steganography and steganalysis . ) ISS-GAN combines the steganalysis ’ s evaluation metrics of secure steganography with the advantages in latest GAN principle , and integrate the counterparts into single framework . Firstly , we will simulate the steganalysis process with discriminative model . It will help us to dynamically change the capacity of cover images , and understand their sensitivity to semantic change . Then with the fine-tuning adversarial training process of steganography generative model and steganalysis discriminative model , ISS-GAN can iteratively reduce the consistent loss between original cover images and generated stego images . Finally , when ISS-GAN gets the minimal consistent differences , the generated stego images can hardly be distinguished from original cover images . In the training process , we also involve some intentional attacks ( noise , compression , etc . ) in dataset . The mixture of training dataset can further improve the security of ISS-GAN . By comparing ISS-GAN with the state-of-the-art steganography methods in benchmark datasets , we can conclude that ISS-GAN has the advantages in improving the quality and security of generated stego images . In Figure 1 , can you differentiate between Van Gogh ’ s paintings in ( a ) and ( b ) ? Or Monet ’ s paintings in ( e ) and ( f ) ? Actually , the images in ( a ) and ( e ) are the original version of drawing masters ’ works . The images in ( b ) and ( f ) are the stego version with ISS-GAN framework . The embedded secret images are emblems of painters ’ nations : Netherland and France . The embedded info is kept imperceptible to ensure there is no influence on audience to appreciate paintings from fidelity aspect . 2 RELATED WORK . State-of-the-art steganography approaches can be categorized into three types . Least Significant Bit Steganography The main strength of this category is that algorithms are theoretically simple and have low computational complexities . Secret information is embedded into cover image with the operations like shifting or replacing of pixels . In typical Least Significant Bit ( LSB ) algorithm , pixel values of cover image and secret messages are represented by binary form . Stego image generation process is implemented by replacing the least significant bits of cover image with the most significant bits of secret information . In ( Das et al. , 2018 ) , authors proposed to generate a LSB based hash function for image authentication process , which can provide good imperceptibility between original image and stego image with hash bits . Moreover , it can successfully identify tamper by a process of tamper localization . Content Adaptive Steganography In this category , some sophisticated steganographic algorithms design a hand-crafted distortion function which is used for selecting the embedding localization of the image . These algorithms are the most secure image steganography in spatial domain , such as Wavelet Obtained Weights ( WOW ) , Highly Undetectable Steganography ( HUGO ) , S-UNIWARD , etc . WOW ( Holub & Fridrich , 2012 ) embeds information into the cover image according to textural complexity of regions . In WOW algorithm , the more texturally complex the image region is , the more pixel values will be modified in this region . HUGO ( Pevnỳ et al. , 2010 ) defines a distortion function domain by assigning costs to pixels based on the effect of embedding some information within a pixel . It uses a weighted norm function to represent the feature space . S-UNIWARD ( Holub et al. , 2014 ) proposes a universal distortion function that is independent of the embedded domain . Despite the diverse implementation details , the ultimate goals are identical in this category . They are all devoted to minimize distortion functions , to embed the secret into the noisy area or complex textures , and to avoid the smooth regions of the cover images . Deep Learning based Steganography As deep learning has brilliant capability in image processing and generation , researchers also attempt to utilize it in steganography . ( Volkhonskiy et al. , 2017 ) introduces a new model for generating more steganalysis-secure cover images based on deep convolutional generative adversarial networks . ( Dong et al. , 2018 ) proposes a steganography model which can conceal a gray secret image into a color cover image with the same size , and generate stego image which seems quite similar to cover image in semantics and color . ( Shi et al. , 2017 ) wants to generate more secure covers for steganography . Based on Wasserstein GAN ( Arjovsky et al. , 2017 ) , the proposed algorithm is efficient to generate cover images with higher visual quality . 3 FRAMEWORK OF ISS-GAN . 3.1 PRINCIPLE OF ISS-GAN . In the proposal , ISS-GAN is a steganography framework to embed secret message into the source cover image . So here are two essential metrics to evaluate the steganographic algorithm . • Secret info should remain imperceptible until it is extracted by specific authorized receiver . • Stego image should be secure and intact to resist tampering and attacks . In traditional state-of-the-art frameworks , the imperceptibility is achieved by carefully choosing the LSB in pixel domain , or relied on hand-crafted distortion function in traditional steganography . So the features and algorithms need meticulous artificial design . Moreover , these designs heavily rely on the characteristics of target images . So it is very hard for these schemes to become general solutions in various applications . The artificial designed features are also vulnerable to intentional and hybrid attacks . For deep learning based steganography , the main focus is to generate the steganalysis-secure cover images . But in many real applications , the cover images are given . So how to fully utilize the given images to hide secret , and to improve the security of generated stego images are not answered . After analysing the drawbacks of state-of-the-art algorithms , we find GAN is very suitable for integrated steganography and steganalysis framework . Instead of artificial design , the generative network can learn from training samples and generate the suitable imperceptible features by itself . The discriminative network can simulate the function of steganalysis . The iterative adversarial training process can strength the capability if steganalysis model as well as steganography model . The stronger steganalysis model will stimulate the boost of steganography model , and vice versa . Moreover , how to resist the tampering can also be learned from attacked training samples . For the first evaluation metric , let ’ s imagine the following situation . An eavesdropper wants to check whether the image he obtained from public media contains secret info . So he needs to discriminate the original cover image and received stego image . If these two images are perceptibly same , then the eavesdropper can hardly differentiate the stego image from the cover image . For the purpose of steganography , we can accumulate the visual and statistic differences between cover and stego images . If the difference for each evaluation metric is small enough , we can regard this stego image as a high-quality steganography result . This aligns with the imperceptible evaluation criterion of steganography . For the second evaluation metric , let ’ s imagine the following situation . The eavesdropper wants to destroy the secret communication . So he makes intentional changes to the stego image , like rotate , clip , add noises and JPEG compression . Because he assume that even the image he obtained contains secret , these intentional changes will make the secret extraction method disabled . If the steganography framework is secure , and steganalysis algorithm is robust enough , the intentional changes are in vain . This aligns with the secure evaluation criterion of steganography . GAN ( Goodfellow et al. , 2014 ) consists of the generative model and the discriminative model . The purpose of the generative model is to generate new samples which are very similar to the real samples , and attempts to confuse the discriminator . While the purpose of the discriminative model is to classify samples synthesized by the generative model and the real ones . The discriminative model will also estimate the probability that a specific sample comes from the generative model rather than the real ones . When the whole GAN model achieves Nash Equilibrium , that is to say , the generative model can generate the samples which exactly align with the character and distribution of real samples . And at the same time , the discriminative model returns the classification probability 0.5 for each pair of generated and real samples . Then this GAN model is well-trained and converged . To combine the purpose of steganography , steganalysis and GAN model , we propose novel ISSGAN framework . ISS-GAN also consists of the steganography generative and steganalysis discriminative model . The purpose of steganography generative model is to generate stego image which is aligned with the original cover image , and attempts to confuse steganalysis discriminative model . While the purpose of the discriminative model is to distinguish generated stego image from the cover image . When ISS-GAN achieves Nash Equilibrium , i.e. , the generative model can generate stego image which exactly aligns with the character and distribution of cover image . And at the same time , the discriminative model returns the classification probability 0.5 for each pair of stego and cover image . This also aligns with the evaluation criterion of steganography and steganalysis . In conclusion , designing steganography and steganalysis framework is equal to make the ISS-GAN model well-trained and converged . The overall framework of ISS-GAN is shown in Figure . 2 . In ISS-GAN , there are two generative models and two discriminative models . Because steganography and steganalysis framework should contain secret info embedding and extraction processes , so it needs to learn the bijective mapping relationship between two image collections . For ISS-GAN , one image collection contains the original cover images , the other collection contains the secret images for embedding . In the left part of Figure 2 , the original cover image ( CI ) and the original secret image ( STI ) go through the stego image generative model GSOI , to produce the stego image ( SOI ) . This is the secret embedding and stego image generation process , which can be expressed as follows . SOI = GSOI ( CI , STI ) ( 1 ) In the right part of Figure 2 , the stego image ( SOI ) go through the secret image generative model GSTI , to get the extracted secret image ( ESTI ) . This is the secret image extraction process , which can be expressed as follows . ESTI = GSTI ( SOI ) ( 2 ) The cover image discriminative model DCI ensures that the distribution of images from CI is indistinguishable from the distribution SOI using an adversarial loss . This is the guarantee of the imperceptible evaluation criterion in steganography . For the purpose of refining secret extraction , we introduce the secret image cycle discriminative model DSTI . Because generative model is learned to transform from a source image domain to a target image domain . Take the secret image generative model GSTI as an example , the learned mapping relation is highly under-constrained , and can not ensure the generated ESTI is indistinguishable from original STI ( Zhu et al. , 2017 ) . So we couple this mapping relation with its inverse mapping GSOI , and introduce a cycle adversarial loss : DSTI ( STI , ESTI ) → 0 ( 3 ) That is equal to GSTI ( SOI ) = GSTI ( GSOI ( CI , STI ) ) ≈ STI ( 4 ) Its goal is to ensure that the distribution of images from ESTI is indistinguishable from the distribution STI using cycle adversarial loss DSTI . This is the guarantee of the secure and robust extraction criterion in steganography and steganalysis . To refine steganalysis scheme , we introduce the extra inconsistent loss . To make the whole ISSGAN framework useable , we should ensure the secret can only be extracted from SOI . If we apply the secret extraction process to CI , secret image should not be recovered . The inconsistent loss can be expressed as follows : max GSTI |GSTI ( CI ) − GSTI ( SOI ) | ( 5 )

Summary: The paper is on applying GAN to steganography, and it is especially suited for people who does not know steganography. In fact, 1/4 of the paper is spent on introducing (in a very clear and catchy way) the basics. State of the art section nonetheless shows that the authors are grounded with the very last related work. The novel GAN framework is called ISS-GAN. Simply speaking, ISS-GAN is built by the combo: <steganography generative, steganalysis discriminative>. In the details, the implementation is not straightforward, and embeds interesting ideas. Two generative and two discriminative models are intertwined: one generative for the stego image generation process, the other generative for the secret image extraction process. The two discriminative models are for ensuring that the distribution of cover images is indistinguishable from the stego distribution and to ensure that the distribution of extracted secret images is indistinguishable from the distribution of the original secret images. In rough terms, the adversarial double loop serves to ensure that the embedding and the extraction function preserve both the aspect of the original and the secret images. PSNR and SSIM metrics are employed to give a quantitative check of the approach.