Variable Length Variable Quality Audio Steganography
Authors: Seungmo Ku
Venue: ICLR 2022 Submitted (2022)
Keywords: computer vision
stegaography
recurrent neural network
loss conditional training
information hiding

Abstract: Steganography is the task of hiding and recovering secret data inside a non-secret container data while making imperceptible changes to the container. When using steganography to hide audio inside an image, current approaches neither allow the encoding of a signal with variable length nor allow making a trade-off between secret data reconstruction quality and imperceptibility in the changes made to the container image. To address this problem, we propose VLVQ (Variable Length Variable Quality Audio Steganography), a deep learning based steganographic framework capable of hiding variable-length audio inside an image by training the network to iteratively encode and decode the audio data from the container image. Complementary to the standard reconstruction loss, we propose an optional conditional loss term that allows the users to make quality trade-offs between audio and image reconstruction on inference time, without needing to train a separate model for each trade-off setups. Our experiments on ImageNet and AudioSet demonstrate VLVQ’s ability to retain reasonable image quality (28.99 $psnr$) and audio reconstruction quality (23.79 $snrseg$) while encoding 19 seconds of audio. We also show VLVQ’s capability to generalize to signals longer than what is seen during training.

Under review as a conference paper at ICLR 2022
VARIABLE LENGTH AND VARIABLE QUALITY AUDIO STEGANOGRAPHY
Anonymous authors Paper under double-blind review
Figure 1: Image with the audio data hidden inside. Bottom: 19 seconds of hidden audio extracted from the image the right.
Hiding and uncovering audio data inside image via VLVQ. Left: Original image. Right:
ABSTRACT
Steganography is the task of hiding and recovering secret data inside a non-secret container data while making imperceptible changes to the container. When using steganography to hide audio inside an image, current approaches neither allow the encoding of signal with variable length allow making trade-off be- tween secret data reconstruction quality and imperceptibilitty in the changes made the container image. To address this problem, we propose VLVQ (Variable Length Variable Quality Audio Steganography), a deep learning based stegano- graphic framework capable of hiding variable-length audio inside an image by training the network to iteratively encode and decode the audio data from the con- tainer image. Complementary to the standard reconstruction loss, we propose an optional conditional loss term that allows the users to make quality trade-off's be- tween audio and image reconstruction on inference time, without needing to train separate model for each trade-off setups. Our experiments AudioSet demonstrate VLVQ's ability to retain reasonable image quality (28.99 psnr) and audio reconstruction quality (23.79 snrseg) while encoding 19 sec- onds audio. We also show VLVQ's capability to generalize to signals longer than what is seen during training.
ImageNet and
INTRODUCTION
Natural images are redundant (Ruderman, 1994). They contain predictable structures, repeating tex- tures, and non-uniform color distribution that contribute to their low overall entropy. Meanwhile, the human visual system is insensitive minor changes its visual field. These features make steganography, the science of hiding a secret data within a non-secred container data, possible, Sev- eral researches have hidden various data inside images such binary messages (Zhu et al., 2018).

---

Under review as a conference paper at ICLR 2022
separate images (Baluja 2017:
Tamimi et al. 2013 Wu et al. 2018 Zhang et al.; 2019a b Duan
jet al. 2019), and audio signals (Kaul & Bajaj 2013 Santosa & Bao 2005 Huu et al. 2019 Here, focus the task of hiding audio inside images.
Many algorithms have successfully hidden audio data inside images, especially with the recent ad- vances on deep learning based steganography. However, the use of deep learning restricts these algorithms to only receiving input dimensions that are allowed by the design of the network ar- chitecture, which usually have fixed dimensions. This condition makes these methods difficult to operate in the real world, where the signals may easily vary in length. Naively applying these tra- ditional models iteratively on different chunks of the audio fails work, as the input distribution starts to diverge from that of the training set.
Furthermore, as the bottleneck of most steganographic systems comes from the container data's capacity, hiding varying length signal inside fixed-sized container requires the capability to trade-off audio quality and image fidelity. One approach to do so by changing the coefficients of the different loss terms that each control the reconstruction quality of the container and the secret data. However, this requires the training of several systems with different coefficients, which is not only time and memory consuming, but also fails to cover the full continuous range of possible coefficient combinations.
We propose new steganographic framework VLVQ (Variable Length Variable Quality Audio Steganography) to encode variable length audio signals in an image and make audio quality and image fidelity trade-off with a single model inference time. [igureeeemmoosssttate demonsstaats VLVQ encoding 19 seconds of audio inside an 224x224 image then decoding it back.
example of
Given the initial container image, VLVQ iteratively embeds an audio chunk inside the image until all of the audio has been encoded. To recover the audio back from this final container image, VLVQ isolates the latest audio chunk embedded inside the container, and update the container image to feed itself back into the decoder recursively. This is repeated until all audio is recovered. An important design choice to use the trade-off coefficient that linearly weighs the image and audio reconstruction quality as an input to the network. By randomly sampling this coefficient at each training step and feeding it input to the model, a single model can learn a distribution of solutions.
Section 2 reviews previous works related to VLVQ. Section 3 describes the problem setup and VLVQ's methodology in depth. Then, Section 4 evaluates our approach on ImageNet (Russakovsky et al. 2015) and AudioSet (Gemmeke et al.) 2017), demonstrating reasonable reconstruction qual- ity even on signals longer than what is seen during training. Finally, Section [ discusses various observations and possible directions for future work.
RELATED WORKS
Image Steganography. Steganography is the task of encoding a secret data inside a non-secret con- tainer data without making noticeable changes to the container. Image steganography describes scenario that uses an image as the container that carries the secret data. The limitations of the human visual system in noticing slight changes in brightness color among many pixels make these image steganography methods effective. Traditional image steganography methods exploit the image spa- tial domain by modifying the least significant bits (LSB) of the image, or the frequency domain with Discrete Fourier Transform (DFT), Discrete Cosine Transform (DCT), and Discrete Wavelet Trans- algorithms, steganographic
form (DWT). With the help of recent advancements in learning- systems have seen tremendous advancements. Many of the learning based steganographic systems employs deep neural networks that are trained end-to-end with reconstruction losses that minimize the change in the container while maximizing the similarity between the recovered secret data and the ground truth. Baluja (2077) uses convolutional architecture to hide images inside images, while Zhu et al. (2018) adopts differentiable augmentations to hide and recover binary data inside images with robustness to image corruptions. Different approaches make improvements in architectural de- signs (Duan et al. 2019 Cui et al. 2020 Wu al. 2018) while some adopt Generative Adversarial Networks (GANs) (Goodfellow et al. 2014) to make the changes further imperceptible.
Hiding Audio in Image. Hiding audio signal inside images is specific instance of image steganog-
raphy. Similar to image steganography in general, methods such as modifying the least significant
bits (LSB) (Kaul & Bajaj 2013) as well as wavelet transformations (Kaul & Bajaj 2013 [anntssa &
2

---

Under review as a conference paper at ICLR 2022
original
7 0.1
7
== 10.0
Figure 2: Difference between the original image and the final container image containing 19 seconds of audio, inferenced using the same model with different conditions. The additional artifact encoding for the STFT features (top part of the difference) becomes more apparent with larger values of Y a coefficient used to trade-off between audio quality and image fidelity, (Left: ? 0.1. Center
7 1.0. Right: 10.0)
Bao 2005 have been applied the task. Deep learning based approaches such Huu et (2019) encodes STFT features of audio into the container image with convolutional architecture. Ye et al. (2019) incorporates GANs. Still, these methods are limited to fixed dimensional inputs, prohibiting its applications in the real world with audio signals that vary in length.
Cossiiiniii Training. Generally, deep learning handles multi-objective training by linearly combining the different sub-objective terms with their respective coefficients. If the coefficient val- ues are closely tied to the model's 's use cases, one must train multiple models with different coefficient combinations to cover all such cases, which is computationally expensive and impractical. Loss- conditional training resolves this by conditioning the model on the randomly sampled coefficients during training. [Babaeizadeh & Ghiasi (2018) first adopted loss-conditional training in style transfer to make the style and content coefficients in style transfer adjustable at inference time. Dosoviiskiy & Djolonga (2019) then proposed a general framework for loss-conditional training, demonstrat- ing its applications in autoencoder, image compression, and style transfer. Lee et al. (2020) adopts loss-conditional training in creating dynamic residual network with adaptable sparsity. Since the importance of audio data reconstruction quality varies among the different use cases of steganogra- phy (e.g.. in speaker identification, high audio quality may not be necessary as long as the voice identifiable), we adopt an optional loss-conditional training process to allow the trade-off between these two objectives inference time.
METHOD
In this section, we describe the VLVQ (Variable Length and Variable Quality Audio Steganography) framework detail. We first describe the problem setting, then elaborate on the specific methods. Please refer to Algorithm T for an overview of the methods.
3.1 PROBLEM SETUP
In steganography, system 7. takes a container data with secret data s to produce a modified container H(c, s) that encodes s while remaining visually similar c. Then, system F takes è to recover the secret data à F(é). In Audio-in-Iman Steganography, is an image, and 8 an audio of variable length. Since the container's capacity the limiting factor in what capable of being hidden, adopt 7 to represent the trade-off parameter between the reconstruction quality of the container and the secret data. Here, a larger value of y increases the quality of the audio reconstruction at the sacrifice of the container image quality, while smaller value makes the change on the container image less noticeable at the sacrifice of the audio reconstruction quality.
The audio data goes through STFT (Short-Tima Fourier Transform) during the preprocessing step and converts into the frequency domain. This makes s, $ e N xTx2 with N as the number of frequencies, T' as the varying length of the audio, and 2 the real and complex channel. c and à is
3

---

Under review as a conference paper at ICLR 2022
Algorithm 1: VLVQ Framework conditioned on
Result: Fully trained H. and JF
Algorithm parameters: Container image c, Secret audio s, range "mmnn Tmaz, total iteration
Trotals audio chunk number range Cmins Cmar. frequency number and image resolution h, w;; Initialize H.F F with random weights;
repeat Totol times
Sample random integer k in range [Cmin: Cmaz]i Let = w 01 = C;
Sample " from log(?) U (log((7mmn) log((maa)))
Sample hxxx22 and E T from the dataset;
Crop into 8; Axxx2 1...k;
for to 1: do
C++1 = H(G, 7);
end
CK+1 = C++1
for i + 1 to 2 do
2-11 5;-1 = F(c;, 7);
end
Limg-
8: Σ |c: cıl12i
Ldec
x Ei=
|| 241112:
Lutst & E ||s; 8;112;
Liotal = Limg + Ldee + Tbari
Backpropagate and optimize H. and with respect to Liotati
end
an RGB image with e, E R We set N h for simplicity and only use h and to denote spatial dimensions, thus 8, 8 E R2xXxx2
3.2 RECURSIVE PATCH INFERENCE
Algorithm. T is a value that changes across different inputs. However, having T = h w would keep the spatial resolution of both and identical and constant, which is an ideal condition for inference on a deep ncural network. We sample to have as a multiple of w during training, so 1...k. k. To guarantee this during inference, we pad s to hhx [ 11x2 and crop s into k = 1 chunks.
crop into k I chunks, with each chunk 5; 1xx=x2
Encoding Process. Let denote the container image with
audio chunks encoded inside. C = C. and G++1 = H(c, Si), which denotes that the current container and a chunk of the secret data is fed into H. to update the container, and it is recursively fed back into H with the next chunk of the secret data until i = + 1. Finally, õ6+1 = Ck+1. which denotes the final container that conceals all the audio chunks.
Decoding Process. Then, 8 = F(r:), which recursively feeds the container image to F to decode each audio chunks, while updating the container image to recursively feed itself back into F. With this process, we obtain ..... S4 that corresponds to $1 Sq. Figure visualizes both the encoding and the decoding process.
3.3 OPTIMIZATION OBJECTIVE
We optimize both H. and FF with respect Liotals objective function that linearly weighs three sub-objective functions.
Audio Container Distance. To ensure that the decoded audio is similar to the ground truth audio at the same chunk index, we minimize the average of their mean-squared distances C Also, to minimize the change H makes the container image, minimize Ling which is the average of

---

Under review as a conference paper at ICLR 2022
Originel Image
Lise
Final Image
Cims
Limo
Weight
Weight
Weight
Caft
Weight Share
Cxl/
Weight Share
Cate
Weight Share
Recavened
Recarvered
Recovared
#3
Laer
Cise
Ldee
Figure 3: The overall process of the VIVQ framework. Iterative encoding H minimizes the distance between original container image and the modified container image (Ling). Iterative de- coding on F minimally updates the container image (Edee), while making the reconstructed audio data to be as close to the ground truth (Cstft).
the mean-squared distances between e₁ and e for . d: +
&
k+1
Lxeft
Σ 11s 8ill2
Ling =
|| calla
(1)
Decoding Consistency. continuously updates the container image from the previous iteration. To prevent this process from destroying the information about the remaining audio chunks, it essential to prevent from making large modifications to the container. We achieve this by minimizing the mean-squared distance between the container images of two consecutive decoding iterations, Ldec-
1 Σ Te
Lasc
||
2:+1/12
Full Objective. The final loss term Ltotat is linear combination of the above three loss terms, and the hyperparameter determines the trade-off between audio and image reconstruction quality. deguureBde the effects of this parameter by visualizing the changes of the residuals. We simply keep the coefficient of Ldce as 1.0, as it didn't ' have significant effect on the outcome.
Lietal Limg + Lidee + TLaft
3.4 TRADE-OFF COEFFICIENT CONDITIONING
Modifying 7 in equation gives control over the trade-off between audio reconstruction quality and container image quality. However, to allow such trade-offs at inference time with varying terms, one must train several VLVQ frameworks, which would computationally expensive. To address this, the VLVQ framework has the option to adopt strategy of directly conditioning the models with y, such that H(c,, st) and F(C;) may become H(G, s; 7) and F(2..
? Conditioning, Both H and F are composed of several convolutional blocks, with each block following the order of convolution (Conv), normalization (Norm), and activation function (Act). Given the input and output of block X, Y #XXXCC with 7 E R RR,72 0.
Y Act (oNorm(Conv((X)
5

---

Under review as a conference paper at ICLR 2022
To condition ,, adopt the FiLM conditioning layer of Perez et al. (2018), which does lin- ear transformation on the convolutional feature with scale and shift parameters generated from the conditional variable.
Original
Container
Conv
Audio Chunks
OAYA
Limg
Ciotal
Liter
Linear
Lesfi
ReLU
Tradecef Coefficient
Figure 4: Conditioning module of the VLVQ framework. The architecture is conditioned via the FiLM layer (Perez et al. 2018), and the loss term is conditioned on via linear combination.
a f(y) h(7)
H Norm (onv(X))
(5)
Y Act(aH + +.
Here, BE RC, H.Y.HE E Rxxxx f and h are two-layer fully-comnected networks with ReLU activation. Figure SegureeFillsterr Hillustrates this conditioning module.
Sampling Distribution of Gamma Since is no longer hyperparameter, we sample from
fixed distribution each training iteration. We apply commonly used hyperparameter distribution of log- ong-unifomm distribution (Bergstra & Bengio 2012) and find Timin 0.01 and "maz 100.0 to be a reasonable range.
log(n) ~ U(log(((linn log(?mma))
(6)
4 EXPERIMENTS
Section 4.1 describe the implementation details of the VLVQ framework, and Section 4.2 describes the datasets and metrics used in our experiments. Section 4.3 demonstrates the effects of modifying the 7 parameter to both conditional and non-conditional versions of the framework, and Section 4.4
tests VLVQ's capability to extrapolate and encode variable length signals.
4.1 IMPLEMENTATION DETAILS
2015) like architecture for both H and When conditioning the network 7, we insert a FiLM layer (Perez et al.) (0088) in all convolutional and transposed convolutional blocks. H receives a 5-channel input by concatenating e; and 8;, and F produces 5-channel output which is split in the channel dimension into è; and š,. Please refer to the supplementary materials for more details.
Architecture. We adopt U-Net (Ronneberger
Hyperparameters. The network is trained end-to-end via Adam (Kingma & Ba 2014) with the initial learning rate 0.001, batch size of 4, and betas of 0.9 and 0.999 for two epochs. The learning rate decays by factor of 10 halfway through the training. The framework is implemented on the Py Torch (Paszke et al. 2019) framework, and all models are trained on a single Nvidia Tesla V100 GPU.

---

Under review as a conference paper at ICLR 2022
30
25
12-
94
-0
20
18
caoAks
snal cazebe croodod
(a) Evaluating a non-condition model trained with
(b) Evaluating condition model trained with y from log(?) ~ U'log(0.01), log (10000)) and 1.0 during inference.
= 1.0.
conditioned
Figure 5: Evaluation encoding variable number of chunks inside the VLVQ framework. Lighter color indicates the encoding of later audio chunks. Despite being trained maximum three chunks, the model can be reasonably extrapolated to encode longer sequences.
4.2 EXPERIMENT SETUP
Dataset. For the images, use the ILSVRC 2012 subset of the ImageNet (Russakovsky et al, 2013) dataset, containing 1.28 million natural images for training and 50k for validation. Images preprocessed with resize and center crop of 224x224. For the audio,
the AudioSet (Gemmeke et al. 2017) dataset, containing 1.7M audio clips that are each 10 seconds long. We convert all the samples into the frequency domain image with height of 224 via STFT. After concatenating all the samples, one to three 224x224 random crops are taken from them every training iteration, with each crop representing an audio chunk that accounts for approximately 6 seconds of audio.
Evaluation metries. For the container image quality, we measure PSNR (Peak Signal-to-Noise Ratio) between the original container image and the current container image (with the audio data embedded inside). For the audio reconstruction, we measure SegSNR (Segmental Signal-to-Noise Ratio) between the original audio and the reconstructed audio.
4.3 EFFECTS OF MODIFYING GAMMA
Verifying Trade-off's Increasing the Y parameter on VLVQ should increase the audio quality at the sacrifice of the container image quality and vice versa. Such trend is shown for both conditional and non-conditional models in Figure demonstrating that modifications in yield meaningful trade-offss between different objectives. An ideal conditional VLVQ framework should have near-identical re- sults compared with the non-conditional VLVQ framework individually trained on their respective y parameters. However, a slight degradation ex- pected as the consequence of having a difficult op- timization space that covers many values of y, fore- ing the model to learn distribution of solutions. Again, such trend is observed between the condi- tional and non-conditional model.
Imag (por)
audi (rrrg))
25
20-
22
Figure Conditional model (curve). Non-
conditional models (point).

---

Under review as a conference paper at ICLR 2022
Method
psnr for different number of audio chunks
2
3
4
6
7
non-cond
10.0
35.47
31.77
29.67
28.26
27.02
26.22
25.49
1.0
40.42
36.67
34.85
33.47
32.30
31.46
30.63
0.1
44.08
40.38
38.03
36.32
35.07
34.02
33.07
cond
10.0
31.40
27.85
25.75
24.37
23.04
22.64
21.78
1.0
34.75
31.03
28.99
27.40
26.26
25.56
24.46
0.1
36.06
32.13
30.29
28.48
26.99
26.29
25.02
Method
7
snrseg for different number of audio chunks
2
3
4
6
7
non-cond
10.0
30.70
28.32
27.02
26.32
25.44
24.62
24.50
1.0
27.85
25.92
25.42
24.18
23.26
22.76
22.07
0.1
25.59
24.43
24.21
22.92
22.09
22.12
21.73
cond
10.0
25.11
27.73
25.09
24.67
23.49
23.50
22.94
1.0
24.79
25.00
23.79
23.87
22.93
21.84
21.16
0.1
25.12
22.16
22.82
20.65
19.84
19.63
18.49
Table I: Effects encoding different audio lengths (1 to chunks) inside the VLVQ frameworks. The snrseg values averaged across the whole audio reconstruction. The effects of the trade-off becomes apparent as ry decreases, with the increase in image quality and decrease audio quality.
4.4 NUMBER OF ENCODED AUDIO CHUNKS
We test whether the VLVQ framework stands the claim of being capable of encoding audio sig- nals with varying length. To evaluate this, we test beyond the expected number of chunks during training (Cmin 1, Cmaz 3) by evaluating up to audio chunks. For both con-conditional and conditional framework, Figure Sa 5b and Table each shows that while both image and audio reconstruction quality drops with longer encoded sequences, the drop continues to maintain a grad- ual decline from 1 to 7 instead of rapid drop at 4. This trend demonstrates VLVQ's reasonable extrapolation capability.
5 DISCUSSION
Defenses Against Steganalysis. While we make no claims regarding VLVQ's defensibility against steganalysis, future work may evaluate and equip VLVQ with defenses (Lyu & Farid [002 Fridrich 2004 Fridrich & Kodovsky 2012 Kodovsky et al. 201 Qian et al. 2015) to prevent algorithmic detections.
Failure Modes. When dealing with multiple audio chunks, F sometimes fails to separate the sig- nals between different chunks, resulting the leakage of audio chunks into different timesteps. This usually happens when different audio chunks greatly vary in volume, as the louder chunks dominate the signals in the container image. Future work may employ an adversarial framework by intro- ducing an adversarial framework to discourage F from producing signals that can be classified as originating from a different chunk.
While we used FiL.M on all convolutional blocks due to its simple architec- ture choice, one may search for a better method conditioning 7, such as searching for the optimal layers to place the conditioning module.
Conditioning Methods
Limitations. Although simple U-Net (Ronneberger et al., 2015) was sufficient to yield satisfac- tory results, there are clear limitations to this architecture. For example, convolutional layer's inductive bias forces the network to rely mostly on local information. Figure 2 demonstrates that most residuals visible the top of the image, where the most prominent STFT features lie. To exploit the full capacity of the container image, architectures with minimal inductive biases such as transformers Vaaswani al. 2017) may be employed.
8

---

Under review as a conference paper at ICLR 2022
6 CONCLUSION
In this work we present VLVQ. a steganographic framework that encodes variable length audio data into images with varying quality trade-offs. Compared to other frameworks of this kind, VLVQ enables greater degree of freedom in terms of secret audio length and infernce-imee quality trade- offs. We achieve this through recursive inference of multiple audio chunks and conditioning the model with the trade-off parameter via FiLM layers. Experiments on ImageNet and Audioset verify these claims and demonstrate extrapolation capabilities beyond audio length seen during training. We hope these efforts make audio-in indio-in-imaae steganography feasible in diverse real-world scenarios.
A ETHICS STATEMENT
With growing concerns various societal issues regarding individual privacy, tools such as steganography can empower individuals to have greater control over their information. For exam- ple, activists in nations where encryption is criminalized may apply steganography in non-secret medium to hide their messages. In this aspect, our work helps widen the available pool of stegano- graphic medium an individual can hide their information on. But this raises concern potential risk based on the malicious uses of steganography, such as its applications as digital fingerprints in intelligence services. Hence, researches on steganography and its applications must be developed with these positive and negative effects in consideration.
REFERENCES
Mohammad Babaeizadeh and Golnaz Ghiasi, Adjustable real-time style transfer. arXiv preprint arXiv: 2018.
Shumeet Baluja. Hiding images in plain sight: Deep steganography. In Proceedings of the 31st International Conference on Neural Information Processing Systems, pp. 2066-2076, 2017.
James Bergstra and Yoshua Bengio. Random search for hyper-parameter optimization. Journal of machine learning research, 13(2), 2012.
Wenxue Cui, Shaohui Liu, Feng Jiang, Yongliang Liu, and Debin Zhao. Multi-stage residual hiding for image-into-aune andioo steganography. In ICASSP 2020-2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 2832 2836. IEEE, 2020.
Alexey Dosovitskiy and Josip Djolonga. You only train once: Loss-conditional training of deep networks. In International Conference on Learning Representations, 2019.
Xintao Duan, Kai Jia, Baoxia Li, Daidou Guo, En Zhang, and Chuan Qin. Reversible image steganography scheme based on u-net structure. IEEE Access, 7:9314-9323, 2019.
Jessica Fridrich. Feature-based steganalysis for jpeg images and its implications for future design of steganographic schemes. In International Workshop on Information Hiding, pp. 67-81. Springer, 2004.
Jessica Fridrich and Jan Kodovsky. Rich models for steganalysis of digital images. IEEE Transac- lions on Information Forensics and Security, 7(3):868 882, 2012.
Jort F. Gemmeke, Daniel P. W. Ellis, Dylan Freedman, Aren Jansen, Wade Lawrence, Channing Moore, Manoj Plakal, and Marvin Ritter. Audio set: An ontology and human- dataset for audio events. In Proc. IEEE ICASSP 2017, New Orleans, LA, 2017.
Ian J Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial networks. arXiv preprint 17Xiv:1406.2661. 2014.
Quang Pham Huu, Thoi Hoang Dinh, Ngoc N Tran, Toan Pham Van, and Thanh Ta Minh. Deep neural networks based invisible steganography for audio-into ceciio--nt--immnnn iiat- algorithm. In 2019 IEEE 8th Global Conference Consumer Electronics (GCCE), pp. 423-427. IERR, 2019.

---

Under review as a conference paper at ICLR 2022
Nitin Kaul and Nikesh Bajaj. Audio in image steganography based on wavelet transform. Interna- tional Journal of Computer Applications, 79(3), 2013.
Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980, 2014.
Jan Kodovsky, Jessica Fridrich, and Vojtech Holub. Ensemble classifiers for steganalysis of digital media. IEEE Transactions on Information Forensics and Security, ((2):432-444, 2011.
Sangho Lee, Simyung Chang, and Nojun Kwak. Urnet: User-resizable residual networks with conditional gating module. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, pp. 4569-4576, 2020.
Siwei Lyu and Hany Farid. Detecting hidden messages using higher-order statistics and support vector machines. In International Workshop on information hiding, pp. 340-354. Springer, 2002.
Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: An imperative style, high-performance deep learning library. Advances in neural information processing systems, 32: 8026-8037, 2019.
Ethan Perez, Florian Strub, Harm De Vries, Vincent Dumoulin, and Aaron Courville. Film: Visual reasoning with general conditioning layer. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 32, 2018
Yinlong Qian, Jing Dong, Wei Wang, and Tieniu Tan. Deep learning for steganalysis via convolu- tional neural networks. In Media Watermarking, Security, and Forensics 2015, volume 9409, pp. 94090J. International Society for Optics and Photonics, 2015,
Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U-net: Convolutional networks for biomedi- cal image segmentation. In International Conference on Medical image computing and computer- assisted intervention, pp. 234-241. Springer, 2015.
Daniel L Ruderman. The statistics of natural images. Network: computation in neural systems, 5 (4):517-548, 1994.
Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, Alexander C. Berg, and Li Fei-Fei. ImageNet Large Scale Visual Recognition Challenge. International Journal of Computer Vision (IJCV,, 115(3):211-252 2015. doi: 10.1007//1 10.1007//1 1233-01--081--1
Rully Adrian Santosa and Paul Bao. Audio-to-image wavelet transform based audio steganography. In 47th International Symposium ELMAR, 2005., pp. 209-212 IEEE. 2005.
Abdelfatah A Tamimi, Ayman M Abdalla, and Omaima Al-Allaf. Hiding an image inside another image using variable-rate steganography. International Journal of Advanced Computer Science and Applications (IJACSA), 4(10), 2013.
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, łukasz Kaiser, and Illia Polosukhin. Attention is all you need. In Advances in neural information processing systems, pp. 5998-6008, 2017.
Pin Wu, Yang Yang, and Xiaoqiang Li. Image-into-image steganography using deep convolutional network. In Pucific Rim Conference on Multimedia, pp. 792-802. Springer, 2018.
Dengpan Ye, Shunzhi Jiang, and Jiaqin Huang. Heard more than heard: An audio steganography method based on gan. arXiv preprint arXiv:1907. ar7.v:190..04496 04986, 2019.
Kevin Alex Zhang, Alfredo Cuesta- Infante, Lei Xu. and Kalyan Veeramachaneni. Steganogan: High capacity image steganography with gans. arXiv preprint arXiv:1901.03882) 2019a.
Ru Zhang, Shiqi Dong, and Jianyi Liu. Invisible steganography via generative adversarial networks. Multimedia tools and applications, 78(7):8559-885 8575, 2019b.
Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks.
In P Proceedings of the European conference on computer vision (ECCV), pp. 657-672, 2018.
10


Reviews:
[{"review_id": "ckp0fjYhOIM", "reviewer": "Reviewer_gihE", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\n1) The paper is well organised and moreover, the research pursued is very important in the cyber security field.\n2) In section 4 (Experimental section), the varying trade-offs of gamma parameter and data on varying length of signal hiding could be valuable/important for researchers in the field of steganography.\n\nWeaknesses:\nThe paper can be improved based on the following points:\n1) In section 1, the authors talk about the drawback of variable length hiding, however, the definition of variable length is not mentioned. Please mention this as it could be any length.\n2) In section 2, several of the recent works in steganography/deep learning have been missed and would be great to mention them as well.\n3) In section 3 (method), it would be better to connect the algorithm (Algorithm 1) mentioned in the text body such that readers find it easier to follow.\n4) The encoding and decoding process lacks novelty. It would be better to justify why such a method has been chosen, apart from the reason of enabling variable length signal hiding. The point of the paper is to contribute to the scientific knowledge of the community, however, the proposed method felt more as applicative based method where a new design proposal is made rather than the advancement of the scientific field. The design justification is missing from the Method's section.\n5)  In section 3.3 and 3.4, the symbols used in the equations are also not described/defined intuitively, which could be a hindrance for many readers. Please update that so that readers of broader interest find it interesting to understand and read the proposed work as well.\n6) In section 4, the experiments are lacking in comparative study. There has been some methods in the same domain to utilize steganography/deep learning to hide signal, however, the proposed method has not been compared with them to show the efficacy of the proposed. The authors should consider this.\n", "summary_of_the_paper": "In the paper, the authors propose a method to  hide audio inside an image with variable length and variable quality leveraging a deep learning based steganographic method framework capable of hiding variable-length audio inside an image by\ntraining the network to iteratively encode and decode the audio data from the container image.\n", "summary_of_the_review": "The paper can be greatly improved based on the points mentioned in the weaknesses section in the main review for the authors. Please refer to the points before the paper could be considered for presentation at ICLR.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "TBYJHwgQen1", "reviewer": "Reviewer_c5tq", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The audio specific aspect of the problem is not sufficiently well justified. Generally speaking, in steganography, the nature of the hidden message does not matter : it can be audio, image or video signals and so long, the only assumption is that the message is binary which is always possible when dealing with digital messages. So why embedding a message that is an audio should lead to any specific difficulties or conversely why would it be helpful to design better steganography ? This should be highlighted in the introduction of the paper. \n\nThe variable length message aspect of the problem is partially legitimate : several steganography algorithms will need to be re-trained or re-adjusted when the size of the message / payload changes. Some even fail to generalize to any other payload than the one they saw during training. For the specific case of ML-based steganography, this raises a well known problem of OOD generalization. But it must also be underlined that many steganographic algorithms can embed messages with various lengths and require no particular effort to do so. This means that the proposed approach should be compared to such methods in the experimental section of the paper. As a baseline, the approach could be compared to UNIWARD [1] coupled with STC encoding [2].\n\n[1] Holub, V., Fridrich, J., & Denemark, T. (2014). Universal distortion function for steganography in an arbitrary domain. EURASIP Journal on Information Security, 2014(1), 1-13.\n\n[2] Filler, T., Judas, J., & Fridrich, J. (2011). Minimizing additive distortion in steganography using syndrome-trellis codes. IEEE Transactions on Information Forensics and Security, 6(3), 920-935.\n\nObviously, the authors address a problem that is different from the one addressed by the mainstream steganographic literature. They allow themselves to modify message length by degrading the audio signal. This is where using an audio is instrumental from the authors’ standpoint : reaching a compromise between the audio signal quality and embedding capacity of the cover image. \nThe legitimacy of this very problem is itself debatable. For a genuinely secure steganography, one would (i) lower the quality of the signal to the minimal acceptable value so that the message is as small as possible and (ii) chose an embedding that minimizes detectability for this message size. Indeed, this strategy minimizes the overall detectability which prevails over audio quality.\n\nMoreover, the proposed approach raises two major security issues :\n\t•\tif one wishes to encrypt the secret message prior to insertion in the cover image, then failing to perfectly extract the message from the stego image will make it impossible to decipher and thus useless.\n\t•\tthere is no notion of secret key in the authors’ approach. Consequently, an attacker can train a neural net similarly and find hidden messages pretty easily.\n\n\nAnother problematic issue is that the notion of detectability is understood as the accuracy of SOTA steganalysis deep neural nets such as SRnet [3] or XUnet [4]. The authors did not evaluate their approach wrt these opponents and thus fail to prove the operational interest of their steganographic scheme.\n\n[3] Boroumand, M., Chen, M., & Fridrich, J. (2018). Deep residual network for steganalysis of digital images. IEEE Transactions on Information Forensics and Security, 14(5), 1181-1193. \n\n[4] Xu, G. (2017, June). Deep convolutional neural network to detect J-UNIWARD. In Proceedings of the 5th ACM Workshop on Information Hiding and Multimedia Security (pp. 67-73).\n\nFinally, using SFTF creates a redundant representation of the initial audio signal. So the message length is inflated by this process which is again is not good for undetectability.", "summary_of_the_paper": "This submission deals with steganography, i.e. the task of hiding a secret message inside a multimedia content. The authors in this submission choose images as cover content and audio signals as secret messages. They also ask their embedding algorithm to be flexible in the sense that variable length audios can be processed by the same algorithm.\nThis is achieved by cleverly designing a neural network pipeline with recursions to tackle the variable length message issue. \n\n", "summary_of_the_review": "Pros : \n- the authors circumvent the variable message length difficulty by recursively embedding message chunks using a neural network. \n- the weight regulating quality/detectability trade-off is tunable at test time thanks to loss-conditional training \n\nCons : \n- the authors evaluate message undetectability through SNR measures instead of relying on detectability by a SOTA opponent. The proposed insertion is likely to be easily detectable by such an opponent because it is not constrained to preserve natural image statistics. \n- the problem addressed is steganography without a shared secret key and thus relies on security through obscurity which was rejected as a sufficiently secure framework long ago. I believe the authors should look for other use cases. The approach might be seen as a form of uncanny compression : instead of sending an image + an audio, one can send an image containing the audio.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "JR-eTGh4di", "reviewer": "Reviewer_jZgM", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "\nStrengths\n\nThe paper is written well and the approach is explained clearly. Iteratively encoding and decoding the audio data in the image is a strength. An optional conditional loss term is also a plus. \n\nWeakness\n\nWhile the approach is promising, the paper still needs some more work. Some of those points are mentioned in the Discussion section. \n\nFirst, it is difficult to assess how the method will perform if post-processing operations such as JPEG compression, smoothening, blurring and other operations are performed on the image.\n\nIt is also difficult to evaluate the proposed approach without knowing how a stegnanlysis method would work on the proposed method.\n\nIt is also not clear how many seconds of variable length audio are considered in the experiments. Though some details are presented in Table 1, the exact lengths of the audio in seconds is not clear. \n", "summary_of_the_paper": "This paper presents a steganographic approach called Variable Length Variable Quality Audio Steganography (VLVQ) that encodes variable length audio data inside images with varying quality trade-offs. The method works by training a network to iteratively encode and decode the audio data from the container image. An optional conditional loss term is also proposed apart from the standard reconstruction loss. Experiments presented on two large datasets - ImageNet dataset for container images and AudioNet dataset for embedding the audio, shows that the approach is promising. \n\n", "summary_of_the_review": "Though the paper has some merit and the approach of iteratively embedding audio in the encoder-decoder is interesting, the paper needs some more work, which if presented will make the paper stronger.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "2z-PyW2xSIy", "reviewer": "Reviewer_zNiL", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Although the idea and techniques are not surprising to me, the proposed method seems to have responded to a very common situation (variable audio length, flexible quality-unnoticeability trade-off) in real-world applications. The presentation is also satisfying. Nevertheless, to my understanding, the paper does not seem to have implemented the idea in a comprehensive and compelling way.\n\nMethod:\n* I hope the authors could explain more on the well-definedness of the task. In Sec. 3.1, the task is to learn the inverse of the map $\\hat{c} = H(c,s)$, but how is this $H$ invertible? Its output has more dimensions than its input. One possibility may be that images have a certain degree of freedom to be perceptually the same, and this degree of freedom can be leveraged for encoding an audio signal. If it is the case, is the capacity of the degree of freedom large enough to hold an audio signal? I expect such an explanation to convince me the task is well-defined, and to provide an insight of the capacity to encode an audio signal.\n* Is the audio encoding of equal quality if encoded in a different order? More specifically, does the audio reconstruction $\\Vert s - F(H(c_i, s)) \\Vert$ change with $i$? If it does, the order of the chunks matters, and the decoded audio may have decreasing quality.\n* Will the image become more and more distorted as the length of the audio increases?\n\nPerformance:\n* In Fig. 1, the decoded audio signal still seems to hold the pattern of the image, e.g. the bird's head and the owl's head. How does it sounds like? Also the audio-encoded images still have a sensible flaw, particularly on the top region.\n* Fig. 2 seems not mentioned in the text. Also, are the second to fourth images showing audio-encoded images or the difference from the original image? In either case, even with $\\gamma=0.1$ the modification to the image seems quite noticeable.\n* The experiment does not seem to compare with baseline methods. I'm not expert in such steganography so I'm not sure if there is indeed no variable-length steganography method, but at least I expect a comparison with a baseline method in a fixed-length setup.\n", "summary_of_the_paper": "The paper presents a method for steganography, that is to encode and decode an audio signal into an image in an unnoticeable way. The feature of the proposed method is that it can handle audio with variable length, and can flexibly trade-off between audio encoding quality and image modification unnoticeability in the inference stage. The method is to learn a pair of encoder and decoder to achieve both encoding and unnoticeability up to some trade-off, and the trade-off coefficient is also input into the model to avoid retraining for an arbitrary trade-off in inference.", "summary_of_the_review": "The paper contributed a method that seems to handle a common case in practice. But the technique does not seem novel enough, the discussion on the method does not seem necessarily comprehensive, and the performance does not seem convincing.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper presents a steganographic approach called Variable Length Variable Quality Audio Steganography (VLVQ) that encodes variable length audio data inside images with varying quality trade-offs. However, according to the reviewers, the proposal made in this paper is not novel enough, there are many details missing in the paper, and the experimental study is far from comprehensive and conclusive. Afte the reviewers provided their comments, the authors did not submit their rebuttals. Therefore, as a result, we do not think the paper is ready for publication at ICLR.
Decision: Reject