Fixed Neural Network Steganography: Train the images, not the network
Authors: Varsha Kishore
Xiangyu Chen
Yan Wang
Boyi Li
Kilian Q Weinberger
Venue: ICLR 2022 Poster (2022)

Abstract: Recent attempts at image steganography make use of advances in deep learning to train an encoder-decoder network pair to hide and retrieve secret messages in images. These methods are able to hide large amounts of data, but they also incur high decoding error rates (around 20%). In this paper, we propose a novel algorithm for steganography that takes advantage of the fact that neural networks are sensitive to tiny perturbations. Our method, Fixed Neural Network Steganography (FNNS), yields significantly lower error rates when compared to prior state-of-the-art methods and achieves 0% error reliably for hiding up to 3 bits per pixel (bpp) of secret information in images. FNNS also successfully evades existing statistical steganalysis systems and can be modified to evade neural steganalysis systems as well. Recovering every bit correctly, up to 3 bpp, enables novel applications that requires encryption. We introduce one specific use case for facilitating anonymized and safe image sharing.  Our code is available at https://github.com/varshakishore/FNNS.

propose Published as a conference paper at ICLR 2022
FIXED NEURAL NETWORK STEGANOGRAPHY: TRAIN THE IMAGES, NOT THE NETWORK
Varsha Kishore, Xiangyu Chen, Yan Wang, Boyi Li & Kilian Weinberger Department of Computer Science Cornell University Ithaca, NY 14850, USA (vk352, xc429, yw763, b1728,
edu
ABSTRACT
Recent attempts at image steganography make use advances deep learn- ing to train an encoder-decoder network pair to hide and retrieve secret mes- sages in images. These methods are able to hide large amounts of data, but they rates (around 20%). In this paper,
also incur high decoding a novel algorithm for steganography that takes advantage of the fact that neural networks are sensitive to tiny perturbations. Our method, Fixed Neural Network Steganography (FNNS), yields significantly lower error rates when compared to prior state-of-the-ar methods and achieves 0% error reliably for hiding up to 3 bits per pixel (bpp) of secret information in images. FNNS also successfully evades existing statistical steganalysis systems and can be modified to evade neu- ral steganalysis systems as well. Recovering every bit correctly, up to 3 bpp, enables novel applications that requires encryption. We introduce one specific use case for facilitating anonymized and safe image sharing. Our code is available at https: github......gg.gg. www.c/aacaaoooooeeoeeeooooo "avvvaaaaae shore/FNaa
INTRODUCTION
Image steganography aims to hide a secret digital message within a cover image (Morkel et al., 2005) ideally, through minimal alterations, such that only intended recipients are aware of the hidden secret. Steganography has been widely used in applications such as watermarking (Wolfgang & Delp, 1996), copyright certification (Lu, 2004) and private information storage (Srinivasan al., 2004). Classic steganography tools use pixel statistics to hide information in images (Pevný et al., 2010). Secret messages hidden with these methods can be recovered with 0% error, but to evade de- tection by steganalysis tools, they can only hide up to 0.5 bits per pixel (bpp) of information (Pevný al., 2010; Holub & Fridrich, 2012; Holub et al., 2014). Encouraged by data-driven deep learning techniques, recent methods propose training deep encoder-decoder networks to hide and recover up to hpp of information
images (Zhang et al., 2019a; Zhu et al., 2018; Baluja, 2017; Wu et al., 2018; Hayes & Danezis, 2017). These methods do achieve higher hpp rates, but they also result in higher error rates for the retrieved messages (Zhang et al., 2019a).
Many applications have low error rate requirements for the steganography algorithm. In some sce- narios, the hidden message has no redundancy for error correction, and there is zero tolerance for even a single incorrectly recovered bit. For example, if the secret message is encrypted, it will be random bit string that must be recovered with zero eтrоr for successful decryption. propose novel approach for image steganography that aims to simultancously and reliably achieve high steganographic capacity and low error rates. Notably, we achieve 0.0% % error when encoding up to bpp of information. We make assumptions on the secret message and allow it to be any arbitrary bit string, We show that our method can be used with randomly initialized neural networks or in conjunction with pre-trained networks.
this paper, we
Unlike previous steganography methods that train deep networks to hide and recover messages in a specific dataset (Zhang et al., 2019a; Zhu al., 2018; Baluja, 2017), our method based upon
"Equal contribution.

---

Published as a conference paper at ICLR 2022
very different approach, which originated in the context of adversarial attacks neural net- works (Szegedy et al., 2013). Adversarial attacks are based on the key insight that deep neural networks are highly sensitive to small changes to the input. An adversary an image with imperceptible perturbations to influence the prediction of a neural network that uses this image as input. The last eight years have witnessed an outpouring of analysis (Kurakin al., 2016b; Carlini & Wagner, 2016; Xu et al., 2017; Shafahi et al., 2018; Meng & Chen, 2017; Li & Li, 2017; Lu al., 2017a; Graese et al., 2016; Dziugaite et al., 2016; Lu al., 2017b; Gu & Rigazio,
therefore manipulate
2015; Kurakin et al., 2016a; Miyato et al., 2015; Nokland, 2015; Cisse et al., 2017; Hu et al., 2019;
Guo et al., 2020; 2017) and methods (Liu et al., 2016; Moosavi-Dezfooli et al., 2016; Carlini & Wagner, 2017; Tramèr et al., 2017; Papernot et al., 2017: 2016; Biggio et al., 2013) to understand and create adversarial perturbations. Notably, it is fair to say that vulnerability to adversarial attacks is generally considered inevitable in most settings (Shafahi et al., 2018) and frustratingly hard to defend against (Carlini & Wagner, 2017; Dziugaite et al., 2016), especially when the target network architecture is known to the adversary (which is generally referred to white-box box setting).
Adversarial attacks are typically considered a nuisance, or a limitation of machine learning. How- ever, in this paper we utilize their persistence and reliability as a desired feature for what refer to as Fixed Neural Nenwork Steganography (FNNS). In a nutshell, FNNS is based on the following procedure (see Figure 1): We initialize a neural network (decoder) that takes input image and produces sufficient binary outputs. Given a secret message and a cover image, the sender (Alice) perturbs the original image in fashion similar to adversarial perturbations (Madry et al., 2017). However, instead of targeting a single prediction bit (c.g. the classification of an image), the sender manipulates thousands or even millions of output bits simultaneously. The intended recipient (Bob) can use the same decoder network and recover the hidden message.
We show that FNNS reliably yields 0% error rate for hiding up to bpp of information and lower error rates than current otate-of-the-art methods for higher bit rates on multiple datasets. FNNS can also be used in conjunction with existing trained encoder-decoder methods (like SteganoGAN (Zhang et al., 2019a)) to further reduce the error rates obtained by the trained meth- ods. Additionally, we show that FNNS evades existing statistical steganalysis methods (Bochm, 2014; Dumitrescu et al., 2002a;b; Böhme & Westfeld, 2004; Zhang & Ping, 2003) and can be made resistant to JPEG compression (Wallace, 1992) for low bpp. Finally, we introduce an example appli- cation of error-free steganography for anonymized image sharing: We replace faces in images with GAN generated substitutes that contain the original faces encrypted and hidden through FNNS ensuring that only intended recipients (with the secret key) can recover the original images.
2 RELATED WORK
Statistical image steganography methods (Pevný et al., 2010) typically pre-date the use of neural networks. Least-Signifccant Bit (LSB) methods modify lower-order bits of each pixel to encode secret message (Van Schyndel et al., 1994; Wolfgang & Delp, 1996; Katzenbeisser & Petitcolas, 2000). Although compellingly simple and lossless, these methods are easily detectable (Dumitrescu et al., 2002a;b; Böhme & Westfeld, 2004; Zhang & Ping, 2003) and often lack robustness (Qin et al., 2010). Many statistical image steganography methods were proposed evade detection by such steganalysis algorithms. Highly Undetectable Steganography (HUGO) (Pevný et al., 2010), is one such method, that uses hand crafted features to measure distortion caused by modifying pixels and modifies pixels that cause the least amount of distortion. Wavelet Obtained Weights (WOW) (Holub & Fridrich, 2012) uses directional high-pass filters to find regions of the cover image with high texture and penalizes changes in low-textured regions. S-UNIWARD (Holub et al., 2014) is similar to WOW but is designed to work with non-spatial domains (e.g. the frequency domain). The main limitation of statistical methods is that the number of bits they encode is relatively low (S 0.5 bpp).
Deep learning image steganography methods have recently achieved impressive results in terms of bpp rates (Zhang et al., 2020b; Baluja, 2017; Rahim et al., 2018; Zhang et al., 2019b). In gen- eral, they mostly share similar pipeline that can be trained end-to-end: An encoder network takes as input a cover image and a message that should be concealed within the image. From these in- puts it generates steganographic image that has hidden information but is visually similar to the cover image. A subsequent decoder network recovers the hidden message from the steganographic image. Multiple loss functions ensure that 1) the generated image is close to the original one; 2)
2

---

Published as a conference paper at ICLR 2022
the decoder's 's output matches the secret message. Zhu et al. (2018)'s HiddenNet pioneered such an encoder- encoder-decoder pipeline, and their HiddenNet could hide up to 0.2 bpp with an error rate of 10- SteganoGAN (Zhang et al., 2019a) uses slightly different encoder-decoder architecture and intro- duces an additional critic network that ensures the produced images look realistic, i.e. like a natural image. The authors show experiments of hiding up to 6 hpp of information with an error rate of 5- 30% (depending on how many bits are hidden). In a similar vein, AdvSGAN (Li et al., 2021) hides up to I bpp by learning an image steganography scheme that plays an adversarial game between a restricted neural coder and a critic. Deep Steganography (Baluja, 2017), ISGAN (Dong et al., 2018), Attention Based Data Hiding (Yu, 2020), Universal Deep Hiding Zhang et al. (2020a) and End-to- end CNN for Image Steganography (Rahim et al., 2018) use similar encoder-decoder architectures to hide and recover structured images instead of random bits. These methods assume the secret message is an image, which allows them to learn image priors that aid in hiding the secret image. Invertible networks have also been explored to hide images within images (Jing ct al., 2021; Lu et al., 2021). Despite handling large number of bits, these end-to-end neural approaches also share set of disadvantages: 1) the error rate for the recovered messages is very high, 2) they assume access to hundreds even thousands of training images from the target domain to train encoder and decoder pairs, and 3) there is little recourse if the model produces an image with high error rate or distortions. There are also methods that have explored hiding messages in physical photographs (Wengrowski & Dana, 2019; Tancik et al., 2020), but our work focuses on digital images.
Imperceptible image perturbations. Adversarial examples (Goodfellow et al., 2014) are inputs to machine learning models that an attacker has intentionally designed to cause the model to make a mistake. Many approaches (Szegedy et al., 2013; Goodfellow et al.,, 2014; Guo al., 2019; et al., 2020; De Palma et al., 2021; Yuan et al., 2019) try to construct adversarial examples by perturbing image pixels. Moosavi-Dezfol -ezzooll et al. (2017) propose a systematic algorithm for computing univer- sal perturbations that many deep neural networks are highly vulnerable to. Su ct al. (2019) propose a differential evolution method to generate oow-dimensional one-pixel adversarial perturbations that change the output of classification network. Athalye et al. (2018b) create adversarial examples that are robust to affine image transformations, noises, and other distortions. Projected gradient de- scent (PGD) (Madry et al., 2017) is one of the most widely used algorithms to generate adversarial examples by adding small perturbations to the input. This method iteratively updates the input with gradient descent until desired output is obtained. The input is projected, or more precisely clipped to be within [-e, c| at the end of every step. This precaution ensures that the perturbations stay reasonably small for all pixels and remain imperceptible. Ghamizi et al. (2019) propose performing stenography by finding perturbations using PGD with a classification network. However, the amount of information they are able to hide is low and they need multiple images to hide long messages.
FIXED NEURAL NETWORK STEGANOGRAPHY
Setting. Let X E J0, x33x be an RGB color image with height H and width W. Further, let M E (0, 1> be message that we are trying to conceal in X, where D specifies the number of bits we need to hide per pixel.' We assume there are two parties involved - the sender, Alice, who hides M in X, creating X; and the receiver, Bob, who extracts M out of X. Given a decoder network F: [o, 1| x3 + [0, 1|#xWD our goal is to generate a perturbed image X, which is close to X (according to metrics specified in the subsequent section) such that F(X) = M.
Encoding and Decoding, In order to generate image X, we use an approach similar to adversarial perturbations (Madry et al., 2017). Given the cover image X and the ground truth message M, the sender (Alice) solves the following optimization problem over the perturbed image X:
min (M, log F ((X)) + ((1 M), log(1 F(X)))
&
TBBCE
s.t. X X lloo S E and 0 < X 1
where (.) denotes inner-product across all Hl x W x D dimensions and the objective function is the binary cross entropy (BCE) loss. The first of the two linear constraints enforces that the maximum
For convenience we assume the message is of length H x W x D. In practice, if the message length is not multiple of H W we can simply ignore the unused output bits during optimization.
3

---

Published as a conference paper at ICLR 2022
Encoding
Fixed Decoder Network
BCE Loss
LacE
Input
Decoding
F
Gradient
Perturbations
Secret Message M
Decoding
Fixed
Decoder
Network
F
2014144
Cover Image X
Perturbed Image X
Decoder Output F(X)
Figure I: FNNS workflow: Alice (sender) encodes the message M into image X such that F(X) M; Bob (receiver) decodes the message with the same decoder F. Alice generates perturbed image
X by using the gradient from the loss between the decoder output F(X) and secret message M.
Algorithm Adversarial Attack for Message hiding
1: Inputs: decoder network F, cover image X, secret message M
2: Hyper-parameters: learning rate
0, perturbation bound 0, optimization steps n 0,
max I-BFGS iterations l: 0
3: X
x
4: for iterations do
5:
X LBFGS(F(X) M, LBCB,
Take ls steps optimize LBCE (F((F M).
6:
- clip (X -X}
Clip pixel value changes exceeding ic. b Clip pixel values to [0, 1].
7:
X - (X + +
8: return X
perturbation does not exceed value of and stays imperceptible. The second constraint enforces that the perturbed image. X, a well-defined image, with pixel values ranging within [0, 1].
Our optimization algorithm is outlined in Algorithm 1, where cliph = max(min(2;; 1),0). We use the unconstrained L-BFGS (Fletcher, 2013) algorithm optimize the objective with respect to X. We used L-BFGS because keeps track of second order gradient statistics and results in faster optimization. To ensure that the constraints are not violated, we project the solution back into the feasible region after & steps. We assume that the recipient (Bob) has access to the same network F as the sender (Alice). He can then recover the concealed message M by computing F(X).
Decoder weights and initialization. Our encoding procedure optimizes the image X directly and considers the weights F fixed throughout. This gives the freedom explore multiple ways to initialize X and obtain weights for the decoder F. yielding three distinct variants of our method: random network and X initialized be the cover image X. When a random network is used, the sender and the receiver only need to share the architecture of the decoder network and the random seed used to initialize its weights; the actual weights of the network do not have to be shared. Additionally, if the image quality of the perturbed image is low, different random decoder can easily initialized with a new random seed and the optimization can be repeated.
1) FNNS-R:
2) FNNS-DE: Given trained encoder-decoder pair (from any of the prior neural work mentioned in section 2), can define F to be the pre-trained decoder and initialize X Enc( X, .M). where Enc is the trained encoder that is paired with the decoder F. With this initialization, a part of the message M is already encoded into X such that F(X) 2 M. As a result, the optimization is much faster. However, the encoding step sometimes deteriorates image quality, and it is hard for the optimization algorithm to "recover" terms of quality in such cases.
3) FNNS-D: is a pre-trained decoder and initialized to be the cover image X. With a trained decoder, messages can be hidden in images using both perturbations and by training weights
4

---

Published as a conference paper at ICLR 2022
Random Sample
High PSNR
PSNR
Cover Image
PSNA Steginographic Image
36.22
33.94
41.71
38.58
27.98
26.17
Figure 2: Examples of cover and steganographic image pairs from MS-COCO and CelebA. In each image FNNS-D is used to hide 4 bpp. (Zoom in for image details.)
conducive to hiding information in the images. As result, the output image quality better and the optimization does not suffer from getting stuck in bad local optima.
Decoder architecture. Prior work on adversarial attacks has explored network designs that are especially robust small perturbations (Xu al., 2020). In contrast, for our decoder we want net- work architectures that are particularly susceptible in that regard. We develop our method based on the basic decoder of SteganoGAN (Zhang et al., 9a), a 4-layer convolutional neural network that takes an H x W x 3 RGB image input and outputs a bit string {0, 1) W x (after rounding). We choose SteganoGAN because it has been shown to achieve state-of-the-art performance for hid- ing arbitrary messages in images. For our experiments, we set the pre-trained encoder and decoder for FNNS-D and FNNS-DE, to be the trained SteganoGAN encoder and decoder. For the FNNS-R R random network empirically explore many variations with different depths, widths, normaliza- tion layers, and activation functions, and evaluate them w.r.t. bit error rates, PSNR, and SSIM. Due to space constraints, summarize our results in Appendix B. Throughout, channels in FNNS-R and 32 in FNNS-D and FNNS-DE. This is because for trained SteganoGAN models, increasing the number hidden units leads no significant improvements in accuracy or image quality (see Appendix E), but slows down the optimization process.
use 128 hidden
3.1 EVALUATION METRICS
We use three popular metries evaluate our results. 1. The bit error rate, (MM-F((X11)) HWD where 1-1 denotes rounding function, measures how many bits are incorrectly recovered. 2. Peak signal-to-noise ratio (PSNR) is common metric used measure image distortions be- tween X and X and has been shown be correlated with human evaluation scores (Isola al., 2017). 3. Structural Similarity Index (SSIM) is another metric used to measure the similarity between two images. SSIM differs from PSNR in that it tries to capture the change in structural information opposed to considering pixel-wise changes. PSNR and SSIM between two images X and X with maximum possible pixel value max x. averages (4, i7, standard deviation a, 7 and co-variance o x are defined in Table
H
W
X ]
MSE
X
HW
i=1
PSNR 20 1001oommaxx (maxx) 10 101og10 -00
(MSE)
SSIM (2pxH4 + c₁ (20 xx + + (43 + + c + + + +
Table 1: Metrics to evaluate image quality. Note
that C1, C2 are small stabilization constants.
STEGANOGRAPHY RESULTS AND DISCUSSION
Experimental Setup We evaluate FNNS on three diverse datasets scenic image dataset Div2k (Agustsson & Timofte, 2017), a 2D object detection dataset MS-COCO (Lin et al., 2014) and a human face dataset CelebA (Liu et al., 2015). For each dataset, we use the provided test/validation images (if unavailable, we use the first 100 images in the dataset for validation). We randomly
We also explored the use of fully connected networks but found them to yield far higher error rates, while heing slower be optimize and requiring larger amounts of memory.
5

---

Published as a conference paper at ICLR 2022
Dataset
Method
Error
Rate (%)
PSNR
SSIM
I bit
2 bits
3 bits
+bits
1 b1t
2 bits
3 bits
4 bits
biE
2 bits
bits
4 bis
SleganoGAN
3.94
7.36
8.84
10.00
25.98
25.53
25.70
25.08
0.85
0.86
0.85
0.82
FNNS-R
0.14
1.80
5.28
15.17
39.79
35.12
33.40
32.53
0.96
0.89
0.84
0.79
CelehA
FNNS-D
0.00
0.00
0,00
3.17
36,06
34.43
30.05
33.92
0.87
0.86
0.71
0.84
FNNS-DE
0.00
0.00
0.00
2.58
21.16
20.85
20.67
21.03
0.71
0.68
0.63
0.64
SloganoGANN
5.12
8.31
13.74
22.85
21.33
21.06
21.42
21.84
0.76
0.76
0.77
0.78
FNNS-R R
0.02
0.18
3.29
10.88
35.31
30.73
28.99
28. 20.60
0.93
0.85
0.78
0.76
Div2k
FNNS-D
0.00
0.00
0.01
5.45
29.30
26.25
22.90
25.74
0.82
0.73
0.53
0.65
FNNS- DE
0.00
0.00
0.01
1.75
18.54
18.02
17.16
17.38
0.60
0.53
0.39
0.60
SleganoGAN
3.40
6.29
11.13
15.70
25.32
24.27
25.01
24,94
0.84
0.82
0.82
0.82
MS-COCO
FNNS-R
0.04
0.32
2.16
10.38
34,68
30.79
29.32
28.22
0.91
0.84
0.79
0.74
FNNS-D
0.00
0.00
0.00
13.65
37.94
34.51
27.77
34.78
0.95
0.90
0.72
0.89
FNNS- DE
0.00
0.00
0.00
1.74
22.52
22.35
21.02
21.33
0.77
0.74
0.62
0.64
Table 2: Performance of FNNS and its variants with different bpp rates. All values shown are averaged over 100 images. We bold the lowest error rate numbers up to statistical significance. Note that the 0.00 numbers are exactly zero
initialized the message bit strings; each bit in the string is independently sampled from Bernoulli- distribution with probability 1 The turbation bound e 0.3, optimization steps stopping if the output has zero error. In cases where the image quality of X is poor,
used for Algorithm are as follows: per- 100, and L--FGS iterations k 10 with early
restart optimization with a different learning rate a. Concretely, we set the learning rate to 0.1 and change it to 0.05 or 0.5 if the output image gets PSNR lower than 20. We train SteganoGAN models for only one epoch for FNNS-D and FNNS-DE, as we observe that a fully-trained (32 epochs) SteganoGAN decoder over-fits to its training objective such that it's hard to use it for FNNS. Appendix G shows the result of using SteganoGAN models trained for 32 epochs.
Quantitative Comparison. We compare FNNS with SteganoGAN, the current state-of-the-ar art method, in Table 2. In addition (not shown in the table), we also compare with steganography methods that hide lower payload messages (that is < 0.5 hpp messages): HUGO (Pevný et, 2010), UNIWARD Holub et al. (2014), WOW (Holub & Fridrich, 2012) and HiDDeN (Zhu et al., 2018). These methods can achieve an error rate of 0% but only for < 0.5 bpp messages. In contrast, FNNS also achieves 0% error for significantly higher bit rates as shown in Table 2. FNNS-D achieves the best performance in terms of both low error rates and good image quality. FNNS-DE is also able to achieve error rates of 0%, but the corresponding image quality worse when compared to FNNS- D. From Table 2, we also see that for Div2k it is hard to achieve 0% error with 3 bpp. Div2k is small dataset with only 800 images and as a result there is not enough diversity to train a flexible StegamoGAN model; this is evidenced by the fact that 0% error for Div2k with 3 bpp can be achieved by using a model trained on MS-COCO.
Qualitative Comparison. Several qualitative examples are presented in Figure 2 (more images from all the method variants can found in Appendix A). Even with 4 bpp information hidden, the cover and stenographic im- ages look identical. There are a few examples where the stenographic images look pixelated, especially when random network is used. This is either because the image is over-optimized to get low bit error rate or because of a bad random seed. To produce better stenographic im- age, the random network can be re-initialized (if using a random network), the optimization can be stopped earlier or the syper-parameter of FNNS can be changed slightly (in order to change the optimization problem).
Figure 3: An Example of artifacts that arise when using an out-of-domain model. Left: original image; right: a steganographic image generated from SteganoGAN
Domain independence. The performance of trained encoder models like SteganoGAN degrade for out-of-domain cover images. For example, a SteganoGAN (Zhang et al., 2019a) model trained on Div2k images (which contains primarily landscapes) produces noticeable artefacts when
'We did not observe that any of the randomly initialized strings are harder. But, it was harder optimize an all Os or all Is message with some decoder initializations.
"We continue optimizing for 25 steps after achieving 0 error in order to ensure that even after converting X into integer color values (integers between 0 to 255), F(X) = M.
'Results with higher hpp are shown in Appendix F.

---

Published as a conference paper at ICLR 2022
tested facial images from CelebA (Figure 3). The only recourse to correcting artifacts quality would be to train another model with in-domain data. contrast, FNNS-R R is completely domain independent. Although FNNS-D uses trained decoder, we find it to be just robust against domain shift. We explain these findings by the fact that the secret message is hidden through an optimization procedure that is very robust to the exact filter values of the decoder network.
Optimization time. Most encoder-decoder deep stenography methods require many hours of training on hundreds of images. However, once trained, it takes less than a second for inference with the model given any cover image and message. FNNS-D and FNNS-DE perform a per-image optimization process for encoding a message in an image and this takes on average 10 seconds for 1-2bpp and 20 seconds for 3-4bpp. For FNNS-R encoding message takes about 3 minutes because optimizing the random network is a harder task. Appendix C has a table showing the amount of time required to each method variant with different bpp rates.
JPEG Compression. A desirable property for any steganography system is robustness against lossy image compression. Unfortunately the goal of imperceptibil-
bpp
Brror Rate (%)
PSNR
SSIM
0.1
0.06
22.9
0.49
0.2
0.34
22.43
0.48
ity is inherently at odds with most image compression methods, which by design aim to remove imperceptible, and therefore unnecessary, information. JPEG (Wallace, 1992) is a lossy compression method for digital images that transforms an image into frequency space and re- moves high frequency components via quantization and rounding. Past work has shown that adversarial perturbations can be removed via JPEG compres- sion (Dziugaite et al., 2016) and trained encoder-decoder steganography networks also fail to be resistant to JPEG compression. Modifications to the loss functions can improve resistance to com- pression, but significantly increase error rates. We can improve the robustness of FNNS to JPEG compression by adding a JPEG layer (with quality factor 80) in our optimization pipeline, in which the propaaroe gradients are approximated with identity transformation (Athalye et al., 2018a). We evaluate on MS-COCO and show results in Table 3. Although we can successfully encode 0.1 hpp (enforcing BCE loss on 10% of pixels) at only 0.06% error, it fair to say that bit-rates beyond 0.5 hpp are currently still out of reach. Alternative approaches that we may explore in the future include adopting the Shadow Attack approach from (Ghiasi et al., 2020) to find larger semantically meaningful perturbations and incorporating global smoothness constraints.
0.5
5.85
22.18
0.46
1.0
32.03
22.65
0.48
Table 3: Performance of JPEG-resistant
FNNS on MS-COCO. FNNS achieves low error rates when the bpp rate is low.
5 STEGANALYSIS
Steganalysis tools are used to identify whether an image has a hidden message. Broadly, these tools can be divided into two categories statistical and neural steganalysis. The former uses statistical methods to detect steganogra- phy, while the latter trains neural network to distinguish between natural images and steganographic images.
Method
bpp
2 bpp
3 bpp
bpp
FNNS
18
22
31
FNNS-D
13
15
8
FNNS-DE
2
3
0
0
Table 4: Detection Rates (in %) ob-
tained by using StegExpose on CelebA steganographic images. Lower is better.
Statistical steganalysis methods were developed to detect LSB (least significant bit) steganography (Gupta et al., 2012) in lossless images. Boehm (2014) presents StegExpose, a library combining many existing steganalysis techniques including Sample Pairs (Dumitrescu et al., 2002b), RS Analysis (Fridrich al., 2001). Chi Squared Attack (Westfeld & Pfitzmann, 1999), and Primary Sets (Dumitrescu et al., 2002a). We show the detection rate of StegExpose for the Div2K dataset in in Table 4. As seen in the table, some images are detected, but the detection rates are low in comparison with traditional methods that are detected with an accuracy of over 75% (Zhu et al., 2018). It is worth noting that even if the image is detected as stegnographic, messages cannot be accessed if they are encrypted.
Neural steganalysis makes use of recent advances in deep learning to detect images with hidden information (Ye et al., 2017; You et al., 2020; Lerch- Hostalot, 2021). Neural networks are pow- erful and are capable of accurately detecting steganographic images from most existing methods, even when they hide less than 0.5 bpp of information. Recent work has explored using signal from steganalysis systems in the encoding process to evade detection (Tang al., 2019; Bernadd et al.,
7

---

Published as a conference paper at ICLR 2022
the gradient signal from differentiable steganalysis network, Meste et al., 2020), and include its classification score as an aux- iliary detection loss in FNNS optimization, and find perturbations such that SiaStegNet does not classify the image as steganographie. We evaluate this method's feasibility and compare results in Table 5. The detection rates shown in the right most section of the table. Since SiaStegNet per- forms random cropping when loading the image, it is hard to guarantee 100% detection avoidance. Still, with < 2 bpp, we see that FNNS achieves 0.0% error rate, while 80% of generated images can successfully evade detection. Furthermore, the weight for this detection loss can be adjusted to obtain higher quality images with slightly higher error rate (see Appendix H). We also present the detection results for hiding < bpp of information in Appendix H. In future, we would like to investigate to what extent we can evade detection by black box steganalysis networks and find robust defenses against them.
2021: Zhang al., 2019b). Along similar lines,
Error Rate (%)
PSNR T
Detection Rate (%)
Dataset
bit
2 bits
3 bits
4 bits
bit
2 bits
b
4 bits
1 bit
2 bits
bits
4 bits
CelebA
0.00
0.00
0.00
0.00
21.04
20.60
20.18
19.70
13
30
58
100
Div2k
0.00
0.00
0.00
0.02
20.32
18.07
17.66
18.23
20
100
100
MS-COCO
0.00
0.00
0.00
0.01
22.28
22.35
21.30
21.36
12
14
83
Table 5: Performance of FNNS-D with auxiliary detection loss from SiaStegNet (You et al., 2020)
trained on MS-COCO. The detection rate is measuring the number of steganographic images that can be detected steganographic by SiaStegNet.
6 APPLICATION FACE ANONYMIZATION
Original Image
Public Image
Recovered Image
As shown in table 2, we can reliably obtain 0% error rates for hiding bpp messages. The abil- ity to recover the bit string with zero error al- lows us to encrypt the message, which is cur- rently the only provable way to safeguard pri- vate information. This property enables us to create protocol where an encrypted message or image is sent from one party to another, and the file is itself indistinct looking image
allowing users to use photo sharing webpages or social media Below, we describe how FNNS can be used create a protocol share images that are anonymized to the public but not to trusted re- cipients.
medium of transmission.
Motivation. Social media platforms have be- come a central part of our communication, with photo sharing one of the center activities (e.g. Instagram, Facebook). There are how- ever well documented dangers with such prac- tices. If photos become publicly available, the owner loses control. Snapshots intended to amuse friends or grandparents can "go vi- ral", with traumatic consequences for individ- uals portrait in the photos. Further, public photos are quickly indexed by image search engines (e.g. https: : / cclle ea sarviiee ew a and can haunt individuals decades later. We use FNNS to facilitate mechanism that allows users to share pictures with their friends on social media, but if these are leaked (e.g. through wrong privacy settings on social media pages, or careless behavior), the identity of the people in the images is preserved.
Figure 4: The left column contains original im- ages. The middle column shows the result re- placing the face with fake face, which contains encrypted form of the original face steganograph- ically hidden through FNNS. The right column shows the image recovered by FNNS decoding the encrypted face, decrypting and re-inserting it.
FNNS face anonymization. Current methods for face amonymization either significantly alter the image by using modifications (like blurring masking) (Neustaedter et al., 2006; Boyle et al, 2000),
8

---

Published as a conference paper at ICLR 2022
Original Image
Public Image
Recovered Image
Figure 5: Example of anonymizing multiple faces in an image. In this example each private face is hidden within the corresponding fake face that replaces
Encoding
Anonymized Image
GAN Generated Face
Public
Decoding
Recovered Private Face
Original Image
Public image: fake face with encrypted
Reconstructed Image
Private Face
Compressed and encrypted code
Figure 6: Pipeline for FNNS face anonymization.
remove the face completely and replace it with "fake" face (Hukkelás al., 2019). The former approach can still leak information and cause the quality of the image to degrade, and the latter approach non-reversibly changes the image. We propose a novel approach for face anonymization using FNNS (see Figure 4).
We make use of DeepPrivacy (Hukkelås et al., 2019) to detect faces in the original image (left) and replace them with plausible looking GAN-generated faces to obtain an anonymized public image (middle image). Because the original face cut before fake face is generated, the public image leaks no information about the sensitive face and can safely be shared. Since FNNS can reconstruct message perfectly, each original private face can be hidden inside its corresponding fake face in the public image. To ensure the private face is secure, we first compress (e.g. using JPEG (Wallace, 1992)) and then encrypt into cryptographically secure bit string (e.g. using AES (Standard, 2001)). The intended recipient can decode this bit-string, using the decoder network and decrypt the image with a private key to obtain the recovered image (right image). Any third party will only observe the public image without any access private information. See Figure for layout of the application pipeline. Because all information is hidden inside the faces the public image, is naturally compatible with existing image sharing pages, and the encryption decryption portion can be realized easily in practice e.g. through simple browser plugin. As each fake face contains all the information required to reconstruct the original private face, this approach can be applied an arbitrary number of (non-overlapping) faces in an image. An example is presented in Figure 5.
7 CONCLUSION
In this paper, we propose a novel and effective algorithm for image steganography based on tech- niques from the adversarial attacks literature. We show that our method can achieve very low error rates while making visually unnoticeable changes to the input image. In contrast to prior work, we are able achieve error rates of exactly 0%% for up to hpp, which turn enables new applications. In the future we plan to explore other variants and extension of FNNS. One useful variant would be to explore new spaces in which to conduct the optimization. Currently we use RGB space, but other color spaces like YCbCr non-spatial spaces like the frequency space can be used well with FNNS. Using different spaces could result in better image quality and could allow for easier encoding of constraints. For instance, to find perturbations robust to JPEG compression, FNNS can be used in only the low frequency region. In the future, we would also like to explore meta-leamiing algorithms for finding networks that conducive FNNS optimization.

---

Published as a conference paper at ICLR 2022
ACKNOWLEDGEMENTS
This research supported by grants from the National Science Foundation NSF (1S-2117161, IIS- 1724282), the DARPA Techniques for Machine Vision Disruption grant (HRO01 12090091), the Cor- nell Center for Materials Research with funding from the NSF MRSEC program (DMR-1719875) and SAP America. We would like to thank Oliver Richardson, Katie Luo, Kate Donahue and our reviewers their valuable feedback and insightful comments.
ETHICS STATEMENT
Steganography is a tool and it's usage depends on the user. Steganography can potentially be used for activities with negative societal impact, such as hidden communication for criminal activities, or espionage. But can also be used for beneficial applications like preventing copyright infringe- ments through watermarking, tracing illegal images social media anonymizing publicly shared images (as shown in the paper).
REPRODUCIBILITY STATEMENT
For our experiments, we use three publicly available datasets as mentioned in section 4. We use common metrics to evaluate results and these metries explained in subsection 3.1. Our method is outlined in Algorithm and we have also clearly described all the hyper-parameter values used to obtain our results in section Our code available at Our code available at https: //github. com/ httpp///ssaasshor.eeeooo
REFERENCES
Eirikur Agustsson and Radu Timofte. Ntire 2017 challenge single image super-resolution: Dataset and study. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops, pp. 126-135, 135, 2017. 5, 19
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense se- curity: Circumventing defenses adversarial examples. In International conference machine learning, pp. 274-283. PMLR, 2018a. 7
Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. In International conference on machine learning, pp. 284-293. PMLR, 201 3
Shumeet Baluja. Hiding images in plain sight: Deep steganography. In Proceedings of the 31st International Conference Neural Information Processing Systems, pp. 2066-206660 2076, 2017. 1,2,
Solène Bernard, Patrick Bas, Tomá' Pevný, and John Klein. Optimizing additive approximations of non-additive distortion functions. In Proceedings of the 2021 ACM Workshop on Information Hiding and Multimedia Security, pp- 105-112. 12, 2021.
Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Šmdić, Pavel Laskov, Gior- gio Giacinto, and Fabio Roli. Evasion attacks against machine learning at test time. In Proc. ECML, pp. 402-402, 2013. 2
Benedikt Boehm. Stegexpose-a tool for detecting Isb steganography.
arXiv preprint
arXiv:1410.6656, 2014. 7
Rainer Böhme and Andreas Westfeld. Exploiting preserved statisties for steganalysis. Interna- tional Workshop on Information Hiding, pp. 82-96. Springer, 2004. 2
Michael Boyle, Christopher Edwards, and Saul Greenberg. The effects of filtered video on awareness and privacy. In Proceedings of the 2000 ACM conference on Computer supported cooperative work, pp. 1-10, 2000. 8
Nicholas Carlini and David A. Wagner. Defensive distillation not robust to adversarial examples. CoRR, abs/1607.04 007104311 2016. 2
10

---

Published as a conference paper at ICLR 2022
Nicholas Carlini and David A. Wagner. Adversarial examples are not easily detected: detection methods. CoRR, abs/11005077265 2017.
Bypassing ten
Moustapha Cisse, Piotr Bojanowski, Edouard Grave, Yann Dauphin, and Nicolas Usunier. Parseval networks: Improving robustness adversarial examples. CoRR, 0es//704.0880 2017. 2
Giacomo De Palma, Bobak Kiani, and Seth Lloyd. Adversarial robustness guarantees for random deep neural networks. In International Conference on Machine Learning, pp. 2522-2534. PMLR, 2021. 3
Shiqi Dong, Ru Zhang, and Jianyi Liu. Invisible steganography via generative adversarial network. arXiv preprint arXiv: 1807.08807 4, 2018.
Sorina Dumitrescu, Xiaolin Wu, and Nasir Memon. On steganalysis of random Isb embedding in continuous-tone images. In Proceedings. International Conference Image Processing, vol- ume 3, pp. 641-644. IEEE, 2002a. 2,
Sorina Dumitrescu, Xiaolin Wu, and Zhe Wang. Detection of Isb steganography via sample pair analysis. In International workshop information hiding, pp. 355-372. Springer, 2002b. 2, 7
Gintare Karolina Dziugaite, Zoubin Ghahramani, and Daniel Roy. A study of the effect of JPG compression on adversarial images. CoRR, abss/660..00833 2016. 2,
Roger Fletcher. Practical methods of optimization. John Wiley & Sons, 2013. 4
Jessica Fridrich, Miroslav Goljan, and Rui Du. Detecting Isb steganography color, and gray-scale images. IEEE multimedia, 8(4):22-28, 2001. 7
Salah Ghamizi, Maxime Cordy, Mike Papadakis, and Yves Le Traon. Adversarial embedding: A robust and elusive steganography and watermarking technique. arXiv preprint 2019. 3
Amin Ghiasi, Ali Shafahi, and Tom Goldstein. Breaking certified defenses: Semantic adversarial examples with spoofed robustness certificates. arXiv preprint arXiv:2003.08933 2020.
Ian Goodfellow, Yoshua Bengio, Aaron Courville, and Yoshua Bengio. Deep learning, volume 1.
MIT press Cambridge, 2016. 19
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6:5: 2014.
Abigail Graese, Andras Rozsa, and Terrance E. Boult. Assessing threat of adversarial examples on deep neural networks. In 15th IEEE International Conference on Machine Learning and Applicutions, ICMLA 2016, Anaheim, CA, USA, December 18-20, 2016, pp. 69-74, 2016. doi: 1109/ ICMLA. 2016 0020. 2
10.1109/CCMA..216.. 0000000 URL https:
Shixiang Gu and Luca Rigazio. Towards deep neural network architectures robust to adversarial examples. In ICLR workshop, 2015.
Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens Van Der Maaten. Countering adversarial images using input transformations, arXiv preprint arXiv:1711.00117 2017.
Chuan Guo, Jacob Gardner, Yurong You, Andrew Gordon Wilson, and Kilian Weinberger. Simple black-box adversarial attacks. In International Conference on Machine Learning, pp. 2484-2493.
PMLR, 2019. 3
Chuan Guo, Jared S. Frank, and Kilian Q Weinberger. Low frequency adversarial perturbation. In Ryan P. Adams and Vibhav Gogate (eds.), Proceedings of The 35th Uncertainty in Artifi- cial Intelligence Conference, volume 115 of Proceedings of Machine Learning Research, pp. 1127-1137. PMLR. 22-25 Jul 2020. URL http: httt:::/proceeddnggg.ooo www.ingg.m..... www.sesss....p...eeeemm... guo20a html. 2
Shailender Gupta, Ankur Goyal, and Bharat Bhushan. Information hiding using least significant bit steganography and cryptography. International Journal of Modern Education and Computer Science, 4(6):27, 2012.

---

Published as a conference paper at ICLR 2022
Jamie Hayes and George Danezis. Generating steganographic images via adversarial training. arXiv preprint Att3v:1703.00113 2017.
Vojtéch Holub and Jessica Fridrich. Designing steganographic distortion using directional filters. In 2012 IEEE International workshop on information forensics and security (WIFS), pp. 234-239. IEEE, 2012. 2,
Vojtéch Holub, Jessica Fridrich, and Tomák Denemark. Universal distortion function for steganog- raphy in an arbitrary domain. EURASIP Journal on Information Security, 2014(():1-11) 2014. 1, 2.6
Shengyuan Hu, Tao Yu, Chuan Guo, Wei-Lum Chao, and Kilian Q Weinberger. A new defense against adversarial images: Turning a weakness into a strength. In H. Wallach, H. Larochelle, Beygelzimer, F. d'Alché-Buc, E. Fox, and R. Garnett (eds.), Advances in Neural Information Processing Systems, volume 32. Curran Asso- ciates, Inc., 2019. URL cbb6a3b88 f4 www.eaaaeeeeeeeeeeeee Paperd.--appp.... pdf. 2
Hákon Hukkelás, Rudolf Mester, and Frank Lindseth. Deepprivacy: A generative adversarial net- work for face anonymization. In International Symposium on Visual Computing, pp. 565-578. Springer, 2019.
Phillip Isola, Yan Zhu, Tinghui Zhou, and Alexei A Efros. Image-to-image translation with conditional adversarial networks. In Proceedings of the IEEE conference on computer vision and paltern recognition, pp. 1125-1134, 2017. 5
Junpeng Jing, Xin Deng, Mai Xu, Jianyi Wang, and Zhenyu Guan. Hinet: Deep image hiding by invertible network. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 4733-4742, 2021. 3
S Katzenbeisser and FAP Petitcolas. Digital watermarking, Artech House, London, 2, 2000. 2
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning at scale. CoRR, abs/1611.00 1,0223,, 2016a.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. CoRR, 0abs/1607.02333 2016b. 2
Daniel Lerch- Hostaloostalo... Aletheia, April 2021. URL
4655945. 7
Boyi Li, Felix Wu, Kilian Q Weinberger, and Serge Belongie. Positional normalization. arXiv preprint arXiv:1907.04331 2019. 19
Lin Li, Mingyu Fan, and Defu Liu. Advsgan: Adversarial image steganography with adversarial networks. Multimedia Tools and Applications, pp. 1-17, 2021. 3
Xin Li and Fuxin Li. Adversarial examples detection in deep networks with convolutional filter statistics. In IEEE International Conference on Computer Vision, ICCV 2017. Venice, Italy, October 22-29, 2017, pp. 5775-5783, 2017. doi: 10.1109/ICCV.2017..55 URL https: //doi. www..orrg11..0 101199///V.../ ICCV 2017. 615.
Tsung-Y Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In European conference on computer vision, pp. 740-755. Springer, 2014. 5
Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial exam- ples and black-box attacks. CoRR, abs/1611.002777 2016. 2
Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of International Conference on Computer Vision (ICCV), December 2015. 5
Chun-Shien Lu. Multimedia security: steganography and digital watermarking techniques for pro-
tection of intellectual property: steganography and digital watermarking techniques for protec- fion of intellectual property. Igi Global, 2004.
12

---

Published as a conference paper at ICLR 2022
Jiajun Lu, Theerasit Issaranon, and David A. Forsyth. Safetynet: Detecting and rejecting adversarial examples robustly. In IEEE International Conference on Computer Vision, ICCV 2017, Venice, Italy, October 22-29. 2017, pp. 446-454, 2017a. doi: 10.1109//CCV22011.566 URL https: //doi. wwo.org//10. /10. 11 09/ TCCV. 201 56.. 6.2
Jiajun Lu, Hussein Sibai, Evan Fabry, and David Forsyth. No need to worry about adversarial examples in object detection in autonomous vehicles. CoRR, abs/1 2017b.
Shao-Ping Lu, Rong Wang, Tao Zhong, and Paul L Rosin. Large-capacity image steganography based on invertible neural networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 10816-10825, 2021.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint 2017. 2,3 3
Dongyu Meng and Hao Chen. Magnet: A two-pronged defense against adversarial examples. In Proceedings of the 2017 ACM SIGSAC Conference Computer and Communications Security, CCS 2017, Dallas, TX, USA, October 30 November 03, 2017, pp. 135-147, 2017. doi: 10.1 3133956.3134057. URL http: /twi//oioooo/oo acm org / 10. 1145 3133956 3134057.2
Takeru Miyato, Shin-ichi Macda, Masanori Koyama, Ken Nakae, and Shin Ishii. Distributional smoothing with virtual adversarial training. In Proc. ICIRR 2015. 2
Seyed-Mohsen -oosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: A simple and accurate method to fool deep neural networks. In Proc. CVPR, pp. 2574-2582, 2016. 2
Scyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturbations. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1765-1773, 2017. 3
Tayana Morkel, Jan HP Eloff, and Martin Olivier. An overview of image steganography. In ISSA, volume 1, 2005.
Carman Neustaedter, Saul Greenberg, and Michael Boyle. Blur filtration fails to preserve privacy for home-based video conferencing. ACM Transactions on Computer-Human Interaction (TOCHI), 13(1):1-36, 2006. 8
Arild Nokland. Improving back-propagation by adding an adversarial gradient. CoRR, abs/1510.04189, 2015. 2015. 2
Nicolas Papernot, Patrick D. McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. Distillation as a defense to adversarial perturbations against deep neural networks. In IEEE Symposium Security and Privacy, SP 2016, San Jose, CA, USA, May 22-26, 2016, pp. 582-597, 2016. 2
Nicolas Papernot, Patrick D. McDaniel, Ian J. Goodfellow, Somesh Jha, Z. Berkay Celik, and Anan- thram Swami. Practical black-box attacks against machine learning. In Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security, AsiaCCS 2017, Abu Dhabi, United Arab Emirates, April 2-6, 2017, pp. 506-515 2017. 2
Tomáš Pevný, Tomáš Filler, and Patrick Bas. Using high- -igensiinni image models perform highly undetectable steganography. In International Workshop on Information Hiding, pp. 161 177. Springer, 2010. 1,
Jiaohua Qin, Xuyu Xiang, and Meng Xian Wang. A review on detection of Isb matching steganog- raphy. Information Technology Journal, 98): 2010.
Rafia Rahim, Shahroz. Nadeem, et al. End-to-end trained cnn encoder-decoder networks for im- age steganography. In Proceedings of the European Conference on Computer Vision (ECCV) Workshops, pp. 0-0, 2018. 2,3
Ali Shafahi, W. Ronny Huang, Christoph Studer, Soheil Feizi, and Tom Goldstein. Are adversarial examples inevitable? CoRR, abs/ 0tss/1809.02110 1809.02104, 2018. URL http: http://wwwww.w.a///////aaaaaaa/a 021 04. 2
13

---

Published as a conference paper at ICLR 2022
Yeshwanth Srinivasan, Brian Nutter, Sunanda Mitra, Benny Phillips, and Daron Ferris. Secure transmission of medical records using high capacity stegamography. In Proceedings. 17th IEEE Symposium Computer- Based Medical Systems, pp. 122-127. IEEE, 2004.
NIST-FIPS Standard. Announcing the advanced eneryption standard (aes). Federal Information Processing Standards Publication, 197(1-51):3-3, 2001.
Jiawei Su, Danilo Vasconcellos Vargas, and Kouichi Sakurai. One pixel attack for fooling deep neural networks. IEEE Transactions on Evolutionary Computation, (3(5):828-441 2019.
Christian Szegedy, Wojeiech Zaremba, lly Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 2013.
3
Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks physical pho- tographs. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recog- nition, pp. 21 17-2126, 2020. 3
Weixuan Tang, Bin Li, Shunquan Tan, Mauro Barni, and Jiwu Huang. Cun-based adversarial em- bedding for image steganography. IEEE Trunsactions Information Forensics and Security, 14 (8):2074-2087, 2019.
Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Dan Boneh, and Patrick D. McDaniel, Ensemble adversarial training: Attacks and defenses. CoRR,
2017. 2
Dmitry Ulyanov, Andrea Vedaldi, and Victor Lempitsky. Instance normalization: The missing in- gredient for fast stylization. arXiv preprint arXiv:1607.08022, 2016. 19
Ron G Van Schyndel, Andrew Tirkel, and Charles F Osborne. A digital watermark. Proceedings of 1st international conference image processing, volume 2. pp. 86-90. IEEE, 1994. 2
Gregory K Wallace. The jpeg still picture compression standard. IEEE transactions consumer
electronics, xv:xxiiixxxxxx 1992. 7,9
Eric Wengrowski and Kristin Dana. Light field messaging with deep photographic steganography. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp- 1515-1524, 2019.
Andreas Westfeld and Andreas Pfizzmann. Attacks on steganographic systems. In International workshop on information hiding, pp. 61-76. Springer, 1999. 7
Raymond B Wolfgang and Edward Delp. watermark for digital images. Proceedings of 3rd IEEE International Conference on Image Processing, volume 3, pp. 219-222. IEEE, 1996. 1,2
Boxi Wu, Jinghui Chen, Deng Cai, Xiaofei He, and Quanquan Gu. Do wider neural networks really
help adversarial robustness? arXiv preprint 2rX1v:2010.01279, 2020. 19
Pin Wu, Yang Yang, and Xiaoqiang Li. Stegnet: Mega image steganography capacity with deep convolutional network. Future Internet, 10(6):54, 2018.
Han Xu, Yao Ma, Hao-Chen Liu, Debayan Deb, Hui Liu, Ji-Liang Tang, and Anil K. Jain. Adversar- ial attacks and defenses images, graphs and text: A review. International Journal of Automation and Computing, 17(2):151-178. 2020. 3,5, 19
Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: Detecting adversarial examples in deep
neural networks. CoRR, 0bb//1704.01155 2017. 2
Jian Ye, Jiangqun Ni, and Yang Yi. Deep learning hierarchical representations for image steganaly-
sis. IEEE Transactions Information Forensics and Security, 12(11):25452255) 2017. 7
Weike You, Hong Zhang, and Xianfeng Zhao. A siamese cnn for image steganalysis. IEEE Trans- actions on Information Forensics and Security, 16:291-306. 2020. 7, 8, 22
Chong Yu. Attention based data hiding with generative adversarial networks. In Proceedings of the
AAAI Conference Artificial Intelligence, volume 34, pp. 1 1120-1 128, 2020.
14

---

Published as a conference paper at ICLR 2022
Xiaoyong Yuan, Pan He, Qile Zhu, and Xiaolin Li. Adversarial examples: Attacks and defenses for deep learning. IEEE transactions on neural networks and learning systems, 30(9):2805-288 2824,, 2019. 3
Chaoning Zhang, Philipp Benz, Adil Karjauv, Geng Sun, and In So Kweon. Udh: hiding for steganography, watermarking, and light field messaging. Advances in Neural Informa- tion Processing Systems, 1020022222224,...-11111110114444 2020a.
Universal deep
Jie Zhang, Dongdong Chen, Jing Liao, Han Fang, Weiming Zhang, Wenbo Zhou, Hao Cui, and Nenghai Yu. Model watermarking for image processing networks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, pp. 12805-12812, 2020b.
Kevin Alex Zhang, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni. Steganogan: High ca- pacity image steganography with gans. arXiv preprint arXiv:1901.03882 2019a. URL https: / //taxxiv.rgg////e/.l....../olaat 19900 03892. 2, 5,
Ru Zhang, Shiqi Dong, and Jianyi Liu. Invisible steganography via generative adversarial networks. Multimedia tools and applications, 78(7):8559 8575, 2019b. 2,
Tao Zhang and Xijian Ping. Reliable detection of Isb steganography based on the difference image histogram. In 2003 IEEE International Conference on Acoustics, Speech, and Signal Processing, 2003. Proceedings.(IAASS (3)), volume 3, pp. III-545. IEEE, 2003. 2
Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. In Proceedings of the European conference computer vision (ECCV), pp. 657-672, 2018. 1,3, 6, 7
15

---

Published as a conference paper at ICLR 2022
A ADDITIONAL QUALITATIVE EXAMPLES
A.1 EXAMPLES FROM FNNS-R
Steganographic image
Steganographic Image (2 bgp)
Steganographic Iia ge (3 bppl
Steganographic Image (4 bgp)
Cover Image
(1 bpp)
Eroa: 0.14%, PSNR:
Croon: 1.2%, PSNR: 31.67
Eror: 0.79%, P5NR: 21,67
Eror: 24. 24.93%, PSNR: 35.1
0.01%, PSNR:
PSNR: 33.26
Erron: 3.10%,
Error: 7.9%, 30.0
Enar 0.0%, PSNR; 36.01
Error. 0.04%, PSNR; 32.73
Braar: 1.96%, PSNR: 31.39
Error: 1.46%, PSNR; 22.12
Emar 0.8%, PSNR: 20.95
Erao 0.118, PSNR: 32.72
Brao:: 2.04%, PSNR: 31.25
Eraa:: 11.77%, PSNR: 30.83
Eraon: 0.0%, PSNR: 36. 96
Erro:: 0.0%, PSNR: 21.10
Error: 0.13%, PSNR: 21.76
Error: 3.97%, PSNR: 22.01
Figure 7: Examples images with different amounts hidden information. The first two images from CelebA, the next two from Div2k and the last two are from MS-COCO. PSNR values vary mostly due to the randomness of the networks. For images with low PSNR values the quality improves with re-initialized network.
16

---

Published as a conference paper at ICLR 2022
A.2
EXAMPLES FROM FNNS-D
Steganographic Image (1 bpp)
Steganographic Image (2 bpp)
Steganographic Image (3 bpp)
Stegamographic Image (4 bppl
Cover Image
Error 0.0%, PSNR; 35.09
Erar:: 0.0%, PSNR: 29.6
Error: 0.0%, PSNR; 28.13
Error: 3.08%, PSNR: 31.61
Error: 0.0%, PSNR: 31.41
Error: 0.0%, PSNR: 28.5
Error: 0.0%, PSNR: 24.66
Erro:: 156%, PSNR: 22.27
Erron 0.0%, PSNR: 31.17
Error: 0.0%, PSNR; 26.3
Erron: 0.0%, PSNR: 24.95
Error: 155%, PSNR: 22.61
PSNR:
37.82
0.0%, 16.5%,
Figure 8: Examples of images with different amounts of hidden information. The first two images from CelebA, the next two are from Div2k and the last two are from MS-COCO.
17

---

Published as a conference paper at ICLR 2022
A.3 EXAMPLES FROM FNNS-DE
Steganograghic Image (pp)
Steganographic Image (2 hpp)
Steganngraphic Image (3 bpp)
Steganographic Image (4 bpp)
Cover Image
0.0%,
Error: 0.0%, PSNR: 23.17
Error: 0.0%, PSNR: 23.66
Error: 0.0%, PSNR: 22.37
Error: 3.44%, PSNR: 22.93
Error: 0.0%, PSNR: 22.2
Error: 0.0%, PSNR: 21.57
Error: 0.0%, PSNR: 20.95
Eroo:: 2.14%, PSNR: 20.53
Error: 0.0%, PSNR: 21, 96
Emer: 0%6, PSNR: 22.5
Enior: 0.0%, PSMR: 21.87
Ener: 2.01%, PSNR: 89
PSNR:
PSMR:
0.0%, 27.73
0.0%, 76.77
Figure 9: Examples of images with different amounts of hidden information. The first two images are from CelebA, the next two are from Div2k and the last two are from MS-COCO. As seen in row 1 or row 4, the color of the image changes sometimes. This is because the trained Steganogan network learns that information can be hidden by changing the color and maintaining the structure.
18

---

Published as a conference paper at ICLR 2022
B RANDOM DECODER ARCHITECTURE
Averaga parcent crrar rate BPP!
The decoder introduced in section 3 can be any net- work that takes an image as input and produces suf- ficiently many binary outputs, but some architectures are better suited for the task at hand. Unlike most prior work, that explores networks that robust adversarial attack (Xu et al., 2020), we find ourselves looking for architectures that are susceptible Consequently, in our search for suitable decoder, we empirically explore many network architectures with different network depth, width, normalization and ac- tivation functions and evaluate them w.r.t. pixel error rates, PSNR, and SSIM. For the experiments in this sections, we test different architectures using 100 im- ages from the training set of the Div2K (Agustsson & Timofte, 2017) dataset, with dimensions 512 x512x3 x3 unless otherwise noted. Since, input consists of images, we focus on convolutional networks (CNN) (Goodfellow et al., 2016).
WhST (HAT Hoddor crebi
-3
2:35
3
D25t1 (ramn cony koyer tlokks
Figure 10: Error rates (%) of bits based on various widths and depths. calculate the error rate average over 100 images from Div2k. The lower the better.
Network depth and width. Figure 10 presents results of convolutional networks with varying height and width, and their respective error rates. Similar to the finding Wu al. (2020), we observe that wider networks are less robust and that increasing the width can lead to networks that are more sensitive to perturbations. However, we notice that the opposite is true for depth; the deeper the network, the less sensitive it to perturbations. Although width of 256 seems clearly superior, is fair to say that the optimization also slower. Finding a perturbed version of a 512 x 512 x 3 image with hpp takes minute for network with width of 32, but 6 minutes with width 256 (on a NVIDIA GTX 1080 GPU).
Normalization. As weights of the decoder network randomly, the gradients can have high variance. In Table 6 we experiment with types of normalization layers that do not require mini-batch statistics. We include Positional Normalization (PONO) (Li et al., 2019) and Instance normalization (IN) (Ulyanov al., 2016) in our model. The results show that both normalization methods improve the error rates and both visual metrics, but IN performs the best in this setting. We hypothesize this is because normalization stabilizes the gradients and brings activations near the activation tipping points, which eases the optimization process. Unlike IN, PONO removes the structural statistics (Li et al., 2019), which might be informative create small perturbations.
the
Normalization
Error Rate(
PSNR(dB)
SSIM
None PONO IN
36.1 + 9.5
15.8
0.35
15.4 + 8.6
17.7
0.34
2.5 + 2.7
23.9
0.55
Table 6: Results with different normalizations. We calculate the average across 10 images.
Activation. One important design choice for neural networks are the ac- tivation functions. In Table shows results for various popular choices. We observe that LeakyRel.u results in better performance when com- pared to other activations like sig- moid tanh. The PSNR and SSIM values for sigmoid or tanh are (triv- ially) high because the optimization fails and very few changes are made
Activation
Error rate (%)
PSNR(dB)
SSIM
None ReLU
1.8 3,9
20.9
0.39
7.1 + 9,6
19.3
0.29
LeakyReLU Sigmoid
2.9 - 4.3
24.7
0.57
25.3 + 4.1
39.5
0.96
Tanh
39.4 1.6
45.5
0.95
Table 7: Error rates of different activation functions. We conceal 3 bits for each pixel. The model without any activa- tion function performs best.
We have also explored the use of fully connected networks but found them to yield far higher envor rates, while being slower optimize for.
19

---

Published as a conference paper at ICLR 2022
to the input image. Omitting the activation layer, despite having low error rates, produces images of inferior quality. Adding the ReLU non-linearity makes the optimization easier and more stable.
The different architectures have different trade-offs in terms of memory, time, and performance. Wider and deeper networks require more time and memory. For our random network experiments, settled four convolutional layers (three intermediate layers and one output layer) with 128 hidden units each, along with instance normalization and ReLU activation.
C TIMING
For all our reported results, we used images with have resolution of 512 x 512 (this which results 1,048,5 .76 hidden bits at 4-BPP). Table shows the amount of time required to encode a message with different FNNS variants and different bit rates (with standard deviations in parentheses) on different sizes and found that the
a NVIDIA GTX 1080 GPU. We also explored using images encoding time scales approximately linearly with the number of pixels; for every factor of 4 increase in the number of pixels, the encoding time increases by a little less than a factor of 4. Note that the encoding optimization is significantly slower if run a CPU. We have currently not optimized the code explicitly for CPU or mobile GPU cards, and this is an interesting avenue for future work.
Time in seconds
Dataset
Method
bit
bits
3 bits
bits
FNNS-D
9.77 (3.46)
13.42 (5.17)
30.81 (21.20)
47.39 (15.32)
CelebA
FNNS-DE
7.47 (2.20)
11.31 (4.90)
35.65 (12.32)
45.39 (16.78)
FNNS
45.94 (5.23)
124.85 (11.29)
151.94 (7,42)
152.18 (8.15)
FNNS-D
4.95 (1.08)
10.53 (9.9)
(5.277))22)
44.29 (5.40)
Div2K
FNNS-DE
4.86 (0.54)
8.09 (5.05)
43.82 (4.75)
44.13 (6.73)
FNNS
42.18 (4.17)
114.44 (6.48)
156.91 (3.88)
159.19 (4.63)
FNNS-D
7.41 (2.50)
10.61 (5.9)
37.72 (15.27)
48.39 (9.40)
MS-COCO
FNNS-DE
5.13 (1.97)
7.04 (2.34)
32.76 (16.20)
48.29 (9.63)
FNNS
47.35 (4.23)
131.85 (12.31)
182.47 (6.49)
184.39 (5.74)
Table 8: Time in seconds for different methods
D UNCONSTRAINED OPTIMIZATION
As we saw in Equation 1, we have two constraints- 1) to ensure that the pixels are between 0 and I and 2) to ensure that no pixel changes by more than c. We tried translating this optimization problem defined in Equation 1 to unconstrained optimization problem by reparameterizing to check if unconstrained optimization yielded better results. Constraint can easily be relaxed by reparameterizing X [0, x x3 to Z # x3 by applying an inverse sigmoid transform Z = (X) and optimizing Z instead of Z. We can also relax the second constraint with a slightly more involved process by computing the softmax over the set of admissible pixel values. However, we see no improvements by using these relaxations. We believe that the main source of error is not the projection step (that is clipping), but rather the restrictions (subpixels remain in [0,1] and change by at most 5) on the perturbation. Regardless of the parameterization, these restrictions remain and in some cases will not be satisfiable.
E STEGANOGAN HIDDEN LAYER SIZE
Table shows difference in performance when using 32 hidden channels vs 128 hidden channels. As seen in the table the difference is quite small. However, using networks with smaller hidden size speeds up both the training of the network and using it for FNNS. Hence, for FNNS we use networks with 32 hidden channels.
20

---

Published as a conference paper at ICLR 2022
rate (%)
PSNR
SSIM
Method
bit
bits
bits
bits
bit
2 bits
bits
bitss
bits
bits
bits
SteganoCiAN-
32 hidden units
5.12
8.31
15.74
22.85
23.53
23.66
22.86
22.87
0.83
0.82
0.8
0.82
SteganoGANN
5.97
10.28
18.11
24.93
20.98
21.52
21.54
21.75
0.76
0.76
0.77
0.78
hidden
Table 9: Performance of SteganoGAN with 32 hidden units and 128 hidden units.
F HIGHER BITS PER PIXEL
Table shows the performance of FNNS with large message payloads (5-6 bpp). SteganoGAN results in very high enror rate. FNNS-baset methods can achieve lower error rates with its op- timization. However, in some cases the image quality is not great. Since the SteganoGAN model cannot encode and decode 5-6 bpp well, FNNS works better with randomly initialized weights than with the pre-trained decoder.
Error Rate (%)
PSNR f
SSIM 1
Dataset
Method
5 bit
6 bits
5 bits
6 bits
5 bit
6 bits
SteganoGAN
32.15
31.16
19.51
21.82
0.74
0.79
FNNS-R
14.14
16.27
18.68
17.86
0.18
0.16
Celeba
FNNS-D
15.3
18.41
12.94
12.99
0.07
0.07
FNNS-DE
15.95
17.88
18.22
16.56
0.17
0.13
SteganoGAN
31.44
35.35
20.05
20.34
0.79
0.8
FNNS-R
13.01
15.98
16.71
16.46
0.25
0.26
Div2k
FNNS-D
18.12
19.67
12.34
12.3
0.13
0.14
FNNS-DE
16.03
17.63
14.74
14.94
0.2
0.21
Table 10: Performance of FNNS and its variants with 5-6 hpp. All values shown are averaged over 100 images.
G OPTIMIZE FULLY TRAINED STEGANOGAN
For FNNS-D and FNNS-DE we used SteganoGAN models trained for epoch as mentioned in section 4. This ensured that the model was flexible enough to achieve 0% error. Table 11 shows the result of using SteganoGAN models trained to completion for 32 epochs. As seen in the table, the error rate decreases significantly for FNNS-D when compared with the numbers in Table 2. The learning rate was set to 0.5 and the number of optimization steps was set to 200 when using SteganoGAN model trained for 32 epochs. All other section 4.
were the same listed in
Error Rate (%)
PSNR
SSIM 1
Dataset
Method
bits
SteganoCiAN AAN
2.42
4.02
7.76
10.56
27.49
27.04
26.64
26.73
0.88
0.87
0.84
0.85
mscoco
FNNS-D
0.00*
0.01
1.31
2.88
27.30
26.98
26.56
26.61
0.86
0.86
0.84
0.84
celeba
StegunoGAN
3.94
7.36
10.00
25.98
25.53
25.70
25.08
0.85
0.86
FNNS-D
1.00
0.88
2.73
3.38
26.02
25.54
25.77
25.08
0.84
0.85
0.85
0.81
SteganoGAAN
5.12
8.31
13.74
22.85
21.33
21.06
21.42
21.84
0.76
0.76
0.77
0.78
Div2k
FNNS-D
0.00
1.12
4.37
11.96
21.01
20.98
20.88
21.27
0.71
0.74
0.67
0.68
Table 11: Performance obtained when using a SteganoGAN trained for 32 epochs. In the table, implies that the value is rounded to two decimal places but it is not exactly 0.
H STEGANALYSIS EVASION
In section 5, we see that can add signal from SiaStegNet into the FNNS optimization process by adding an auxiliary SiaStegNet loss term, to evade detection from SiaStegNet. In Table 12 we follow the same setting and show results for hiding < 1 bpp of information. To hide less than I bpp of information we only compute LOCE with a subset of pixels in the image. We see that FNNS is able to achieve 0.0% error rate and low detection rates for hiding < 1 bpp of information.
21

---

Published as a conference paper at ICLR 2022
Table shows that the image quality is a little low when the additional SiaStegNet loss term is added. To increase the image quality, we can decrease the weight on the SiaStegNet loss term (from 1000 to 100) and the results of doing the error rate but the error rate is still under I % for <3 hpp.
shown in Table 13. This results in slight increase in
Error Rate (%)
PSNR 1
Detection Rate (%)
Dataset
0.1 bit
0.2 bit
0.5 bit
0.1 bit
0.2 bit
0.5 bit
0.1 bit
0.2 bit
0.5 bit
CelebA
0.00
0.00
0.00
18.04
18.05
20.72
0
0
Div2k
0.00
0.00
0.00
25.02
24.95
25.13
MS-COCO
0.00
0.00
0.00
21.55
21.67
21.27
15
8
8
Performance of FNNS-D with the auxiliary detection loss from SiaStegNet (You al., 2020) for hiding < bpp of information.
Table 12:
Error Rate (%)
+
PSNR
Detection Rate (%)
Dataset
bit
bits
3its
bbts
bit
2 bits
3 bits
bits
Tbit
2 bits
3 bits
4
CclebA
0.00
0.00
0.55
1.35
26.42
19.28
18.66
25.07
52
66
93
Div2k
0.00
0.02
0.21
3.95
26.15
19.12
19.23
21.14
37
69
84
99
MS-COCO
0.02
0.01
0.01
13.69
36.27
30.29
18.37
34.87
19
49
55
Table 13: Performance of FNNS-D with a lower weight on auxiliary detection loss from SiaSteg- Net (You et al., 2020) trained MS-COCO.
22


Reviews:
[{"review_id": "cUnFOrMS6X", "reviewer": "Reviewer_3seg", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "## Strengths\nThe observation that neural networks are sensitive to adversarial perturbations can be regarded as a feature and not a bug is very nice.\nThe method is simple and quite general. The experiments show that the run-time of the algorithm, while appropriate for high-throughput applications,\nis reasonable (on the magnitude of a few minutes).\nThe experiments are relevant and the methodology seemed reasonable with a few minor issues.\n\nThe proposed application of hiding images is also very interesting. In my view, its usefulness depends on how easily the optimization procedure can be performed\non e.g. mobile devices.\n\nOn the whole, the paper is easy to follow and is generally well-written with only a few mistakes.\n   \n## Weaknesses\nMy main concerns are regarding some of the experimental procedures and results and the way they are reported.\n- What bit strings were encoded for the experimental results? Was the bit string fixed for each image, or was it randomly sampled for each image separately? Are there any bit strings that are harder to encode than others, e.g. all 0 or all 1s? Intuitively, I do not expect it to be the case, but I wonder if the authors carried out any experiments.\n- What hardware was used for the encoding is unspecified, which makes the reported decoding times less useful. It would be very good if the authors could specify if the encoding was performed on a GPU and if yes then how long it takes on a CPU and maybe even mobile devices. In a similar vein, the actual number of bits encoded is also unspecified. It would be good if the authors could maybe investigate how long the compression takes per pixel on average with error bars for example.\n- As an extension of the second point, what is the biggest message the authors experimented with encoding?\n- It is unclear to what the sentence at the top of page 8 is referring. The claim is that FNNS achieves 0% error at 2bpp with a 0.5% detection rate,\n  but Table 5 doesn't seem to bear this out for any of the datasets. Is this sentence misplaced perhaps?\n   \n## Questions\n   - As I understand, the two sources of decoding errors are clipping the difference (line 6 in Alg 1) and clipping the addition of the delta (line 7 in Alg 1).\n     Did the authors investigate which of these steps tends to cause more errors? Could the issue be partially resolved by first reparameterizing the image $X \\in [0, 1]^{W \\times H \\times 3}$\n     to $ Z \\in R^{W \\times H \\times 3}$ by applying an inverse sigmoid transform $Z = \\sigma^{-1}(X)$ and optimizing $Z$ instead of $X$? This would ensure that the second clipping operation never needs to be performed, right?\n   - This might be a simple point, but I wonder how robust the encoding is to the random seed used in FNNS-R to sample the NN weights in the following sense.\n     Imagine the message is encoded using weights $w_1$ sampled randomly with seed $s_1$. What is the decoding error rate with weights $w_2$ sampled with $s_2$? Assuming that the\n     NN predictions are iid Bernoulli $1/2$ variables, the decoding error for a random bit string should be around 50%. Is this indeed a correct intuition?\n\n## After author rebuttal\n\nThe authors have addressed my concerns satisfactorily, and I believe that the final version of the paper will be a strong contribution to the literature.\n ", "summary_of_the_paper": "The paper proposes a novel neural image steganography method. The fundamental idea is that the sensitivity of neural networks to adversarial perturbations can be leveraged to encode an arbitrary hidden message into imperceptible perturbations. The authors' method heavily outperforms current classical and neural image steganography methods. They also perform several relevant experiments, such as robustness of the method to lossy compression and avoiding steganalysis.\n\nThe authors also propose to apply their method to protect persons' identities in pictures by detecting all faces present in a picture, in-painting them with a GAN and hiding the picture of the original face in the GAN-generated image.\n", "summary_of_the_review": "The core idea presented in the paper is simple and quite general, going beyond image steganography. The authors heavily outperform current steganography algorithms with their method and the community would benefit from its publication.\n\nHowever, the article has some weaknesses that if the authors can address I will be happy to raise my score.\n", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "Ue8HV0fzW4L", "reviewer": "Reviewer_Cqai", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "There has been a form of misunderstanding in some recent publications in the ML community that claim to do steganography. Stricto sensu, these papers do hide information in a cover content and this secret message is typically not visible to the human eye. Yet the problem is that those techniques are easily detectable by SOTA opponents (steganalysis algorithms) and thus one does not reach the required level of secrecy in this multimedia security context. Also, in practice, it is unthinkable to use an algorithm that cannot embed an encrypted message which means that the message must be recovered with 0% error all the time. This is why the steganography community has been working on the problem of minimizing detectability given a message length to embed and does not allow to trade message retrieval exactness with detectability. \nFortunately, the present paper seems to be aware of the problem and attempts to remediate this issue by achieving 0% error using ML-based message embedding. \n\nThere are a number of claims in the introduction with which I do not agree :\n- Steganography is presented as a superset of other problems such as watermarking or copyright certification. I argue that these are separate problems with separate solutions even if they borrow some ideas from one another. This is again about the misunderstanding mentioned above.\n- Classic steganography techniques « can only hide up to 0.4 bits per pixel  » in order to avoid detection. First, such an empirical result is highly dependent on the cover image. There are some for which one can embed much more and other possibly less. So this must be an average bpp. More importantly, I do no think any steganographic scheme can claim to achieve 0% detection with 0.4 bpp. The usual experimental setup is to provide a curve showing the detection rate as a function of bpp payload. This curve will be dependent on the image dataset and the chosen opponent (usually a SOTA steganalyzer). \n- StegoGAN is not SOTA steganography.. it might be ML-based SOTA steganography. But the mainstream steganography does better than this notably regarding detectability.\n\nConcerning related works and novelty, the paper is not the first to exploit adversarial image to improve steganography see for example:\n\n[1] W. Tang, B. Li, S. Tan, M. Barni, and J. Huang. 2019. CNN-Based Adversarial Embedding for Image Steganography. IEEE Transactions on Information Forensics andSecurity14,8(2019),2074–2087\n \n[2] Bernard, S., Bas, P., Pevný, T., & Klein, J. (2021, June). Optimizing Additive Approximations of Non-Additive Distortion Functions. In Proceedings of the 2021 ACM Workshop on Information Hiding and Multimedia Security (pp. 105-112).\n\n\nThe authors use clipping to prevent the stego and cover to have too high pixelwise differences and to prevent out-of-range pixel value assignments.. In practice, most image formats use 1 byte for each pixel (or 3 bytes for RGB). So it would have been more convincing to clip image between 0 and 255 and then clip modifications to integers values. \n\nThe quality of a steganographer should not be evaluated through reconstruction errors such as PSNR, MSE or SSIM because they do not say much about detectability. This is what Table 5 reveals. The detection rates are too high to entrust the algorithm for achieving secret communication. BTW, detection rate is a bit ambiguous term, it is true positive rate ? It would be better to show classifier error rate. \nThe security of the steganography must be evaluated through SOTA steganalyzer error rates. The authors use ref. [You et al. 2020] as SOTA steganalyzer. Others are:\n\n[3] Boroumand, M., Chen, M., & Fridrich, J. (2018). Deep residual network for steganalysis of digital images. IEEE Transactions on Information Forensics and Security, 14(5), 1181-1193. \n\n[4] Xu, G. (2017, June). Deep convolutional neural network to detect J-UNIWARD. In Proceedings of the 5th ACM Workshop on Information Hiding and Multimedia Security (pp. 67-73).\n\n\nThe authors say on page 6, that they include some comparison with HUGO but I could not find it in the mentioned table (maybe I missed something). As a baseline, I think the authors should at least compare themselves to UNIWARD [Holub et al. 2014] although there are now more secure steganography schemes in the mainstream steganography literature. \n\nBesides, one of the main weakness of the presented study is that the achieved zero error for message retrieval is only empirical while with statistical image steganography zero error is a built-in property. So in practice, one has to trust the generalization performances of the model in order to send an encrypted message.\n\nWhile section 6 is somewhat interesting, I think this use case is quite narrow. The security relies on 0% error + encryption but many other concurrent approaches can do that relying on the cover produced by the face GAN. So why the proposed approach should be used ? It is because the message to embed is large ? I agree that, here, detectability is not the top priority. But I am unsure about the interest of publicly sharing someone’s picture with the face of someone else.  If two parties want to share pictures they can use private messaging apps with encryption.", "summary_of_the_paper": "This submission deals with steganographic paradigm : hiding a secret message in a cover content while remaining undetectable. The authors use a purely ML-based pipeline. They intend to achieve zero message-retrieval-error (which is normally a must-have for steganographic approaches). They use a neural network decoder and exploit adversarial perturbations to compute the stego version of the cover image. The loss from which gradients originate is the sum of binary cross-entropies between decoder output and message to embed. \n", "summary_of_the_review": "pros : \n- it is clever to rely on adversarial examples and iterating to obtain a stego image\n\ncons : \n- the evaluation in terms of undetectability (which is what matters most in steganography) is insufficient: one should provide the error rate of a few SOTA opponents. The method must also be compared to gold standards steganographers. \n- the zero error of message retrieval is only empirically checked and one cannot hope for perfect generalization performances\n", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "G3FepxSFZ2", "reviewer": "Reviewer_vPjm", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "# Strong Points\n* FNNS constitute a novel approach in the field of steganography leveraging adversarial attack techniques to hide a secret message in an image. \n* The paper is well written and easy to follow\n* The presented application of face anonymization is interesting.\n* The authors present that FNNS is capable of evading steganalysis frameworks. \n\n# Weak Points\n* I am wondering about the computation time of the proposed approach? It appears that FNNS has to process each image individually with L-BFGS, which might be relatively time-intensive. On the other hand, previous techniques can hide secret information in a matter of a single forward pass. This might make FNNS inefficient at deployment in real-world scenarios.\n* I am wondering about the motivation of the authors to choose the L-BFGS algorithm? In the adversarial attack community many other, maybe better or faster adversarial attack algorithms had been proposed. Did the authors experiment with other attack algorithms such as PGD, DeepFool, or C&W?\n* The paper misses related works. Just to mention a few: [1,2,3,4,5,6,7,8], which should be discussed and ideally differentiated and compared to. \n* The source code is not provided? Will the code be publicly available? \n\n[1] Light field messaging with deep photographic steganography; CVPR 2019  \n[2] Stegastamp: Invisible hyperlinks in physical photographs; CVPR 2020  \n[3] UDH: Universal Deep Hiding for Steganography, Watermarking, and Light Field Messaging - NeurIPS 2020  \n[4] HiNet: Deep Image Hiding by Invertible Network; ICCV 2021  \n[5] Large-Capacity Image Steganography Based on Invertible Neural Networks; CVPR 2021  \n[6] Deep Multi-Image Steganography with Private Keys; 2021  \n[7] Enhancing the Security of Deep Learning Steganography via Adversarial Examples; Mathematic 2020  \n\n# Additional Questions \n* The motivation for the naming of FNNS is not entirely clear to me. What does the **Fixed** in FNNS stand for? Aren’t all other neural network-based steganography techniques using fixed neural networks? \n", "summary_of_the_paper": "This work proposes Fixed Neural Network Steganography (FNNS), an algorithm for steganography leveraging adversarial attacks to hide a secret message in an image. The authors propose three variants of FNNS, show its performance under steganalysis, and propose face anonymization as a possible use case of FNNS. ", "summary_of_the_review": "In my opinion, FNNS can provide a contribution to the steganography community. The proposed algorithm is novel and includes sufficient results and the evaluation and analysis appear valid. The authors also show an interesting use case of FNNS. However, the paper still has some weak points the authors should address to increase the quality and completeness of the paper. \n\n====== Edit November 23 ======  \nRaised my score to Accept after reading the author's response. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "-A_m6G-WkcZ", "reviewer": "Reviewer_NkWr", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths: \n1. The paper is written clearly and easy to follow. \n2. The observations regarding the limitations of an encoder - decoder architecture is novel and provides new insights to the field. \n3. The empirical performance of the method is strong. The out-of-domain example is convincing and the decode accuracy of the method is very high. Moreover, the paper deals with the setting of an arbitrary binary message. \n\nWeakness:\n1. The parts regarding JPEG compression can be expanded. For example, \n(a) what are the JPEG compression quality factors used for the experiment? \n(b) It would be interesting to combine the approach with JPEG-resistant adversarial attacks. But it's understandable if this is outside the current scope of the paper.  ", "summary_of_the_paper": "This paper proposes a method for image steganography based on adversarial attacks. Unlike previous works such as SteganoGAN, the proposed method fixes the decoder and performs an inference-time attack to produce a perturbation which maps to the correct message. Empirical results show the proposed method out-performs existing encoder decoder based design, and is also more robust in out-of-domain applications. ", "summary_of_the_review": "Overall I enjoyed reading this work. See main review for details. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Meta-review: This submission proposes a method for steganography, i.e. hiding "secret messages" in images. Specifically, the proposed approach implements a procedure similar to adversarial example generation, where a perturbation is found that a) is imperceptible and b) can be decoded by a fixed decoder. This approach results in the ability to hide a significant amount of information (up to 3 bpp) with essentially no decoding errors. While the resulting perturbations are sometimes detectable by existing methods, the authors nevertheless provide a compelling case that their approach is a significant step forward and demonstrate an interesting new application to face hiding. Reviewers generally found the paper easy to follow and clear and felt the proposed approach provided a new and effective way to perform steganography. However, there were many requests for clarification of the work's situation in the larger literature of steganography and adversarial ML. The authors have clarified their contribution in the rebuttal, and as long as these changes have made it back into the paper, I am happy to recommend acceptance.
Decision: Accept (Poster)