# Adversarial Attack for Deep Steganography Based on Surrogate Training and Knowledge Diffusion
## 4 Experiment
### Black-Box Attack Results  
For untargeted attacks in a black-box scenario, the attacker could leverage the adversarial samples calculated from the initial surrogate model \(F^{\prime}\) and attack the target model \begin{table}
\begin{tabular}{l c c c c c c} \hline \hline  & \multicolumn{3}{c}{\(\begin{pmatrix}\mathbf{C^{\prime}},\mathbf{C^{\prime}}+\delta\end{pmatrix}\)} & \multicolumn{3}{c}{\(\begin{pmatrix}\mathbf{S^{\prime}},\mathbf{S^{\prime\prime}}\end{pmatrix}\)} \\ **PSNR** & \(\begin{pmatrix}\mathbf{\text{SSIM}}\end{pmatrix}\) & **APE** & \(\begin{pmatrix}\mathbf{\text{PSNR}}\end{pmatrix}\) & **SSIM** & **APE** \\ \hline \(F\) & 36.09 & 0.98 & 3.02 & 34.07 & 0.98 & 3.88 \\ \(F^{\prime}\) & 35.83 & 0.98 & 3.01 & 32.96 & 0.98 & 4.18 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Performance of DS on target model and surrogate model. \begin{table}
\begin{tabular}{l c c c c c c} \hline \hline  & \multicolumn{3}{c}{\(\begin{pmatrix}\mathbf{C^{\prime}},\mathbf{C^{\prime}}+\delta\end{pmatrix}\)} & \multicolumn{3}{c}{\(\begin{pmatrix}\mathbf{S^{\prime\prime}},\mathbf{Target}\end{pmatrix}\)} \\ **PSNR** & \(\begin{pmatrix}\mathbf{\text{SSIM}}\end{pmatrix}\) & **APE** & \(\begin{pmatrix}\mathbf{\text{PSNR}}\end{pmatrix}\) & **SSIM** & **APE** \\ \hline GN (0.3) & 33.26 & 0.95 & 4.35 & 12.86 & 0.47 & 45.04 \\ GN (0.5) & 30.59 & 0.92 & 5.98 & 9.02 & 0.29 & 71.89 \\ GB & 27.92 & 0.94 & 6.85 & 15.40 & 0.80 & 35.58 \\ \(\delta=0.03\) & 37.32 & 0.98 & 3.33 & 4.76 & 0.16 & 136.24 \\ \(\delta=0.06\) & 32.46 & 0.95 & 5.51 & 3.22 & 0.04 & 166.27 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: White-box untargeted attacks. \begin{table}
\begin{tabular}{l c c c c c c} \hline \hline  & \multicolumn{3}{c}{\(\begin{pmatrix}\mathbf{C^{\prime}},\mathbf{C^{\prime}}+\delta\end{pmatrix}\)} & \multicolumn{3}{c}{\(\begin{pmatrix}\mathbf{S^{\prime\prime}},\mathbf{S^{\prime\prime}}\end{pmatrix}\)} \\ **PSNR** & \(\begin{pmatrix}\mathbf{\text{SSIM}}\end{pmatrix}\) & **APE** & \(\begin{pmatrix}\mathbf{\text{PSNR}}\end{pmatrix}\) & **SSIM** & **APE** \\ \hline \(\delta=0.03\) & 39.09 & 0.99 & 2.53 & 23.58 & 0.86 & 11.43 \\ \(\delta=0.06\) & 37.88 & 0.98 & 2.66 & 30.49 & 0.95 & 5.74 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: White-box targeted attacks. \(F\) according to the transferability of the adversarial samples. Figure 6 reveals that the untargeted attack was easy to successfully transfer. As with the white-box scenario, a larger disturbance radius \(\epsilon\) led to a larger decoding error. The quantitative results of the _Tiny-ImageNet_ testing dataset for the black-box untargeted attack of Algorithm 1 are shown in Table 4. \begin{table}
\begin{tabular}{l c c c c c c} \hline \hline  & \multicolumn{3}{c}{\(\mathbf{(C^{\prime},C^{\prime}+\delta)}\)} & \multicolumn{3}{c}{\(\mathbf{(S^{\prime},S^{\prime\prime})}\)} \\  & **PSNR** & **SSIM** & **APE** & **PSNR** & **SSIM** & **APE** \\ \hline GN (0.3) & 33.26 & 0.95 & 4.35 & 12.86 & 0.47 & 45.04 \\ GN (0.5) & 30.59 & 0.92 & 5.98 & 9.02 & 0.29 & 71.89 \\ GB & 27.92 & 0.94 & 6.85 & 15.40 & 0.80 & 35.58 \\ \(\delta=0.03\) & 36.99 & 0.98 & 3.53 & 8.76 & 0.34 & 76.53 \\ \(\delta=0.06\) & 31.86 & 0.94 & 6.12 & 6.22 & 0.18 & 104.94 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Black-box untargeted attacks. Figure 4: White-box untargeted attack based on Algorithm 1 (\(\epsilon=0.03\) and \(\epsilon=0.06\)) and Algorithm 2 (\(lr=0.01\)). The first four columns contain the results of target model encoding and decoding. Column 5 contains the results \(C^{\prime\prime}\) of Algorithm 1 (\(\epsilon=0.03\))’s attack on the encoded image \(C^{\prime}\) of the target model, and column 6 contains the decoding results of the image \(C^{\prime\prime}\) (column 5) produced by the target model. Similarly, columns 7 and 8 present the attack effects of Algorithm 1 (\(\epsilon=0.06\)). Column 9 presents the results of Algorithm 2 (\(lr=0.01\))’s attack on the encoded image \(C^{\prime}\) of the target model.