# Adversarial Attack for Deep Steganography Based on Surrogate Training and Knowledge Diffusion
## 4 Experiment
### Black-Box Attack Results
Column 10 contains the decoding results of the target model for image \(C^{\prime\prime}\) (column 9). Figure 5: White-box targeted attack based on Algorithm 1 (\(\epsilon=0.03\)) and Algorithm 2 (\(lr=0.01\)). The first two columns present the results of target model decoding. Column 7 contains the images that the attacker wants the target model to decode. Column 3 contains the results \(C^{\prime\prime}\) of Algorithm 1 (\(\epsilon=0.03\)) attack on the encoded image \(C^{\prime}\) of the target model, and column 4 contains the decoding results of the image \(C^{\prime\prime}\) (column 3) produced by the target model. Column 5 presents the results of Algorithm 2 (\(lr=0.01\))’s attack on the encoded image \(C^{\prime}\) of the target model. Column 6 presents the decoding results of the target model for image \(C^{\prime\prime}\) (column 5). Figure 6: Black-box untargeted attack based on Algorithm 1. The first two columns present the results of target model decoding. Column 3 contains the results \(C^{\prime\prime}\) of Algorithm 1 (\(\epsilon=0.03\))’s attack on the encoded image \(C^{\prime}\) of the target model, and column 4 contains the decoding results of the image \(C^{\prime\prime}\) (column 3) by the target model. Similarly, columns 5 and 6 present the attack effects of Algorithm 1 (\(\epsilon=0.06\)). Excert Image Analysis and Black-box Target Attack  
Through knowledge distillation, the surrogate model \(F^{\prime}\) could more closely approximate the target model \(F\). As the number of instances \((C^{\prime},SorS^{\prime})\) of the target model increased, the surrogate model came closer to the target model. Figure 7 and Table 5 reflect the trend of the model's approximation for the number of instances. Knowledge distillation was performed using different numbers of instances and evaluated the approximation of the two models for the entire dataset. The ALD (average logits distance) of the model output was used to measure the model similarity (Equation (9)). \[ALD=1/n\sum mse(F(C^{\prime}),F^{\prime}(C^{\prime})) \tag{9}\]  
Through knowledge distillation, the attacker could use the optimized surrogate model \(F^{\prime}\) to analyze the secret image. As the number of instances increased, the recovered secret image became clearer (Figure 8). Figure 8 shows that the attacker only needed to obtain 32 instances (about 0.03% of the training set) to accurately decode the secret image without having access to the target model. Black-box targeted attacks requires more precise gradients, and thus more instances were needed to achieve the ideal attack effect. As shown in Figure 9 and Table 6, when the attacker mastered 128 instances, the ideal attack effect was basically achieved. \begin{table}
\begin{tabular}{l c c c c c c c} \hline \hline
**Instances Numbers** & **32** & **64** & **128** & **256** & **512** & **1024** & **2048** \\ \hline ALD & 0.0276 & 0.0124 & 0.0055 & 0.0026 & 0.0015 & 0.0010 & 0.0006 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Knowledge distillation between \(F\) and \(F^{\prime}\). Figure 7: Knowledge distillation between \(F\) and \(F^{\prime}\). The horizontal axis shows the number of instances using the teacher model (target model). The vertical axis shows the approximation between the teacher model (target model) and the student model (surrogate model) after knowledge distillation for the corresponding number of instances. Figure 8: Content analysis of secret images. \(S\_n(n=0,32,\ldots,2048)\) represents the secret image decoded by the surrogate model \(F^{\prime}\) when using n instances for knowledge distillation. Figure 9: Black-box targeted attack. \(S\_n(n=0,32,\ldots,2048)\) represents the decoding after a black-box targeted attack of Algorithm 1 (\(\epsilon=0.06\)) when \(n\) instances are used for knowledge distillation. Figure 10 shows the \(L2\)-distance between different \(\epsilon\). \(L2\)-distance was calculated between the decoded image and the target image or secret image.