# Adversarial Attack for Deep Steganography Based on Surrogate Training and Knowledge Diffusion
###### Abstract  
Deep steganography (DS), using neural networks to hide one image in another, has performed well in terms of invisibility, embedding capacity, etc. Current steganalysis methods for DS can only detect or remove secret images hidden in natural images and cannot analyze or modify secret content. Our technique is the first approach to not only effectively prevent covert communications using DS, but also analyze and modify the content of covert communications. We proposed a novel adversarial attack method for DS considering both white-box and black-box scenarios. For the white-box attack, several novel loss functions were applied to construct a gradient- and optimizer-based adversarial attack that could delete and modify secret images. As a more realistic case, a black-box method was proposed based on surrogate training and a knowledge distillation technique. All methods were tested on the Tiny ImageNet and MS COCO datasets. The experimental results showed that the proposed attack method could completely remove or even modify the secret image in the container image while maintaining the latter's high quality. More importantly, the proposed adversarial attack method can also be regarded as a new DS approach. adversarial examples; deep hiding; deep steganography; deep steganalysis Article  
Adversarial Attack for Deep Steganography Based on Surrogate Training and Knowledge Diffusion  
12202  
samples contain secret information [7]. Active steganalysis algorithms, also known as steganographic firewalls, attempt to remove secret information within container images [8], while minimizing the impact on the quality of the container image [9]. Recently, deep learning has been proven to be promising in computer vision. Deep-learning-based image steganography has been applied, mostly using deep neural networks, demonstrating promising performance in terms of embedding capacity as compared to traditional methods [10]. In addition to hiding one or more images in another image of the same size [11; 12; 13; 14], deep neural networks can also hide binary information in an image [15; 16], and the embedded binary information can be transmitted in light fields [17; 18; 19]. Generally, the backbone network of image-to-image deep-learning-based models is an autoencoder, which is trained in an end-to-end manner. When the network is well-trained, the sender can encode a secret image into a container image of the same size through the encoder. The receiver can use the decoder provided by the sender to recover the secret image from the container image. [PERSON] et al. [20] showed that deep-learning-based steganography is difficult to detect by traditional passive attack methods. Despite benefiting from deep learning techniques, deep steganography (DS) also introduces adversarial examples, which could be vulnerable to adversarial attacks. Furthermore, DS and adversarial attacks are naturally connected [21]. We attempted to use adversarial attack technology to achieve attack capabilities that are difficult to reach through traditional steganalysis methods. To the best of our knowledge, current steganalysis methods for DS are limited to the elimination of secret images and cannot modify these images or analyze their content [22; 23; 24]. An attack method for deep steganography is proposed, taking advantage of the fact that deep learning models are vulnerable to adversarial attacks [25; 26]. DS secret image removal, modification, and content analysis were achieved using the proposal method. The main contributions of this paper are as follows:  
* To the best of our knowledge, we are the first group to apply the white-box attack method to deep steganographic models by constructing an adversarial perturbation. Attackers can remove or modify secret images by superimposing imperceptible adversarial perturbations onto container images (Figure 1).