# Generative Reversible Data Hiding by Image-to-Image Translation via GANs

Authors: Zhuo Zhang; Guangyuan Fu; Fuqiang Di; Changlong Li; Jia Liu
Journal: Security and Communication Networks
 (2019)

---

## Abstract

The traditional reversible data hiding technique is based on cover image modification which inevitably leaves some traces of rewriting that can be more easily analyzed and attacked by the warder. Inspired by the cover synthesis steganography-based generative adversarial networks, in this paper, a novel generative reversible data hiding (GRDH) scheme by image translation is proposed. First, an image generator is used to obtain a realistic image, which is used as an input to the image-to-image translation model with CycleGAN. After image translation, a stego image with different semantic information will be obtained. The secret message and the original input image can be recovered separately by a well-trained message extractor and the inverse transform of the image translation. The experimental results have verified the effectiveness of the scheme.


---

## Body

## 1. Introduction

Information hiding [1–5], also called data hiding, is an important information security technique widely used in secret transmission [6], digital copyright protection [7], and other scenarios. If we classify data hiding by the reversibility of cover image, data hiding can generally be divided into two types: irreversible data hiding (IDH) [8, 9] and reversible data hiding (RDH) [10–12]. The traditional data hiding methods can be classified into the former type, while the latter type is a special technique which is mainly applied to medical, judicial, and military fields.With the emergence and development of artificial intelligence [13–16] and other new techniques, the IDH methods using deep learning models have achieved a series of breakthroughs in methods and performance and become the trend of development in this field [17–20]. Among these new methods, secret data can be hidden and extracted well without any modification in the original cover image and cannot be detected by the warder (steganalysis algorithm). Comparatively, RDH with deep learning has received less attention. As far as our best knowledge, currently, no RDH method can hide data without modification. At present, RDH methods can be divided into two types: RDH in unencrypted images [21–23] and RDH in encrypted images [24, 25]. Among these RDH methods, data hiding is based on cover image modification, which is more and more easily to be detected by increasingly advanced machine learning detection tools.In [18], a new image steganography method via deep convolutional generative adversarial networks (DCGANs) is proposed. In this method, a mapping from the secret data to random noise is designed. With this mapping, a corresponding relationship between secret data and the stego image generated by the DCGAN model is obtained, and an extractor used to extract secret data is trained. This method has a strong ability to resist state-of-the-art detection tools, and it has provided great inspiration for the RDH method without modification.Cycle-consistent generative adversarial network (CycleGAN) [26] is a newly proposed image-to-image translate model, which learns to automatically translate an image from a source domain into a target domain in the absence of paired examples. In this generative adversarial network (GAN) model, there are two generators and two discriminators. Cycle-consistency loss is defined to train the CycleGAN model. Using CycleGAN, one type of picture can be transformed into another, and this transformation is reversible. Obviously, this kind of technique can be applied to the RDH field.In [27], a framework for RDH in encrypted images based on reversible image transformation is proposed. At first, a cover image is transformed into another target image by image transformation. Then, secret data are embedded into the transformed image, which is regarded as the encrypted image. There have been many similar methods [28–30]. In this type of method, the image transformation is regarded as a special type of image encryption. And the embedding method belongs to the traditional method and essentially relies on pixel modification. However, the generative model uses neural networks to learn the data distribution rule of samples, and the generated image has strong randomness, which enhances the security of the data hiding algorithms. This advantage makes it far superior to traditional methods.In this paper, the generative reversible data hiding (GRDH) method based on the GAN model is proposed. Learning the secret data mapping method in [18] and the image recovery method in CycleGAN, a new GRDH framework is proposed. In this framework, a cover image is generated by a noise vector, which is transformed by the secret data. Then, the cover image is transformed into a marked image by the CycleGAN model. Similar to the frame in [27], the transformed image can be regarded as a special encrypted image. In addition, a new extractor is trained to extract the secret data, which make the data hiding framework reversible. The experimental results have proved the feasibility of the proposed GRDH method.


## 2. DCGAN and CycleGAN

DCGAN [31] is an upgraded version of GAN. In the DCGAN model, a convolutional neural network is introduced to design a generator and discriminator. To improve the quality of generated samples and the speed of the convergence process, some changes to the structure of the original convolutional neural network have been made. With the powerful feature extraction ability of the convolutional neural network, the learning effect of the generative adversarial network has been significantly improved. The illustration of the DCGAN model is shown in Figure 1. The fake image is generated by random noise and a generator. The discriminator is designed in order to judge whether the generated image is a real image or fake image. The goal of the generator is to generate real images to deceive the discriminator. The goal of the discriminator is to separate the fake image from the real one as far as possible. In this way, the generator and discriminator constitute a dynamic game process.Figure 1
Illustration of the DCGAN model.CycleGAN [26] is essentially a ring network which is made up of two symmetrical GAN models. The illustration of the CycleGAN model is shown in Figure 2. On the one hand, two GAN models share two generators. On the other hand, each GAN model contains a discriminator. Thus, there are two generators and two discriminators in a CycleGAN model. Figure 3 shows the illustration of a one-way GAN model. Real images in domain A can be transformed to fake images in domain B based on a discriminator and then transformed to the recovered image of domain A by another generator.Figure 2
Illustration of the CycleGAN model.Figure 3
Illustration of a one-way GAN model in CycleGAN.


## 3. Generative Reversible Data Hiding

The illustration of GRDH is shown in Figure4.Figure 4
Illustration of the proposed GRDH method.There are two processes in GRDH: preparation process and implementation process, consisting of the following 4 phases:Phase 1 (CycleGAN training).
A generatorG1 and a restorer F are generated by the CycleGAN method. With two discriminators D1 and D2, two image mapping goals are achieved: X⟶Y and Y⟶X, where X and Y are image collections.Phase 2 (generator training).
A generatorG2 is obtained by a GAN method (e.g., DCGAN or BEGAN) with the help of a discriminator D3.Phase 3 (extractor training).
In this phase based on the two discriminatorsG1 and G2 obtained earlier, we can achieve the transformation from random noise to image collection Y. Then, we train a new extractor E based on the GAN technique and ensure that the generated output Z2 is as close as possible to the input Z1.Phase 4 (send and receive).
Before data hiding, the sender sends an extractorE and a restorer F to the receiver. Both sides learn a mapping from secret data M to noise Z. Corresponding to the traditional RDH methods, the image generated by G1 and G2 can be regarded as the cover image and marked image. Then, the sender sends the marked image G1G2Z to the receiver. At the receiver side, recovered image can be obtained and the embedded data can be extracted. We will go into detail about various phases in the following.


### 3.1. Preparation Process

The purpose of the preparation process is to train related models and prepare for data hiding, including three phases: CycleGAN training, generator training, and extractor training. The detailed steps can be described as follows:Phase 1 (CycleGAN training).
Our goal of this phase is to generate a marked image generatorG1 and a recovered image restorer F. Without loss of generality, we choose the original CycleGAN model to train. Assume X and Y denote two image collections, corresponding to the cover image and marked image, respectively. Firstly, two image databases are built: a cover image database CDB and a marked image database MDB. Each database contains one type of image. For example, the CDB contains images of normal horses and the MDB contains images of zebras. Then, the cover image in the following phases will be an image of a normal horse, and the marked image to be sent to the receiver can be an image of a zebra. In Phase 1, the training process is based on the original CycleGAN model. We apply the two adversarial losses: LGANG1,D1,X,Y and LGANF,D2,Y,X, for mapping X⟶Y and Y⟶X defined in [26], and the full objective function can be described as follows:(1)LG1,F,D1,D2=LGANG1,D1,X,Y+LGANF,D2,Y,X+λLcycG1,F,where LcycG1,F denotes the cycle-consistency loss.Phase 2 (generator training).
Our goal of this phase is to generate a cover image generatorG2. Without loss of generality, we can choose the original DCGAN model to train. According to the principle of the DCGAN model, a generator G2 can be generated by the cover image database CDB and the discriminator D3. Then, the mapping from random noise z to image collection X can be learned. The structures of the DCGAN model are introduced in [31]. Both the generator G2 and the discriminator D3 are CNN structures. Denote x and Pdata as the real image and its distribution from the cover image database CDB, and then the objective function to be optimized is as follows:(2)minmaxVG2,D3=Ex∼PdataxlogD3x+EZ∼Pzz⋅log1−D3G2z.Other unsupervised GAN models (e.g., BEGAN) can also be used for generator training.Phase 3 (extractor training).
After Phase 1 and Phase 2, two generatorsG1 and G2 have been trained. Based on these two generators and input noise z1, the marked image can be generated by G1G2z1. Our goal of Phase 3 is to train an extractor E for secret data. We draw on Hu’s method [18]. The construction method of E is similar to that of the discriminator in the DCGAN model, which has four convolutional layers and a fully connected layer. A leak-Relu activation function and batch normalization are used in each layer. Different from conventional CNN models, there is no pooling layer or dropout operation in the extractor. The illustration of the extractor in the GRDH method is shown in Figure 5.Figure 5
Illustration of the extractor in the GRDH method.If the input ofE is the marked image with the size 64 × 64 × 3, the output size after the first layer is 32 × 32 × 64. In the following layers, the image dimensions are halved, and the number of channels is doubled from that in the previous layer. The final output is a noise vector of 100 dimensions. Each noise value in the vector is between −1 and 1. The defined loss function for extractor training can be described as follows:(3)LE=∑i=1nz1−EG1G2z12.We use this loss function to train the extractor as much as possible so that its output is as close as possible to the input noisez1.


### 3.2. Implementation Process

After the preparation process, two generatorsG1 and G2, an extractor E, and a restorer F are obtained. As shown in Figure 4, the sender holds G1 and G2 and sends E and F in advance by a secure channel. The above process is similar to that of key distribution in public key cryptography.According to the steps of the preparation process, the noise vectorZ is transformed into an image G2Z by G2 at first and then transformed into another image G1G2Z by G1. From the view of the RDH technique, the first image G2Z can be seen as the cover image, and the second image G1G2Z can be seen as the marked image. In the implementation process, the only thing that the image owner needs to do is sending the marked image G1G2Z to the receiver. At the receiving end, the receiver can recover the cover image by the restorer F and extract the noise vector by the extractor E. From the view of RDH in encrypted images, the above process at the receiving end belongs to a separable scheme. It means that the receiver can not only recover the image before data extraction but also recover the image after data extraction. Beyond that, the mapping method proposed in [18] is used to realize the mapping from the secret binary bits to the noise vector. The mapping method can be described as follows.At first, the secret binary bits are divided into several groups. Each group containsk bits. For example, {110101100} is divided into the three groups {110}, {101}, and {100} when k=3. Then, each group is mapped to a random noise r with a given interval according to the following equation:(4)r=randomm2k−1−1+δ,m+12k−1−1−δ,where m denotes the decimal value of the group to be mapped and δ denotes the gap between the divided intervals. For example, k=3 and δ=0.001. We map every three secret bits into a random noise with the value between −1 and 1. The mapping from the group to the interval is shown in Table 1. At last, all the mapped noise is packaged into a vector. The above mapping method allows a deviation tolerance in data extraction and ensures the extraction accuracy of the secret data during the implementation process. This mapping method will be shared by both the sender and the receiver. The sender maps the secret data to the noise vector, and the receiver maps the noise vector to the secret data.Table 1
Mapping from the group to the interval.
Group
Interval
000
(−0.999, −0.751)
001
(−0.749, −0.501)
010
(−0.499, −0.251)
011
(−0.249, −0.001)
100
(0.001, 0.249)
101
(0.251, 0.499)
110
(0.501, 0.749)
111
(0.751, 0.999)


## 3.1. Preparation Process

The purpose of the preparation process is to train related models and prepare for data hiding, including three phases: CycleGAN training, generator training, and extractor training. The detailed steps can be described as follows:Phase 1 (CycleGAN training).
Our goal of this phase is to generate a marked image generatorG1 and a recovered image restorer F. Without loss of generality, we choose the original CycleGAN model to train. Assume X and Y denote two image collections, corresponding to the cover image and marked image, respectively. Firstly, two image databases are built: a cover image database CDB and a marked image database MDB. Each database contains one type of image. For example, the CDB contains images of normal horses and the MDB contains images of zebras. Then, the cover image in the following phases will be an image of a normal horse, and the marked image to be sent to the receiver can be an image of a zebra. In Phase 1, the training process is based on the original CycleGAN model. We apply the two adversarial losses: LGANG1,D1,X,Y and LGANF,D2,Y,X, for mapping X⟶Y and Y⟶X defined in [26], and the full objective function can be described as follows:(1)LG1,F,D1,D2=LGANG1,D1,X,Y+LGANF,D2,Y,X+λLcycG1,F,where LcycG1,F denotes the cycle-consistency loss.Phase 2 (generator training).
Our goal of this phase is to generate a cover image generatorG2. Without loss of generality, we can choose the original DCGAN model to train. According to the principle of the DCGAN model, a generator G2 can be generated by the cover image database CDB and the discriminator D3. Then, the mapping from random noise z to image collection X can be learned. The structures of the DCGAN model are introduced in [31]. Both the generator G2 and the discriminator D3 are CNN structures. Denote x and Pdata as the real image and its distribution from the cover image database CDB, and then the objective function to be optimized is as follows:(2)minmaxVG2,D3=Ex∼PdataxlogD3x+EZ∼Pzz⋅log1−D3G2z.Other unsupervised GAN models (e.g., BEGAN) can also be used for generator training.Phase 3 (extractor training).
After Phase 1 and Phase 2, two generatorsG1 and G2 have been trained. Based on these two generators and input noise z1, the marked image can be generated by G1G2z1. Our goal of Phase 3 is to train an extractor E for secret data. We draw on Hu’s method [18]. The construction method of E is similar to that of the discriminator in the DCGAN model, which has four convolutional layers and a fully connected layer. A leak-Relu activation function and batch normalization are used in each layer. Different from conventional CNN models, there is no pooling layer or dropout operation in the extractor. The illustration of the extractor in the GRDH method is shown in Figure 5.Figure 5
Illustration of the extractor in the GRDH method.If the input ofE is the marked image with the size 64 × 64 × 3, the output size after the first layer is 32 × 32 × 64. In the following layers, the image dimensions are halved, and the number of channels is doubled from that in the previous layer. The final output is a noise vector of 100 dimensions. Each noise value in the vector is between −1 and 1. The defined loss function for extractor training can be described as follows:(3)LE=∑i=1nz1−EG1G2z12.We use this loss function to train the extractor as much as possible so that its output is as close as possible to the input noisez1.


## 3.2. Implementation Process

After the preparation process, two generatorsG1 and G2, an extractor E, and a restorer F are obtained. As shown in Figure 4, the sender holds G1 and G2 and sends E and F in advance by a secure channel. The above process is similar to that of key distribution in public key cryptography.According to the steps of the preparation process, the noise vectorZ is transformed into an image G2Z by G2 at first and then transformed into another image G1G2Z by G1. From the view of the RDH technique, the first image G2Z can be seen as the cover image, and the second image G1G2Z can be seen as the marked image. In the implementation process, the only thing that the image owner needs to do is sending the marked image G1G2Z to the receiver. At the receiving end, the receiver can recover the cover image by the restorer F and extract the noise vector by the extractor E. From the view of RDH in encrypted images, the above process at the receiving end belongs to a separable scheme. It means that the receiver can not only recover the image before data extraction but also recover the image after data extraction. Beyond that, the mapping method proposed in [18] is used to realize the mapping from the secret binary bits to the noise vector. The mapping method can be described as follows.At first, the secret binary bits are divided into several groups. Each group containsk bits. For example, {110101100} is divided into the three groups {110}, {101}, and {100} when k=3. Then, each group is mapped to a random noise r with a given interval according to the following equation:(4)r=randomm2k−1−1+δ,m+12k−1−1−δ,where m denotes the decimal value of the group to be mapped and δ denotes the gap between the divided intervals. For example, k=3 and δ=0.001. We map every three secret bits into a random noise with the value between −1 and 1. The mapping from the group to the interval is shown in Table 1. At last, all the mapped noise is packaged into a vector. The above mapping method allows a deviation tolerance in data extraction and ensures the extraction accuracy of the secret data during the implementation process. This mapping method will be shared by both the sender and the receiver. The sender maps the secret data to the noise vector, and the receiver maps the noise vector to the secret data.Table 1
Mapping from the group to the interval.
Group
Interval
000
(−0.999, −0.751)
001
(−0.749, −0.501)
010
(−0.499, −0.251)
011
(−0.249, −0.001)
100
(0.001, 0.249)
101
(0.251, 0.499)
110
(0.501, 0.749)
111
(0.751, 0.999)


## 4. Experimental Results

In this section, a group of experiments is conducted to verify the effectiveness of the GRDH method proposed in this paper. These experiments consist of two parts. First, we train the GAN models and the extractor for GRDH preparation. Then, we use these trained models for GRDH to verify the feasibility of the method. In all the experiments, we generate random bits (using random.randint function in NumPy) as secret information. All images in the datasets were resized to 64 × 64 in advance for model training. All experimental results are obtained by the Lenovo graphic workstation ThinkStation P500 with NVIDIA GeForce GTX 1080 Ti GPU and 128 GB of memory.


### 4.1. Experimental for GRDH Preparation

#### 4.1.1. CyclyGAN Model Training

We select the image database of horses and zebras in [32] as training samples. In the CycleGAN training stage, we set the initial learning rate to 0.0002 and the least batch size to 100. Besides, the stochastic gradient descent (SGD) [33] is selected as the optimization algorithm in model training. Some visual experimental results of CycleGAN training are shown in Figure 6.Figure 6
Partial experimental results of CycleGAN training. (a) Step = 200. (b) Step = 86000. (c) Step = 160000. (d) Step = 210000.
(a)
(b)
(c)
(d)The first line stands for the mapping from theX-domain image (horse) into the Y-domain image (zebra). The images from left to right are, respectively, the original image, the transformed image, and the reconstructed image. The second line stands for the mapping from the Y-domain image (zebra) into the X-domain image (horse). From Figure 6, it can be seen that when the model is trained for 210000 steps, the visual results of image transformation and image recovery can be acceptable in some special scenes when the demand for reversibility is not high. The visual results are related to the chosen image database and sample size.We also use the man2woman image set [34] to train the model. The batch size is set to 100, and the random number seed is set to 1234; the initial learning rate value is set to 0.002, and the rate remains the same in the first 10,000 steps and then decays every 10,000 steps until it decays to zero (one step represents a batch of image training). Assuming that the Man image set is X and the Woman image set is Y, the adjustment parameters are set to 10.0. In training in both directions X⟶Y and Y⟶X, the first-moment parameter of the gradient descent optimizer is set to 0.5 and the number of filters of the first convolutional layer is set to 64. Figure 7 shows the image quality using the CycleGAN model after different training steps. The CycleGAN model is trained for 600,000 steps and takes about 52 hours, that is, about 11,500 steps per hour. It can be seen from the figure that the quality of the gender-converted image after the number of trainings more than 100,000 has reached an acceptable level. As the number of trainings continues to increase, the image quality of the CycleGAN model for gender conversion and image restoration is gradually improved.Figure 7
CycleGAN model training results. (a) Step = 5000. (b) Step = 200000. (c) Step = 400000. (d) Step = 600000.
(a)
(b)
(c)
(d)


#### 4.1.2. Generator Training

Because of the high image quality of BEGAN’s production, we directly use the BEGAN model for generator training. We use the CelebA image library [35]; the batch size is set to 16; the initial base learning rate is set to 0.001, and the learning rate is gradually attenuated. Furthermore, the initial value of the parameter k0 = 0, and the initial value of the parameter γ = 2. The quality of the image generated by the BEGAN model after different training steps is shown in Figure 8. It can be seen from the figure that the quality of the generated image gradually increases with the increase of the number of training steps, and the number of steps is gradually increased to a more realistic level with the natural image.Figure 8
BEGAN model training results. (a) Step = 2000. (b) Step = 20000. (c) Step = 80000. (d) Step = 400000.
(a)
(b)
(c)
(d)It is worth noting that one of the important factors affecting the quality of the generated image is the type of the GAN model selected. The BEGAN model is relatively simple, the training time is low, and the image quality is relatively acceptable. Compared with the BEGAN model, although the training of the StyleGAN model takes a lot of time, the generated image is more realistic and closer to the natural image. Figure9 shows a partial generation of the StyleGAN model based on the FFHQ image library. It can be seen that it is very close to the natural image, but even if the GPU of the NVIDIA Tesla V100 model needs to be trained for about five weeks.Figure 9
StyleGAN model training results.


#### 4.1.3. Extractor Training

First, we generate 10,000 marked images by the generator from the trained BEGAN (random noise as the input) and CycleGAN. Then, we used these 10,000 images as training sets to train the extractor with a large number of random noise vectors. In the training procedure, the minibatch is set to 100, Adam optimization is used for training, and the learning rate is set to 0.0002. We train the extractor for 200,000 steps. The loss function value of the extractor is shown in Figure10.Figure 10
Loss function value of the extractor in training.From the experimental results, it can be seen that the extractor converges rapidly and will eventually converge to a small value, which means that the output of the extractor is very close to the input noise vector. This means that we can reverse map the output of the extractor back to the secret message using data in Table1.


### 4.2. Experiments for GRDH Implementation

First, the secret information bit string (generated using random.randint in NumPy) is divided into several segments (3 bits/segment, i.e.,k = 3), and then the binary bit form segment is converted into a random noise form of the range [−1, 1] by formula (4). Image generation, image transformation, and image restoration were performed using the trained CycleGAN model and BEGAN model. Among them, CycleGAN model training image sets are the Man image set and Woman image set, and the training frequency is 600,000 steps; the BEGAN model training image set is CelebA image library, and the training frequency is 400,000 steps; the noise dimension is set to 100, so the amount of embedded data in the experiment was set to 300 bits (i.e., 100 × 3). The experimental results of image generation, image transformation, and image restoration in some samples are shown in Figure 11(a). Because of the limitations of image quality generated by BEGAN, the visual quality of gender conversion and image restoration is relatively low. Figure 11(b) shows some experimental results when the StyleGAN model is adopted in the image generation process.Figure 11
Results of image generation, image conversion, and image restoration. (a) BEGAN. (b) StyleGAN.
(a)
(b)In addition, we calculated the average value of peak signal-to-noise ratio (PSNR) for 1,000 recovered images from two GAN models separately, as shown in Table2.Table 2
Average values of PSNRs of recovered images.
GAN model
PSNR value (dB)
BEGAN
22.665
StyleGAN
28.333Although the average PSNR value of restored images is not high, the subjective visual effect is acceptable. Meanwhile, it is easy to see from the figure that the visual quality of gender conversion and image restoration is relatively high. Therefore, whether in the preparation phase or the implementation phase, the image visual quality is mainly affected by the type of the selected GAN model.To test the extractor, we measured the accuracy of the extraction of secret information from 1,000 marked images. The average extraction accuracy of the extractor is 88.7%. In addition, to test the effects of parametersk and δ on the extractor recovery accuracy rate R, some further experiments are carried out. The effects of parameters k and δ on recovery accuracy R are shown in Tables 3 and 4, respectively.Table 3
Effects of parameterk on recovery accuracy R when δ=0.01.
k value
1
2
3
4
5
R value
0.951
0.937
0.891
0.765
0.657Table 4
Effects of parameterδ on recovery accuracy R when k=3.
δ value
0.01
0.02
0.03
0.04
0.05
0.06
0.07
0.08
0.09
0.1
R value
0.883
0.889
0.894
0.887
0.889
0.893
0.897
0.886
0.894
0.898From the tables, it can be seen the recovery accuracyR significantly decreases with the rise of parameter k and slightly increases with the rise of parameter δ. It is just because the smaller the parameter k is, the better the correction capability of the algorithm will be. Although the extractor recovery accuracy is not perfect, this problem can be resolved by including error-correction codes in the input noise.Because the generative steganography is to fully fit the data distribution in the natural image dataset through the training generator, this technique is very resistant to the machine learning-based steganographic analyzer, which was mentioned in [18]. In other words, it is safer than traditional modification-based steganography. Besides, because of the data hiding principle, the embedding capacity is very limited now. In the future, with the progress of the GAN model, the steganographic capacity of this scheme will gradually increase.


## 4.1. Experimental for GRDH Preparation

### 4.1.1. CyclyGAN Model Training

We select the image database of horses and zebras in [32] as training samples. In the CycleGAN training stage, we set the initial learning rate to 0.0002 and the least batch size to 100. Besides, the stochastic gradient descent (SGD) [33] is selected as the optimization algorithm in model training. Some visual experimental results of CycleGAN training are shown in Figure 6.Figure 6
Partial experimental results of CycleGAN training. (a) Step = 200. (b) Step = 86000. (c) Step = 160000. (d) Step = 210000.
(a)
(b)
(c)
(d)The first line stands for the mapping from theX-domain image (horse) into the Y-domain image (zebra). The images from left to right are, respectively, the original image, the transformed image, and the reconstructed image. The second line stands for the mapping from the Y-domain image (zebra) into the X-domain image (horse). From Figure 6, it can be seen that when the model is trained for 210000 steps, the visual results of image transformation and image recovery can be acceptable in some special scenes when the demand for reversibility is not high. The visual results are related to the chosen image database and sample size.We also use the man2woman image set [34] to train the model. The batch size is set to 100, and the random number seed is set to 1234; the initial learning rate value is set to 0.002, and the rate remains the same in the first 10,000 steps and then decays every 10,000 steps until it decays to zero (one step represents a batch of image training). Assuming that the Man image set is X and the Woman image set is Y, the adjustment parameters are set to 10.0. In training in both directions X⟶Y and Y⟶X, the first-moment parameter of the gradient descent optimizer is set to 0.5 and the number of filters of the first convolutional layer is set to 64. Figure 7 shows the image quality using the CycleGAN model after different training steps. The CycleGAN model is trained for 600,000 steps and takes about 52 hours, that is, about 11,500 steps per hour. It can be seen from the figure that the quality of the gender-converted image after the number of trainings more than 100,000 has reached an acceptable level. As the number of trainings continues to increase, the image quality of the CycleGAN model for gender conversion and image restoration is gradually improved.Figure 7
CycleGAN model training results. (a) Step = 5000. (b) Step = 200000. (c) Step = 400000. (d) Step = 600000.
(a)
(b)
(c)
(d)


### 4.1.2. Generator Training

Because of the high image quality of BEGAN’s production, we directly use the BEGAN model for generator training. We use the CelebA image library [35]; the batch size is set to 16; the initial base learning rate is set to 0.001, and the learning rate is gradually attenuated. Furthermore, the initial value of the parameter k0 = 0, and the initial value of the parameter γ = 2. The quality of the image generated by the BEGAN model after different training steps is shown in Figure 8. It can be seen from the figure that the quality of the generated image gradually increases with the increase of the number of training steps, and the number of steps is gradually increased to a more realistic level with the natural image.Figure 8
BEGAN model training results. (a) Step = 2000. (b) Step = 20000. (c) Step = 80000. (d) Step = 400000.
(a)
(b)
(c)
(d)It is worth noting that one of the important factors affecting the quality of the generated image is the type of the GAN model selected. The BEGAN model is relatively simple, the training time is low, and the image quality is relatively acceptable. Compared with the BEGAN model, although the training of the StyleGAN model takes a lot of time, the generated image is more realistic and closer to the natural image. Figure9 shows a partial generation of the StyleGAN model based on the FFHQ image library. It can be seen that it is very close to the natural image, but even if the GPU of the NVIDIA Tesla V100 model needs to be trained for about five weeks.Figure 9
StyleGAN model training results.


### 4.1.3. Extractor Training

First, we generate 10,000 marked images by the generator from the trained BEGAN (random noise as the input) and CycleGAN. Then, we used these 10,000 images as training sets to train the extractor with a large number of random noise vectors. In the training procedure, the minibatch is set to 100, Adam optimization is used for training, and the learning rate is set to 0.0002. We train the extractor for 200,000 steps. The loss function value of the extractor is shown in Figure10.Figure 10
Loss function value of the extractor in training.From the experimental results, it can be seen that the extractor converges rapidly and will eventually converge to a small value, which means that the output of the extractor is very close to the input noise vector. This means that we can reverse map the output of the extractor back to the secret message using data in Table1.


## 4.1.1. CyclyGAN Model Training

We select the image database of horses and zebras in [32] as training samples. In the CycleGAN training stage, we set the initial learning rate to 0.0002 and the least batch size to 100. Besides, the stochastic gradient descent (SGD) [33] is selected as the optimization algorithm in model training. Some visual experimental results of CycleGAN training are shown in Figure 6.Figure 6
Partial experimental results of CycleGAN training. (a) Step = 200. (b) Step = 86000. (c) Step = 160000. (d) Step = 210000.
(a)
(b)
(c)
(d)The first line stands for the mapping from theX-domain image (horse) into the Y-domain image (zebra). The images from left to right are, respectively, the original image, the transformed image, and the reconstructed image. The second line stands for the mapping from the Y-domain image (zebra) into the X-domain image (horse). From Figure 6, it can be seen that when the model is trained for 210000 steps, the visual results of image transformation and image recovery can be acceptable in some special scenes when the demand for reversibility is not high. The visual results are related to the chosen image database and sample size.We also use the man2woman image set [34] to train the model. The batch size is set to 100, and the random number seed is set to 1234; the initial learning rate value is set to 0.002, and the rate remains the same in the first 10,000 steps and then decays every 10,000 steps until it decays to zero (one step represents a batch of image training). Assuming that the Man image set is X and the Woman image set is Y, the adjustment parameters are set to 10.0. In training in both directions X⟶Y and Y⟶X, the first-moment parameter of the gradient descent optimizer is set to 0.5 and the number of filters of the first convolutional layer is set to 64. Figure 7 shows the image quality using the CycleGAN model after different training steps. The CycleGAN model is trained for 600,000 steps and takes about 52 hours, that is, about 11,500 steps per hour. It can be seen from the figure that the quality of the gender-converted image after the number of trainings more than 100,000 has reached an acceptable level. As the number of trainings continues to increase, the image quality of the CycleGAN model for gender conversion and image restoration is gradually improved.Figure 7
CycleGAN model training results. (a) Step = 5000. (b) Step = 200000. (c) Step = 400000. (d) Step = 600000.
(a)
(b)
(c)
(d)


## 4.1.2. Generator Training

Because of the high image quality of BEGAN’s production, we directly use the BEGAN model for generator training. We use the CelebA image library [35]; the batch size is set to 16; the initial base learning rate is set to 0.001, and the learning rate is gradually attenuated. Furthermore, the initial value of the parameter k0 = 0, and the initial value of the parameter γ = 2. The quality of the image generated by the BEGAN model after different training steps is shown in Figure 8. It can be seen from the figure that the quality of the generated image gradually increases with the increase of the number of training steps, and the number of steps is gradually increased to a more realistic level with the natural image.Figure 8
BEGAN model training results. (a) Step = 2000. (b) Step = 20000. (c) Step = 80000. (d) Step = 400000.
(a)
(b)
(c)
(d)It is worth noting that one of the important factors affecting the quality of the generated image is the type of the GAN model selected. The BEGAN model is relatively simple, the training time is low, and the image quality is relatively acceptable. Compared with the BEGAN model, although the training of the StyleGAN model takes a lot of time, the generated image is more realistic and closer to the natural image. Figure9 shows a partial generation of the StyleGAN model based on the FFHQ image library. It can be seen that it is very close to the natural image, but even if the GPU of the NVIDIA Tesla V100 model needs to be trained for about five weeks.Figure 9
StyleGAN model training results.


## 4.1.3. Extractor Training

First, we generate 10,000 marked images by the generator from the trained BEGAN (random noise as the input) and CycleGAN. Then, we used these 10,000 images as training sets to train the extractor with a large number of random noise vectors. In the training procedure, the minibatch is set to 100, Adam optimization is used for training, and the learning rate is set to 0.0002. We train the extractor for 200,000 steps. The loss function value of the extractor is shown in Figure10.Figure 10
Loss function value of the extractor in training.From the experimental results, it can be seen that the extractor converges rapidly and will eventually converge to a small value, which means that the output of the extractor is very close to the input noise vector. This means that we can reverse map the output of the extractor back to the secret message using data in Table1.


## 4.2. Experiments for GRDH Implementation

First, the secret information bit string (generated using random.randint in NumPy) is divided into several segments (3 bits/segment, i.e.,k = 3), and then the binary bit form segment is converted into a random noise form of the range [−1, 1] by formula (4). Image generation, image transformation, and image restoration were performed using the trained CycleGAN model and BEGAN model. Among them, CycleGAN model training image sets are the Man image set and Woman image set, and the training frequency is 600,000 steps; the BEGAN model training image set is CelebA image library, and the training frequency is 400,000 steps; the noise dimension is set to 100, so the amount of embedded data in the experiment was set to 300 bits (i.e., 100 × 3). The experimental results of image generation, image transformation, and image restoration in some samples are shown in Figure 11(a). Because of the limitations of image quality generated by BEGAN, the visual quality of gender conversion and image restoration is relatively low. Figure 11(b) shows some experimental results when the StyleGAN model is adopted in the image generation process.Figure 11
Results of image generation, image conversion, and image restoration. (a) BEGAN. (b) StyleGAN.
(a)
(b)In addition, we calculated the average value of peak signal-to-noise ratio (PSNR) for 1,000 recovered images from two GAN models separately, as shown in Table2.Table 2
Average values of PSNRs of recovered images.
GAN model
PSNR value (dB)
BEGAN
22.665
StyleGAN
28.333Although the average PSNR value of restored images is not high, the subjective visual effect is acceptable. Meanwhile, it is easy to see from the figure that the visual quality of gender conversion and image restoration is relatively high. Therefore, whether in the preparation phase or the implementation phase, the image visual quality is mainly affected by the type of the selected GAN model.To test the extractor, we measured the accuracy of the extraction of secret information from 1,000 marked images. The average extraction accuracy of the extractor is 88.7%. In addition, to test the effects of parametersk and δ on the extractor recovery accuracy rate R, some further experiments are carried out. The effects of parameters k and δ on recovery accuracy R are shown in Tables 3 and 4, respectively.Table 3
Effects of parameterk on recovery accuracy R when δ=0.01.
k value
1
2
3
4
5
R value
0.951
0.937
0.891
0.765
0.657Table 4
Effects of parameterδ on recovery accuracy R when k=3.
δ value
0.01
0.02
0.03
0.04
0.05
0.06
0.07
0.08
0.09
0.1
R value
0.883
0.889
0.894
0.887
0.889
0.893
0.897
0.886
0.894
0.898From the tables, it can be seen the recovery accuracyR significantly decreases with the rise of parameter k and slightly increases with the rise of parameter δ. It is just because the smaller the parameter k is, the better the correction capability of the algorithm will be. Although the extractor recovery accuracy is not perfect, this problem can be resolved by including error-correction codes in the input noise.Because the generative steganography is to fully fit the data distribution in the natural image dataset through the training generator, this technique is very resistant to the machine learning-based steganographic analyzer, which was mentioned in [18]. In other words, it is safer than traditional modification-based steganography. Besides, because of the data hiding principle, the embedding capacity is very limited now. In the future, with the progress of the GAN model, the steganographic capacity of this scheme will gradually increase.


## 5. Conclusions

In this paper, a novel RDH scheme named “GRDH” based on the GAN model is proposed. Firstly, we use the GAN model to train a powerful image generator to get realistic images. This image is imported into the CycleGAN model to obtain images with different semantic information. In order to achieve message embedding, we then establish a mapping relationship between noise and messages. The extraction of the message is achieved by training an extractor to remove noise from the final dense image. The experimental results have demonstrated the effectiveness of the proposed method. Although the 100 percent reversibility cannot be achieved because of the existing performance of CycleGAN, the proposed method can achieve the first RDH scheme without cover modification. However, compared with those of the traditional methods, the embedding capacity of the proposed method is very limited, but the security is higher. In the future work, we will try to experiment with some new generative models to improve the quality of restored images and to improve the steganographic capacity of the method.



---

*Source: 4932782-2019-09-11.xml*