# Improving Anticompression Robustness of JPEG Adaptive Steganography Based on Robustness Measurement and DCT Block Selection

Authors: Haocheng Fu; Xianfeng Zhao; Xiaolei He
Journal: Security and Communication Networks
 (2021)

---

## Abstract

With the development of the Internet, social network platforms (SNPs) have become the most common channel for image sharing. As a result, transmitting stego images in the public channels gives steganographers the best opportunity to transmit secret messages with behavioral security preserved. However, the SNPs typically compress uploaded images and damage the weak signal of steganography. In this study, a robust JPEG steganographic scheme based on robustness measurement and cover block selection (CBSRS) is proposed. We first design a deep learning-based model to fit the blockwise change rate of coefficients after JPEG recompression. Then, a cover block selection strategy is proposed to improve the robustness by optimizing the joint distortion function of transmission costs and classic costs. Moreover, by embedding indicator of cover block selection in chrominance channels of JPEG images, a shareable cover construction scheme is designed to solve the problem of auxiliary information transmission. The experimental results show that our proposed framework improves robustness while maintaining statistical security. Comparing with state-of-the-art methods, the framework achieves better performance under given recompression channels.


---

## Body

## 1. Introduction

Steganography is an advanced art of covert communication encoding secret messages into natural-looking covers while transmitting data without arousing attention of the others [1]. With the widespread use of JPEG format images, modern frameworks of JPEG image steganography are deeply researched and generally designed by minimizing modification distortion with matrix coding, e.g., Syndrome-Trellis codes (STCs) [2] and steganographic polar codes (SPCs) [3]. Meanwhile, distortion functions of JPEG images, such as J-UNIWARD [4], UED [5], and UERD [6], achieve highly statistical undetectability when against both high-dimensional feature extractors [7, 8] and deep learning-based steganalyzer [9–11]. However, most of these steganography schemes are proposed under the hypothesis that the communication relationship of the sender and receiver is secure and the transmission channel of JPEG stego images is lossless.To overcome the deficiency of classic schemes, the traditional one-to-one transmission mode must be replaced or optimized. In [12], Zhao et al. proposed a sharing-based model with public channels for steganography, with which the both statistical security and behavioral security of covert communication can be maintained. In this model, social network platforms (SNPs), the most common channels for multimedia sharing, are adopted for the construction of sharing-based steganographic communication model in real-world. Since SNPs form a new way for individuals to update their trends of life with various carriers such as images and videos [13, 14], it provides a one-to-many transmission method which weakens the connectivity of the parties of communication. However, SNPs generally recompress uploaded multimedia files to review their content and optimize storage spaces into a uniform format. The JPEG recompression operation, especially with the fixed quantization table, is the most common procedure of the lossy channel of JPEG image transmission. The studying of anticompression steganographic schemes is the key to solving this problem.To improve the anticompression robustness, robust steganographic schemes are designed with many considerations. Figure1 shows the typical framework of robust steganography. The stego elements in the selected embedding domain, which will be encoded by specific steganographic code, are expected to remain almost invariant after transmitted in the recompression channel. The error correction codes (ECCs) provide integrity of extracted message from stego images. Besides, the preprocessing and postprocessing are also introduced for better performance. By the optimization above, the robustness of adaptive steganography is significantly improved.Figure 1
The typical framework of robust steganography.As pointed out in [15], the robustness of the steganographic algorithm and stego images varies from one lossy channel to another, which denotes that the properties of recompression channel affect the performance of robustness. Therefore, the robust adaptive steganographic frameworks can be divided into two categories: “General Robustness” and “Dedicated Robustness” according to the type recompression channel they aim at.Steganographic frameworks in the “General Robustness” category are designed to improve comprehensive robustness by resisting general lossy properties of JPEG recompression and to preserve the integrity of secret message without considering the specific properties of JPEG recompression channel. In these frameworks, secret messages are embedded in different domains such as quantized pixel values [16–19] and the sign of DCT coefficients [20]. Typically, the amplitude of steganographic modification is larger than one, which introduces larger noise of steganography. As a result, the robustness performance is highly improved at the expense of the decrease of statistical security.While, “Dedicated Robustness” is a class of robust adaptive steganography that provides reliable robustness performance for specific JPEG recompression channels. These schemes generally regard a JPEG recompression channel as a black box and optimize the procedure of steganography with the specific properties of channels [15, 21], by which the modification amplitude of coefficients is weakened, and the robustness of steganography improved, while the security performance is ensured to a certain extent. However, under the actual circumstances, the image data before and after recompression are available since the recompression channel of SNP is public. As a result, designing a robust steganographic framework in the “Dedicated Robustness” mode is appropriate.Besides, as the quantization steps adopted in the recompression procedure are fixed in most SNP channels, the quantization tables of the cover JPEG image can be adjusted to the same as those of the recompression channel before steganographic embedding to reduce the error rate of stego image transmission, which shows that the problem of anticompression robust steganography under the same quantization table is more worthy of study.In this study, a robust adaptive steganographic framework is proposed against any given recompression channel with the same quantization table. First, a deep regression model for DCT block robustness measurement is designed for transmission costs prediction. Then, the cost of steganographic embedding is combined with the blockwise transmission cost, with which the cover DCT block selection scheme is proposed. Furthermore, a shareable cover construction scheme is proposed for the receiver to reconstruct stego blocks and extract embedded messages. Therefore, the proposed framework can be used under any given recompression channel.The main contributions of this study are as follows:(1)
A novel designed deep learning-based model for robustness measurement of the DCT block is proposed and can be extended to any recompression channel with the same quantization steps. To the best of our knowledge, it is the first model for quantitative analysis of the JPEG image robustness.(2)
The DCT cover block selection strategy is designed for improving both security and robustness performance. Comparing with state-of-the-art robust steganographic schemes, our framework achieves high robustness performance while preserving statistical security.(3)
The shareable cover construction scheme provides high accuracy of auxiliary information recovery, which supports a complete end-to-end robust steganography framework effectivelyThe main part of this study starts in Section2, where we restate and expand the preliminaries of JPEG compression and the theory of classic adaptive steganography. In Section 3, the scheme of robustness measurement of the JPEG image is introduced first. Te framework of robust adaptive steganography based on cover block selection is described in Section 4. Section 5 gives the experimental results and analysis in detail. Finally, a brief conclusion of this study is listed in Section 6 as well as our future work.


## 2. Preliminaries and Related Works

### 2.1. Notions

In this study, matrices and vectors are written in boldface and sets are written in swash letters. Without loss of generality, letX=x1,x2,…,xn∈ℒn represent a n pixels cover image and Y=y1,y2,…,yn∈ℒn represent the stego image after steganographic embedding on X. ℒ is the pixel dynamic range of image. As for JPEG images, ℒ=−1024,−1023,…,1023, and xi is the DCT coefficients in i location. Besides, Q=qij stands for the quantization table of the JPEG images. The modification pattern of cover element xi is formulated by ℐi. The k-ary entropy function can be denoted by Hkπ.


### 2.2. JPEG Recompression Procedure

The JPEG recompression is a lossy procedure for digital images because of the quantization and rounding operation, which can be divided into two parts: JPEG compression and JPEG decompression. Generally, for a spatial imageU=ui∈0,1,…,255n, with a given quantization table Q, JPEG compress procedure performs mathematical operations on divided disjoint blocks of 8×8 pixels separately, which can be denoted as(1)D=roundDCTUQ,where D denotes the DCT coefficient in JPEG format, and the division above operates elementwise. The functions DCT⋅ and round⋅ represent the DCT operation and the rounding operation, respectively. Similarly, the JPEG decompression procedure operates on images blockwise, which is as follows:(2)U′=roundIDCTD⋅Q,where IDCT⋅ denotes the inverse DCT operation.Because of the nonlinearity of the rounding operation, for a given JPEG image, it is hardly able to restore the original one accurately after JPEG encoding and decoding procedure eventhough the quantization tables are the same. As a result, secret messages extracted from the JPEG stego images are possibly damaged after the basic JPEG recompression process as a result of the change of DCT coefficients [22, 23], not to mention the practical transcode channel in the real world.


### 2.3. Sharing-Based Public Channel for Steganography

In [24], Simmons proposed the prisoner-warden model, which defines a typical scenario of steganography, where steganographic schemes are expected to design for minimizing the perturbation of modification. This class of steganographic schemes mainly focuses on statistical security but ignore the insecurity of communication behavior.To cover the deficiency of the classic steganographic model, Zhao et al. [12] proposed a sharing-based steganography model. As shown in Figure 2, the stego file is uploaded to the public platform by Alice which can be downloaded by all parties including Bob. In this scenario, the relationship of communication is established between Alice and Bob through the public channels, which is weakened, since the method of communication is one-to-many instead of point-to-point. As a result, both statistical and behavioral security performance is considered in the steganography communication.Figure 2
The basic model of steganographic communication scenario where Alice tries to communicate covertly with bob. (a) The prisoner-warden model, where a point-to-point communication is established between Alice and Bob. The stego files Y and Y’ may be different which depend on whether active or passive mode of attack is used by Eve. (b) Illustration of the sharing-based model, in which the communication relationship between Alice and Bob is hiding.
(a)(b)However, the public channels will generally recompress the uploaded files to uniform the format and save the storage space, while the steganographic signal will be disturbed. As for the media of image, since the public channels, such as SNPs, typically utilize the fixed quantization table to transcode the uploaded files, the cover images can be recompressed with the same quantization table to minimize the disturbance of transcoding. Therefore, the sharing-based model of steganography is degraded to the problem of reliable steganography communication under the recompression channel with the same quantization table.


### 2.4. Optimal Steganographic Embedding

In the payload-limited sender (PLS) problem, steganographic schemes try to embed messagem with calculated costs ρ into cover image X to generate stego image Y by solving the following optimization problem:(3)minπEπD=∑i=1n∑si∈ℐiπisiρisi,(4)Subjected toHπ=−∑i=1n∑si∈ℐiπisilog2πisi=m,where si denote the modification patterns for pixel in i location and ρisi denote the cost with modification pattern si for ith cover element. D represents the sum of the costs with certain modification pattern s=s1,s2,…,sn for cover image, that is,(5)Ds=∑i=1nρisi,where πisi denotes the probability of modifying the ith cover element. While solving the optimization problem shown in equation (3) with Lagrangian multiplier [25], the optimal probability of modification for each element is obtained:(6)πisi=exp−λρisi∑si′∈ℐiexp−λρisi′,where λ>0 is a scalar parameter determined by equation (4). The optimal probability above is the best mapping from the modification probability to the cost and has been proven to have a Gibbs distribution [26].


### 2.5. The Sources of Extraction Errors in Recompression Channels Transmission

To further improve the robustness of adaptive steganography, lots of previous works have analyzed the sources of message extraction errors. In [27], Bao et al. proposed an error model that mathematically analyzes the error diffusion phenomenon of STCs. The approximate bit error probability of extracted message deduced in [27] implies that the larger values of h and w take the higher error probability of extracted message. In other words, the increase of submatrix height h and the decrease of relative payload α reduce the correct rate of message extraction in steganography since the width of submatrix can be calculated as w=⌊1/α⌋ in STCs.Furthermore, when a JPEG format stego image is transmitted in the recompression channel, bit errors will be generated in the extracted message for the changes of DCT coefficients. In modern JPEG steganography, the rate of modification is typically lower than the rate of embedding, i.e., relative payload, as a result of the matrix coding. Table1 provides the statistical results of the number of modified coefficients per block using STCs with J-UNIWARD, where 4096000 samples of the DCT block partitioned from JPEG images of the ALASKA-JSMALL dataset (ALASKA-JSMALL dataset is obtained from RAW format images of the ALASKA database [28]. After center-cropped and rescaled to the size of 512 × 512, the format of which is converted to JPEG with different quality factors.) are adopted. The average and standard deviation of modification number, denoted as μ and σ, respectively, represent that no more than 2 coefficients per block are modified by the adaptive steganographic scheme on average when the quality factor is lower than 85.Table 1
The number of modified coefficients under different relative payloads and quality factors using STCs with J-UNIWARD.
0.2 bpnzAC0.4 bpnzACμσμσQF = 750.359 71.003 80.793 81.688 3QF = 800.422 41.098 40.932 91.854 3QF = 850.511 31.238 51.126 22.088 8


## 2.1. Notions

In this study, matrices and vectors are written in boldface and sets are written in swash letters. Without loss of generality, letX=x1,x2,…,xn∈ℒn represent a n pixels cover image and Y=y1,y2,…,yn∈ℒn represent the stego image after steganographic embedding on X. ℒ is the pixel dynamic range of image. As for JPEG images, ℒ=−1024,−1023,…,1023, and xi is the DCT coefficients in i location. Besides, Q=qij stands for the quantization table of the JPEG images. The modification pattern of cover element xi is formulated by ℐi. The k-ary entropy function can be denoted by Hkπ.


## 2.2. JPEG Recompression Procedure

The JPEG recompression is a lossy procedure for digital images because of the quantization and rounding operation, which can be divided into two parts: JPEG compression and JPEG decompression. Generally, for a spatial imageU=ui∈0,1,…,255n, with a given quantization table Q, JPEG compress procedure performs mathematical operations on divided disjoint blocks of 8×8 pixels separately, which can be denoted as(1)D=roundDCTUQ,where D denotes the DCT coefficient in JPEG format, and the division above operates elementwise. The functions DCT⋅ and round⋅ represent the DCT operation and the rounding operation, respectively. Similarly, the JPEG decompression procedure operates on images blockwise, which is as follows:(2)U′=roundIDCTD⋅Q,where IDCT⋅ denotes the inverse DCT operation.Because of the nonlinearity of the rounding operation, for a given JPEG image, it is hardly able to restore the original one accurately after JPEG encoding and decoding procedure eventhough the quantization tables are the same. As a result, secret messages extracted from the JPEG stego images are possibly damaged after the basic JPEG recompression process as a result of the change of DCT coefficients [22, 23], not to mention the practical transcode channel in the real world.


## 2.3. Sharing-Based Public Channel for Steganography

In [24], Simmons proposed the prisoner-warden model, which defines a typical scenario of steganography, where steganographic schemes are expected to design for minimizing the perturbation of modification. This class of steganographic schemes mainly focuses on statistical security but ignore the insecurity of communication behavior.To cover the deficiency of the classic steganographic model, Zhao et al. [12] proposed a sharing-based steganography model. As shown in Figure 2, the stego file is uploaded to the public platform by Alice which can be downloaded by all parties including Bob. In this scenario, the relationship of communication is established between Alice and Bob through the public channels, which is weakened, since the method of communication is one-to-many instead of point-to-point. As a result, both statistical and behavioral security performance is considered in the steganography communication.Figure 2
The basic model of steganographic communication scenario where Alice tries to communicate covertly with bob. (a) The prisoner-warden model, where a point-to-point communication is established between Alice and Bob. The stego files Y and Y’ may be different which depend on whether active or passive mode of attack is used by Eve. (b) Illustration of the sharing-based model, in which the communication relationship between Alice and Bob is hiding.
(a)(b)However, the public channels will generally recompress the uploaded files to uniform the format and save the storage space, while the steganographic signal will be disturbed. As for the media of image, since the public channels, such as SNPs, typically utilize the fixed quantization table to transcode the uploaded files, the cover images can be recompressed with the same quantization table to minimize the disturbance of transcoding. Therefore, the sharing-based model of steganography is degraded to the problem of reliable steganography communication under the recompression channel with the same quantization table.


## 2.4. Optimal Steganographic Embedding

In the payload-limited sender (PLS) problem, steganographic schemes try to embed messagem with calculated costs ρ into cover image X to generate stego image Y by solving the following optimization problem:(3)minπEπD=∑i=1n∑si∈ℐiπisiρisi,(4)Subjected toHπ=−∑i=1n∑si∈ℐiπisilog2πisi=m,where si denote the modification patterns for pixel in i location and ρisi denote the cost with modification pattern si for ith cover element. D represents the sum of the costs with certain modification pattern s=s1,s2,…,sn for cover image, that is,(5)Ds=∑i=1nρisi,where πisi denotes the probability of modifying the ith cover element. While solving the optimization problem shown in equation (3) with Lagrangian multiplier [25], the optimal probability of modification for each element is obtained:(6)πisi=exp−λρisi∑si′∈ℐiexp−λρisi′,where λ>0 is a scalar parameter determined by equation (4). The optimal probability above is the best mapping from the modification probability to the cost and has been proven to have a Gibbs distribution [26].


## 2.5. The Sources of Extraction Errors in Recompression Channels Transmission

To further improve the robustness of adaptive steganography, lots of previous works have analyzed the sources of message extraction errors. In [27], Bao et al. proposed an error model that mathematically analyzes the error diffusion phenomenon of STCs. The approximate bit error probability of extracted message deduced in [27] implies that the larger values of h and w take the higher error probability of extracted message. In other words, the increase of submatrix height h and the decrease of relative payload α reduce the correct rate of message extraction in steganography since the width of submatrix can be calculated as w=⌊1/α⌋ in STCs.Furthermore, when a JPEG format stego image is transmitted in the recompression channel, bit errors will be generated in the extracted message for the changes of DCT coefficients. In modern JPEG steganography, the rate of modification is typically lower than the rate of embedding, i.e., relative payload, as a result of the matrix coding. Table1 provides the statistical results of the number of modified coefficients per block using STCs with J-UNIWARD, where 4096000 samples of the DCT block partitioned from JPEG images of the ALASKA-JSMALL dataset (ALASKA-JSMALL dataset is obtained from RAW format images of the ALASKA database [28]. After center-cropped and rescaled to the size of 512 × 512, the format of which is converted to JPEG with different quality factors.) are adopted. The average and standard deviation of modification number, denoted as μ and σ, respectively, represent that no more than 2 coefficients per block are modified by the adaptive steganographic scheme on average when the quality factor is lower than 85.Table 1
The number of modified coefficients under different relative payloads and quality factors using STCs with J-UNIWARD.
0.2 bpnzAC0.4 bpnzACμσμσQF = 750.359 71.003 80.793 81.688 3QF = 800.422 41.098 40.932 91.854 3QF = 850.511 31.238 51.126 22.088 8


## 3. Measurement Model of Robustness

### 3.1. Change Properties of DCT Block after Recompression

As discussed in Section2.2, images are partitioned into blocks of 8×8 pixels in the lossy procedure of JPEG compression. As a result, the DCT block is selected as the basic unit of research on the change properties of JPEG image coefficients after recompression.To investigate the change properties of the JPEG recompressed DCT block, simulated±1 modifications are directly operated on randomly selected coefficients in each DCT block. The simulation is performed on 409600 samples of 3-channel DCT block generated from the ALASKA-JSMALL dataset with quality factor of 75, 80, and 85. The recompression channel is established with MozJPEG (MozJPEG is a patch for libJPEG-turbo that improves JPEG compression efficiency achieving higher visual quality and smaller file sizes at the same time. MozJPEG can be explored on https://github.com/mozilla/mozjpeg) which is widely used by SNPs in the real world. The number of modified coefficients is in the range of 1–9 according to results in Section 2.5 and the theorem of large numbers. To obtain more complete statistical results, operations on each block are repeatedly conducted for 30 times. As shown in Figure 3, the average percentage of changed coefficients per block after recompression, denoted as pc, and is monotonically increasing with the number of modified coefficients per block nm.Figure 3
The average number of the changed coefficients after JPEG recompression over DCT blocks of 100 JPEG images sized512×512 under different numbers of modification on each block.Furthermore, the average and standard derivation ofpc overall nm from Figure 3 are calculated and given in Table 2, which implies that pc remains almost constant as nm increases since the standard derivation of pc is less than 0.05%. As a result, the average percentage of changed coefficients after JPEG recompression can approximately represent the change properties of the DCT block.Table 2
The average and standard deviation of the percentage of changed coefficients over different rates of modification that demonstrated in Figure3.
QF = 75QF = 80QF = 85Average (%)0.207 00.230 60.305 2Std. dev. (%)0.046 70.041 90.051 7


### 3.2. The Model of Robustness Measurement

Since the JPEG compression procedure is nonlinear, the mathematical model of the recompression process in the analytical form can be highly sophisticated. In other words, the heuristic designed features can hardly represent the change properties of the DCT block before and after the JPEG recompression. Nevertheless, deep learning-based methods have achieved start-of-the-art performance in many fields, especially those related to image and video processing. For image compression, lots of works have been proposed [29–31] with the structure of autoencoders that performed better than classic schemes, which indicates that it is operable to design a deep learning-based model to extract features of JPEG recompression channel.Since the transcoding procedure between DCT and spatial coefficients is nonlinear, the robustness measurement model is designed to fit the coefficient change rate with generality and nonlinearity. Therefore, the coefficients of both DCT and spatial domain are inputted with two separate branches, and nonlinear activation functions are introduced in the model. Figure4 shows the structure of the proposed model. The first branch, named D-branch, is designed for extracting the change features of DCT coefficients di in zig-zag order, while the S-branch aims at catching information of the block in spatial domain, which is denoted as si. The features extracted by two branches are concatenated and activated by the TanH function for limiting the range of output before fed into the last pipeline. Batch normalization are utilized, and the activation function ReLU and leaky ReLU are introduced to improve the nonlinearity of the model. Dropout layers are also used after activation layers to overcome overfitting.Figure 4
Structure of the proposed robustness measurement model. The parameter of convolutional layers and fully connected layers are labeled on each block. “TanH” and “Leaky ReLU” represent the activation function Tanh and leaky ReLU. Generally, ReLU activation functions are not labeled.As the figure shows,ηi is one of the outputs that represents the average percentage of the changed coefficient in the DCT block after JPEG recompression, while ξi denotes the percentage of the change in block without any modification. It is worth mentioning that no activation function is adopted at the end of the output layers because the proposed model is designed for solving the regression problem.In the training stage, 409600 samples in total are generated from the ALASKA-JSMALL dataset. Images are partitioned into blocks and of which the coefficients are randomly modified with different rates of modification for 30 times. Considering both the rate of modification and the accuracy of the generated samples, the numbers of modified coefficients in the experiment are all integers and range from 1 to 9.In terms of the hyperparameters, the dropout rates are set to 0.25 in both feature extraction branches while 0.4 in other dropout layers. The negative slope of each leaky ReLU layer is set to 0.2. Adam optimizer is used with learning rate 0.000 1, and mini-batch gradient descent strategy is adopted with size 64. The loss function, which is defined asl=α⋅lη+β⋅lξ, is used for network optimization, where lη and lξ are the loss of outputs ηi and ξi, respectively. Considering the properties of the DCT block both with and without recompression, α and β are all set to 0.5. MSE (mean square error) function is also used for fitting both ηi and ξi. The proposed model is trained for 100 epochs. All the training procedures are conducted on NVIDIA Tesla P100 GPU with 12 GB graphics memory.


### 3.3. Performance of the Robustness Measurement Model

Figure5 shows the loss of training and validating stage, where the model converges rapidly at around 5th epoch. The loss of the model decreases with training and stabilizes at a small value. Therefore, the proposed model can efficiently estimate the robustness of the DCT block and provide high accuracy performance in quantitative analysis of robustness.Figure 5
The average mean square error loss of the model in training and validating stage. The JPEG samples with quality factor of 85 are trained for 100 epochs.


## 3.1. Change Properties of DCT Block after Recompression

As discussed in Section2.2, images are partitioned into blocks of 8×8 pixels in the lossy procedure of JPEG compression. As a result, the DCT block is selected as the basic unit of research on the change properties of JPEG image coefficients after recompression.To investigate the change properties of the JPEG recompressed DCT block, simulated±1 modifications are directly operated on randomly selected coefficients in each DCT block. The simulation is performed on 409600 samples of 3-channel DCT block generated from the ALASKA-JSMALL dataset with quality factor of 75, 80, and 85. The recompression channel is established with MozJPEG (MozJPEG is a patch for libJPEG-turbo that improves JPEG compression efficiency achieving higher visual quality and smaller file sizes at the same time. MozJPEG can be explored on https://github.com/mozilla/mozjpeg) which is widely used by SNPs in the real world. The number of modified coefficients is in the range of 1–9 according to results in Section 2.5 and the theorem of large numbers. To obtain more complete statistical results, operations on each block are repeatedly conducted for 30 times. As shown in Figure 3, the average percentage of changed coefficients per block after recompression, denoted as pc, and is monotonically increasing with the number of modified coefficients per block nm.Figure 3
The average number of the changed coefficients after JPEG recompression over DCT blocks of 100 JPEG images sized512×512 under different numbers of modification on each block.Furthermore, the average and standard derivation ofpc overall nm from Figure 3 are calculated and given in Table 2, which implies that pc remains almost constant as nm increases since the standard derivation of pc is less than 0.05%. As a result, the average percentage of changed coefficients after JPEG recompression can approximately represent the change properties of the DCT block.Table 2
The average and standard deviation of the percentage of changed coefficients over different rates of modification that demonstrated in Figure3.
QF = 75QF = 80QF = 85Average (%)0.207 00.230 60.305 2Std. dev. (%)0.046 70.041 90.051 7


## 3.2. The Model of Robustness Measurement

Since the JPEG compression procedure is nonlinear, the mathematical model of the recompression process in the analytical form can be highly sophisticated. In other words, the heuristic designed features can hardly represent the change properties of the DCT block before and after the JPEG recompression. Nevertheless, deep learning-based methods have achieved start-of-the-art performance in many fields, especially those related to image and video processing. For image compression, lots of works have been proposed [29–31] with the structure of autoencoders that performed better than classic schemes, which indicates that it is operable to design a deep learning-based model to extract features of JPEG recompression channel.Since the transcoding procedure between DCT and spatial coefficients is nonlinear, the robustness measurement model is designed to fit the coefficient change rate with generality and nonlinearity. Therefore, the coefficients of both DCT and spatial domain are inputted with two separate branches, and nonlinear activation functions are introduced in the model. Figure4 shows the structure of the proposed model. The first branch, named D-branch, is designed for extracting the change features of DCT coefficients di in zig-zag order, while the S-branch aims at catching information of the block in spatial domain, which is denoted as si. The features extracted by two branches are concatenated and activated by the TanH function for limiting the range of output before fed into the last pipeline. Batch normalization are utilized, and the activation function ReLU and leaky ReLU are introduced to improve the nonlinearity of the model. Dropout layers are also used after activation layers to overcome overfitting.Figure 4
Structure of the proposed robustness measurement model. The parameter of convolutional layers and fully connected layers are labeled on each block. “TanH” and “Leaky ReLU” represent the activation function Tanh and leaky ReLU. Generally, ReLU activation functions are not labeled.As the figure shows,ηi is one of the outputs that represents the average percentage of the changed coefficient in the DCT block after JPEG recompression, while ξi denotes the percentage of the change in block without any modification. It is worth mentioning that no activation function is adopted at the end of the output layers because the proposed model is designed for solving the regression problem.In the training stage, 409600 samples in total are generated from the ALASKA-JSMALL dataset. Images are partitioned into blocks and of which the coefficients are randomly modified with different rates of modification for 30 times. Considering both the rate of modification and the accuracy of the generated samples, the numbers of modified coefficients in the experiment are all integers and range from 1 to 9.In terms of the hyperparameters, the dropout rates are set to 0.25 in both feature extraction branches while 0.4 in other dropout layers. The negative slope of each leaky ReLU layer is set to 0.2. Adam optimizer is used with learning rate 0.000 1, and mini-batch gradient descent strategy is adopted with size 64. The loss function, which is defined asl=α⋅lη+β⋅lξ, is used for network optimization, where lη and lξ are the loss of outputs ηi and ξi, respectively. Considering the properties of the DCT block both with and without recompression, α and β are all set to 0.5. MSE (mean square error) function is also used for fitting both ηi and ξi. The proposed model is trained for 100 epochs. All the training procedures are conducted on NVIDIA Tesla P100 GPU with 12 GB graphics memory.


## 3.3. Performance of the Robustness Measurement Model

Figure5 shows the loss of training and validating stage, where the model converges rapidly at around 5th epoch. The loss of the model decreases with training and stabilizes at a small value. Therefore, the proposed model can efficiently estimate the robustness of the DCT block and provide high accuracy performance in quantitative analysis of robustness.Figure 5
The average mean square error loss of the model in training and validating stage. The JPEG samples with quality factor of 85 are trained for 100 epochs.


## 4. Proposed Framework

The proposed robust JPEG adaptive steganographic framework is shown in Figure6. In the framework, we first use the robustness measurement model to estimate the coefficient change rate of each DCT block after recompression. Then, DCT blocks with the available cover elements are selected by selection strategy. The messages are embedded by classic steganographic schemes, and the auxiliary information of selection is encoded with the coefficients in the chrominance channel. After receiving stego images from SNPs, the receiver can extract messages from reconstructed cover elements. We name our proposed framework cover block selection-based adaptive robust steganography (abbreviated to CBSRS). Each strategy will be explained in detail in the following subsections.Figure 6
The proposed robust steganographic framework. (a) The embedding procedure. (b) The extraction procedure.
(a)(b)


### 4.1. The Properties of Cover Selection

Defining the selection rateθ0<θ<1 as the ratio of selected block number to overall block number, the optimality of cover block selection is associated with the selection rate since the coding efficiency of STCs changes with the number of selected elements.For the security performance of steganography after selection, the average classic distortion of steganographic embedding increases as the block selection is conducted. The smaller the selection rate, the greater the classic steganographic distortion. As a result, selecting the cover block according to the newly designed joint distortion function introduces navigate impact on security performance, and the optimal average classic distortion is unreachable for the element with top smallest costs cannot be selected.Concerning the robustness performance, adaptive steganography with only transmission costs defined as(7)ρkrsk=ηk,sk=0,ξk,sk=1,is discussed, where ηk and ξk are the predictions of the measurement model that, respectively, represent the robustness of the kth block with and without modification after JPEG recompression, and sk∈ℐ=0,1 is the modification pattern of DCT block, where si=1 denotes that the block is modified regardless of the number or the location of the modification, while si=0 denotes that the block is not modified. In this scenario, given m bits message sequence m and cover of b blocks x=x1,x2,⋯xb, the blockwise transmission costs are calculated as ρr=ρ1r,ρ2r,…,ρbr. The expectation of transmission costs is(8)EpD=∑i=1b∑si∈ℐpirsiρirsi,where ℐ=0,1. Referring to the optimal embedding theory in Section 2.4, the expectation of distortion has a minimal value only when the probability of modification on each block ρr follows Gibbs distribution. Assuming the number of embedded message bits is the same in each DCT block, the optimal probability of embedding satisfies(9)pirsi=exp−λρirsi∑si′∈ℐexp−λρirsi′,(10)m=−b⋅∑i=1b∑si∈ℐpirsilog2pirsi.When the cover block selection is conducted with given selection rateθ, b′=roundθb blocks are selected as x′ with costs ρr′=ρ1r′,ρ2r′,…,ρb′r′. To embed the same message m into selected cover blocks x′, the optimal expectation of distortion is calculated by(11)Ep′D′=∑i=1b′∑si∈ℐpir′siρir′si,where the optimal probability of modification satisfies(12)pir′si=exp−λρir′si∑si′∈ℐexp−λρir′si′,(13)m=−b′⋅∑i=1b′∑si∈ℐpir′silog2pir′si.As the selection rateθ ranges from 0 to 1, number of cover blocks b′<b. To satisfy both constrains in equations (10) and (13), for each cover block in both x and x′, since the optimal probability is a monotonic function of λ, we have(14)∑si∈ℐpirsilog2pirsi≥∑si∈ℐpir′silog2pir′si,which denotes that the entropy of each selected block increases after selection. According to the piecewise monotonicity of the binary entropy function, the probability of pir′0 and pir′1 changes closer to 0.5 after selection. As ρir0≡0, the expectation of embedding distortion Ep′D′ is smaller than EpD, which means that the cover block selection reduces the average distortion with optimal embedding.


### 4.2. Cover Block Selection Strategy

As discussed in Section2.5, the error of message extraction in recompression channels is introduced from decoding procedure of STCs. As a result, the anticompression properties of the DCT block determine the correct rate of extracted messages regardless of whether the DCT block is modified or not. This inspires us that steganographic encoding can be adopted in the DCT block with higher robustness performance. In other words, selecting cover block before embedding improves robustness of steganography.Since STCs are adopted, the candidate cover block can be also selected based on the cost of steganography. However, robustness and security performance are a pair of contradictions. To improve robustness through cover block selection while minimizing the security performance, in our framework, the measurement of robustness, regarded as transmission costs, is defined in equation (7) and used as the distortion of image lossy transmission that combined with the classic costs of steganography ρc.According to the discussion above, the orders of magnitude between two types of distortion function is different. Thus, the combination of transmission costs and the classic costs is defined in the form of multiplication. The joint distortion for cover block selection of each blockds is computed by(15)ds=dc⋅dr,where dc denotes the blockwise average of classic embedding distortion. In particular, let ρkc represent all the classic distortion in the kth DCT block. Before utilizing, ρkc is updated by(16)β⋅ρkc,ifρkr0<ρkr1,ρkc,otherwise,which demonstrates that steganographic embedding is encouraged if transmission cost under modification is smaller. Besides, dr represents the expectation of transmission costs of each block, which is(17)dkr=pkrρkr1+1−pkrρkr0,and pkr denotes the probability of modification of each block with the classic cost. Given the distortion of each coefficient in the j position of the kth DCT block ρjc, the optimal ±1 modification probability pjc satisfies Gibbs distribution and is calculated by(18)pjc=exp−λρjc2exp−λρjc+1,and pk is calculated by(19)pkr=1−∏j1−pjc.Based on the conclusion above, lower transmission cost and higher embedding cost are introduced by the cover block selection when the joint distortion function in equation (15) is used as the criteria. When the value of the selection rate θ is determined, θb blocks with the smallest joint distortion are selected as the cover element.Meanwhile, for a given JPEG cover image, different robustness and security performance are acquired with different selection rateθ. To obtain the optimal trade-off between robustness and security in cover block selection, we introduce gain function for the decision of parameter θ.Denoteℬk=j∣1≤j≤8 as the index set of the kth DCT block as zig-zag order. The expectation of classic costs Dc and transmission costs Dr without cover block selection are calculated by(20)Dc=∑k=1b∑j∈ℬkpjcρjc,Dr=∑k=1bpkrρkr1+1−pkrρkr0,which are defined as the standard expectation of distortion, where pic is the optimal modification probability in equation (6) under the classic costs and pkr denotes the modification probability of the kth block represented in equation (19). After block selection, b′ blocks are selected as cover and the expectation of two costs are changed to(21)Dc′θ=∑k=1b′∑j∈ℬkpjc′ρjc,Dr′θ=∑k=1b′pkr′ρkr1+1−pkr′ρkr0.Based on the discussion above, the optimal expectation of classic costs increases while the average distortion defined by transmission costs decreases. As a result, the gain function is defined as(22)Gθ=Dc′θ−DcDc+Dr′θ−DrDr.The optimal parameterθ0 can be obtained by optimizing the gain function(23)θ0=argmin0<θ<1Gθ,(24)Subjected toHθ0=−∑k=1b0∑j∈ℬkpjc′log2pjc′=m,where b0=roundθ0b is the number of selected blocks.In practice, to solving the optimization problem in equations (23) and (24), the optimal modification distribution of steganography pjc′ must be calculated first. However, the distribution pjc′ can be obtained only when the element of cover is specified, which means the problem cannot be directly optimized. In the proposed framework, Gθ is numerically calculated, where θ∈0.2,0.3,…,0.8, and the suboptimal parameter can be obtained. The concrete method is described by Algorithm 1.Algorithm 1: Cover block selection algorithm.
Input: JPEG cover imageX, elementwise classic cost ρc, blockwise transmission cost ρrOutput: cover selection indicatorK(1)
For each DCT blockBk in X do(2)
forj=1to 64 do     // elementwise(3)
pjc←expλρjc/2expλρjc+1(4)
end(5)
pkc←1−∏j=1641−pjc     // blockwise(6)
dkc←1/64∑j=164ρjc(7)
ifρkr0<ρkr1then     // update(8)
dkc=0.7⋅dkc(9)
end(10)
dkr←pkrρkr1+1−pkrρkr0(11)
dks←dkc⋅dkr     // joint cost(12)
end(13)
Dc←ρc,ρc,lexpection_cost(14)
Dr←ρr,ρc,lexpection_cost_r(15)
for eachθ in 0.2,0.3,…,0.8do(16)
Dc′←ρc,ρc,θexpection_cost_c(17)
Dr′←ρr,ρc,θexpection_cost_r// calculate gain function(18)
Gθ←Dc′θ−Dc/Dc+Dr′θ−Dr/Dr(19)
end(20)
θ0←argminθGθ     // suboptimal(21)
K←block_selection (thresholdX,θ0)As for the value of update parameterβ, few experiments are conducted on the BOSSBase dataset [32] for steganographic statistical security and robustness performance, which is shown in Figure 7. P¯E denotes the average detection error of the DCTR (discrete cosine transform residual) [8] extractor and R¯E represents the average error rate of message extraction. With the decrease of the value of β, the robustness performance improves while the statistical security declines markedly. To improve the robustness within the acceptable range of security performance, β=0.7 is determined in our work.Figure 7
Security and robustness performance of CBSRS with different values of parameterβ.


### 4.3. Construction of Shareable Cover

For the sender of adaptive steganography, cover block selection improves the robustness performance. However, the auxiliary information about the selected block is nonshared with the receiver. To complete the steganographic channel, the shareable cover between the sender and receiver needs to be constructed. Classic JPEG steganography mainly focuses on the luminance channel while keeping the chrominance unmodified. Actually, DCT coefficients in the chrominance channel also have the capacity to carry messages. Therefore, the auxiliary information can be encoded into the chrominance channel.In this study, JPEG images without chrominance channel subsampling are discussed. The sign of DCT coefficient is utilized as the embedding domain and the STCs are adopted to minimize the impact of auxiliary information encoding. As the experiment conducted in [19] shows, the coefficients in the higher frequency domain perform more stable after recompression while providing less security after modification. Besides, the DCT coefficients may shrinks towards 0 during JPEG recompression [33]. Since the relative payload of auxiliary information is low, the 5 AC coefficients at the lowest frequency are used for embedding.Redefiningℬk=i,j|1≤i,j≤8 as the index of rows and columns of coefficients in separate DCT blocks, in the proposed strategy, the cover element xi,jk can be formulated by(25)xi,jk=1,ifci,jk>0,0,ifci,jk<0,imod2,ifci,jk=0,.where ci,jk denotes the DCT coefficient of i,j position in kth block. The modification distance is defined as(26)hi,jk=q0−ci,jk,ifci,jk>0−q0−ci,jk,ifci,jk<0∞,ifci,jk=0.The unit cost of each coefficientρi,jk is calculated by the distortion function of J-UNIWARD, and the embedding cost ζi,jk is calculated by(27)ζi,jk=hi,jk⋅ρi,jk.where the multiplication is operated elementwise. These denote that cover element flipping will change the coefficient to the magnitude of q0 with opposite sign and the zero valued coefficients will remain unchanged.Besides, to ensure the integrity of auxiliary information, RS codes are adopted with bit-interleaved coding instead of random shuffle, which further improves the integrity of auxiliary information. The performance of cover reconstruction accuracy is discussed in Section5.4.


## 4.1. The Properties of Cover Selection

Defining the selection rateθ0<θ<1 as the ratio of selected block number to overall block number, the optimality of cover block selection is associated with the selection rate since the coding efficiency of STCs changes with the number of selected elements.For the security performance of steganography after selection, the average classic distortion of steganographic embedding increases as the block selection is conducted. The smaller the selection rate, the greater the classic steganographic distortion. As a result, selecting the cover block according to the newly designed joint distortion function introduces navigate impact on security performance, and the optimal average classic distortion is unreachable for the element with top smallest costs cannot be selected.Concerning the robustness performance, adaptive steganography with only transmission costs defined as(7)ρkrsk=ηk,sk=0,ξk,sk=1,is discussed, where ηk and ξk are the predictions of the measurement model that, respectively, represent the robustness of the kth block with and without modification after JPEG recompression, and sk∈ℐ=0,1 is the modification pattern of DCT block, where si=1 denotes that the block is modified regardless of the number or the location of the modification, while si=0 denotes that the block is not modified. In this scenario, given m bits message sequence m and cover of b blocks x=x1,x2,⋯xb, the blockwise transmission costs are calculated as ρr=ρ1r,ρ2r,…,ρbr. The expectation of transmission costs is(8)EpD=∑i=1b∑si∈ℐpirsiρirsi,where ℐ=0,1. Referring to the optimal embedding theory in Section 2.4, the expectation of distortion has a minimal value only when the probability of modification on each block ρr follows Gibbs distribution. Assuming the number of embedded message bits is the same in each DCT block, the optimal probability of embedding satisfies(9)pirsi=exp−λρirsi∑si′∈ℐexp−λρirsi′,(10)m=−b⋅∑i=1b∑si∈ℐpirsilog2pirsi.When the cover block selection is conducted with given selection rateθ, b′=roundθb blocks are selected as x′ with costs ρr′=ρ1r′,ρ2r′,…,ρb′r′. To embed the same message m into selected cover blocks x′, the optimal expectation of distortion is calculated by(11)Ep′D′=∑i=1b′∑si∈ℐpir′siρir′si,where the optimal probability of modification satisfies(12)pir′si=exp−λρir′si∑si′∈ℐexp−λρir′si′,(13)m=−b′⋅∑i=1b′∑si∈ℐpir′silog2pir′si.As the selection rateθ ranges from 0 to 1, number of cover blocks b′<b. To satisfy both constrains in equations (10) and (13), for each cover block in both x and x′, since the optimal probability is a monotonic function of λ, we have(14)∑si∈ℐpirsilog2pirsi≥∑si∈ℐpir′silog2pir′si,which denotes that the entropy of each selected block increases after selection. According to the piecewise monotonicity of the binary entropy function, the probability of pir′0 and pir′1 changes closer to 0.5 after selection. As ρir0≡0, the expectation of embedding distortion Ep′D′ is smaller than EpD, which means that the cover block selection reduces the average distortion with optimal embedding.


## 4.2. Cover Block Selection Strategy

As discussed in Section2.5, the error of message extraction in recompression channels is introduced from decoding procedure of STCs. As a result, the anticompression properties of the DCT block determine the correct rate of extracted messages regardless of whether the DCT block is modified or not. This inspires us that steganographic encoding can be adopted in the DCT block with higher robustness performance. In other words, selecting cover block before embedding improves robustness of steganography.Since STCs are adopted, the candidate cover block can be also selected based on the cost of steganography. However, robustness and security performance are a pair of contradictions. To improve robustness through cover block selection while minimizing the security performance, in our framework, the measurement of robustness, regarded as transmission costs, is defined in equation (7) and used as the distortion of image lossy transmission that combined with the classic costs of steganography ρc.According to the discussion above, the orders of magnitude between two types of distortion function is different. Thus, the combination of transmission costs and the classic costs is defined in the form of multiplication. The joint distortion for cover block selection of each blockds is computed by(15)ds=dc⋅dr,where dc denotes the blockwise average of classic embedding distortion. In particular, let ρkc represent all the classic distortion in the kth DCT block. Before utilizing, ρkc is updated by(16)β⋅ρkc,ifρkr0<ρkr1,ρkc,otherwise,which demonstrates that steganographic embedding is encouraged if transmission cost under modification is smaller. Besides, dr represents the expectation of transmission costs of each block, which is(17)dkr=pkrρkr1+1−pkrρkr0,and pkr denotes the probability of modification of each block with the classic cost. Given the distortion of each coefficient in the j position of the kth DCT block ρjc, the optimal ±1 modification probability pjc satisfies Gibbs distribution and is calculated by(18)pjc=exp−λρjc2exp−λρjc+1,and pk is calculated by(19)pkr=1−∏j1−pjc.Based on the conclusion above, lower transmission cost and higher embedding cost are introduced by the cover block selection when the joint distortion function in equation (15) is used as the criteria. When the value of the selection rate θ is determined, θb blocks with the smallest joint distortion are selected as the cover element.Meanwhile, for a given JPEG cover image, different robustness and security performance are acquired with different selection rateθ. To obtain the optimal trade-off between robustness and security in cover block selection, we introduce gain function for the decision of parameter θ.Denoteℬk=j∣1≤j≤8 as the index set of the kth DCT block as zig-zag order. The expectation of classic costs Dc and transmission costs Dr without cover block selection are calculated by(20)Dc=∑k=1b∑j∈ℬkpjcρjc,Dr=∑k=1bpkrρkr1+1−pkrρkr0,which are defined as the standard expectation of distortion, where pic is the optimal modification probability in equation (6) under the classic costs and pkr denotes the modification probability of the kth block represented in equation (19). After block selection, b′ blocks are selected as cover and the expectation of two costs are changed to(21)Dc′θ=∑k=1b′∑j∈ℬkpjc′ρjc,Dr′θ=∑k=1b′pkr′ρkr1+1−pkr′ρkr0.Based on the discussion above, the optimal expectation of classic costs increases while the average distortion defined by transmission costs decreases. As a result, the gain function is defined as(22)Gθ=Dc′θ−DcDc+Dr′θ−DrDr.The optimal parameterθ0 can be obtained by optimizing the gain function(23)θ0=argmin0<θ<1Gθ,(24)Subjected toHθ0=−∑k=1b0∑j∈ℬkpjc′log2pjc′=m,where b0=roundθ0b is the number of selected blocks.In practice, to solving the optimization problem in equations (23) and (24), the optimal modification distribution of steganography pjc′ must be calculated first. However, the distribution pjc′ can be obtained only when the element of cover is specified, which means the problem cannot be directly optimized. In the proposed framework, Gθ is numerically calculated, where θ∈0.2,0.3,…,0.8, and the suboptimal parameter can be obtained. The concrete method is described by Algorithm 1.Algorithm 1: Cover block selection algorithm.
Input: JPEG cover imageX, elementwise classic cost ρc, blockwise transmission cost ρrOutput: cover selection indicatorK(1)
For each DCT blockBk in X do(2)
forj=1to 64 do     // elementwise(3)
pjc←expλρjc/2expλρjc+1(4)
end(5)
pkc←1−∏j=1641−pjc     // blockwise(6)
dkc←1/64∑j=164ρjc(7)
ifρkr0<ρkr1then     // update(8)
dkc=0.7⋅dkc(9)
end(10)
dkr←pkrρkr1+1−pkrρkr0(11)
dks←dkc⋅dkr     // joint cost(12)
end(13)
Dc←ρc,ρc,lexpection_cost(14)
Dr←ρr,ρc,lexpection_cost_r(15)
for eachθ in 0.2,0.3,…,0.8do(16)
Dc′←ρc,ρc,θexpection_cost_c(17)
Dr′←ρr,ρc,θexpection_cost_r// calculate gain function(18)
Gθ←Dc′θ−Dc/Dc+Dr′θ−Dr/Dr(19)
end(20)
θ0←argminθGθ     // suboptimal(21)
K←block_selection (thresholdX,θ0)As for the value of update parameterβ, few experiments are conducted on the BOSSBase dataset [32] for steganographic statistical security and robustness performance, which is shown in Figure 7. P¯E denotes the average detection error of the DCTR (discrete cosine transform residual) [8] extractor and R¯E represents the average error rate of message extraction. With the decrease of the value of β, the robustness performance improves while the statistical security declines markedly. To improve the robustness within the acceptable range of security performance, β=0.7 is determined in our work.Figure 7
Security and robustness performance of CBSRS with different values of parameterβ.


## 4.3. Construction of Shareable Cover

For the sender of adaptive steganography, cover block selection improves the robustness performance. However, the auxiliary information about the selected block is nonshared with the receiver. To complete the steganographic channel, the shareable cover between the sender and receiver needs to be constructed. Classic JPEG steganography mainly focuses on the luminance channel while keeping the chrominance unmodified. Actually, DCT coefficients in the chrominance channel also have the capacity to carry messages. Therefore, the auxiliary information can be encoded into the chrominance channel.In this study, JPEG images without chrominance channel subsampling are discussed. The sign of DCT coefficient is utilized as the embedding domain and the STCs are adopted to minimize the impact of auxiliary information encoding. As the experiment conducted in [19] shows, the coefficients in the higher frequency domain perform more stable after recompression while providing less security after modification. Besides, the DCT coefficients may shrinks towards 0 during JPEG recompression [33]. Since the relative payload of auxiliary information is low, the 5 AC coefficients at the lowest frequency are used for embedding.Redefiningℬk=i,j|1≤i,j≤8 as the index of rows and columns of coefficients in separate DCT blocks, in the proposed strategy, the cover element xi,jk can be formulated by(25)xi,jk=1,ifci,jk>0,0,ifci,jk<0,imod2,ifci,jk=0,.where ci,jk denotes the DCT coefficient of i,j position in kth block. The modification distance is defined as(26)hi,jk=q0−ci,jk,ifci,jk>0−q0−ci,jk,ifci,jk<0∞,ifci,jk=0.The unit cost of each coefficientρi,jk is calculated by the distortion function of J-UNIWARD, and the embedding cost ζi,jk is calculated by(27)ζi,jk=hi,jk⋅ρi,jk.where the multiplication is operated elementwise. These denote that cover element flipping will change the coefficient to the magnitude of q0 with opposite sign and the zero valued coefficients will remain unchanged.Besides, to ensure the integrity of auxiliary information, RS codes are adopted with bit-interleaved coding instead of random shuffle, which further improves the integrity of auxiliary information. The performance of cover reconstruction accuracy is discussed in Section5.4.


## 5. Experiments

### 5.1. Experimental Setups

The experiments for performance analysis are all conducted on images in JPEG format center-cropped and resized to the size of512×512, which are converted from the RAW format BOSSBase [32] dataset. Adaptive steganographic schemes are utilized in the proposed framework. The ternary multilayered version of STCs is used with the parameter h fixed of 3 for the best performance of robustness. Baseline algorithms JCRISBE [21] and GMAS [19] are selected as well as classic steganographic schemes J-UNIWARD [4] to compare with the proposed CBSRS framework, since JCRISBE and GMAS are the representative algorithms of the dedicated robustness and general robustness, respectively. Besides, the samples with quality factor of 75, 80, and 85 are evaluated for the SNPs will not transcode images with low quality. All the JPEG recompression procedures in the experiments are implemented with MozJPEG, and all samples are in color.To evaluate the security performance, the ensemble classifier [34] is trained to discriminate the cover and stego samples. High-dimensional features are extracted from the samples and randomly divided into two groups. Half of the features are input into the classifier for training, while the others are used for testing. The performance of steganalysis is evaluated by the detection error of the classifier, which is defined as(28)PE=12PFA+PMD,where PFA and PMD are the probability of false alarm and missed detection rate, respectively. Practically, the evaluation is conducted 10 times, and the average output of multiple tests, denoted as P¯E, is adopted as the final result. In the experiments, the DCTR and PHARM (PHase Aware pRojection Model) [7] feature extractor are utilized.Furthermore, the error rate of the extracted secret message is calculated by(29)RE=nEm,where m represents the original embedded secret message and m is the length of bit of m, and nE represents the number of bit error of extracted secret message. Note that the payload mentioned in the experiments denotes the original embedding rate calculated by the length of not encoded secret message.


### 5.2. Robustness Performance of the Proposed Framework

To demonstrate the effectiveness of cover block selection strategy, the robustness is evaluated by the bit error of message extraction defined by equation (29). All the sample images from BOSSBase 1.01 are utilized, which are converted to JPEG format with the size of 512×512. Chrominance subsampling is disabled during the cover image conversion process. Stego samples are generated with payloads of 0.05, 0.1, 0.2, and 0.3 bpnzAC for comprehensive evaluation.As Figure8 shows, no matter under any relative payload, the proposed CBSRS framework significantly improves the robustness under the lossy channel constructed by MozJPEG. And the compare result shows that the classic steganographic schemes are not capable of covert communication under JPEG recompression channel.Figure 8
Average extraction error rate of the classic J-UNIWARD algorithm and the proposed CBSRS framework over 10,000 cover images of quality factor of 85.To further illustrate the effectiveness of the proposed CBSRS framework, the state-of-the-art robust steganographic schemes JCRISBE and GMAS are compared. The function imread and imwrite from MATLAB are utilized in the transport channel matching procedure of JCRISBE. Note that RS codes or BCH codes are adopted in JCRISBE and GMAS, but no ECCs are used in CBSRS framework. Table3 provides the result of extraction error rate of different steganographic schemes. Compared with the classic scheme, the robustness performance of these robust steganographic schemes is improved to varying degrees. While, GMAS outperforms other algorithms in the class of dedicated robustness as watermarking modulation mode is adopted.Table 3
The bit error rate of message extraction with different steganographic schemes under different actual payloads.
MethodPayload (bpnzAC)0.050.10.20.3J-UNIWARD [4]QF = 750.215 00.148 10.094 20.070 5QF = 800.255 80.180 20.116 70.087 8QF = 850.261 80.182 10.116 70.087 1JSCRIBE [21]QF = 750.166 70.108 10.063 40.043 4QF = 800.166 30.105 60.060 90.041 0QF = 850.181 60.115 30.066 50.044 6GMAS [19]QF = 750.084 10.041 70.020 90.004 5QF = 800.079 50.039 90.020 60.003 9QF = 850.074 80.039 10.018 50.003 4CBSRS (ours)QF = 750.111 60.078 80.052 50.041 1QF = 800.110 40.072 50.046 90.035 9QF = 850.103 00.069 40.045 80.035 3As for dedicated robustness, the extraction error rate of JCRISBE is higher than which of the CBSRS framework especially when at the lower relative payload, which denotes that the robustness performance will decrease when the channel is not completely matched in JCRISBE. However, CBSRS is designed by mastering the recompression properties of aimed lossy channel. For robustness, the proposed CBSRS framework performs better than the baseline algorithm of the class of dedicated robustness.


### 5.3. Security Performance Comparison

In this experiment, security performance is evaluated by using the detection error defined in equations (10) and (28) and converted images in color JPEG format from BOSSBase are utilized. To compare the statistical security with the steganographic algorithms, only steganalytic features of luminance channel are extracted. Figures 9–11 show the security performance of the proposed CBSRS and compared schemes. The statistical result of J-UNIWARD is also presented as the baseline of steganalytic security.Figure 9
The detection error of the steganalysis detector under different steganographic algorithms with quality factor of 75. (a) Security performance with DCTR features. (b) Security performance with PHARM features.
(a)(b)Figure 10
The detection error of the steganalysis detector under different steganographic algorithms with quality factor of 80. (a) Security performance with DCTR features. (b) Security performance with PHARM features.
(a)(b)Figure 11
The detection error of the steganalysis detector under different steganographic algorithms with quality factor of 85. (a) Security performance with DCTR features. (b) Security performance with PHARM features.
(a)(b)Since the amplitude of modification is large, the steganographic security of the GMAS scheme is quite unsatisfactory when comparing with other dedicated robustness schemes. However, both JCRISBE and CBSRS basically maintain the statistical security while providing robustness of steganography. However, the proposed CBSRS framework surpasses the state-of-the-art robust steganographic scheme for statistical security since the ECCs are adopted in JCRISBE. The experimental results demonstrate that the model of proposed robustness measurement is effective, and the strategy of cover block selection is capable of optimizing the trade-off between the robustness and the security of steganography.Besides, the position distribution of modification of each steganographic scheme is investigated. As shown in Figure12, the modification position of the proposed CBSRS scheme is more concentrated than which of other schemes. Therefore, the affected area of steganographic noise in the image is smaller which contributes to the high statistical security.Figure 12
Two cover examples, i.e., (a) No. 10 and (e) No. 6222 in BOSSBase and the corresponding modification position in spatial domain generated by J-UNIWARD, i.e., (b) and (f), GMAS, i.e., (c) and (g), and CBSRS, i.e., (d) and (h) for relative payload 0.3 bpnzAC with quality factor of 85 and STCs, respectively. In this subsection, the accuracy of the cover reconstruction is evaluated. For the cover images size512×512, 4096 bit indicators are required to reconstruct the location of the cover element. To decrease the size of auxiliary information and increase the accuracy of the cover reconstruction, the indicators of each block are quantized in each 2×2 units for the robustness distribution in natural images continuous with the image content. Meanwhile, (31, 15) RS codes are adopted with bit-interleaved coding to further reduce the extraction error rate. Thus, 2,170 bit auxiliary information is encoded with the chrominance channel of each cover image in the experiment.
(a)(b)(c)(d)(e)(f)(g)(h)


### 5.4. Accuracy of Cover Reconstruction

The experimental results of both the reconstruct successful rate and the bit error rate of auxiliary information are given in Table4. The successful reconstruct rate is considerable especially at the higher quality factor of channel. This is because the lower quantization step provides higher accuracy of sign-based stego element. Besides, the average information error rate maintains low and increases with relative payload, which denotes that steganographic embedding in the luminance channel of JPEG affects the robustness of element in the chrominance channel. As a result, the coefficient sign-based cover reconstruction strategy is effective in recompression channel.Table 4
The experimental results of cover reconstruction accuracy.
Payload (bpnzAC)Successful decode rateInformation error rateQF = 75QF = 80QF = 85QF = 75QF = 80QF = 850.050.84800.91740.95960.07680.04070.01810.10.84350.91520.95810.08310.04440.02220.20.84610.91640.95810.09050.04820.02310.30.84300.91580.95860.09670.05120.0244


## 5.1. Experimental Setups

The experiments for performance analysis are all conducted on images in JPEG format center-cropped and resized to the size of512×512, which are converted from the RAW format BOSSBase [32] dataset. Adaptive steganographic schemes are utilized in the proposed framework. The ternary multilayered version of STCs is used with the parameter h fixed of 3 for the best performance of robustness. Baseline algorithms JCRISBE [21] and GMAS [19] are selected as well as classic steganographic schemes J-UNIWARD [4] to compare with the proposed CBSRS framework, since JCRISBE and GMAS are the representative algorithms of the dedicated robustness and general robustness, respectively. Besides, the samples with quality factor of 75, 80, and 85 are evaluated for the SNPs will not transcode images with low quality. All the JPEG recompression procedures in the experiments are implemented with MozJPEG, and all samples are in color.To evaluate the security performance, the ensemble classifier [34] is trained to discriminate the cover and stego samples. High-dimensional features are extracted from the samples and randomly divided into two groups. Half of the features are input into the classifier for training, while the others are used for testing. The performance of steganalysis is evaluated by the detection error of the classifier, which is defined as(28)PE=12PFA+PMD,where PFA and PMD are the probability of false alarm and missed detection rate, respectively. Practically, the evaluation is conducted 10 times, and the average output of multiple tests, denoted as P¯E, is adopted as the final result. In the experiments, the DCTR and PHARM (PHase Aware pRojection Model) [7] feature extractor are utilized.Furthermore, the error rate of the extracted secret message is calculated by(29)RE=nEm,where m represents the original embedded secret message and m is the length of bit of m, and nE represents the number of bit error of extracted secret message. Note that the payload mentioned in the experiments denotes the original embedding rate calculated by the length of not encoded secret message.


## 5.2. Robustness Performance of the Proposed Framework

To demonstrate the effectiveness of cover block selection strategy, the robustness is evaluated by the bit error of message extraction defined by equation (29). All the sample images from BOSSBase 1.01 are utilized, which are converted to JPEG format with the size of 512×512. Chrominance subsampling is disabled during the cover image conversion process. Stego samples are generated with payloads of 0.05, 0.1, 0.2, and 0.3 bpnzAC for comprehensive evaluation.As Figure8 shows, no matter under any relative payload, the proposed CBSRS framework significantly improves the robustness under the lossy channel constructed by MozJPEG. And the compare result shows that the classic steganographic schemes are not capable of covert communication under JPEG recompression channel.Figure 8
Average extraction error rate of the classic J-UNIWARD algorithm and the proposed CBSRS framework over 10,000 cover images of quality factor of 85.To further illustrate the effectiveness of the proposed CBSRS framework, the state-of-the-art robust steganographic schemes JCRISBE and GMAS are compared. The function imread and imwrite from MATLAB are utilized in the transport channel matching procedure of JCRISBE. Note that RS codes or BCH codes are adopted in JCRISBE and GMAS, but no ECCs are used in CBSRS framework. Table3 provides the result of extraction error rate of different steganographic schemes. Compared with the classic scheme, the robustness performance of these robust steganographic schemes is improved to varying degrees. While, GMAS outperforms other algorithms in the class of dedicated robustness as watermarking modulation mode is adopted.Table 3
The bit error rate of message extraction with different steganographic schemes under different actual payloads.
MethodPayload (bpnzAC)0.050.10.20.3J-UNIWARD [4]QF = 750.215 00.148 10.094 20.070 5QF = 800.255 80.180 20.116 70.087 8QF = 850.261 80.182 10.116 70.087 1JSCRIBE [21]QF = 750.166 70.108 10.063 40.043 4QF = 800.166 30.105 60.060 90.041 0QF = 850.181 60.115 30.066 50.044 6GMAS [19]QF = 750.084 10.041 70.020 90.004 5QF = 800.079 50.039 90.020 60.003 9QF = 850.074 80.039 10.018 50.003 4CBSRS (ours)QF = 750.111 60.078 80.052 50.041 1QF = 800.110 40.072 50.046 90.035 9QF = 850.103 00.069 40.045 80.035 3As for dedicated robustness, the extraction error rate of JCRISBE is higher than which of the CBSRS framework especially when at the lower relative payload, which denotes that the robustness performance will decrease when the channel is not completely matched in JCRISBE. However, CBSRS is designed by mastering the recompression properties of aimed lossy channel. For robustness, the proposed CBSRS framework performs better than the baseline algorithm of the class of dedicated robustness.


## 5.3. Security Performance Comparison

In this experiment, security performance is evaluated by using the detection error defined in equations (10) and (28) and converted images in color JPEG format from BOSSBase are utilized. To compare the statistical security with the steganographic algorithms, only steganalytic features of luminance channel are extracted. Figures 9–11 show the security performance of the proposed CBSRS and compared schemes. The statistical result of J-UNIWARD is also presented as the baseline of steganalytic security.Figure 9
The detection error of the steganalysis detector under different steganographic algorithms with quality factor of 75. (a) Security performance with DCTR features. (b) Security performance with PHARM features.
(a)(b)Figure 10
The detection error of the steganalysis detector under different steganographic algorithms with quality factor of 80. (a) Security performance with DCTR features. (b) Security performance with PHARM features.
(a)(b)Figure 11
The detection error of the steganalysis detector under different steganographic algorithms with quality factor of 85. (a) Security performance with DCTR features. (b) Security performance with PHARM features.
(a)(b)Since the amplitude of modification is large, the steganographic security of the GMAS scheme is quite unsatisfactory when comparing with other dedicated robustness schemes. However, both JCRISBE and CBSRS basically maintain the statistical security while providing robustness of steganography. However, the proposed CBSRS framework surpasses the state-of-the-art robust steganographic scheme for statistical security since the ECCs are adopted in JCRISBE. The experimental results demonstrate that the model of proposed robustness measurement is effective, and the strategy of cover block selection is capable of optimizing the trade-off between the robustness and the security of steganography.Besides, the position distribution of modification of each steganographic scheme is investigated. As shown in Figure12, the modification position of the proposed CBSRS scheme is more concentrated than which of other schemes. Therefore, the affected area of steganographic noise in the image is smaller which contributes to the high statistical security.Figure 12
Two cover examples, i.e., (a) No. 10 and (e) No. 6222 in BOSSBase and the corresponding modification position in spatial domain generated by J-UNIWARD, i.e., (b) and (f), GMAS, i.e., (c) and (g), and CBSRS, i.e., (d) and (h) for relative payload 0.3 bpnzAC with quality factor of 85 and STCs, respectively. In this subsection, the accuracy of the cover reconstruction is evaluated. For the cover images size512×512, 4096 bit indicators are required to reconstruct the location of the cover element. To decrease the size of auxiliary information and increase the accuracy of the cover reconstruction, the indicators of each block are quantized in each 2×2 units for the robustness distribution in natural images continuous with the image content. Meanwhile, (31, 15) RS codes are adopted with bit-interleaved coding to further reduce the extraction error rate. Thus, 2,170 bit auxiliary information is encoded with the chrominance channel of each cover image in the experiment.
(a)(b)(c)(d)(e)(f)(g)(h)


## 5.4. Accuracy of Cover Reconstruction

The experimental results of both the reconstruct successful rate and the bit error rate of auxiliary information are given in Table4. The successful reconstruct rate is considerable especially at the higher quality factor of channel. This is because the lower quantization step provides higher accuracy of sign-based stego element. Besides, the average information error rate maintains low and increases with relative payload, which denotes that steganographic embedding in the luminance channel of JPEG affects the robustness of element in the chrominance channel. As a result, the coefficient sign-based cover reconstruction strategy is effective in recompression channel.Table 4
The experimental results of cover reconstruction accuracy.
Payload (bpnzAC)Successful decode rateInformation error rateQF = 75QF = 80QF = 85QF = 75QF = 80QF = 850.050.84800.91740.95960.07680.04070.01810.10.84350.91520.95810.08310.04440.02220.20.84610.91640.95810.09050.04820.02310.30.84300.91580.95860.09670.05120.0244


## 6. Conclusion and Future Works

In this study, we propose a robust steganographic framework with the strategy of cover block selection, which are capable of resisting JPEG recompression while maintaining high steganographic security. Besides, a deep learning-based model for robustness measurement of DCT block is designed, and a joint distortion function of cover block selection is defined. The comparison results show that our proposed framework highly decreases the bit error rate under the lossy channel with the same quantization table while maintaining statistical security by mastering the properties of the lossy channel, and the CBSRS framework outperforms the state-of-the-art steganographic schemes in a specific lossy channel. Furthermore, a synchronous transmission strategy of block selection auxiliary information is investigated to construct shareable cover with sender and receiver, which builds up the first framework of auxiliary information-based robust steganography for JPEG images.In the future, the model of robustness measurement will be updated, and the proposed robust steganographic framework will be expanded to the lossy channel with different quantization tables. In addition, we will design a suitable error correction scheme to further improve the robustness of adaptive steganography.



---

*Source: 9153468-2021-12-18.xml*