Dig a Hole and Fill in Sand: Adversary and Hiding Decoupled Steganography

Authors: weixuan  tang
haoyu  yang
yuan  rao
zhili  zhou
fei  peng
Venue: acmmm_org_ACMMM_2024_Conference
Published: 2024-04-07 15:06:48

Abstract: Deep steganography is a technique that imperceptibly hides secret information into image by neural networks. Existing networks consist of two components, including a hiding component for information hiding and an adversary component for countering against steganalyzers.
However, these two components are two ends of the seesaw, and it is difficult to balance the tradeoff between message extraction accuracy and security performance by joint optimization. To address the issues, this paper proposes a steganographic method called AHDeS (Adversary-Hiding-Decoupled Steganography) under the Dig-and-Fill paradigm, wherein the adversary and hiding components can be decoupled into an optimization-based adversary module in the digging process and an INN-based hiding network in the filling process. Specfically in the training stage, the INN is first trained for acquiring the ability of message embedding. In the deployment stage, given the well-trained and fixed INN, the cover image is first iteratively optimized for enhancing the security performance against steganalyzers, followed by the actual message embedding by the INN. Owing to the reversibility of the INN, security performance can be enhanced without sacrificing message extraction accuracy. Experimental results show that AHDeS can achieve the state-of-the-art security performance and visual quality while maintaining satisfied message extraction accuracy.

Main paper: 
 related work 2.1 image steganography: 
 With the rapid development of deep learning technique, image steganographic methods based on deep learning have received great attention. Baluja [1] proposed the first deep image hiding method, wherein the secret image and cover image were concatenated and fed into the encoder to generate the stego image, and then stego image was fed into the decoder to reveal the secret image. Hayes et al. [14] introduced adversarial training into deep steganography, wherein the generator was utilized to generate stego image, and the discriminator was utilized to distinguish between cover and stego images. Zhu et al. [37] proposed HiDDeN, wherein the noise layer was introduced in the training stage to enhance the robustness of steganographic method. Zhang et al. [36] proposed SteganoGAN, wherein the residual and dense architecture was applied to improve the payload of steganographic method. Yu [34] proposed ABDH, wherein the attention mechanism was applied to find the inconspicuous areas of cover images. Zhang et al. [35] proposed UDH, wherein the secret image was projected as universal adversarial perturbation, and was embedded into the cover image in a coveragnostic manner. Tan et al. [25] proposed CHAT-GAN, where the channel attention mechanism was applied to improve the quality of stego image and the error-correcting algorithm was applied to improve the message extraction accuracy. The above methods are modification-based methods. Another type are generative methods, which generate stego according to latent noise by generative models, such as [5] . It maps secret message into latent noise without changing its distribution, and thus the distribution of stego and cover image (generated image without secret message) could be the same. Despite this, image quality for cover and stego images depends on the generative models, and poor image quality would raise suspicion. This paper focuses on modification-based methods. Dinh et al. proposed the concept of INN [7] , and designed the coupling layers to improve its representation ability [8] . Kingma et al. [17] proposed Glow, which utilized invertible 1 × 1 convolution to reverse the ordering of channels. Ouderaa et al. [28] proposed INN with low memory complexity in image-to-image translation task. Wang et al. [29] applied INN in digital image compression task, which reduced information loss. Xiao et al. [31] proposed to model the rescaling process as invertible transformation between high-resolution and low-resolution images. Ma et al. [22] incorporated INN into blind watermarking to learn the joint representation between watermark embedding and extraction.In recent years, INN has also been applied in the field of image steganography. Jing et al. [16] proposed HiNet, which implemented message hiding and extraction by the forward calculation and reverse calculation of INN. Lu et al. [21] also applied INN to the field of steganography. Guan et al. [12] proposed DeepMIH, which can sequentially hide multiple secret images under the guidance of importance map module. Lan et al. [18] proposed to hide secret information in the DCT domain of cover image and designed a mutual information loss to constrain the flow of information. 
dig-and-fill paradigm: 
 Existing deep steganographic methods consist of two essential components, including an adversary component for countering against steganalyzers and a hiding component for message embedding. In previous methods, the adversary and hiding components are jointly trained, which increase the optimization difficulties. To overcome the above limitation, the Dig-and-Fill paradigm is proposed, which can decouple these two components for independent optimization.Suppose that the task is to transport a specific volume of sand from the bucket to the beach while avoiding leaving obvious transportation traces on the beach. If the porter directly transports the sand, the beach surface would be severely changed and arouse suspicion, as shown in Fig. 1 (b ). However, if the porter has some prior knowledge of the sand to be transported, it is possible to transport the sand in an imperceptible manner. For example, if the porter knows the sand's volume, then the porter can dig a hole with equal volume in advance. Afterwards, the sand can be transported into such hole, and then the beach surface can be kept unchanged, as shown in Fig. 1 (c ). The key idea of such Dig-and-Fill paradigm is that if the filling process can be pre-determined, then the digging process can be settled according to the filling process, and the transportation behavior can be well hidden.In the field of image steganography, the task is to hide secret information into the cover image while maintaining the stego image undetected by steganalyzer. Under the Dig-and-Fill paradigm, the steganographer can first optimize the cover image in the digging process and then embed secret messages into the optimized cover image in the filling process. If the steganographer is fully aware of the hiding pattern in the filling process, then the steganographer can optimize the cover image in advance in the digging process, so that the optimized cover image embedded with secret messages can obtain satisfied security performance. By this means, the adversary and hiding components can be effectively decoupled into the digging and filling processes. The remaining challenge is to design a network via which can optimize the digging process while keeping the effect of filling process unchanged. 
proposed method 4.1 method overview: 
 Following the Dig-and-Fill paradigm, a steganographic method called AHDeS (Adversary-Hiding-Decoupled Steganography) is proposed, as shown in Fig. 2 . In AHDeS, the INN-based hiding network is first trained to acquiring the ability of message embedding, and then based on the well trained INN, the optimization-based adversary module is utilized to optimize the cover image for enhancing security performance in the digging process, followed by the actual message embedding by INN the filling process.Specifically, the INN is first trained to obtaining the ability of information hiding and extraction via forward calculation and reverse calculation, respectively. Such an INN is of dual-branch structure. In the forward calculation, it takes in the cover image C and the secret message M, and outputs the stego image S and the latent noise Z. In the reverse calculation, it takes in S and the randomly sampled latent noise Z, and outputs the reconstructed cover image C and the extracted secret message M. Benefiting from the reversible properties of INN, M is of great message extraction accuracy. Given the well-trained and fixed INN, the adversary module iteratively optimizes the perturbation P, which is added on the original cover image C 𝑜𝑟𝑖 to obtain the optimized cover image C 𝑜𝑝𝑡 . Such C 𝑜𝑝𝑡 is further fed into the fixed INN to obtain the stego image S. The perturbation P is iteratively optimized according to the frequency compensation mechanism, which tries to preserve the high-frequency components neglected by the fixed INN. The iteration ends until the stego image S can be classified as cover image with high confidence by a pre-trained CNN-based steganalyzer. Owing to the dual-branch structure and reversible properties of INN, perturbing the original cover image C 𝑜𝑟𝑖 can contribute to generating stego image S with higher anti-steganalysis ability in the forward calculation, and barely affect extracting secret messages M extremely close to M in the reverse calculation. Therefore, the optimization-based adversary module can enhance security performance against steganalyzers without sacrificing message extraction accuracy.The reversibility of INN is suitable for steganography task. It takes in the cover image C and the secret message M and outputs the stego image S and the latent noise Z asEQUATIONIn the reverse calculation, it takes in S and the randomly sampled latent noise Z, and outputs the reconstructed cover image C and extracted secret message M asEQUATIONSuch an INN consists of 16 invertible blocks. Specifically, the 𝑘-th block's affine transformation in forward calculation can be formulated asEQUATIONEQUATIONwhere C (1) = C, M (1) = M, C (17) = S, M (17) = Z. And the 𝑘-th block's affine transformation in reverse calculation can be formulated asEQUATIONEQUATIONwhere S (17) = S, Z (17) = Z, S (1) = C, Z (1) = M. Note that 𝜙, 𝜌, and 𝜂 denote 3 CNNs with same structure but different parameters.Cover image is denoted as C ∈ {0, ..., 255} 𝐻,𝑊 ,𝑁 . Binary bitstream is converted into three-dimensional format as M ∈ {0, 1} 𝐻,𝑊 ,𝑁 ′ . As for 1.0 bpp (bit per pixel), 𝑁 is equal to 𝑁 ′ . C and M are processed by DWT (Discrete Wavelet Transform) into size (𝐻 /2, 𝑊 /2, 4𝑁 ), and further fed into the INN.The loss function of INN is formulated asEQUATION)𝐿 𝑐𝑜𝑛 is the concealing loss that makes the stego image similar to the original cover image, and is formulated asEQUATION)𝐿 𝑟𝑒𝑣 is the revealing loss for successful message extraction, and is formulated asEQUATION)𝐿 𝑙𝑝 𝑓 is the low-pass-filter loss that tries to preserve the low frequency sub-band unchanged, and is formulated asEQUATIONwhere C 𝐿𝐿 and S 𝐿𝐿 denote the low frequency sub-band after wavelet decomposition for C 𝑜𝑟𝑖 and S, respectively.Benefitting from the dual branch structure and the reversibility of INN, from Eq. ( 1) and Eq. ( 2), it can be observed that given a fixed INN and in the ideal situation that Z and Z are the same, no matter what perturbation is added on the cover image, the extracted secret message M and the original secret message M would still be the same. Inspired by such property, the optimization-based adversary module is designed to enhance the anti-steganalysis ability without sacrificing message extraction accuracy.The key idea of the adversary module is that given a well-trained and fixed INN, the perturbation P is optimized and then added on the original cover image C 𝑜𝑟𝑖 , so that the optimized cover image embedded with secret messages can obtain better security performance against steganalyzer. Note that according to 𝐿 𝑙𝑝 𝑓 in Eq. ( 10), the INN strives to preserve the low frequency components unchanged, and tends to modify the high frequency components for information hiding. Although high frequency components are more suitable to hide secret information than low frequency components, inappropriate and extensive modifications would still lead to poor anti-steganalysis performance. Therefore, a frequency compensation mechanism is deigned in the adversary module, which strives to preserve the high frequency components neglected by the INN-based hiding network. Specifically, given the well-trained and fixed INN, the adversary module aims to preserve the high frequency components between the original cover image C 𝑜𝑟𝑖 and the stego image S, and the loss function is formulated asEQUATIONwhere F denotes the operation of obtaining the high frequency components via DFT (Discrete Fourier Transform). Note that the perturbation P is added on the original cover image C 𝑜𝑟𝑖 to obtain the optimized cover image C 𝑜𝑝𝑡 , which is further fed into the INN-based hiding network to obtain the stego image S. Such P is iteratively optimized by means of minimizing Eq. (11) . Specifically, in each iteration, the gradients G of the loss function 𝐿 ℎ𝑝 𝑓 with respect to P is calculated, and P is updated by subtracting G. The iterations are terminated until the stego image can obtain satisfied security performance. To evaluate the security performance, a CNN-based steganalyzer is first trained and then fixed. The termination condition is that the stego image is judged as cover image with confidence higher than a specific threshold or iteration number exceeds a certain value.The proposed AHDeS is a model-based and optimization-based hybrid method. The training strategy is given in Algorithm 1. In general, in the training stage, the INN is trained to obtain the ability of message embedding and extraction. The deployment strategy is given in Algorithm 2. In the deployment stage, the well-trained INN is fixed, and perturbation optimization for cover image in digging process occurs before message embedding in filling process. Therefore, the only network that needs to be trained is the INN. To sufficiently train the INN in AHDeS, a perturbation adaptive training strategy is proposed. Such strategy contains two phases. The first phase aims to make the INN acquire the basic function of message embedding. It takes the original cover image C 𝑜𝑟𝑖 as input, and its parameters are updated by minimizing Eq. (7) . Afterwards, the second phase aims to adapt the INN to the Dig-and-Fill paradigm, and let the INN learn to process the optimized cover image C 𝑜𝑝𝑡 . Specifically, in each training iteration, the adversary module is first applied to iteratively add P on C 𝑜𝑟𝑖 . And then the INN takes C 𝑜𝑝𝑡 as input, and its parameters are updated by minimizing Eq. (7) . By this means, the well-trained and fixed INN is adaptive to the Dig-and-Fill paradigm and can be regarded as the prior knowledge for the adversary module. (S, Z) ← ℎ 𝜃 (C 𝑜𝑟𝑖 , M) // Forward calculation.( C, M) ← ℎ -1 𝜃 (S, Z) // Reverse calculation.Update 𝜃 with loss function 𝐿 INN ;9: Initialize the perturbation P; 10: for 𝑛 = 0 to 𝑁 2 do // Second phase.11:C 𝑜𝑝𝑡 = C 𝑜𝑟𝑖 + P 12:(S, Z) ← ℎ 𝜃 (C 𝑜𝑝𝑡 , M) // Forward calculation.( C, M) ← ℎ -1 𝜃 (S, Z) // Reverse calculation.𝑞 ← 𝐷 (S) //Obtain confidence of judging S as C 𝑜𝑟𝑖 . C 𝑜𝑝𝑡 = C 𝑜𝑟𝑖 + P // Digging process.(S, Z) ← ℎ 𝜃 (C 𝑜𝑝𝑡 , M) // Filling process.( C, M) ← ℎ -1 𝜃 (S, Z)9:𝑞 ← 𝐷 (S) //Obtain confidence of judging S as C 𝑜𝑟𝑖 . Update P with loss function 𝐿 ℎ𝑝 𝑓 ;5 Experiments 
experimental setup: 
 Dataset. The COCO dataset [20] is utilized in the experiments. Specifically, 5,000 images are utilized to train the deep-learningbased steganographic models in the training stage and 10,000 images are utilized to generate stego images in the deployment stage.These 10,000 images are split into training, validation, and testing set for security performance evaluation by steganalyzers according to the proportion of 5:1:4. As for the steganalyzer applied in the adversary module, 10,000 images are utilized to train such steganalyzer. All images are central cropped into 256 × 256. Implementation details. The Adam optimizer with default settings is utilized to to optimize the proposed AHDeS. For the INNbased hiding network, the initial learning rate is set to 1 × 10 -5.2 , and the batch size is set to 16. For the optimization-based adversary module, the learning rate is set to 1 × 10 -4 , and the batch size is set to 1. 𝜆 𝑐 , 𝜆 𝑟 , and 𝜆 𝑓 in Eq. ( 7) are all set to 1.0. The first and second phases of training process of INN consist of 1, 000 and 200 epochs, respectively. In the termination condition of perturbation optimization, the threshold for steganalyzer's confidence and iteration number is set to 90% and 200, respectively. Note that we simulate real-world scenarios of secret information transmission, wherein digital images in integer type are applied as carrier. In the deep-learning-based steganographic methods, the neural networks receives original images in integer type and outputs temporal images in floating type, which are further rounded into stego image in integer type. This rounding process leads to a certain degree of information loss and may further result in performance degradation of secret message extraction accuracy. Such stego images are evaluated from different aspects, including security performance, decoding performance, and visual quality. The experiments are implemented by PyTorch and executed on Tesla V100 GPU card.Steganographic methods and steganalyzers. Five steganographic methods are compared, including HiDDeN [37] , SteganoGAN [36] , CHAT-GAN [25] , HiNet [16] , and the proposed AHDeS. Noted that network with specific structure can hide both bitstream and image. For example, HiNet is originally used to hide image, while [18] , which has similar structure as HiNet, is used to hide bitstream. Therefore, as long as the hidden content is the same, the comparison would be fair. Five steganalyzers are utilized to evaluate the security performance of steganographic methods, including XuNet [32] , SRNet [4] , LWENet [30] , CovNet [6] , and StegExpose [3] .In this part, the performance of steganographic methods are evaluated from two aspects, including security performance and decoding performance.Four steganalyzers are adopted to evaluate the security performance of steganographic methods. Specifically, CovNet is utilized to evaluate the security performance of the generated stego images in the adversary module in the proposed AHDeS. Therefore, from the perspective of steganographer of AHDeS, CovNet is regarded as the known steganalyzer, while XuNet, SRNet, and LWENet are regarded as the unknown steganalyzers. The experimental results are shown in Table 1 . It can be observed that the proposed AHDeS achieves the best security performance against both known and unknown steganalyzers in all cases. Compared with HiNet, AHDeS can obtain improvement of 16.80%, 5.57%, 6.62%, and 6.83% against XuNet, SRNet, LWENet, and CovNet, respectively. The traditional handcrafted steganalyzer is also adopt for performance evaluation. AUC is 0.509 for AHDeS, and 0.592, 0.567, 0.581, 0.573 for the rest. Noted that lower AUC indicates better security performance. BER (Bit Error Rate) between the original message and the extracted message is utilized to evaluate the decoding performance of steganographic methods. The results are shown in Table 1 . It can be observed that the BER of HiNet and AHDeS is close to 0 and is superior to the other methods, indicating that the proposed AHDeS can transmit secret messages in a nearly lossless manner.We also analyze the relationship between payload, security performance, and decoding performance. Specifically, in the case of 1 bpp, the detection error rate of CovNet is 8.99% and the BER is 0.85%. While in the case of 2 bpp, the detection error rate is 7.27% and the BER is 0.95%. It can be observed that the higher the payload, the lower the security performance and the decoding performance. Noted that although INN has the inverse property, its BER is affected by the rounding operation for the forward calculation's output. To hide larger payload of messages, a cover image's pixel has to carry more bits in average, and thus given a specific modification range for such pixel, the modification range for each bit would be smaller and thus could be more easily erased by the rounding operation. Besides, higher payload would introduce more artifacts and thus decrease security performance.In this part, the visual quality of the stego image is evaluated from the objective evaluation and the subjective evaluation.For subjective evaluation, we visualize the difference between the cover and stego images. The cover image in AHDeS is the original cover image. The results are given in Fig. 3 . It can be observed that the difference for proposed AHDeS are nearly invisible. Such phenomenon indicates that AHDeS can generate stego images in an imperceptible manner. For objective evaluation, we evaluate the visual quality by PSNR (peak-signal-to-noise-ratio) and SSIM (structural similarity) between the cover and stego images. The cover image in AHDeS is the original cover image. The results are given in Table 2 . It can be observed that the visual quality of the stego images for AHDeS significantly outperforms the other methods. For example, the PSNR of AHDeS, HiDDeN, SteganoGAN, CHAT-GAN, and HiNet are 45.07, 37.29, 42.61, 43.34 and 42.95, respectively.In this part, ablation studies are conducted from different aspects. In this part, the embedding patterns of the proposed AHDeS are analyzed in the frequency domain. DWT is first applied to process the cover and stego images. And then, components on four subbands can be obtained, including HH, HL, LH, and LL, where H and L denote high frequency and low frequency along a specific direction, respectively. For a specific steganographic method and a specific sub-band, the difference between the components of cover and stego images can be calculated. The frequency characteristics is analyzed by visualization and statistics as follows.From the perspective of visualization, we show the absolute difference of high frequency components and low frequency components, where the high frequency components are the summation of HH, HL, and LH sub-bands, while the low frequency components are the LL sub-band. AHDeS and HiNet is compared, and the results are given in Fig. 4 . From the third and fifth columns, it can be observed that both of the AHDeS and HiNet can well preserve the low frequency components. However, from the second and fourth columns, it can be observed that HiNet leaves more obvious artifacts on high frequency components than AHDeS.From the perspective of statistics, the values of the absolute difference on a specific sub-band are summed up. Five steganographic methods are compared, and the results averaged on 10,000 images from COCO dataset are given in Fig. 5 . Comparing with HiDDeN, SteganoGAN, and CHAT-GAN, the proposed AHDeS can better preserve the LL sub-band unchanged. Comparing with HiNet, although the effect on LL sub-band is quite similar, AHDeS can obtain much better preserving performance on high frequency sub-bands of HH, HL, and LH.In this part, the offset effects of the digging and filling processes in AHDeS are visualized. Note that in the proposed AHDeS, in the deployment stage, the adversary module receives the original cover image C 𝑜𝑟𝑖 and outputs the optimized cover image C 𝑜𝑝𝑡 , and then the INN takes in C 𝑜𝑝𝑡 and secret message M and outputs the stego image S. Specifically, the difference between C 𝑜𝑝𝑡 and C 𝑜𝑟𝑖 in the digging process is denoted as D 𝑑𝑖𝑔 , and the difference between S and C 𝑜𝑝𝑡 in the filling process is denoted as D 𝑓 𝑖𝑙 . The offset effect for the digging and filling processes are visualized in Fig. 6 , where the red and blue points represent elements in D 𝑑𝑖𝑔 and D 𝑓 𝑖𝑙 having the opposite signs and the same signs, respectively. From Fig. 6 , it can be observed that the red points are far more than the blue points. Such phenomenon indicates that the modification direction in the digging and filling processes have the offset effect, and thus the stego image is closer to the original cover image. In such manner, the stego image is of better anti-steganalysis performance.In this part, INN's forward calculation outputs spatial stego image, which is transformed by DCT, divided by quantization step, and processed by simulated rounding function to approximate JPEG compression. The output is decompressed as spatial image, and fed into reverse calculation for message extraction. BERs are 0.99%, 0.52% and 0.24% for quality factor of 70, 80 and 90. 
conclusions: 
 In this paper, the steganographic method called AHDeS is proposed under the Dig-and-Fill paradigm, wherein the adversary component for countering against steganalyzers and the hiding component for information hiding can be decoupled. Extensive experiments have been conducted, and the following conclusions can be made. Firstly, AHDeS can obtain the state-of-the-art security performance and visual quality, while maintaining satisfied message extraction accuracy. Secondly, owing to the frequency compensation mechanism, AHDeS can well preserve the high frequency components without disturbing the low frequency components. Thirdly, the digging and filling processes in AHDeS have the offset effect of modification direction, which is beneficial to generating more secure stego image during information hiding. In the future, we hope to extend the Dig-and-Fill paradigm to information hiding in other multimedia carriers, such as audio and video. 
: 
 1 IntroductionMultimedia steganography is the art and science of concealing secret messages within multimedia carriers, where digital images are the commonly used carriers. Traditional steganographic methods were designed under the distortion minimization framework [10] , which can be formulated as minimizing distortion function under payload constraint. In the past decades, different distortion functions have been proposed, which were based on heuristic principles [15, 19] or statistical models [11, 13] . To further improve the security performance, deep learning techniques have been introduced, and the distortion functions could be automatically learned by GAN (Generative Adversarial Networks) [27, 33] , RL (Reinforcement Learning) [23, 24] , or AE (Adversarial Examples) [2, 26] . Practical steganographic codes, such as STC (Syndrome Trellis Code) [9] , can be applied for message embedding according to the defined distortion functions. However, due to the constraint of distortion minimization framework, the hiding capacities of the above steganographic methods were relatively low. To obtain higher capacities, deep steganography has been proposed, which utilized neural networks to implement message embedding and extraction, instead of practical steganographic codes. These neural networks consist of a hiding component for message embedding and an adversary component for countering against steganalyzers. Baluja [1] proposed the first deep image hiding method. Hayes et al. [14] introduced adversarial training into deep steganography. Zhu et al. [37] introduced noise layer into HiDDeN for robust steganography. Zhang et al. [36] proposed SteganoGAN with residual and dense architecture. Considering that the reversibility of INN (Invertible Neural Networks) is suitable for steganography task, Jing et al. [16] and Lu et al. [21] respectively proposed steganographic method based on INN, which implemented message hiding and extraction by the forward calculation and reverse calculation of INN. Lan et al. [18] utilized INN to hide secret information in the DCT domain to resist JPEG compression. In the above deep steganographic methods, the hiding component and adversary component are jointly trained. However, higher payload information hiding would lead to more modification artifacts, which can increase the risk of being detected by steganalyzers. Therefore, these two components are two ends of the seesaw, and it is difficult to balance the tradeoff between message extraction accuracy and security performance by joint optimization with multiple loss functions.To address the above limitations, this paper first proposes the Dig-and-Fill paradigm, as shown in Fig. 1 . The key idea is inspired from the case of imperceptible sand transportation. If the porter has some prior knowledge of the sand to be transported, such as the sand's volume, then the porter can dig a hole with equal volume in advance, and then subsequently fill the hole with sand. By this manner, the beach surface can still be kept unchanged, and the transportation behaviour can be well hidden. In the case of steganography, the adversary and hiding components can be decoupled into the digging and filling processes. Specifically, if the steganographer is aware of the hiding pattern in the filling process, then the steganographer can optimize the cover image in advance in the digging process, so that the optimized cover image embedded with secret messages can obtain satisfied security performance.Under such paradigm, a steganographic method called AHDeS (Adversary-Hiding-Decoupled Steganography) is proposed. AHDeS is an optimization-based and model-based hybrid method, wherein the adversary component and hiding component are implemented as an optimization-based adversary module and an INN-based hiding network, respectively. Specifically, the INN is first trained for obtaining the ability of message embedding. Afterwards, given the well-trained and fixed INN, the cover image is iteratively optimized for enhancing the security performance against steganalyzers in the filling process, followed by actual information hiding by INN in the digging process. As long as the INN is fixed, owing to the reversibility and the dual branch structure of INN, security performance can be enhanced without sacrificing message extraction accuracy. The contributions of this work are summarized as follows:• A Dig-and-Fill paradigm is designed, wherein the adversary and hiding components of steganographic methods can be decoupled into the digging and filling processes and independently optimized.  
 
 Appendix:  


Decision: The paper presents a novel approach to modification-based steganography. While the research has several strengths, some areas require further clarification and experimentation to enhance the study's comprehensiveness. Despite these limitations, the paper's contributions and potential impact on the field merit its acceptance.

Limitations:

The paper should clarify whether the order of digging and filling processes depends on the deployment stage or the training stage. This is crucial for understanding the methodology and its application in different scenarios.
It is unclear whether the adversarial noise is added to the cover images before embedding the message. Clarifying this aspect would help in replicating the experiments and understanding the impact of adversarial noise on the method's performance.
Hiding an image into an image and hiding a bitstream into an image are fundamentally different tasks. The paper should address this discrepancy to ensure a fair and accurate comparison of experimental results.
The paper focuses on modification-based steganography but should also include baselines from both modification-based and generative steganography methods, especially for undetectability comparisons. This would provide a more comprehensive evaluation of the proposed method.
Although the method improves undetectability compared to baselines, the Detection Error Rate (DER) is still too low, indicating potential security issues. The paper should discuss this limitation and explore ways to further enhance the method's security.
The authors are expected to provide experimental results analyzing the relationship between payload and security, as well as extraction accuracy. The current text descriptions are commonly known and not convincing. Detailed experimental data would strengthen the paper's claims and provide more robust evidence of the method's effectiveness.

The paper makes significant contributions to the field of steganography by introducing an innovative method that aims to improve undetectability and security. While there are several areas requiring further clarification and more comprehensive experimental analysis, the overall impact and novelty of the research justify its acceptance. Addressing the identified limitations in future work will further strengthen the study and its contributions to the field.

Reviews: review: paper_summary: paper_summary: This paper proposes a steganographic method under the Dig-and-Fill paradigm, which decouples the adversary component and the hiding component. Specifically, the INN is first trained to implement the hiding task, and then the cover image is optimized to enhance the security. Experiments show that the proposed method outperform previous methods.

However, the structure of the paper is somewhat repetitive. The details of the methodology are not clearly described. Additional information and clarification are necessary to fully understand the proposed approach.
strength_weakness: strength_weakness: 1. The topic of this paper is interesting,

2. The experimental results are compelling.
limitations: limitations: 1. Line 148 and Line 151: There are two filling processes. 
> the INN is first trained to implement information hiding in the **filling** process. Afterwards, given the well-trained and fixed INN, the cover  image is iteratively optimized for enhancing the security performance against steganalyzers in the **filling** process.

2. The description of the digging process and the filling process is confusing.

   In Line 133-140 and Line 342-358, the Dig-and-Fill paradigm is described as follows: 
> the steganographer can first optimize the cover image in the digging process and then embed secret messages into the optimized cover image in the filling process. If the steganographer is fully aware of the hiding pattern in the filling process, then the steganographer can optimize the cover image in advance in the digging process, so that the optimized cover image embedded with secret messages can obtain satisfied security performance.

   In Line 147-151 and Line 364-370, the Dig-and-Fill paradigm is described as follows: 
> In AHDeS, the INN-based hiding network is first trained to implement message embedding in the filling process, and then based on the well-trained INN, the optimization-based adversary module is utilized to optimize the cover image for enhancing security performance in the digging process.

   There is inconsistency in the description of the sequence of digging and filling. Morever, the Dig-and-Fill paradigm in Figure 2 is again a two-way process. So the description of the digging process and the filling process is rather confusing.

3. The content in Section 3 is entirely repetitive of the Introduction. Therefore, Section 3 should be removed to avoid redundancy.

4. According to the description of the Dig-and-Fill paradigm in Introduction section, the digging and filling processes are closely related, requiring knowledge of the filling process details to prepare in advance during the digging process. However, Section 4 describes the INN-based hiding process and adversarial example-based optimization processes as completely independent. The overall process involves adding adversarial noise to the cover to mislead the steganalyzer and then embedding the message into the optimized cover. This adversarial example-based optimization seems more like a preprocessing step rather than a digging process related to the filling process.

5. If the adversarial noise is added to the cover images before embedding the message, will the latter process disrupt the already added adversarial noise, reducing the possibility of successfully misleading the steganalyzer?

6. Is there only one steganalyzer used during adversarial training? If so, will the adversarial noise only defend against this specific steganalyzer, thus limiting steganographic security? The authors should conduct experiments to verify this, especially using traditional steganalyzers based on handcrafted features, to test for this steganalyzer mismatch.

7. How is the secret message input into the INN? Is the binary bitstream converted into a two-dimensional format similar to an image? What is the steganographic capacity?

8. In Table 1, some steganographic methods hide an image within another image, whereas the proposed method hides a bitstream within an image. The hiding capacities of these two types of methods are different, making the comparison unfair.
paper_summary: paper_summary: This paper proposes an adversary-hiding-decoupled steganographic method based on the Dig-and-Fill paradigm. Specifically, the INN is first trained to implement message embedding and extraction in the digging process. And then given the trained INN, the optimization module is utilized to iteratively optimize the cover image to improve security performance without sacrificing message extraction accuracy in the filling process. The proposed method is compared with several SOTA methods from different aspects. Results show that the proposed method can significantly improve the security performance and visual quality of stego images.
strength_weakness: strength_weakness: 1. The Dig-and-Fill paradigm is a novel instructive, which can well solve the difficulties of jointly training the adversary and hiding components in steganography. Combining the design philosophy of the Dig-and-Fill paradigm and the reversibility of INN, security performance can be enhanced without sacrificing message extraction accuracy. 
2. The frequency compensation mechanism is innovative, which breaks the stereotype of merely preserving the low-frequency components unchanged in steganography. 
3. Comprehensive experiments have been conducted, including performance comparison with SOTA methods and ablation studies. Results show that the proposed method can obtain SOTA performance.
limitations: limitations: The description of how to train the steganalyzer for termination conditions is missing. Provide detailed information on such training process. 

-Typo. In Figure 1 (b), Diresctly->Directly.
-What images are utilized to pre-train the steganalyzer (CovNet) in the proposed method?
-How do different settings of confidence threshold and iteration number in termination condition affect the steganographic performance?
paper_summary: paper_summary: This paper proposes a novel dig-and-fill steganographic paradigm that combines the learning-based and optimization-based steganography. The authors first learn invertible steganographic network (ISN) for data embedding and extraction.  Then, based on the trained ISN (with fixed parameters), they optimize the cover images to generate undetectable stego-images. The learning and optimization processes are conducted alternately.
strength_weakness: strength_weakness: - The paper is well written and organized and I enjoy reading it.
- The authors provide a very clear description of the dig-and-fill paradigm, which I really appreciate.
- I appreciate the author's use of quantized images (8x3bpp) for testing.
- This paper achieves good steganography performance, especially in undetectability.
limitations: limitations: - The idea of combining the learning-based and optimization-based steganography have been explored by previous method LISO [R1]. Please detail the key differences between the proposed AHDeS and LISO.

- The results in Tables 1/2/3 indicate that the proposed AHDeS outperforms HiNet in terms of the quality/undetectability of stego-images but is inferior to HiNet in terms of BER recovery. However, there is a trade-off between the recovery BER and the quality/undetectability of the stego-images. One can improve the quality/undetectability of the stego-images by HiNet via decreasing the weight of the recovery loss in its total losses, at the cost of increasing the recovery BER. Therefore, the experimental results of the paper fail to demonstrate that the proposed method is superior to HiNet.

- How did the authors train the steganalysis network, including known CovNet and unknown XuNet/SRNet/LWENet. Please detail the dataset and training strategy. 

If authors address my concerns, I will raise my score.

[R1] Chen X, Kishore V, Weinberger K Q. Learning iterative neural optimizers for image steganography[C]//The Eleventh International Conference on Learning Representations. 2022.
paper_summary: paper_summary: This paper proposed an adversary-hiding-decoupled steganography (AHDeS) scheme under the dig-and-fill paradigm. It decoupled the steganography into an optimization-based adversary module in the digging process and an INN-based hiding network in the filling process.
strength_weakness: strength_weakness: 1. The dig-and-fill paradigm is interesting and easy to understand.
2. This paper is very well-written and easy to follow. The structure is clear and reasonable. The analyses of the dig-and-fill paradigm and the proposed method are full.
3. Compared to HiNet, the proposed digging process improved significantly the security of steganography.
4. This paper has conducted sufficient experiments to prove the effectiveness of AHDeS. The ablation and frequency analysis are also supportive.
limitations: limitations: 1. (Very important) About the security of INN-based steganography. The INN has been proven as a kind of secure steganography method where the differences between stego image/audio and cover image/audio cannot be recognized, because the distribution of cover image/audio is the same as that of stego image/audio [1-4]. However, this paper was based on the assumption that the INN-based methods are not secure. Therefore, the reviewer is very eager to know which conclusion is correct, or how the AHDeS differs from the previous INN-based methods. 

2. This paper mentioned in the Introduction that, “Therefore, these two components are two ends of the seesaw, and it is difficult to balance the tradeoff between message extraction accuracy and security performance by joint optimization with multiple loss functions.” (lines 121-124). To solve this problem, this paper proposed AHDeS. However, from the results in Table 1, AHDeS achieved better security but lower extraction accuracy compared to HiNet. It seems that AHDeS also suffered from the imbalance between security and extraction accuracy. Therefore, the reviewer also wants to know whether and how this paper solves the above imbalance.

3. (Important) About the steganography baselines and steganography analysis methods. The adopted methods are a little old, and the authors are expected to select recent methods (2023 or 2024) to increase the convincingness. 

4. (Very important) Detection error rate (DER) in Table 1 needs to be explained in detail by the authors. To the knowledge of the reviewer, the steganography analysis model is used to judge whether the stego image contains hidden information, and output a binary classification result. AHDeS can achieve only 8.99% of DER under CovNet. Does this mean that most stego images can still be detected by steganography analysis models? From this point of view, the method proposed by the author does not seem to have its due effect.

5. (Important) This paper lacked an analysis of the relationship between payload and steganography security, and extraction accuracy.

6. About the writing: $C^{ori}$ in Eq 8 was used for the first time and should be explained here.

7. (Important) Is the proposed AHDeS robust to image compression (e.g., JPEG)? 

8. The template style is wrong, and the authors are expected to use the correct template style.

[1] HiNet: Deep Image Hiding by Invertible Network

[2] Large-capacity image steganography based on invertible neural networks

[3]  Distribution-preserving steganography based on text-to-speech generative models

[4]  Hiding video in audio via reversible generative models

Note: The reviewer will change the score according to the authors' responses.