GAN-based Symmetric Embedding Costs Adjustment for Enhancing Image Steganographic Security

Venue: acmmm_org_ACMMM_2024_Conference
Published: 2024-04-07 14:05:46

Abstract: Designing embedding costs is pivotal in modern image steganography. Many studies have shown adjusting symmetric embedding costs to asymmetric ones can enhance steganographic security. However, most existing methods heavily depend on manually defined parameters or rules, limiting security performance improvements. To overcome this limitation, we introduce an advanced GAN-based framework that transitions symmetric costs to asymmetric ones without the need for the manual intervention seen in existing approaches, such as the detailed specification of cost modulation directions and magnitudes. In our framework, we firstly achieve symmetric costs for a cover image, which is randomly split into two sub-images, with part of the secret information embedded into one. Subsequently, we design a GAN model to adjust the embedding costs of the second sub-image to asymmetric, facilitating the secure embedding of the remaining secret information. To support our phased embedding approach, our GAN's discriminator incorporates two steganalyers with different tasks: distinguishing the generator's final output, i.e., the stego image, from both the input cover image and the partially embedded stego image, providing diverse guidance to the generator. In addition, we introduce a simple yet effective update strategy to ensure a stable training process. Comprehensive experiments demonstrate that our method significantly enhances security over existing symmetric steganography techniques, achieving state-of-the-art levels compared to other methods focused on embedding costs adjustments. Additionally, detailed ablation studies validate our approach's effectiveness.

Main paper: 
 introduction: 
 Image steganography involves the imperceptible embedding of secret messages within images for covert communication. Current steganographic research utilizes the distortion minimization framework [9] . Within this paradigm, the key challenge is to design embedding costs for each embedding unit (pixels or DCT coefficients) within an image. Subsequently, coding schemes like Syndrome-Trellis Codes (STC) [8] and Steganographic Polar Codes (SPC) [20] are then applied to embed secret information, aiming to approach the rate-distortion boundary. In contrast to other information hiding techniques such as watermarking, security is the foremost metric of evaluation in steganography, defined by the method's effectiveness in avoiding detection by steganalyzers.Embedding costs can be divided into symmetric and asymmetric types. Symmetric steganography operates under the assumption that +1 or -1 modifications on the same embedding unit have the same impact on steganographic security, whereas asymmetric methods recognize different impacts. Among existing steganographic approaches, the majority of embedding costs are symmetric, including both traditional methods manually designed, such as WOW [13] , S-UNIWARD [14] and HILL [17] , and those based on deep learning techniques, like ASDL-GAN [32] , UT-GAN [36] , SPAR-RL [30] and steg-GMAN [15] . Current research [18, 24] indicates that symmetric steganography often fails to adequately account for the statistical relationships between neighboring pixels in images, leading to a security enhancement bottleneck. Consequently, the development of asymmetric embedding costs has emerged as a pivotal research direction for enhancing the security of steganography.Defining or learning an effective asymmetric embedding cost from scratch is relatively challenging, which is why most current efforts start with a given symmetric embedding cost and then obtain an asymmetric one through adjustments. For instance, CMD [18] and Synch [6] advocate for synchronizing modification directions during the adjustment of embedding costs, which markedly enhance the security over their symmetric counterparts. However, these strategies [18, 6, 34, 39, 33] are largely based on heuristic principles that require a deep understanding of image features. In contrast, inspired by the concept of adversarial examples [12] , some studies have adopted a learning approach to derive asymmetric embedding costs by countering CNN-based steganalyzers. These methods [4, 19, 22, 23, 26, 27, 29, 31] typically involve pre-training a CNN-based steganalyzer using existing symmetric methods like S-UNIWARD or HILL. Following this, they adjust embedding costs based on the signs and magnitudes of gradients provided by the steganalyzer, adhering to specific modification rules. For instance, the UGS [23] initially identifies embedding units necessitating adjustment by evaluating gradient magnitudes and initial embedding costs, using two manually set ratios. Additionally, a pre-determined parameter is needed to dictate the magnitude of modifications for each embedding unit. Although these adjusted methods can effectively enhance the corresponding symmetric steganography, they heavily depend on manually defined parameters and rules for adjustment. The selection of these parameters significantly influences their performance. Unlike methods that rely on heuristic principles and adversarial examples, ReLOAD [25] utilizes a network to learn adjustment policies by minimizing the residual distance between cover and stego images. While ReLOAD markedly improves the security performance of current symmetric approaches. However, like UGS, ReLOAD also requires meticulous choice of adjustment amplitude, which significantly influences the security performance. Moreover, the constant amplitude restricts the capacity to fully leverage the potential of the adjustment, given that the optimal amplitude might vary across various regions of an image.GANs [11] are potent generative models extensively used in various applications, including image generation, editing, inpainting, and style transformation. Unlike these applications, the distinct requirements of steganography, such as ensuring the complete extraction of secret information and making modifications visually undetectable, limit the adoption of GAN-based techniques in image steganography. Consequently, there are only a few steganographic efforts, such as [32, 36, 30, 15, 16, 21] , that are designed using GANs. These approaches exhibit superior security compared to traditional methods, highlighting the potent learning capability of GANs in steganography. To our best knowledge, however, there is no existing research that specifically investigates the use of GANs to automatically refine symmetric embedding costs, aimed at enhancing current steganography methods.This paper presents an innovative GAN-based framework designed to enhance the security of existing symmetric steganography through the automatic adjustment of embedding costs. Initially, in our framework's Initial Embedding Process stage, we calculate the embedding costs for a cover image subjected to symmetric steganography. We then divide this cover image into two distinct, non-overlapping equal sub-images randomly. The first sub-image is employed to embed half of the secret information, leveraging the initial symmetric embedding costs. The embedding costs for the second sub-image are automatically adjusted using the proposed GAN framework. By adopting our phased embedding strategy, we integrate two steganalyzers within the discriminator. These steganalyzers are designed to distinguish the generated stego image from both the original cover image and the partially embedded stego image, thus offering varying guidance to the generator. In addition, we introduce a straightforward yet efficient update strategy to balance the performance of the generator and discriminator as much as possible for ensuring stable and effective training. Overall, the key contributions of this work are highlighted as follows:• We introduce a GAN-based model capable of autonomously adjusting existing symmetric embedding costs for enhancing steganographic security. This approach significantly differs from previous related steganography approaches that overly relies on manually set adjustment parameters or rules. • Unlike current GAN-based steganography approaches, our approach harnesses the advantages of our phased embedding technique, enabling the integration of two steganalyzers with varied discrimination tasks within the discriminator.In addition, we offer a straightforward update strategy to achieve and maintain a relative stable and effective process during the GAN training stage. • Through thorough comparative experiments, we show that our approach substantially improves the security of symmetric steganography, setting a new benchmark for state-of-theart performance. Additionally, we provide detailed ablation studies to validate the effectiveness of our method. 
proposed method: 
 As depicted in Figure 1 , the framework of the proposed method consists of two main stages: the Initial Embedding Process and the GAN Framework for Refinement.In Stage #1, we commence by calculating the preliminary embedding probability map, 𝑃 1 , for the input cover image 𝑋 utilizing a prior symmetry method, 𝑆 𝑖𝑛𝑖𝑡 (•), like HILL. Given that the cover image 𝑋 is defined as 𝑋 = [𝑥 (𝑖, 𝑗)] 𝐻 ×𝑊 with dimensions 𝐻 × 𝑊 , and the probability map 𝑃 1 as 𝑃 1 = [𝑝 1 (𝑖, 𝑗)] 𝐻 ×𝑊 , where 𝑝 1 (𝑖, 𝑗) ∈ [0, 1] indicates the likelihood of the pixel value 𝑥 (𝑖, 𝑗) being altered in data embedding process. Concurrently, 𝑋 is randomly divided into two sub-images with equal size, identified by 𝑀𝑎𝑠𝑘 1 = [𝑚𝑎𝑠𝑘 1 (𝑖, 𝑗)] 𝐻 ×𝑊 ∈ {0, 1} and 𝑀𝑎𝑠𝑘 2 = [𝑚𝑎𝑠𝑘 2 (𝑖, 𝑗)] 𝐻 ×𝑊 ∈ {0, 1}, where 𝑀𝑎𝑠𝑘 1 assigning a value of 1 when the elements are located at the first sub-image and assigning 0 when the elements are located at the second sub-image, and inversely for the 𝑀𝑎𝑠𝑘 2 . Subsequently, half of the secret information is embedded into the first sub-image marked by 𝑀𝑎𝑠𝑘 1 using STC, resulting in a modification map 𝑀 1 = [𝑚 1 (𝑖, 𝑗)] 𝐻 ×𝑊 , where 𝑚 1 (𝑖, 𝑗) ∈ {-1, 0, +1}, and the corresponding partially embedded stego image 𝑌 1 .In Stage #2, a GAN is designed to modify the embedding costs on the remaining sub-image and complete the embedding of the remaining secret information. In the subsequent sub-sections, we will individually and thoroughly detail the design aspects of the generator, discriminator, and update strategy in Stage #2 within the GAN framework.Design of Structure: In the proposed method, the generator receives two inputs: the initial symmetric embedding probability map 𝑃 1 and a modification map 𝑀 1 , which result from the Initial Embedding Process. Leveraging the alterations indicated by 𝑀 1 , the generator aims to adjust 𝑃 1 in the second sub-image (identified by 𝑀𝑎𝑠𝑘 2 ) to achieve a more secure asymmetric embedding probability. Subsequently, it embeds the remaining secret information into this modified probability landscape.To this end, we firstly employ an adjustment network for the generator, illustrated in Figure 2 . This network resembles the U-Net architecture, comprising an encoder and decoder layer. The encoder layer consists of 8 down-sampling blocks, while the decoder layer comprises two branches with 8 up-sampling blocks each. Every block consists of two convolution layers, followed by batch normalization and LeakyReLU activation. Unlike previous GANbased steganographic methods such as [32, 36, 30] , which typically employ the common U-Net architecture, taking the cover image as input and outputting the corresponding symmetric embedding probabilities, the adjustment network takes the concatenation of 𝑀 1 and 𝑃 1 as input, and directly outputs the adjusted asymmetric probability map𝑃 + 2 = [𝑝 + 2 (𝑖, 𝑗)] 𝐻 ×𝑊 and 𝑃 - 2 = [𝑝 - 2 (𝑖, 𝑗)] 𝐻 ×𝑊 .In these maps, 𝑝 + 2 (𝑖, 𝑗) and 𝑝 - 2 (𝑖, 𝑗) represents the probability of being embedded +1 and -1 for the pixel value 𝑥 (𝑖, 𝑗) of the cover image 𝑋 . It should be noted that, during the Initial Embedding Process, the sub-image within the cover image 𝑋 , identified by 𝑀𝑎𝑠𝑘 1 , has been utilized to embed half of the secret information. Therefore, while the probability maps 𝑃 + 2 and 𝑃 - 2 cover the entire image, attention will be focused solely on the probabilities associated with the second sub-image. This strategy is employed to streamline the embedding process for the remaining secret information.Considering that the STC embedding process initially involves converting embedding probabilities into embedding costs (as indicated in Equation ( 2)), followed by the execution of STC on the computed embedding costs, this procedure is non-differentiable and notably slow. To circumvent these limitations, an embedding simulator is employed during the training of the GAN model. This simulator uses modified embedding probabilities (𝑃 + 2 and 𝑃 - 2 ) to effectively simulate the information embedding process. Specifically, we firstly generate a random noise matrix 𝑁 = [𝑛(𝑖, 𝑗)] 𝐻 ×𝑊 , where each element 𝑛(𝑖, 𝑗) falls within the range [0, 1]. Following this, the modification map 𝑀 2 is derived by comparing the noise element with the corresponding embedding probability that are located at 𝑀𝑎𝑠𝑘 2 , as detailed below:EQUATIONThen we add the partially embedded stego image 𝑌 1 and the resulting modification map 𝑀 2 to achieve the final stego image 𝑌 2 which contains the whole secret information. This process ensures that half of the secret information is embedded within the sub-image identified by 𝑀𝑎𝑠𝑘 1 , and the remaining half is embedded within the sub-image identified by 𝑀𝑎𝑠𝑘 2 .It should be emphasized that the embedding simulator is deployed exclusively during the GAN model's training phase. Upon completing the training, the embedding costs 𝜌 2 are calculated using the following equations:         𝜌 + 2 = 𝑙𝑛(1/𝑝 + 2 -2), 𝜌 - 2 = 𝑙𝑛(1/𝑝 - 2 -2), 𝜌 0 2 = 0.(EQUATIONUtilizing these costs, we can generate the actual stego images through the STC process.To guide the generator's updates, the corresponding loss function is defined as follows:EQUATIONcomprising the adversarial loss 𝑙 1 𝐺 , the entropy loss 𝑙 2 𝐺 and the reconstruction loss 𝑙 3 𝐺 . Here 𝛼, 𝛽 and 𝛾 are the weights to attain a balance between the amplitudes of the loss components. In our experiments, we set 𝛼 = 1, 𝛽 = 10 -6 and 𝛾 = 10. Next, we will discuss these three distinct losses in detail.Adversarial Loss: The adversarial loss 𝑙 1 𝐺 aims at guiding a secure modification against discriminator, which is given by:EQUATIONwhere 𝑝 + 2 (𝑖, 𝑗), 𝑝 - 2 (𝑖, 𝑗) and 𝑚 2 (𝑖, 𝑗) respectively denote the (𝑖, 𝑗)-th element in the probability map 𝑃 + 2 , 𝑃 - 2 and the modification map 𝑀 2 . 𝛿 (•) represents an indicator function. The weight 𝑟 𝑖,𝑗 for position (𝑖, 𝑗) is defined as follows:EQUATIONwhere 𝜖 = 10 7 . The gradient component 𝑔(𝑖, 𝑗) represents the gradient at position (𝑖, 𝑗) provided by the discriminator, to be discussed in Equation (10) in the subsection 2.3. This encourages modification in the direction of the gradient, as when the sign of 𝑚 2 (𝑖, 𝑗) matches that of 𝑔(𝑖, 𝑗), it increases 𝑟 (𝑖, 𝑗), aiming at confounding the discriminator's ability to distinguish. The residual component 𝑡 (𝑖, 𝑗) is the (𝑖, 𝑗)-th element of 𝑇 , which is the absolute values of 𝑌 1 's residual filtered by a 3 × 3 Laplacian filter kernel with a center element 8, aimed at concentrating modifications in regions characterized by complex textures. Entropy Loss: The entropy loss 𝑙 2 𝐺 is to ensure the embedding capacity within the second sub-image, and is defined as follows:EQUATIONwhere 𝑞 denotes the embedding payload and 𝑐 is the capacity computed based on the embedding probabilities within the second sub-image:EQUATIONwhere 𝑘 ∈ {-1, 0, +1}. Due to the second sub-image embedding only half the amount of secret information, the target embedding capacity in the loss function ( 6) is also halved. Reconstruction Loss: As outlined earlier, the proposed adjustment network alters embedding probabilities across the whole image, not just within the area defined by 𝑀𝑎𝑠𝑘 2 . Given that the subimage indicated by 𝑀𝑎𝑠𝑘 1 already contains embedded data, our goal is to maintain the probabilities in the first sub-image and limit adjustments solely to the second sub-image. To achieve this, the reconstruction loss 𝑙 3 𝐺 is specifically engineered to maintain the embedding probabilities within the first sub-image, identified by 𝑀𝑎𝑠𝑘 1 . This mechanism is encapsulated in the following expression:EQUATIONwhere 𝑘 ∈ {-1, 0, +1} and 𝑝 𝑘 1 (𝑖, 𝑗) represents the initial embedding probability to embed 𝑘 for pixel 𝑥 (𝑖, 𝑗). Due to the symmetric nature of the initial embedding probabilities, 𝑝 + 1 (𝑖, 𝑗) and 𝑝 - 1 (𝑖, 𝑗) are both equal to 𝑝 1 (𝑖, 𝑗)/2, and 𝑝 0 1 (𝑖, 𝑗) = 1 -𝑝 1 (𝑖, 𝑗). It's important to highlight that this particular loss function is not found in earlier GAN-based steganography methods. Our design is tailored to the unique requirements of our adjustment task, taking cues from the domain of image inpainting [38, 28, 40] . In these works, reconstruction loss is frequently used to ensure the inpainted image closely matches the original in areas that are not modified, thereby maintaining the integrity of the unaltered sections while effectively restoring the altered or missing areas. This principle mirrors the objectives of our task. Furthermore, empirical evidence from our experiments suggests that incorporating reconstruction loss positively influences the generator's performance, enhancing it to a certain degree, notably achieving over an 1% improvement against the steganalyzer Yedroudj-Net [37] .Design of Structure: The primary goal of the discriminator is to distinguish between the input cover image 𝑋 and the stego image 𝑌 2 that contains all the secret information, created by the generator. In our proposed framework, the process of embedding information is divided into two phases: initially embedding half of the secret information onto the sub-image identified by 𝑀𝑎𝑟𝑘 1 , and subsequently embedding the remaining secret information onto another sub-image identified by 𝑀𝑎𝑟𝑘 2 . To fully leverage the information from the stego images generated during these two phases to guide the modification of embedding probabilities, we incorporate two steganalyzers, 𝐷 1 and 𝐷 2 , into the discriminator, each tasked with specific discriminating functions.Specifically, besides setting up steganalyzer 𝐷 1 to differentiate the cover image 𝑋 from the final stego image 𝑌 2 , we recognize that 𝑌 2 is modified on the basis of the stego 𝑌 1 . Therefore, the modification locations and their directions in 𝑌 2 (i.e., 𝑀 2 ) are influenced by the first round of steganographic modifications in 𝑌 1 (i.e., 𝑀 1 ). Previous steganographic studies such as [6, 18] have indicated that concentrating modifications in specific locations and maintaining consistent modification directions among adjacent pixels can significantly improve steganographic security. Thus, we additionally configure steganalyzer 𝐷 2 to distinguish between the partially embedded stego image 𝑌 1 and the final stego 𝑌 2 , with the aim of effectively learning the impact of modifications of neighboring pixels between 𝑀 1 and 𝑀 2 on steganographic security, and guiding the adjustments to the embedding probabilities accordingly. By integrating feedback from both steganalyzers, the discriminator provides diverse guidance to the generator.It should be noted that, unlike existing GAN-based steganographic methods that rely on a single discriminator, as referenced in [32, 36, 30] , and those utilizing multiple discriminators, such as [15, 16] , we propose a steganographic framework based on two discriminators with two distinct discriminating tasks. In contrast, in current GAN steganography approaches, the task of the discriminator is uniform, focusing solely on distinguishing between the cover and the final obtained stego image.To update the discriminator, we take the cross-entropy loss as the discriminant loss as follows:EQUATIONwhere 𝐷 1 (𝑋 ) and 𝐷 1 (𝑌 For stable training in GANs, maintaining a balance between the generator and the discriminator is essential. Our proposed method, which incorporates two steganalyzers 𝐷 1 and 𝐷 2 with distinct discriminating tasks into the discriminator, further complicates this balance, as the generator must effectively deceive both steganalyzers simultaneously.Due to the differences in embedding capacity modifications, it is evident that 𝐷 1 's task of distinguishing between the cover image 𝑋 and the final stego image 𝑌 2 is relatively simpler than that of 𝐷 2 , which distinguishes between the partially embedded stego image 𝑌 1 and the final stego image 𝑌 2 . Hence, 𝐷 1 is relatively more adept at discerning the output of the generator compared to 𝐷 2 . Efforts should be made to narrow the performance gap between the generator and 𝐷 1 . Furthermore, considering the crucial role of 𝐷 1 in the security evaluation for steganography, prioritizing its guidance is essential. Taking all these factors into account, we propose an update strategy to strive to ensure balance between the generator and each steganalyzer in the discriminator, as well as ensuring that each steganalyzer operates according to its respective importance level, thereby enabling a stable and effective training process.The proposed update strategy consists of two aspects. On the one hand, we decrease the initial learning rate of 𝐷 1 to weaken its discriminatory capability, thereby reducing the performance gap between 𝐷 1 and the generator. On the other hand, we increase the weight of 𝐷 1 's gradient feedback to the generator compared to that of 𝐷 2 , as depicted in Equation (10) . This enhances the generator's focus on 𝐷 1 and further bridges the gap between them. Additionally, it amplifies the guidance provided by 𝐷 1 compared to 𝐷 2 , assigning it a more significant role. The gradient component 𝑔(𝑖, 𝑗), as previously presented in Equation ( 5), comprises two parts: the partial derivative of the loss function 𝑙 𝐷 1 and 𝑙 𝐷 2 with respect to the modification 𝑚 2 (𝑖, 𝑗), respectively, which is given by:EQUATION)𝜂 is a parameter to control the weight of the gradients from 𝐷 1 .We set 𝜂 = 5 based on experiments. Further details regarding the update strategy will be provided in Section 3.4. 
experiments 3.1 experimental setups: 
 In our experiments, we firstly pre-trained our proposed GAN model with 40,000 images sourced from SZUBase [32] . Following this, we employed the pre-trained generator to adjust the embedding costs for a specific steganography (i.e., WOW [13] , S-UNIWARD [14] , HILL [17] , and steg-GMAN [15] ). Leveraging the adjusted embedding costs, we then produced stego images through the application of STC on an additional compilation of 10,000 images drawn from both BOSSBase [3] and BOWS2 [2] . This process enabled us to create a dataset of 10,000 cover-stego image pairs. For the evaluation phase, we randomly selected 5,000 of these pairs for the training set, reserved 1,000 pairs for validation, and utilized the remaining 4,000 pairs for the final evaluation. Following the precedent set by ReLOAD, we standardized the resolution of all source images to 256 × 256 pixels using MATLAB's imresize function, ensuring uniformity across our datasets. Our experiments considered two different embedding payloads, 0.2 bpp and 0.4 bpp. To demonstrate the efficacy of our approach, we conducted comparative analyses with three established steganography techniques known for embedding costs adjustment: CMD [18] , UGS [23] , and ReLOAD [25] . Moreover, the security are evaluated using five steganalyzers, including one traditional method SRM [10] and four CNN-based methods, namely, Xu-Net [35] , Yedroudj-Net [37] , SRNet [5] , and Deng-Net [7] .In our model training process, we configured the batch size to 24. The initial learning rates were set at 10 -4 for both the generator and steganalyzer 𝐷 2 , and 10 -5 for steganalyzer 𝐷 1 . These rates are programmed to reduce to 40% of their previous values every 20 epochs. Our training regimen spanned 72 epochs in total. For optimization, we employed the Adam optimizer, configured with beta values of 0.5 and 0.999. To support reproducibility and further research, the source code of our model will be made available online upon the paper's acceptance.In this section, we begin by comparing the security performance of the proposed method to that of three related methods based on embedding costs adjustment: CMD [18] , UGS [23] , and ReLOAD [25] . The comparative results are shown in Table 1 . From the table, we can formulate the following conclusions:• First of all, the proposed method surpasses the three compared methods in terms of overall performance. Remarkably, it consistently achieves either the first or second highest security performance, underscoring our method's effectiveness. For instance, when considering S-UNIWARD at 0.4 bits per pixel (bpp), our method registers the highest detection error rates across all five steganalyzers. It shows improvements of 1.03%, 0.73%, 5.43%, 2.20%, and 3.15% respectively, when compared to the second-best performing methods. Such enhancements are considerable within the domain of image steganography. • Compared to the four baseline methods, which include three conventional approaches (WOW, S-UNIWARD, and HILL) and a current leading symmetric embedding cost model based on deep learning (namely, steg-GMAN), our proposed method consistently enhances performance across all cases. For example, in comparison with steg-GMAN, our method shows performance improvements of 2.75% against SRM, 4.71% against Xu-Net, 3.93% against Yedroudj-Net, 4.37% against SRNet, and 5.56% against Deng-Net, respectively, at the payload of 0.4 bpp. However, the method CMD even fails to surpass the performance of steg-GMAN when evaluated against CNN-based steganalysis models.We also compare the training time and the average time to generate stego images. For a fair comparison, all experiments are conducted on the same server, equipped with an Intel(R) Core(TM) i7-6900K CPU @ 3.20GHz and 4 NVIDIA TITAN X GPUs. The results are presented in Table 2 . From this table, we observe that the training time for our method is 13.87 hours, which is slightly slower Table 1 : Detection error rate (%) of the proposed method and related methods. In the following tables, values with an asterisk(*) denote the best performance in the corresponding case, while the values with an underline denote the second best. The values in parentheses represent differences compared to the baseline, with blue indicating improvement and red indicating decline.Method WOW [13] S-UNWARD [14] HILL [ In the proposed model, we incorporate two steganalyzers (i.e., 𝐷 1 and 𝐷 2 ) within the discriminator, each tasked with unique classification roles. Precisely, their objective is to distinguish the generator's output (i.e., the stego image 𝑌 2 ) from the cover image 𝑋 , and the stego image 𝑌 1 that has undergone partial information embedding.In this section, we undertake an experiment involving various combinations of four typical steganalyzers: Xu-Net, Yedroudj-Net, SRNet, and Deng-Net for 𝐷 1 and 𝐷 2 . For the sake of simplicity, we limit our scenarios to those where the same steganalyzer is utilized for both 𝐷 1 and 𝐷 2 , and the original embedding cost is calculated by the steganography HILL at 0.4 bpp. The results are summarized in Table 3 . From this table, it is evident that:• Using two steganalyzers typically results in improved security compared to relying on just one. In our setup, we utilized Deng-Net as both 𝐷 1 and 𝐷 2 , achieving the highest level of security in most scenarios. Employing a single steganalyzer, particularly 𝐷 2 , proved to be less effective. This highlights the benefit of combining two steganalyzers, each analyzing distinct inputs, to provide comprehensive insights, substantially boosting the robustness of steganographic security. • The selection of steganalyzers significantly influences the security effectiveness of the proposed method, whether employing a single steganalyzer or a combination of two. Specifically, utilizing Deng-Net as 𝐷 1 in a single steganalyzer setup, or as both 𝐷 1 and 𝐷 2 in a dual steganalyzer configuration, demonstrates a noticeable advantage.In the proposed model, we allocate two steganalyzers, namely 𝐷 1 and 𝐷 2 , in the discriminator and implement a straightforward update strategy to maintain equilibrium between the generator and discriminator for stable training. This is achieved by decreasing the initial learning rate of 𝐷 1 and enhancing the weight 𝜂 of its gradient feedback to the generator. In this section, we compare our approach The comparative results are shown in Table 4 . From Table 4 , we observe that the choice of update strategy plays a crucial role in enhancing the security performance of our proposed method. Specifically, by reducing the initial learning rate and fixing 𝜂 at 5, our strategy achieves superior performance compared to Strategies #1 to #4, with an impressive average performance boost of 31.08%, an improvement of at least 1.44%. This represents a commendable In the proposed method, we concatenate the modification map 𝑀 1 and the initial embedding probability map 𝑃 1 as the inputs of the generator, as illustrated in Figure 2 . In this section, three alternative forms of input to the generator are included for comparative study, which are designed as follows:• Input #1: We only input 𝑃 1 to the generator, excluding 𝑀 1 , in order to explore the effects of 𝑀 1 on adjustments. • Input #2: We input the concatenation of 𝑃 1 and the residual of 𝑀 1 , extracted by a 3 × 3 filter with 0 at the middle and 1 around, which tends to capture neighboring modifications instead of directly feeding 𝑀 1 to the generator, following the principle of typical steganography CMD [18] . • Input #3: We employ a generator with two encoding branches and input 𝑃 1 and 𝑀 1 respectively to one branch. This aims at investigating on the impact of employing multiple branches instead of multi-channel inputs.The comparative results are presented in Table 5 . From the table, we observe three key points: 1) The modification map 𝑀 1 is highly beneficial for the generator in adjusting to obtain safe embedding costs. This is evident as the results of Input #1 demonstrate a significant decrease of 4.43%, 6.80%, and 3.15%, respectively, when compared to the proposed method; 2) After first performing filtering preprocessing on the modification map 𝑀 1 and then inputting it along with the probability map 𝑃 1 into the generator, it does not enhance the steganographic security performance; 3) Incorporating a dual encoding branch for 𝑀 1 and 𝑃 1 in the generator does not contribute to enhancing security performance and instead increases model complexity. Although this approach performs better than other inputs, it still falls short of the effectiveness achieved by directly concatenating 𝑀 1 and 𝑃 1 for the input.In the proposed method, we divide the secret messages into two equal halves for embedding into each sub-image with equal size. In this section, we explore scenarios where the cover image is partitioned into varying proportions, with secret information allocated accordingly. This includes proportions of 30%-70%, 40%-60%, 50%-50% (proposed), 60%-40%, and 70%-30%. The results are summarized in Table 6 . From Table 6 , we obtain two following observations:• On average, equal partitioning achieves the highest security performance. As the difference in the partitioning ratio increases-for example, changing from an equal partition to more imbalanced ratios like 30%-70% or 70%-30%-a significant decrease in security performance is observed. • For the steganalyzer Deng-Net, allocating a larger proportion of the secret message to the second sub-image (indicated by 𝑀𝑎𝑠𝑘 2 ) enhances security performance. The primary reason is that Deng-Net serves as the targeted steganalyzer (𝐷 1 = 𝐷 2 = Deng-Net) within the proposed discriminator.In our prior methodological discussions, we began by randomly splitting the cover image into two non-overlapping sub-images.Initially, we utilized an existing symmetric steganography method to embed half of the secret information into one of the sub-image. Then, we employed a trained GAN model to adjust the embedding costs for the other sub-image, facilitating the embedding of the remaining secret information. Importantly, our approach can be expanded to divide the image into multiple sub-images, with each sequentially embedding a corresponding portion of information until the entire secret message is concealed.In this section, we investigate the effects of varying the number of sub-images (1, 2, 3, 4) on the steganographic security and the efficiency of the training process. Here, the use of 1 signifies no division into sub-images, depending entirely on the original HILL steganography for data embedding. The comparative results are detailed in Table 7 . It is observed that with an increase in the number of divisions, there is a progressive improvement in the security of image steganography. Specifically, when the division increases to four, our method shows an approximate 2% performance enhancement compared to the earlier experiments with two divisions. However, this improvement in performance comes with an increase in training time. Since the adjustment and embedding of each subimage require the full image information for GAN training, each stage of GAN training for one sub-image takes approximately 14 hours, leading to an overall training time that increases linearly with the number of divisions. Considering the training time, we only conducts experiments with the image divided into two subimages previously. 
conclusion: 
 In this paper, we introduced an innovative GAN-based framework to enhance the security of existing symmetric steganography methods by adjusting their embedding costs to asymmetric ones. Our approach overcomes the limitation of previous related techniques that heavily relied on heuristics and manually defined parameters or rules. Tailoring to the unique demands of steganographic tasks, we meticulously designed a steganographic framework utilizing GAN, encompassing generators, discriminators, and their respective loss functions. Notably, in line with our phased embedding strategy, we introduce a dual-discriminator and dual-tasks mechanism and an associated update policy, ensuring a stable and efficacious training regime. Through extensive comparative analysis, our approach is shown to outperform traditional symmetric steganography techniques and other relevant methods that aim to adjust embedding costs, marking a significant advancement in the field.While our framework represents a significant step in the research on automatic embedding costs adjustment, certain aspects warrant further investigation. To better capture the correlation and interaction of neighboring pixel modifications, we plan to explore an improved architecture for the generator, potentially incorporating an attention module or drawing inspiration from network architectures used in image inpainting tasks. Additionally, we will explore adaptively introducing noise to the discriminator's input as a data augmentation technique, contingent upon its relative performance compared to the generator, thereby achieving dynamic balance between the two. Furthermore, given the scarcity of methods addressing embedding costs adjustment for JPEG images, we intend to extend our framework to the JPEG domain in future research. 
 
 Appendix:  


Decision: One weakly accept, two borderline accepts and one accept.

Reviews: review: paper_summary: paper_summary: This paper introduces an advanced GAN-based framework that transitions symmetric costs to asymmetric ones without the need for the manual intervention seen in existing approaches, to improve the security of steganography. The framework starts by creating symmetric costs for a cover image split into two sub-images, with part of the secret information embedded in one. A GAN model is then used to adjust the costs of the second sub-image asymmetrically to securely embed the rest of the information. The GAN's discriminator uses two steganalysis for diverse guidance, and a stable training update strategy is implemented.
strength_weakness: strength_weakness: 1、The paper introduces a novel application of GANs in steganography, automatically adjusting embedding costs without relying on manually defined parameters.

2、The introduction of a stable training process and a simple yet effective update strategy ensures the model's robustness and reliability.

3、Comprehensive experiments demonstrate significant security improvements over existing symmetric steganography methods.
limitations: limitations: 1、This article does not illustrate related work. It is very difficult for readers to understand the improvements they have made and to measure innovation.

2、For steganography methods, the PSNR of original container image and decoded image, show the effect of steganography. This result is also not given. The authors not only need to show that their method has better security but also need to show advantages in terms of fidelity and robustness.

3、The author does not provide any subjective comparisons, which makes it difficult for readers to intuitively feel the advantages of the method.
paper_summary: paper_summary: In this paper, the authors propose a GAN-based framework to enhance the security of existing symmetric steganography methods by adjusting the embedding costs to asymmetric ones. The proposed method addresses the limitation of previous works which rely on heuristics and manually defined parameters or rules. Experimental results show that the proposed method outperforms several SOTAs of symmetric steganography in terms of detection error rate against steganalyzers.
strength_weakness: strength_weakness: -The two-stage steganography framework is somewhat novel, which includes an initial embedding process and a GAN-based refinement.
-The authors incorporate two steganalyzers into the discriminator, each of which is customized for specific tasks. The results in Table 3 do support their claim.
-Comparison against other methods has been included diligently.
limitations: limitations: -The motivation of randomly dividing the cover image into two non-overlapping sub-images of the same size should be clarified.
-Explanation of why certain choices were made such as the 8 up-sampling blocks in adjustment network, the weights corresponding to three losses in Equation 3 and the weight of gradient from D1 in Equation 10.
-More details of the adjustment network should be provided in Figure 2.
-Clarify the training process of the five steganalyzers including SRM [10], Xu-Net [35], Yedroudj-Net [37], SRNet [5], and Deng-Net.
-The authors only evaluate the performance in terms of detection error rate. Other metrics will also be helpful for discussion.
paper_summary: paper_summary: This paper introduces a novel embedding costs adjustment method based on Generative Adversarial Networks (GAN), aimed at addressing the limitations associated with prior methods that heavily rely on handcrafted parameters or predefined rules for adjustment. A GAN-based framework is used to automatically transform symmetric costs into asymmetric costs without manual intervention, and a two-stage embedding process is designed to realize the embedding of secret messages. To accommodate the two-stage embedding process, the discriminator is combined by two steganalyzers. The experimental results show that the proposed approach significantly improves security performance compared to related methods, and achieves the state-of-the-art results.
strength_weakness: strength_weakness: 1. The approach proposed in this paper is novel. The authors propose to use GAN to automatically optimize the symmetric embedding cost without manual intervention in related methods. In addition, this paper further improves the security performance by integrating two steganalyzers for different tasks respectively in the discriminator.

2. This paper has clear logic and sufficient experimental verification. The authors clearly illustrate the specific scheme proposed in this paper through charts and detailed formulas. Meanwhile, the authors design experiments from multiple perspectives to verify the effectiveness of the proposed method.
limitations: limitations: 1. Some of the descriptions are not precise enough. Adjustment methods can generally be categorized into additive and non-additive approaches. For example, CMD is a non-additive method, whereas ReLOAD is an additive method. Therefore, it is crucial to clearly state in the introduction that the proposed method adopts a non-additive approach. In conclusion section, the mention of a "dual-discriminator" appears contradictory to the previous statement, which indicated the incorporation of two steganalyzers into one discriminator. Consistency in terminology should be ensured throughout the paper.

2. Some of the content is not explained in sufficient depth. In the proposed method, the cover image is randomly divided instead of in the way of CMD or Synch. What are the specific advantages of random division? In addition, Section 2.2 elucidates the rationale behind incorporating steganalyzer D_2, aiming to learning the impact of modification between M_1 and M_2 by differentiating between Y_1 and Y_2. However, a more detailed explanation of the connection is needed to improve clarity.

3. Lack of description of the learning rate setting for the discriminator. In Section 2.3 the authors propose to balance the performance difference between the two classification tasks by reducing the initial learning rate of D_1, but the paper does not explain how to reduce the learning rate of D_1. Considering that Section 3.4 shows that the updating strategy of the discriminator has a large impact on the experimental results, the initial settings of the learning rates of D_1 and D_2 should be stated and the impact of the different settings should be explored.
paper_summary: paper_summary: The paper proposes an asymmetric embedding cost for adaptive image steganography, which uses a GAN to adjust the symmetric embedding cost generated by the previous method, Hill. Specifically, the authors first embed secret data into half of the cover image using the symmetric embedding cost to obtain a partially embedded stego image. Then, they adjust the symmetric embedding cost using a GAN to obtain the asymmetric embedding cost. Finally, they embed the secret data into the partially embedded stego image to obtain the final stego image. Two discriminators are used to distinguish between the cover, partially embedded stego, and stego images.
strength_weakness: strength_weakness: - The paper is well-structured and easy to follow.

- The design of discriminator is interesting.

- The experimental results look promising.
limitations: limitations: - The key of adaptive steganography is to design embedding cost. Despite different methods following different technical paths, the final evaluation ultimately depends on the quality of the embedding distortion. Why not compare the proposed method with the GAN-based techniques [15, 16, 21].

- The amplitude significantly influences the performance of the compared method.  How is the magnitude in the comparison methods selected? Is it set to be the same, or based on the default settings of the original work?