Original: I NTEGRATED S TEGANOGRAPHY AND S TEGANALYSIS WITH G ENERATIVE A DVERSARIAL N ETWORKS
Revised: I NTEGRATED S TEGANOGRAPHY AND S TEGANALYSIS WITH G ENERATIVE A DVERSARIAL N ETWORKS

Original: Anonymous authors
Revised: Anonymous authors

Original: Paper under double-blind review
Revised: Paper under double-blind review

Original: A BSTRACT
Revised: A BSTRACT

Original: Recently, generative adversarial network is the hotspot in research areas and industrial application areas.
Revised: Recently, generative adversarial network is the hotspot in research areas and industrial application areas.

Original: It’s application on data generation in computer vision is most common usage.
Revised: Its application on data generation in computer vision is most common usage.

Original: This paper extends its application to data hiding and security area.
Revised: This paper extends its application to data hiding and security area.

Original: In this paper, we propose the novel framework to integrate steganography and steganalysis processes.
Revised: In this paper, we propose the novel framework to integrate steganography and steganalysis processes.

Original: The proposed framework applies generative adversarial networks as the core structure.
Revised: The proposed framework applies generative adversarial networks as the core structure.

Original: The discriminative model simulate the steganalysis process, which can help us understand the sensitivity of cover images to semantic changes.
Revised: The discriminative model simulate the steganalysis process, which can help us understand the sensitivity of cover images to semantic changes.

Original: The steganography generative model is to generate stego image which is aligned with the original cover image, and attempts to confuse steganalysis discriminative model.
Revised: The steganography generative model is to generate stego image which is aligned with the original cover image, and attempts to confuse steganalysis discriminative model.

Original: The introduction of cycle discriminative model and inconsistent loss can help to enhance the quality and security of generated stego image in the iterative training process.
Revised: The introduction of cycle discriminative model and inconsistent loss can help to enhance the quality and security of generated stego image in the iterative training process.

Original: Training dataset is mixed with intact images as well as intentional attacked images.
Revised: Training dataset is mixed with intact images as well as intentional attacked images.

Original: The mix training process can further improve the robustness and security of new framework.
Revised: The mix training process can further improve the robustness and security of new framework.

Original: Through the qualitative, quantitative experiments and analysis, this novel framework shows compelling performance and advantages over the current state-of-the-art methods in steganography and steganalysis benchmarks.
Revised: Through the qualitative, quantitative experiments and analysis, this novel framework shows compelling performance and advantages over the current state-of-the-art methods in steganography and steganalysis benchmarks.

Original:  I NTRODUCTION
Revised:  I NTRODUCTION

Original: Imaging that you are an enthusiastic shutterbug.
Revised: Imagine that you are an enthusiastic shutterbug.

Original: You are onthe trip to New Orleans and took a nice photo of St. Louis Cathedral.
Revised: You are on trip to New Orleans and took a nice photo of St. Louis Cathedral.

Original: You want to send the beautiful photo and reveal the romantic feelings to your girlfriend.
Revised: You want to send the beautiful photo and reveal the romantic feelings to your girlfriend.

Original: As your girlfriend is the Ph.D candidate of computer vision, so you want to share the romantic words in her professional manner.
Revised: As your girlfriend is the Ph.D candidate of computer vision, so you want to share the romantic words in her professional manner.

Original: You embed the words by changing the least signiﬁcant bits of the photograph, because this method can hide the romantic words in nearly invisible way.
Revised: You embed the words by changing the least signiﬁcant bits of the photograph, because this method can hide the romantic words in nearly invisible way.

Original: As a social media network fan, you share this photo on Facebook.
Revised: As a social media network fan, you share this photo on Facebook.

Original: Many friends leave the messages to express their love of this photo.
Revised: Many friends leave the messages to express their love of this photo.

Original: And your girlfriend write the following sentence under your photo.
Revised: And your girlfriend write the following sentence under your photo.

Original: “Wonderful photo.
Revised: “Wonderful photo.

Original: By the way, I like the clever idea.
Revised: By the way, I like the clever idea.

Original: I think I am the ﬁrst audience who have read the hidden words.
Revised: I think I am the ﬁrst audience who have read the hidden words.

Original: I love you, too.”
Revised: I love you, too.”

Original: You will be in a cheerful mood, and appreciate the clever communication method that only you and your girlfriend can “see” the secret information inside the photograph.
Revised: You will be in a cheerful mood, and appreciate the clever communication method that only you and your girlfriend can “see” the secret information inside the photograph.

Original: This is a simple scenario to show the basic workﬂow of steganography and steganalysis.
Revised: This is a simple scenario to show the basic workﬂow of steganography and steganalysis.

Original: Steganography is deﬁned as the art and science of hiding information in ways that prevent the detection of hidden messages (Obaid, 2015).
Revised: Steganography is deﬁned as the art and science of hiding information in ways that prevent the detection of hidden messages (Obaid, 2015).

Original: Steganography literally means “covered writing” and is usually interpreted to hide information in other information.
Revised: Steganography literally means “covered writing” and is usually interpreted to hide information in other information.

Original: In the simple scenario aforementioned, you apply steganography to hide the romantic information into the photo of New Orleans.
Revised: In the simple scenario aforementioned, you apply steganography to hide the romantic information into the photo of New Orleans.

Original: The romantic information is called the secret message, while the original photo of New Orleans is called the cover image.
Revised: The romantic information is called the secret message, while the original photo of New Orleans is called the cover image.

Original: Steganalysis as the counterpart,is an attack to thesteganography. Its main idea  is to analyze whether the received information contains any hidden information, and recovering the hidden information if possible (Volkhonskiy et al., 2017).
Revised: As the counterpart, the main idea of steganalysis is to analyze whether the received information contains any hidden information, and to recover the hidden information if possible (Volkhonskiy et al., 2017).

Original: In the simple scenario aforementioned, the social network plays the role of the public channel, and the posted photo is called stego image (Dong et al., 2018), which contains the secret message.
Revised: In the simple scenario aforementioned, the social network plays the role of the public channel (Hayes & Danezis, 2017), and the posted photo is called stego image (Dong et al., 2018), which contains the secret message.

Original: Your girlfriend applies steganalysis to discover and recover the secret information you embedded.
Revised: Your girlfriend applies steganalysis to discover and recover the secret information you embedded.

Original: Since their birth, steganography and steganalysis promote the progress of each other.
Revised: Since their birth, steganography and steganalysis have complementary progress.

Original: Steganography is widely used in secret information transmission (Shi et al., 2017), watermark (Yu, 2016), copyright certiﬁcation (Mun et al., 2017), forgery detection (Wolfgang & Delp, 1996) applications.
Revised: Steganography is widely used in secret information transmission (Shi et al., 2017), watermark (Yu, 2016), copyright certiﬁcation (Mun et al., 2017), forgery detection (Wolfgang & Delp, 1996) applications.

Original: In this paper, we propose an integrated steganography and steganalysis framework with generative adversarial networks, and use ISS-GAN to represent it.
Revised: In this paper, we propose an integrated steganography and steganalysis framework with generative adversarial networks, and use ISS-GAN to represent the method in this paper.

Original:  ISS-GAN combines the steganalysis’s evaluation metrics of secure steganography with the advantages in latest GAN principle, and integrate the counterparts into single framework.
Revised: (ISS is the acronym of integrated steganography and steganalysis.) ISS-GAN combines the steganalysis’s evaluation metrics of secure steganography with the advantages in latest GAN principle, and integrate the counterparts into single framework.

Original: Firstly, we will simulate the steganalysis process with discriminative model.
Revised: Firstly, we will simulate the steganalysis process with discriminative model.

Original: It will help us to dynamically change the capacity of cover images, and understand their sensitivity to semantic change.
Revised: It will help us to dynamically change the capacity of cover images, and understand their sensitivity to semantic change.

Original: Then with the ﬁne-tuning adversarial training process of steganography generative model and steganalysis discriminative model, ISS-GAN can iteratively reduce the consistent loss between original cover images and generated stego images.
Revised: Then with the ﬁne-tuning adversarial training process of steganography generative model and steganalysis discriminative model, ISS-GAN can iteratively reduce the consistent loss between original cover images and generated stego images.

Original: Finally, when ISS-GAN gets the minimal consistent differences, the generated stego images can hardly be distinguished from original cover images.
Revised: Finally, when ISS-GAN gets the minimal consistent differences, the generated stego images can hardly be distinguished from original cover images.

Original: In the training process, we also involve some intentional attacks (noise, compression, etc.) in dataset.
Revised: In the training process, we also involve some intentional attacks (noise, compression, etc.) in dataset.

Original: The mixture of training dataset can further improve the security of ISS-GAN.
Revised: The mixture of training dataset can further improve the security of ISS-GAN.

Original: By comparing ISS-GAN with the state-of-the-art(SOTA) steganography methods in benchmark datasets, we can conclude that ISS-GAN has the advantages in improving the quality and security of generated stego images.
Revised: By comparing ISS-GAN with the state-of-the-art steganography methods in benchmark datasets, we can conclude that ISS-GAN has the advantages in improving the quality and security of generated stego images.

Original: In Figure 1, can you differentiate between Van Gogh’s paintings in (a) and (b)?
Revised: In Figure 1, can you differentiate between Van Gogh’s paintings in (a) and (b)?

Original: Or Monet’s paintings in (e) and (f)?
Revised: Or Monet’s paintings in (e) and (f)?

Original: Actually, the images in (a) and (e) are the original version of drawing masters’ works.
Revised: Actually, the images in (a) and (e) are the original version of drawing masters’ works.

Original: The images in (b) and (f) are the stego version with ISS-GAN framework.
Revised: The images in (b) and (f) are the stego version with ISS-GAN framework.

Original: The embedded secret legends are emblems of painters’ nations: Netherland and France.
Revised: The embedded secret images are emblems of painters’ nations: Netherland and France.

Original: The embedded info is kept imperceptible to ensure there is no inﬂuence on audience to appreciate paintings from ﬁdelity aspect.[Equation] (b)
Revised: The embedded info is kept imperceptible to ensure there is no inﬂuence on audience to appreciate paintings from ﬁdelity aspect.

Original: [Figure]
Revised: [Figure]

Original:  R ELATED W ORK
Revised:  R ELATED W ORK

Original: SOTA steganography approaches can be categorized into three types.
Revised: State-of-the-art steganography approaches can be categorized into three types.

Original: Least Signiﬁcant Bit Steganography
Revised: Least Signiﬁcant Bit Steganography

Original: The main strength of this category is that algorithms are theoretically simple and have low computational complexities.
Revised: The main strength of this category is that algorithms are theoretically simple and have low computational complexities.

Original: Secret information is embedded into cover image with the operations like shifting or replacing of pixels.
Revised: Secret information is embedded into cover image with the operations like shifting or replacing of pixels.

Original: In typical Least Signiﬁcant
Revised: In typical Least Signiﬁcant

Original: Bit (LSB) algorithm, pixel values of cover image and secret messages are represented by binary form.
Revised: Bit (LSB) algorithm, pixel values of cover image and secret messages are represented by binary form.

Original: Stego image generation process is implemented by replacing the least signiﬁcant bits of cover image with the most signiﬁcant bits of secret information.
Revised: Stego image generation process is implemented by replacing the least signiﬁcant bits of cover image with the most signiﬁcant bits of secret information.

Original: In (Das et al., 2018), authors proposed to generate a LSB based hash function for image authentication process, which can provide good imperceptibility between original image and stego image with hash bits.
Revised: In (Das et al., 2018), authors proposed to generate a LSB based hash function for image authentication process, which can provide good imperceptibility between original image and stego image with hash bits.

Original: Moreover, it can successfully identify tamper by a process of tamper localization.
Revised: Moreover, it can successfully identify tamper by a process of tamper localization.

Original: Content Adaptive Steganography
Revised: Content Adaptive Steganography

Original: In this category, some sophisticated steganographic algorithms design a hand-crafted distortion function which is used for selecting the embedding localization of the image.
Revised: In this category, some sophisticated steganographic algorithms design a hand-crafted distortion function which is used for selecting the embedding localization of the image.

Original: These algorithms are the most secure image steganography in spatial domain, such as Wavelet Obtained Weights (WOW), Highly Undetectable Steganography (HUGO),
Revised: These algorithms are the most secure image steganography in spatial domain, such as Wavelet Obtained Weights (WOW), Highly Undetectable Steganography (HUGO),

Original: S-UNIWARD, etc.
Revised: S-UNIWARD, etc.

Original: WOW (Holub & Fridrich, 2012) embeds information into the cover image according to textural complexity of regions.
Revised: WOW (Holub & Fridrich, 2012) embeds information into the cover image according to textural complexity of regions.

Original: In WOW algorithm, the more texturally complex the image region is, the more pixel values will be modiﬁed in this region.
Revised: In WOW algorithm, the more texturally complex the image region is, the more pixel values will be modiﬁed in this region.

Original: HUGO (Pevn`y et al., 2010) deﬁnes a distortion function domain by assigning costs to pixels based on the effect of embedding some information within a pixel.
Revised: HUGO (Pevn`y et al., 2010) deﬁnes a distortion function domain by assigning costs to pixels based on the effect of embedding some information within a pixel.

Original: It uses a weighted norm function to represent the feature space.
Revised: It uses a weighted norm function to represent the feature space.

Original: S-UNIWARD (Holub et al., 2014) proposes a universal distortion function that is independent of the embedded domain.
Revised: S-UNIWARD (Holub et al., 2014) proposes a universal distortion function that is independent of the embedded domain.

Original: Despite the diverse implementation details, the ultimate goals are identical in this category.
Revised: Despite the diverse implementation details, the ultimate goals are identical in this category.

Original: They are all devoted to minimize distortion functions, to embed the secret into the noisy area or complex textures, and to avoid the smooth regions of the cover images.
Revised: They are all devoted to minimize distortion functions, to embed the secret into the noisy area or complex textures, and to avoid the smooth regions of the cover images.

Original: Deep Learning based Steganography
Revised: Deep Learning based Steganography

Original: As deep learning has brilliant capability in image processing and generation, researchers also attempt to utilize it in steganography.
Revised: As deep learning has brilliant capability in image processing and generation, researchers also attempt to utilize it in steganography.

Original: Paper (Volkhonskiy et al., 2017) introduces a new model for generating more steganalysis-secure cover images based on deep convolutional generative adversarial networks.
Revised: Paper (Volkhonskiy et al., 2017) introduces a new model for generating more steganalysis-secure cover images based on deep convolutional generative adversarial networks.

Original: Paper (Dong et al., 2018) proposes a steganography model which can conceal a gray secret image into a color cover image with the same size, and generate stego image which seems quite similar to cover image in semantics and color.
Revised: Paper (Dong et al., 2018) proposes a steganography model which can conceal a gray secret image into a color cover image with the same size, and generate stego image which seems quite similar to cover image in semantics and color.

Original: Paper (Shi et al., 2017) wants to generate more secure covers for steganography.
Revised: Paper (Shi et al., 2017) wants to generate more secure covers for steganography.

Original: Based on Wasserstein GAN (Arjovsky et al., 2017), the proposed algorithm is efﬁcient to generate cover images with higher visual quality.
Revised: Based on Wasserstein GAN (Arjovsky et al., 2017), the proposed algorithm is efﬁcient to generate cover images with higher visual quality.

Original: Their model is suitable for embedding secret with the random key.

Original:  F RAMEWORK OF ISS-GAN 3. P RINCIPLE OF ISS-GAN
Revised:  F RAMEWORK OF ISS-GAN 3. P RINCIPLE OF ISS-GAN

Original: In the proposal, ISS-GAN is a steganography framework to embed secret message into the source cover image.
Revised: In the proposal, ISS-GAN is a steganography framework to embed secret message into the source cover image.

Original: So here are two essential metrics to evaluate the steganographic algorithm.
Revised: So here are two essential metrics to evaluate the steganographic algorithm.

Original: • Secret info should remain imperceptible until it is extracted by speciﬁc authorized receiver.
Revised: • Secret info should remain imperceptible until it is extracted by speciﬁc authorized receiver.

Original: • Stego image should be secure and intact to resist tampering and attacks.
Revised: • Stego image should be secure and intact to resist tampering and attacks.

Original: In traditional SOTA frameworks, the imperceptibility is achieved by carefully choosing the LSB in pixel domain, or relied on hand-crafted distortion function in traditional steganography.
Revised: In traditional state-of-the-art frameworks, the imperceptibility is achieved by carefully choosing the LSB in pixel domain, or relied on hand-crafted distortion function in traditional steganography.

Original: So the features and algorithms need meticulous artiﬁcial design.
Revised: So the features and algorithms need meticulous artiﬁcial design.

Original: Moreover, these designs heavily rely on the characteristics of target images.
Revised: Moreover, these designs heavily rely on the characteristics of target images.

Original: So it is very hard for these schemes to become general solutions in various applications.
Revised: So it is very hard for these schemes to become general solutions in various applications.

Original: The artiﬁcial designed features are also vulnerable to intentional and hybrid attacks.
Revised: The artiﬁcial designed features are also vulnerable to intentional and hybrid attacks.

Original: For deep learning based steganography, the main focus is to generate the steganalysis-secure cover images.
Revised: For deep learning based steganography, the main focus is to generate the steganalysis-secure cover images.

Original: But in many real applications, the cover images are given.
Revised: But in many real applications, the cover images are given.

Original: So how to fully utilize the given images to hide secret, and to improve the security of generated stego images are not answered.
Revised: So how to fully utilize the given images to hide secret, and to improve the security of generated stego images are not answered.

Original: After analysing the drawbacks of SOTA algorithms, we ﬁnd GAN is very suitable for integrated steganography and steganalysis framework.
Revised: After analysing the drawbacks of state-of-the-art algorithms, we ﬁnd GAN is very suitable for integrated steganography and steganalysis framework.

Original: Instead of artiﬁcial design, the generative network can learn from training samples and generate the suitable imperceptible features by itself.
Revised: Instead of artiﬁcial design, the generative network can learn from training samples and generate the suitable imperceptible features by itself.

Original: The discriminative network can simulate the function of steganalysis.
Revised: The discriminative network can simulate the function of steganalysis.

Original: The iterative adversarial training process can strength the capability if steganalysis model as well as steganography model.
Revised: The iterative adversarial training process can strength the capability if steganalysis model as well as steganography model.

Original: The stronger steganalysis model will stimulate the boost of steganography model, and vice versa.
Revised: The stronger steganalysis model will stimulate the boost of steganography model, and vice versa.

Original: Moreover, how to resist the tampering can also be learned from attacked training samples.
Revised: Moreover, how to resist the tampering can also be learned from attacked training samples.

Original: For the ﬁrst evaluation metric, let’s imagine the following situation.
Revised: For the ﬁrst evaluation metric, let’s imagine the following situation.

Original: An eavesdropper wants to check whether the image he obtained from public media contains secret info.
Revised: An eavesdropper wants to check whether the image he obtained from public media contains secret info.

Original: So he needs to discriminate the original cover image and received stego image.
Revised: So he needs to discriminate the original cover image and received stego image.

Original: If these two images are perceptibly same, then the eavesdropper can hardly differentiate the stego image from the cover image.
Revised: If these two images are perceptibly same, then the eavesdropper can hardly differentiate the stego image from the cover image.

Original: For the purpose of steganography, we can accumulate the visual and statistic differences between cover and stego images.
Revised: For the purpose of steganography, we can accumulate the visual and statistic differences between cover and stego images.

Original: If the difference for each evaluation metric is small enough, we can regard this stego image as a high-quality steganography result.
Revised: If the difference for each evaluation metric is small enough, we can regard this stego image as a high-quality steganography result.

Original: This aligns with the imperceptible evaluation criterion of steganography.
Revised: This aligns with the imperceptible evaluation criterion of steganography.

Original: For the second evaluation metric, let’s imagine the following situation.
Revised: For the second evaluation metric, let’s imagine the following situation.

Original: The eavesdropper wants to destroy the secret communication.
Revised: The eavesdropper wants to destroy the secret communication.

Original: So he makes intentional changes to the stego image, like rotate, clip, add noises and JPEG compression.
Revised: So he makes intentional changes to the stego image, like rotate, clip, add noises and JPEG compression.

Original: Because he assume that even the image he obtained contains secret, these intentional changes will make the secret extraction method disabled.
Revised: Because he assume that even the image he obtained contains secret, these intentional changes will make the secret extraction method disabled.

Original: If the steganography framework is secure, and steganalysis algorithm is robust enough, the intentional changes are in vain.
Revised: If the steganography framework is secure, and steganalysis algorithm is robust enough, the intentional changes are in vain.

Original: This aligns with the secure evaluation criterion of steganography.
Revised: This aligns with the secure evaluation criterion of steganography.

Original: GAN (Goodfellow et al., 2014) consists of the generative model and the discriminative model.
Revised: GAN (Goodfellow et al., 2014) consists of the generative model and the discriminative model.

Original: The purpose of the generative model is to generate new samples which are very similar to the real samples, and attempts to confuse the discriminator.
Revised: The purpose of the generative model is to generate new samples which are very similar to the real samples, and attempts to confuse the discriminator.

Original: While the purpose of the discriminative model is to classify samples synthesized by the generative model and the real ones.
Revised: While the purpose of the discriminative model is to classify samples synthesized by the generative model and the real ones.

Original: The discriminative model will also estimate the probability that a speciﬁc sample comes from the generative model rather than the real ones.
Revised: The discriminative model will also estimate the probability that a speciﬁc sample comes from the generative model rather than the real ones.

Original: When the whole GAN model achieves Nash Equilibrium, that is to say, the generative model can generate the samples which exactly align with the character and distribution of real samples.
Revised: When the whole GAN model achieves Nash Equilibrium, that is to say, the generative model can generate the samples which exactly align with the character and distribution of real samples.

Original: And at the same time, the discriminative model returns the classiﬁcation probability 0.
Revised: And at the same time, the discriminative model returns the classiﬁcation probability 0.

Original: for each pair of generated and real samples.
Revised: for each pair of generated and real samples.

Original: Then this GAN model is well-trained and converged.
Revised: Then this GAN model is well-trained and converged.

Original: [Figure]
Revised: [Figure]

Original: To combine the purpose of steganography, steganalysis and GAN model, we proposethe novel ISS-GAN framework.
Revised: To combine the purpose of steganography, steganalysis and GAN model, we propose novel ISSGAN framework.

Original: ISS-GAN also consists of the steganography generative and steganalysis discriminative model.
Revised: ISS-GAN also consists of the steganography generative and steganalysis discriminative model.

Original: The purpose of steganography generative model is to generate stego image which is aligned with the original cover image, and attempts to confuse steganalysis discriminative model.
Revised: The purpose of steganography generative model is to generate stego image which is aligned with the original cover image, and attempts to confuse steganalysis discriminative model.

Original: While the purpose of the discriminative model is to distinguish generated stego image from the cover image.
Revised: While the purpose of the discriminative model is to distinguish generated stego image from the cover image.

Original: When ISS-GAN achieves Nash Equilibrium, i.e., the generative model can generate stego image which exactly aligns with the character and distribution of cover image.
Revised: When ISS-GAN achieves Nash Equilibrium, i.e., the generative model can generate stego image which exactly aligns with the character and distribution of cover image.

Original: And at the same time, the discriminative model returns the classiﬁcation probability 0.5 for each pair of stego and cover image.
Revised: And at the same time, the discriminative model returns the classiﬁcation probability 0.5 for each pair of stego and cover image.

Original: This also aligns with the evaluation criterion of steganography and steganalysis.
Revised: This also aligns with the evaluation criterion of steganography and steganalysis.

Original: In conclusion, designing steganography and steganalysis framework is equal to make the ISS-GAN model well-trained and converged.
Revised: In conclusion, designing steganography and steganalysis framework is equal to make the ISS-GAN model well-trained and converged.

Original: The overall framework of ISS-GAN is shown in Figure.
Revised: The overall framework of ISS-GAN is shown in Figure.

Original: In ISS-GAN, there are two generative models and two discriminative models.
Revised: In ISS-GAN, there are two generative models and two discriminative models.

Original: Because steganography and steganalysis framework should contain secret info embedding and extraction processes, so it needs to learn the bijective mapping relationship between two image collections.
Revised: Because steganography and steganalysis framework should contain secret info embedding and extraction processes, so it needs to learn the bijective mapping relationship between two image collections.

Original: For ISS-GAN, one image collection contains the original cover images, the other collection contains the secret images for embedding.
Revised: For ISS-GAN, one image collection contains the original cover images, the other collection contains the secret images for embedding.

Original: In the left part of Figure 2, the original cover image ( CI ) and the original secret image ( STI ) go through the stego image generative model G SOI , to produce the stego image ( SOI ).
Revised: In the left part of Figure 2, the original cover image ( CI ) and the original secret image ( STI ) go through the stego image generative model G SOI , to produce the stego image ( SOI ).

Original: This is the secret embedding and stego image generation process, which can be expressed as follows.
Revised: This is the secret embedding and stego image generation process, which can be expressed as follows.

Original: [Equation]
Revised: [Equation]

Original: In the right part of Figure 2, the stego image ( SOI ) go through the secret image generative model
Revised: In the right part of Figure 2, the stego image ( SOI ) go through the secret image generative model

Original: G STI , to get the extracted secret image ( ESTI ).
Revised: G STI , to get the extracted secret image ( ESTI ).

Original: This is the secret image extraction process, which can be expressed as follows.
Revised: This is the secret image extraction process, which can be expressed as follows.

Original: [Equation]
Revised: [Equation]

Original: The cover image discriminative model D CI ensures that the distribution of images from CI is indistinguishable from the distribution SOI using an adversarial loss.
Revised: The cover image discriminative model D CI ensures that the distribution of images from CI is indistinguishable from the distribution SOI using an adversarial loss.

Original: This is the guarantee of the imperceptible evaluation criterion in steganography.
Revised: This is the guarantee of the imperceptible evaluation criterion in steganography.

Original: For the purpose of reﬁning secret extraction, we introduce the secret image cycle discriminative model D STI .
Revised: For the purpose of reﬁning secret extraction, we introduce the secret image cycle discriminative model D STI .

Original: Because generative model is learned to transform from a source image domain to a target image domain.
Revised: Because generative model is learned to transform from a source image domain to a target image domain.

Original: Take the secret image generative model G STI as an example, the learned mapping relation is highly under-constrained, and cannot ensure the generated ESTI is indistinguishable from original STI (Zhu et al., 2017).
Revised: Take the secret image generative model G STI as an example, the learned mapping relation is highly under-constrained, and cannot ensure the generated ESTI is indistinguishable from original STI (Zhu et al., 2017).

Original: So we couple this mapping relation with its inverse mapping
Revised: So we couple this mapping relation with its inverse mapping

Original: G SOI , and introduce a cycle adversarial loss:
Revised: G SOI , and introduce a cycle adversarial loss:

Original: [Equation]
Revised: [Equation]

Original: That is equal to
Revised: That is equal to

Original: [Equation]
Revised: [Equation]

Original: Its goal is to ensure that the distribution of images from ESTI is indistinguishable from the distribution STI using cycle adversarial loss D STI .
Revised: Its goal is to ensure that the distribution of images from ESTI is indistinguishable from the distribution STI using cycle adversarial loss D STI .

Original: This is the guarantee of the secure and robust extraction criterion in steganography and steganalysis.
Revised: This is the guarantee of the secure and robust extraction criterion in steganography and steganalysis.

Original: To reﬁne steganalysis scheme, we introduce the extra inconsistent loss.
Revised: To reﬁne steganalysis scheme, we introduce the extra inconsistent loss.

Original: To make the whole ISSGAN framework useable, we should ensure the secret can only be extracted from SOI .
Revised: To make the whole ISSGAN framework useable, we should ensure the secret can only be extracted from SOI .

Original: If we apply the secret extraction process to CI , secret image should not be recovered.
Revised: If we apply the secret extraction process to CI , secret image should not be recovered.

Original: The inconsistent loss can be expressed as follows:
Revised: The inconsistent loss can be expressed as follows:

Original: [Equation]
Revised: [Equation]

Original: 3. L OSS F UNCTION D EFINITION
Revised: 3. L OSS F UNCTION D EFINITION

Original: The overall loss function of ISS-GAN consists of three parts: the adversarial loss L GAN ( G SOI ,
Revised: The overall loss function of ISS-GAN consists of three parts: the adversarial loss L GAN ( G SOI ,

Original: D CI ), the cycle adversarial loss L GAN ( G STI , D STI ) and the inconsistent loss L IC .
Revised: D CI ), the cycle adversarial loss L GAN ( G STI , D STI ) and the inconsistent loss L IC .

Original: So the loss function is written as follows:
Revised: So the loss function is written as follows:

Original: [Equation]
Revised: [Equation]

Original: where λ is the parameter to adjust the percentages between adversarial loss and inconsistent loss.
Revised: where λ is the parameter to adjust the percentages between adversarial loss and inconsistent loss.

Original: The inconsistent loss needs to change to the minimization format as follows.
Revised: The inconsistent loss needs to change to the minimization format as follows.

Original: [Equation]
Revised: [Equation]

Original: In ISS-GAN framework, the quality of generated stego image SOI and extracted secret image ESTI is judged by the difference from original cover image CI and original secret image STI , respectively.
Revised: In ISS-GAN framework, the quality of generated stego image SOI and extracted secret image ESTI is judged by the difference from original cover image CI and original secret image STI , respectively.

Original: In this paper, two quantitative image effect indicators are applied to measure the differences (Yu, 2017).
Revised: In this paper, two quantitative image effect indicators are applied to measure the differences (Yu, 2017).

Original: Peak Signal to Noise Ratio (PSNR) indicator is applied to assess the effect difference from the gray-level ﬁdelity aspect.
Revised: Peak Signal to Noise Ratio (PSNR) indicator is applied to assess the effect difference from the gray-level ﬁdelity aspect.

Original: Structural Similarity (SSIM) (Wang et al., 2004) indicator which is an image quality assessment indicator based on the human vision system is applied to assess the effect difference from the structure-level ﬁdelity aspect.
Revised: Structural Similarity (SSIM) (Wang et al., 2004) indicator which is an image quality assessment indicator based on the human vision system is applied to assess the effect difference from the structure-level ﬁdelity aspect.

Original: The deﬁnitions of these two evaluation indicators are as follows.
Revised: The deﬁnitions of these two evaluation indicators are as follows.

Original: [Equation]
Revised: [Equation]

Original: where MAX I is the maximum possible pixel value of images: x and y .
Revised: where MAX I is the maximum possible pixel value of images: x and y .

Original: MSE ( x , y ) represents the
Revised: MSE ( x , y ) represents the

Original: Mean Squared Error (MSE) between images: x and y .
Revised: Mean Squared Error (MSE) between images: x and y .

Original: [Equation]
Revised: [Equation]

Original: where µ x and µ y represent the average grey values of images.
Revised: where µ x and µ y represent the average grey values of images.

Original: Symbol σ x and σ y represent the variances of images.
Revised: Symbol σ x and σ y represent the variances of images.

Original: Symbol σ xy represents covariance between images.
Revised: Symbol σ xy represents covariance between images.

Original: C 1 and C 1 are two constants which are used to prevent unstable results when either µ 2 x + µ 2 y or σ 2 x + σ 2 y is very close to 0.
Revised: C 1 and C 1 are two constants which are used to prevent unstable results when either µ 2 x + µ 2 y or σ 2 x + σ 2 y is very close to 0.

Original: 3. ISS-GAN N ETWORK S TRUCTURE
Revised: 3. ISS-GAN N ETWORK S TRUCTURE

Original: For ISS-GAN, the resolution of cover image CI and secret image STI is 256 × 256.
Revised: For ISS-GAN, the resolution of cover image CI and secret image STI is 256 × 256.

Original: The network structure of stego image generative model G SOI includes a convolution layer (kernel size = 7, stride = 0, pad = 0), two convolution layers (kernel size = 3, stride = 2, pad = 1), nine residual blocks (He et al., 2016), and two deconvolution layers (kernel size = 3, stride = 2, pad = 1, outside pad = 1), and a convolution layer (kernel size = 7, stride = 0, pad = 0).
Revised: The network structure of stego image generative model G SOI includes a convolution layer (kernel size = 7, stride = 0, pad = 0), two convolution layers (kernel size = 3, stride = 2, pad = 1), nine residual blocks (He et al., 2016), and two deconvolution layers (kernel size = 3, stride = 2, pad = 1, outside pad = 1), and a convolution layer (kernel size = 7, stride = 0, pad = 0).

Original: Each convolution and deconvolution layer follows with an instance normalization layer and a ReLU layer.
Revised: Each convolution and deconvolution layer follows with an instance normalization layer and a ReLU layer.

Original: The structure of secret image generative model G STI is identical with G SOI .
Revised: The structure of secret image generative model G STI is identical with G SOI .

Original: The network structure of cover image discriminative model D CI is similar with PatchGAN model (Isola et al., 2017).
Revised: The network structure of cover image discriminative model D CI is similar with PatchGAN model (Isola et al., 2017).

Original: Each time, it operates a image patch with 70 × 70 size, and classiﬁes whether this patch is real or fake.
Revised: Each time, it operates a image patch with 70 × 70 size, and classiﬁes whether this patch is real or fake.

Original: The model will run across the whole image, and average all results in the 70 × 70 overlapping patches to provide the ensemble output.
Revised: The model will run across the whole image, and average all results in the 70 × 70 overlapping patches to provide the ensemble output.

Original: The architecture of such a patch-level discriminative model requires fewer parameters and runs faster than a full-image discriminator (Yi et al., 2017).
Revised: The architecture of such a patch-level discriminative model requires fewer parameters and runs faster than a full-image discriminator (Yi et al., 2017).

Original: Moreover, it has no constraints over the size of the input image.
Revised: Moreover, it has no constraints over the size of the input image.

Original: D C contains a convolution layer (kernel size = 4, stride = 2, pad = 1) follows with a leaky ReLU layer, three convolution layers (kernel size = 4, stride = 2, pad = 1) follows with an instance normalization layer and a leaky
Revised: D C contains a convolution layer (kernel size = 4, stride = 2, pad = 1) follows with a leaky ReLU layer, three convolution layers (kernel size = 4, stride = 2, pad = 1) follows with an instance normalization layer and a leaky

Original: ReLU layer, a convolution layer (kernel size = 4, stride = 1, pad = 1) follows with an instance normalization layer and a leaky ReLU layer, a convolution layer (kernel size = 4, stride = 1, pad = 1) follows with a sigmoid layer to output a scalar output between [0, 1].
Revised: ReLU layer, a convolution layer (kernel size = 4, stride = 1, pad = 1) follows with an instance normalization layer and a leaky ReLU layer, a convolution layer (kernel size = 4, stride = 1, pad = 1) follows with a sigmoid layer to output a scalar output between [0, 1].

Original: The structure of secret image cycle discriminative model D STI is identical with D CI .
Revised: The structure of secret image cycle discriminative model D STI is identical with D CI .

Original: Moreover, to improve the convergence performance, we use Adam optimizer (Kinga & Adam, 2015) instead of stochastic gradient descent (SGD) optimizer.
Revised: Moreover, to improve the convergence performance, we use Adam optimizer (Kinga & Adam, 2015) instead of stochastic gradient descent (SGD) optimizer.

Original: In practice, Adam optimizer can be adaptive to the training of ISS-GAN.
Revised: In practice, Adam optimizer can be adaptive to the training of ISS-GAN.

Original: It is computationally efﬁcient and has little memory requirements.
Revised: It is computationally efﬁcient and has little memory requirements.

Original: The hyper-parameters of Adam optimizer are: β 1 =0.5, β 2 =0.999.
Revised: The hyper-parameters of Adam optimizer are: β 1 =0.5, β 2 =0.999.

Original: The base learning rate is 0.0002.
Revised: The base learning rate is 0.0002.

Original:  E XPERIMENTAL R ESULTS 4. S TEGANOGRAPHY P ERFORMANCE E XPERIMENTS
Revised:  E XPERIMENTAL R ESULTS 4. S TEGANOGRAPHY P ERFORMANCE E XPERIMENTS

Original: In the secret embedding and stego image generation performance experiments, we adopt the benchmark images as the cover images CI shown in the ﬁrst row of Figure 3 to test the performance of proposed ISS-GAN framework. 
Revised: In the secret embedding and stego image generation performance experiments, we adopt the benchmark images as the cover images CI shown in the ﬁrst row of Figure 3 to test the performance of proposed ISS-GAN framework. The embedded secret image used is the Barbara benchmark image.

Revised: We use PyTorch as the framework and train ISS-GAN with 150 epochs.

Original: The generated stego images SOI are shown in the second row of 
Revised: The generated stego images SOI are shown in the second row of Figure 3.

Original:  Figure 3. 
Revised: For illustration purpose, the residual differences between cover and stego images are shown in the third row of Figure 3. The PSNR and SSIM metrics for generated stego images SOI versus cover images CI are shown in Table 1. ( SOI is used as image x , and CI is used as image y for PSNR and SSIM metrics calculation equations (8) and (9).)

Original: The results shown in Figure 3 and Table.
Revised: The results shown in Figure 3 and Table.

Original: 1 can prove the high quality and difference imperceptibility of SOI in qualitative and quantitative aspects.
Revised: 1 can prove the high quality and difference imperceptibility of SOI in qualitative and quantitative aspects.

Original: [Table]
Revised: [Table]

Revised: Let’s have a further analysis of the obtained results.

Revised: If we magnify Figure 3 to see the residual differences, we can ﬁnd they are mainly on the marginal and textural parts of objects.

Revised: For example, the hat of Lena, the edges of F16 plane, the skin and whiskers of baboon, the proﬁle of fruits and peppers, etc.

Original: [Table]
Revised: It means ISS-GAN tends to hide the secret info into marginal parts of the object in original cover images. In information theory, textures and edges represent the high frequency parts of the image, while smooth regions represent the low frequency parts of the image. If we change the low frequency parts, it is easy to be detected by steganalysis method. So many state-of-theart steganography algorithms transform the cover image from spatial domain to frequency domain.

Revised: Change the tiny part in high frequency parts, and transform it back to spatial domain.

Revised: Moreover, when we discuss the state-of-the-art content adaptive steganography algorithms, we ﬁnd the ultimate goal is trying to embed the secret image into the parts with complex edges and textures, and avoiding the smooth regions of the cover images.

Revised: The behavior of ISS-GAN is very similar to the state-ofthe-art steganography algorithms.

Revised: But the state-of-the-art algorithms need to design a hand-crafted distortion function to achieve the goal, while ISS-GAN learns from the discriminative network which simulates the behaviors of steganalysis.

Revised: From the learning process, the generative network in ISSGAN ﬁnds steganalysis method are very sensitive to the low frequency parts, and not so sensitive to the high frequency parts.

Revised: So the stego images generated by ISS-GAN generative network mainly hide their secret info into marginal and textural parts to ensure the best imperceptibility.

Original: 4. S TEGANALYSIS Q UALITATIVE P ERFORMANCE E XPERIMENTS
Revised: 4. S TEGANALYSIS Q UALITATIVE P ERFORMANCE E XPERIMENTS

Original: In the steganalysis qualitative experiments, we adopt the world-renowned art paintings shown in
Revised: In the steganalysis qualitative experiments, we adopt the world-renowned art paintings shown in

Original: Figure 1 to test the performance of proposed ISS-GAN and its robustness to different patterns of noise attack.
Revised: Figure 1 to test the performance of proposed ISS-GAN and its robustness to different patterns of noise attack.

Original: Several patterns of noises are adopted respectively to imitatethe real-world noise attacks.
Revised: Several patterns of noises are adopted respectively to imitate real-world noise attacks.

Revised: We use PyTorch as the framework and train ISS-GAN with 200 epochs.

Original: The extracted secret image ESTI are shown in Figure 4.
Revised: The extracted secret image ESTI are shown in Figure 4.

Original: The results shown in Figure 4 can prove the high quality of ESTI in qualitative aspect.
Revised: The results shown in Figure 4 can prove the high quality of ESTI in qualitative aspect.

Original: 4. S TEGANALYSIS Q UANTITATIVE C OMPARATIVE E XPERIMENTS
Revised: 4. S TEGANALYSIS Q UANTITATIVE C OMPARATIVE E XPERIMENTS

Original: We compare ISS-GAN with the state-of-the-art steganography methods in various image benchmarks.
Revised: We compare ISS-GAN with the state-of-the-art steganography methods in various image benchmarks.

Original: Here we use steganalysis process to extract secret images from stego images, and evaluate the security criteria of steganography algorithms.
Revised: Here we use steganalysis process to extract secret images from stego images, and evaluate the security criteria of steganography algorithms.

Original: For LSB steganography algorithms, we choose
Revised: For LSB steganography algorithms, we choose

Original: LSB-TLH Das et al.
Revised: LSB-TLH Das et al.

Original: For content adaptive steganography algorithms, we choose WOW Holub & Fridrich (2012), HUGO (Pevn`y et al., 2010) and S-UNIWARD (Holub et al., 2014).
Revised: For content adaptive steganography algorithms, we choose WOW Holub & Fridrich (2012), HUGO (Pevn`y et al., 2010) and S-UNIWARD (Holub et al., 2014).

Original: For deep learning based steganography algorithms, we choose ISGAN Dong et al.
Revised: For deep learning based steganography algorithms, we choose ISGAN Dong et al.

Original: and SSGAN Shi et al.
Revised: and SSGAN Shi et al.

Original: (2017) for comparation.
Revised: (2017) for comparation.

Original: We make two group experiments.
Revised: We make two group experiments.

Original: In the ﬁrst group experiment, we use Lena as the original cover image, and the trolleybus image as the secret image.
Revised: In the ﬁrst group experiment, we use Lena as the original cover image, and the trolleybus image as the secret image.

Original: The results are shown in Figure 5.
Revised: The results are shown in Figure 5.

Original: In the second group experiment, we use Lena as the original cover image, and the headline of ICLR conference as the secret image.
Revised: In the second group experiment, we use Lena as the original cover image, and the headline of ICLR conference as the secret image.

Original: The results are shown in Figure 6.
Revised: The results are shown in Figure 6.

Original: [Table]
Revised: In quantitative experiments, we add the JPEG compression to simulate the coding and decoding processes in real secure information transmission system. We need to ensure ISS-GAN can work well against coding and decoding algorithms.

Original: The PSNR and SSIM metrics for extracted secret image of trolleybus and ICLR conference headline are shown in Table 2 ∼ 5, respectively.
Revised: The PSNR and SSIM metrics for extracted secret image of trolleybus and ICLR conference headline are shown in Table 2 ∼ 5, respectively.

Revised: In Table 2 ∼ 5, extracted secret image is used as image x , and original secret image is used as image y for PSNR and SSIM metrics calculation equations (8)

Original:  According to these metrics, the security of ISS-GAN outperforms all other state-of-the-art steganography algorithms in quantitative aspect.
Revised: [Table] and (9). According to these metrics, the security of ISS-GAN outperforms all other state-of-the-art steganography algorithms in quantitative aspect [Table]

Original: In these two group experiments
Revised: In these two group experiments

Original: [Table]
Revised: [Table]

Original: PSNR and SSIM metrics, the closest competitors are content adaptive steganography algorithms.
Revised: PSNR and SSIM metrics, the closest competitors are content adaptive steganography algorithms.

Original: WOW , HUGO and S-UNIWARD have quite good performance on steganography security.
Revised: WOW , HUGO and S-UNIWARD have quite good performance on steganography security.

Original: But for PSNR metric, ISS-GAN can still achieve 1.01X ∼ 1.12X relative improvement over the second highest PSNR algorithms with trolleybus secret image embedded, and achieve 1.01X ∼ 1.81X relative improvement over the second highest PSNR algorithms with ICLR 
Revised: But for PSNR metric, ISS-GAN can still achieve 1.01X ∼ 1.12X relative improvement over the second highest PSNR algorithms with trolleybus secret image embedded, and achieve 1.01X ∼ 1.81X relative improvement over the second highest PSNR algorithms with ICLR conference headline secret image embedded. For SSIM metric, ISS-GAN can achieve 1.01X ∼ 1.11X

Original: [Table]
Revised: [Table]

Original: conference headline secret image embedded. For SSIM metric, ISS-GAN can achieve 1.01X ∼ 1.11X relative improvement over the second highest SSIM algorithms with trolleybus secret image embedded, and achieve 1.01X ∼ 1.46X relative improvement over the second highest SSIM algorithms with
Revised: relative improvement over the second highest SSIM algorithms with trolleybus secret image embedded, and achieve 1.01X ∼ 1.46X relative improvement over the second highest SSIM algorithms with

Original: ICLR conference headline secret image embedded.
Revised: ICLR conference headline secret image embedded.

Revised: To have a further analysis of the obtained results

Revised: [Table]

Original: The performance of SOTA deep learning steganography algorithms is not as good as expected.
Revised: we can ﬁnd the performance of state-of-theart deep learning steganography algorithms is not as good as expected.

Original: The main reason is the authors are more focus on generating the new cover images which are steganalysis-secure.
Revised: The main reason is the authors are more focus on generating the new cover images which are steganalysis-secure.

Original: But in our experiments, the cover images are ﬁxed.
Revised: But in our experiments, the cover images are ﬁxed.

Original: So we can see the perfor-
Revised: So we can see the performance of state-of-the-art deep

Original: [Table] [Table] 
Revised: [Table] [Table] [Figure]

Original: mance of SOTA deep learning steganography algorithms is just at the same level of LSB steganography algorithms, and is worse than content adaptive steganography algorithms.
Revised: learning steganography algorithms is just at the same level of LSB steganography algorithms, and is worse than content adaptive steganography algorithms.

Original: Compare the results of ﬁrst and second group experiments, we ﬁnd ISS-GAN has better performance with the ICLR conference headline secret image.
Revised: Compare the results of ﬁrst and second group experiments, we ﬁnd ISS-GAN has better performance with the ICLR conference headline secret image.

Original: The amount of meaningful pixels and semantic info in ICLR conference headline image is much less than trolleybus image.
Revised: The amount of meaningful pixels and semantic info in ICLR conference headline image is much less than trolleybus image.

Original: This aligns with the principle of steganography, i.e., if more pixels are concealed into the cover image, then the security of stego image will be worse.
Revised: This aligns with the principle of steganography, i.e., if more pixels are concealed into the cover image, then the security of stego image will be worse.

Original: C ONCLUSION AND F UTURE W ORKS
Revised: To further illustrate the effect of embedding secret info amount on the security and imperceptibility of stego image, we make the curve plots to show the quantitative experiment results of generated stego images SOI versus cover images CI as shown in Figure 7. Here, we use the pixel-ratio to control the amount of embedding secret info. It is deﬁned as the ratio of valid pixels amount in secret image versus those in cover images. For example, if the amount of valid pixels in 256 ×size cover image is 63000, and the amount of valid pixels in secret image is 15000, then pixel-ratio is 0.2381.

Revised: From the curve plots shown above, we can see PSNR and SSIM metrics decline with the increase of pixel-ratio.

Revised: Under the noise attack or image compression, PSNR and SSIM metrics are worse than the situations without attack, and also decline with the increase of pixel-ratio.

Revised: The detailed results further prove the inherent contradiction between embedded secret amount and security of stego image.

Revised: So in the real applications, ISS-GAN should make the trade-off between embedding capacity, imperceptibility and security according to real requirements, just like all state-of-the-art steganography methods.

Revised: This curve can tell user the largest embedded secret capacity at certain imperceptibility and security level.

Revised: So it is helpful for user to choose the most suitable embedded secret image in real secure information transmission systems.

Revised: For example, if the user want to generate a stego image with no less than 25dB PSNR and 0.97 SSIM versus cover image.

Revised: Considering the noise attacks and image compression possibility, the largest embedded secret pixel-ratio should be less than 0.5.

Revised:  C ONCLUSION AND F UTURE W ORKS

Original: In this paper, we integrate steganography and steganalysis into single framework.
Revised: In this paper, we integrate steganography and steganalysis into single framework.

Original: The good performance of ISS-GAN derives from the following factors
Revised: The good performance of ISS-GAN derives from the following factors.

Original: • The discriminative network simulates the features of steganalysis.
Revised: • The discriminative network simulates the features of steganalysis.

Original: It helps to understand the sensitivity of cover images to semantic changes.
Revised: It helps to understand the sensitivity of cover images to semantic changes.

Original: • The introduction of cycle discriminative model and inconsistent loss helps to enhance the quality and security of generated stego image.
Revised: • The introduction of cycle discriminative model and inconsistent loss helps to enhance the quality and security of generated stego image.

Original: • The mixture training dataset can further improve the robustness and security of ISS-GAN framework.
Revised: • The mixture training dataset can further improve the robustness and security of ISS-GAN framework.

Original: How to resist the tampering can be learned from attacked training samples.
Revised: How to resist the tampering can be learned from attacked training samples.

Original: • The iterative adversarial training process can strength the capability if steganalysis model and steganography model at the same time.
Revised: • The iterative adversarial training process can strength the capability if steganalysis model and steganography model at the same time.

Original: The stronger steganalysis model will stimulate the improvement of steganography model, and vice versa.
Revised: The stronger steganalysis model will stimulate the improvement of steganography model, and vice versa.

Original: In the future, we will involve more types of intentional attacks, such as cropping, scaling, rotation, ﬁltering, etc.

Original: And study their inﬂuence on ISS-GAN. We willalso study the inﬂuence of color cover/secret image andthe gray cover/secret 
Revised: In the future, we will study the inﬂuence of color cover/secret image and gray cover/secret image to the proposed ISS-GAN framework.