Original: L EARNING I TERATIVE N EURAL O PTIMIZERS FOR I MAGE S TEGANOGRAPHY
Revised: L EARNING I TERATIVE N EURAL O PTIMIZERS FOR I MAGE S TEGANOGRAPHY

Original: A BSTRACT
Revised: A BSTRACT

Original: Image steganography is the process of concealing secret information in images through imperceptible changes.
Revised: Image steganography is the process of concealing secret information in images through imperceptible changes.

Original: Recent work has formulated this task as a classic constrained optimization problem.
Revised: Recent work has formulated this task as a classic constrained optimization problem.

Original: In this paper, we argue that image steganography is inherently performed on the (elusive) manifold of natural images, and propose an iterative neural network trained to perform the optimization steps.
Revised: In this paper, we argue that image steganography is inherently performed on the (elusive) manifold of natural images, and propose an iterative neural network trained to perform the optimization steps.

Original: In contrast to classic optimization methods like L-BFGS or projected gradient descent, we train the neural network to also stay close to the manifold of natural images throughout the optimization.
Revised: In contrast to classic optimization methods like L-BFGS or projected gradient descent, we train the neural network to also stay close to the manifold of natural images throughout the optimization.

Original: We show that our learned neural optimization is faster and more reliable than classic optimization approaches.
Revised: We show that our learned neural optimization is faster and more reliable than classic optimization approaches.

Original: In comparison to previous state-of-the-art encoder-decoder-based steganography methods, it reduces the recovery error rate by multiple orders of magnitude and achieves zero error up to 3 bits per pixel (bpp) without the need for error-correcting codes.
Revised: In comparison to previous state-of-the-art encoder-decoder-based steganography methods, it reduces the recovery error rate by multiple orders of magnitude and achieves zero error up to 3 bits per pixel (bpp) without the need for error-correcting codes.

Original: Our code is available at https://github.com/cxy1997/LISO .
Revised: Our code is available at https://github.com/cxy1997/LISO .

Original:  I NTRODUCTION
Revised:  I NTRODUCTION

Original: Image steganography aims to alter a cover image, to imperceptibly hide a (secret) bit string, such that a previously defined decoding method can then extract the message from the altered image.
Revised: Image steganography aims to alter a cover image, to imperceptibly hide a (secret) bit string, such that a previously defined decoding method can then extract the message from the altered image.

Original: Steganography has been used in many applications such as digital watermarking to establish ownership (Cox et al., 2007),
Revised: Steganography has been used in many applications such as digital watermarking to establish ownership (Cox et al., 2007),

Original: copyright certification (Bilal et al., 2014), anonymized image sharing (Kishore et al., 2021), and for hiding information coupled with images (e.g. patient name and
Revised: copyright certification (Bilal et al., 2014), anonymized image sharing (Kishore et al., 2021), and for hiding information coupled with images (e.g. patient name and

Original: ID in medical CT scans (Srinivasan et al., 2004)).
Revised: ID in medical CT scans (Srinivasan et al., 2004)).

Original: Following the success of neural networks on various tasks, prior work has used end-to-end encoder-decoder networks for steganography (Zhu et al., 2018; Zhang et al., 2019; Hayes & Danezis, 2017a; Baluja, 2017).
Revised: Following the success of neural networks on various tasks, prior work has used end-to-end encoder-decoder networks for steganography (Zhu et al., 2018; Zhang et al., 2019; Hayes & Danezis, 2017a; Baluja, 2017).

Original: The encoder takes as input an image X and a message M , and produces a steganographic image ˜
Revised: The encoder takes as input an image X and a message M , and produces a steganographic image ˜

Original: X that is visually imperceptible from the original image X .
Revised: X that is visually imperceptible from the original image X .

Original: The decoder recovers the message M from the steganographic image ˜
Revised: The decoder recovers the message M from the steganographic image ˜

Original: X .
Revised: X .

Original: Such methods can hide large amounts of data in images with great image quality, due to convolutional networks’ ability to generate realistic outputs that are close to the input image along the manifold of natural images (Zhu et al., 2016; Zhang et al., 2019).
Revised: Such methods can hide large amounts of data in images with great image quality, due to convolutional networks’ ability to generate realistic outputs that are close to the input image along the manifold of natural images (Zhu et al., 2016; Zhang et al., 2019).

Original: However, these approaches can only reliably encode 2 bits per pixel.
Revised: However, these approaches can only reliably encode 2 bits per pixel.

Original: At higher bit rates, they suffer from poor recovery error rates for the message M (around 5-25% at 4 bpp).
Revised: At higher bit rates, they suffer from poor recovery error rates for the message M (around 5-25% at 4 bpp).

Original: Consequently, they cannot be used for some steganography applications that require the message to be recovered with 100.0% accuracy, for example, if the message is encrypted or hashed.
Revised: Consequently, they cannot be used for some steganography applications that require the message to be recovered with 100.0% accuracy, for example, if the message is encrypted or hashed.

Original: Although error-correcting codes (Crandall, 1998; Munuera, 2007) can be used to recover spurious mistakes, their reliance on additional parity bits reduces the payload, negating much of the advantages of neural approaches.
Revised: Although error-correcting codes (Crandall, 1998; Munuera, 2007) can be used to recover spurious mistakes, their reliance on additional parity bits reduces the payload, negating much of the advantages of neural approaches.

Original: Recent work abandoned learned encoders altogether and reformulated image steganography as a constrained optimization problem (Kishore et al., 2021), where the steganographic image is optimized with respect to the outputs of a fixed (random or pre-trained) decoder – by employing a technique based on adversarial image perturbations (Szegedy et al., 2013).
Revised: Recent work abandoned learned encoders altogether and reformulated image steganography as a constrained optimization problem (Kishore et al., 2021), where the steganographic image is optimized with respect to the outputs of a fixed (random or pre-trained) decoder – by employing a technique based on adversarial image perturbations (Szegedy et al., 2013).

Original: The optimization problem is solved with off-the-shelve gradient-based optimizers, such as projected gradient descent (Carlini & Wagner, 2017) or L-BFGS (Fletcher, 2013).
Revised: The optimization problem is solved with off-the-shelve gradient-based optimizers, such as projected gradient descent (Carlini & Wagner, 2017) or L-BFGS (Fletcher, 2013).

Original: Such approaches achieve low error rates with ∗ Equal contribution.
Revised: Such approaches achieve low error rates with ∗ Equal contribution.

Original: high payloads (2-3% error at 4 bpp), but are slow and prone to getting stuck in local minima.
Revised: high payloads (2-3% error at 4 bpp), but are slow and prone to getting stuck in local minima.

Original: Further, their pixel-level constraints only ensure that the steganographic image stays close to the input image according to an algebraic norm, rather than along the natural image manifold.
Revised: Further, their pixel-level constraints only ensure that the steganographic image stays close to the input image according to an algebraic norm, rather than along the natural image manifold.

Original: Although similar manifold-unaware approaches are successfully deployed for adversarial attacks, steganography needs to precisely control millions of binary decoder outputs, instead of a single class prediction; the optimization problem is thus harder and prone to producing unnatural-looking images.
Revised: Although similar manifold-unaware approaches are successfully deployed for adversarial attacks, steganography needs to precisely control millions of binary decoder outputs, instead of a single class prediction; the optimization problem is thus harder and prone to producing unnatural-looking images.

Original: [Figure]
Revised: [Figure]

Original: In this paper we introduce Learned Iterative
Revised: In this paper we introduce Learned Iterative

Original: Steganography Optimization (LISO) , a method that combines the ability of neural networks to learn image manifolds with the rigor of constrained optimization.
Revised: Steganography Optimization (LISO) , a method that combines the ability of neural networks to learn image manifolds with the rigor of constrained optimization.

Original: LISO is highly efficient in hiding messages inside images, and achieves very low message recovery error.
Revised: LISO is highly efficient in hiding messages inside images, and achieves very low message recovery error.

Original: LISO achieves these feats with an encoderdecoder-critic architecture.
Revised: LISO achieves these feats with an encoderdecoder-critic architecture.

Original: The encoder is a learned recurrent neural network that iteratively solves (Teed & Deng, 2020;
Revised: The encoder is a learned recurrent neural network that iteratively solves (Teed & Deng, 2020;

Original: Alaluf et al., 2021)
Revised: Alaluf et al., 2021)

Original: the constraint optimization problem proposed in Kishore et al.
Revised: the constraint optimization problem proposed in Kishore et al.

Original: and mimics the steps of a gradient-based optimization method.
Revised: and mimics the steps of a gradient-based optimization method.

Original: Figure 1 demonstrates how the steganographic image and error rate change over subsequent iterations.
Revised: Figure 1 demonstrates how the steganographic image and error rate change over subsequent iterations.

Original: We also use a critic network (Zhang et al., 2019) to ensure the changes stay imperceptible and that the steganographic image looks natural.
Revised: We also use a critic network (Zhang et al., 2019) to ensure the changes stay imperceptible and that the steganographic image looks natural.

Original: Our resulting architecture can be trained end-to-end.
Revised: Our resulting architecture can be trained end-to-end.

Original: We show that LISO finds more efficient descent directions than standard (manifold unaware) optimization algorithms and produces better steganography results with great consistency.
Revised: We show that LISO finds more efficient descent directions than standard (manifold unaware) optimization algorithms and produces better steganography results with great consistency.

Original: Finally, the error rate can (almost) always be driven to a flat 0 if the optimization is finished with a few iterations of
Revised: Finally, the error rate can (almost) always be driven to a flat 0 if the optimization is finished with a few iterations of

Original: L-BFGS within the vicinity of LISO’s solution (LISO + L-BFGS).
Revised: L-BFGS within the vicinity of LISO’s solution (LISO + L-BFGS).

Original: We evaluate the efficacy of LISO extensively across multiple datasets.
Revised: We evaluate the efficacy of LISO extensively across multiple datasets.

Original: We demonstrate that at testtime, with unseen cover images and random bit strings, the optimizer can reliably circumvent bad local minima and find a low-error solution within only a few iterative steps that already outperforms all previous encoder-decoder-based approaches.
Revised: We demonstrate that at testtime, with unseen cover images and random bit strings, the optimizer can reliably circumvent bad local minima and find a low-error solution within only a few iterative steps that already outperforms all previous encoder-decoder-based approaches.

Original: If the optimization is followed by a few additional updates of L-BFGS optimization, we can reliably reach 100% error-free recovery even with 3 bits per pixel (bpp) hidden information across all (thousands of) images we tested on.
Revised: If the optimization is followed by a few additional updates of L-BFGS optimization, we can reliably reach 100% error-free recovery even with 3 bits per pixel (bpp) hidden information across all (thousands of) images we tested on.

Original: Our contributions are as follows: 1) We introduce a novel gradient-based neural optimization algorithm, LISO, that learns preferred descent directions and is image manifold aware. 2)
Revised: Our contributions are as follows: 1) We introduce a novel gradient-based neural optimization algorithm, LISO, that learns preferred descent directions and is image manifold aware. 2)

Original: We show that its optimization process based on learned descent directions is orders of magnitudes faster than classic optimization procedures.
Revised: We show that its optimization process based on learned descent directions is orders of magnitudes faster than classic optimization procedures.

Original: As far as we know, our variant LISO + L-BFGS is by far the most accurate steganography algorithm in existence, resulting in perfect recovery on all images we tried with 3bpp and the vast majority for 4bpp — implying that it avoids bad local minima and can be deployed without error correcting code.
Revised: As far as we know, our variant LISO + L-BFGS is by far the most accurate steganography algorithm in existence, resulting in perfect recovery on all images we tried with 3bpp and the vast majority for 4bpp — implying that it avoids bad local minima and can be deployed without error correcting code.

Original:  R ELATED W ORK
Revised:  R ELATED W ORK

Original: Steganography.
Revised: Steganography.

Original: Classic steganography methods operate directly on the spatial image domain to encode data.
Revised: Classic steganography methods operate directly on the spatial image domain to encode data.

Original: Least Significant Bit (LSB)
Revised: Least Significant Bit (LSB)

Original: Steganography encodes data by replacing the least significant bits of the input image pixels with bits from the secret data sequentially (Chan & Cheng, 2004).
Revised: Steganography encodes data by replacing the least significant bits of the input image pixels with bits from the secret data sequentially (Chan & Cheng, 2004).

Original: Pixel-value Differencing (PVD) (Wu & Tsai, 2003) hides data by comparing the differences between the intensity values of two successive pixels.
Revised: Pixel-value Differencing (PVD) (Wu & Tsai, 2003) hides data by comparing the differences between the intensity values of two successive pixels.

Original: Following this, many methods were presented to hide data while minimizing distortion to the input images and these methods differed in how the distortion was measured.
Revised: Following this, many methods were presented to hide data while minimizing distortion to the input images and these methods differed in how the distortion was measured.

Original: Highly Undetectable Steganography (HUGO)
Revised: Highly Undetectable Steganography (HUGO)

Original: (Pevn`y et al., 2010) identifies pixels that can be modified without resulting in a large distortion based on handcrafted steganalytic
Revised: (Pevn`y et al., 2010) identifies pixels that can be modified without resulting in a large distortion based on handcrafted steganalytic

Original: 2012) uses codes to minimize the expected distortion and to identify noisy or high-textured regions to modify.
Revised: 2012) uses codes to minimize the expected distortion and to identify noisy or high-textured regions to modify.

Original: With the advent of deep learning, many deep learning approaches have been proposed for steganography.
Revised: With the advent of deep learning, many deep learning approaches have been proposed for steganography.

Original: These approaches either use neural networks in some stages of the pipeline (e.g., as a feature extractor) or learn end-to-end message encoding and decoding.
Revised: These approaches either use neural networks in some stages of the pipeline (e.g., as a feature extractor) or learn end-to-end message encoding and decoding.

Original: HiDDeN (Zhu et al., 2018) proposed an end-to-end encoder-decoder architecture to hide up to 0.4 bpp of information in images.
Revised: HiDDeN (Zhu et al., 2018) proposed an end-to-end encoder-decoder architecture to hide up to 0.4 bpp of information in images.

Original: Hayes & Danezis (2017b) used adversarial training to approximately hide 0.4 bpp in 32 × 32 images.
Revised: Hayes & Danezis (2017b) used adversarial training to approximately hide 0.4 bpp in 32 × 32 images.

Original: SteganoGAN Zhang et al.
Revised: SteganoGAN Zhang et al.

Original: (2019) adopted adversarial training to generate steganographic images with better quality, and can hide up to 6 bpp with error rates at about 13-33%.
Revised: (2019) adopted adversarial training to generate steganographic images with better quality, and can hide up to 6 bpp with error rates at about 13-33%.

Original: Tan et al.
Revised: Tan et al.

Original: (2021) improved upon SteganoGAN and introduce CHAT-GAN which uses an additional channel attention module to identify favorable channels in feature maps to hide bits of information.
Revised: (2021) improved upon SteganoGAN and introduce CHAT-GAN which uses an additional channel attention module to identify favorable channels in feature maps to hide bits of information.

Original: HiDDeN, SteganoGAN, and CHAT-GAN are designed to hide arbitrary bit strings but there is also a class of methods that aim to hide a (structured) image within an image (Baluja, 2017;
Revised: HiDDeN, SteganoGAN, and CHAT-GAN are designed to hide arbitrary bit strings but there is also a class of methods that aim to hide a (structured) image within an image (Baluja, 2017;

Original: Dong et al., 2018; Yu, 2020; Rahim et al., 2018) by condensing structural information.
Revised: Dong et al., 2018; Yu, 2020; Rahim et al., 2018) by condensing structural information.

Original: Invertible Steganography
Revised: Invertible Steganography

Original: Network (Lu et al., 2021) hid multiple images in a single cover image using an invertible neural network.
Revised: Network (Lu et al., 2021) hid multiple images in a single cover image using an invertible neural network.

Original: Deep Multi-Image Steganography with Private Keys (Shang et al., 2020) hid multiple images in a cover image while producing many secret keys, each of which is used to extract exactly one of the hidden images.
Revised: Deep Multi-Image Steganography with Private Keys (Shang et al., 2020) hid multiple images in a cover image while producing many secret keys, each of which is used to extract exactly one of the hidden images.

Original: HiNet (Jing et al., 2021) used an invertible network to hide information in the wavelet domain.
Revised: HiNet (Jing et al., 2021) used an invertible network to hide information in the wavelet domain.

Original: Universal Deep Hiding (UDH) (Zhang et al., 2020) explores finding coveragnostic universal perturbations that can be added to any natural image to hide a secret image.
Revised: Universal Deep Hiding (UDH) (Zhang et al., 2020) explores finding coveragnostic universal perturbations that can be added to any natural image to hide a secret image.

Original: There have also been attempts to conduct steganography with non-digital images (Tancik et al., 2020;
Revised: There have also been attempts to conduct steganography with non-digital images (Tancik et al., 2020;

Original: Wengrowski & Dana, 2019), but in this paper we focus on digital images.
Revised: Wengrowski & Dana, 2019), but in this paper we focus on digital images.

Original: Steganalysis.
Revised: Steganalysis.

Original: Many applications require that steganographic images are indistinguishable from natural images.
Revised: Many applications require that steganographic images are indistinguishable from natural images.

Original: Steganalysis systems are used to detect whether secret information is hidden in images and they can broadly be divided into two categories – statistical and neural.
Revised: Steganalysis systems are used to detect whether secret information is hidden in images and they can broadly be divided into two categories – statistical and neural.

Original: The former makes use of statistical tests on pixels to determine whether a message is encoded in an image (Dumitrescu et al., 2002b; Fridrich et al., 2001; Westfeld & Pfitzmann, 1999; Dumitrescu et al., 2002a), while the latter employs neural networks to detect the existence of hidden messages.
Revised: The former makes use of statistical tests on pixels to determine whether a message is encoded in an image (Dumitrescu et al., 2002b; Fridrich et al., 2001; Westfeld & Pfitzmann, 1999; Dumitrescu et al., 2002a), while the latter employs neural networks to detect the existence of hidden messages.

Original: Classic steganography methods can be easily detected by statistical tools, but more recent methods are complex and harder to detect with statistical tools and require neural tools.
Revised: Classic steganography methods can be easily detected by statistical tools, but more recent methods are complex and harder to detect with statistical tools and require neural tools.

Original: Neural steganalysis methods have shown state-of-the-art performances for detecting steganography with high accuracy even when low payloads of information are hidden.
Revised: Neural steganalysis methods have shown state-of-the-art performances for detecting steganography with high accuracy even when low payloads of information are hidden.

Original: GNCNN (Qian et al., 2016) used handcrafted features and CNNs to perform steganalysis.
Revised: GNCNN (Qian et al., 2016) used handcrafted features and CNNs to perform steganalysis.

Original: Following that, many methods have used deep networks to automatically extract features and perform steganalysis (You et al., 2020;
Revised: Following that, many methods have used deep networks to automatically extract features and perform steganalysis (You et al., 2020;

Original: Qian et al., 2015; Chen et al., 2017; Wu et al., 2019;
Revised: Qian et al., 2015; Chen et al., 2017; Wu et al., 2019;

Original: Qian et al., 2018).
Revised: Qian et al., 2018).

Original: In response to the advances in steganalysis, neural steganography methods add steganalysis systems into their end-to-end pipeline in order to find robust perturbations that evade detection by steganalysis systems (Shang et al., 2020; Dong et al., 2018).
Revised: In response to the advances in steganalysis, neural steganography methods add steganalysis systems into their end-to-end pipeline in order to find robust perturbations that evade detection by steganalysis systems (Shang et al., 2020; Dong et al., 2018).

Original: Learning to Optimize.
Revised: Learning to Optimize.

Original: Recent methods have investigated incorporating optimization problems into neural network architectures (Amos & Kolter, 2017;
Revised: Recent methods have investigated incorporating optimization problems into neural network architectures (Amos & Kolter, 2017;

Original: Agrawal et al., 2019; Wang et al., 2019).
Revised: Agrawal et al., 2019; Wang et al., 2019).

Original: These methods design custom neural network layers that mimic certain canonical optimization problems.
Revised: These methods design custom neural network layers that mimic certain canonical optimization problems.

Original: As a result, parametrized optimization problems can be inserted into neural networks.
Revised: As a result, parametrized optimization problems can be inserted into neural networks.

Original: Not all optimization algorithms can easily be written as a layer and another strategy is to train a network to learn iterative updates from data (Adler & ¨Oktem, 2018; Flynn et al., 2019; Gregor & LeCun, 2010).
Revised: Not all optimization algorithms can easily be written as a layer and another strategy is to train a network to learn iterative updates from data (Adler & ¨Oktem, 2018; Flynn et al., 2019; Gregor & LeCun, 2010).

Original: Most similar to our approach is arguably RAFT (Teed & Deng, 2020), which poses optical flow estimation as an optimization problem and uses a recurrent neural network to find an optimal descent direction.
Revised: Most similar to our approach is arguably RAFT (Teed & Deng, 2020), which poses optical flow estimation as an optimization problem and uses a recurrent neural network to find an optimal descent direction.

Original: In a similar vein, we aim to learn the steganography optimization problem with a convolutional neural network without specially designed optimization layers.
Revised: In a similar vein, we aim to learn the steganography optimization problem with a convolutional neural network without specially designed optimization layers.

Original:  N OTATION AND S ETUP
Revised:  N OTATION AND S ETUP

Original: Let X ∈
Revised: Let X ∈

Original: [0 , 1] H × W × 3 denote an RGB cover image with height H and width W . 

Revised: [0 , 1] H × W × 3 denote an RGB cover image with height H and width W .

Original: The hidden message M is a bit string of length m = H × W × B
Revised: The hidden message M is a bit string of length m = H × W × B

Original: that is reshaped to match the cover image’s size, i.e. M ∈ { 0 , 1 } H × W × B , where payload B is the number of encoded bits per pixel (bpp).
Revised: that is reshaped to match the cover image’s size, i.e. M ∈ { 0 , 1 } H × W × B , where payload B is the number of encoded bits per pixel (bpp).

Original: 2 Image practice
Revised: 2 Image practice

Original: If m is not a multiple of H × W , it is padded with zeros.
Revised: If m is not a multiple of H × W , it is padded with zeros.

Original: steganography aims to conceal M in a steganographic image ˜ X ∈ [0 , 1] H × W × 3 , that looks visually identical to X , such that M is transmitted undetected through ˜ X .
Revised: steganography aims to conceal M in a steganographic image ˜ X ∈ [0 , 1] H × W × 3 , that looks visually identical to X , such that M is transmitted undetected through ˜ X .

Original: A steganographic encoder Enc takes as input X and M and outputs ˜ X .
Revised: A steganographic encoder Enc takes as input X and M and outputs ˜ X .

Original: A decoder Dec recovers the message, M ′ =
Revised: A decoder Dec recovers the message, M ′ =

Original: Dec ( ˜ X ) , with minimal recovery error ϵ = ∥
Revised: Dec ( ˜ X ) , with minimal recovery error ϵ = ∥

Original: M ′ − M ∥ 0 m (ideally ϵ = 0 ).
Revised: M ′ − M ∥ 0 m (ideally ϵ = 0 ).

Original: Below we will describe two recent paradigms for steganography (see Appendix F for a summary of comparing the paradigms).
Revised: Below we will describe two recent paradigms for steganography (see Appendix F for a summary of comparing the paradigms).

Original: Learned Image Steganography.
Revised: Learned Image Steganography.

Original: Recent deep-learning-based image steganography methods (Zhang et al., 2019; Zhu et al., 2018; Tan et al., 2021) use straight-forward convolutional neural network architectures for encoders and decoders that maintain the same feature dimensions, H × W , throughout (i.e. no downsampling).
Revised: Recent deep-learning-based image steganography methods (Zhang et al., 2019; Zhu et al., 2018; Tan et al., 2021) use straight-forward convolutional neural network architectures for encoders and decoders that maintain the same feature dimensions, H × W , throughout (i.e. no downsampling).

Original: SteganoGAN (Zhang et al., 2019) and CHAT-GAN (Tan et al., 2021) use such an encoder network to generate the steganographic image
Revised: SteganoGAN (Zhang et al., 2019) and CHAT-GAN (Tan et al., 2021) use such an encoder network to generate the steganographic image

Original: ˜ X with a single forward pass and a decoder network to predict the message M ′ .
Revised: ˜ X with a single forward pass and a decoder network to predict the message M ′ .

Original: The final layer of the decoder usually consists of H × W × B sigmoidal outputs, producing real values within [0 , 1] that turn into the binary recovered message M ′ after rounding.
Revised: The final layer of the decoder usually consists of H × W × B sigmoidal outputs, producing real values within [0 , 1] that turn into the binary recovered message M ′ after rounding.

Original: These methods also have a Critic/Discriminator to predict whether an image looks natural.
Revised: These methods also have a Critic/Discriminator to predict whether an image looks natural.

Original: The encoder, decoder, and critic are all trained end-to-end.
Revised: The encoder, decoder, and critic are all trained end-to-end.

Original: Optimization-based Image Steganography.
Revised: Optimization-based Image Steganography.

Original: Given a differentiable decoder with random or learned weights (from a method mentioned in the last paragraph), Kishore et al. (2021) express the steganography encoding step as a per sample optimization problem that is inspired by adversarial perturbations (Szegedy et al., 2013).
Revised: Given a differentiable decoder with random or learned weights (from a method mentioned in the last paragraph), Kishore et al. (2021) express the steganography encoding step as a per sample optimization problem that is inspired by adversarial perturbations (Szegedy et al., 2013).

Original: Their method, Fixed Neural Network Steganography (FNNS), finds a steganographic image by solving the following constrained optimization problem while constraining the perturbed image within the [0 , 1]
Revised: Their method, Fixed Neural Network Steganography (FNNS), finds a steganographic image by solving the following constrained optimization problem while constraining the perturbed image within the [0 , 1]

Original: [Equation]
Revised: [Equation]

Original: W
Revised: W

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: where ⟨·⟩ denotes the dot product operation, λ is a weight factor and N =
Revised: where ⟨·⟩ denotes the dot product operation, λ is a weight factor and N =

Original: H
Revised: H

Original: × W × 3 .
Revised: × W × 3 .

Original: Note that only the perturbed image ˜ X is being optimized and the decoder Dec is kept fixed throughout.
Revised: Note that only the perturbed image ˜ X is being optimized and the decoder Dec is kept fixed throughout.

Original: The accuracy loss L acc ( M ′ , M ) is a binary cross entropy loss that encourages the message recovery error to be low, and the quality loss L qua ( X , ˜ X ) uses mean squared error to ensure that the steganographic image looks similar to the cover image.
Revised: The accuracy loss L acc ( M ′ , M ) is a binary cross entropy loss that encourages the message recovery error to be low, and the quality loss L qua ( X , ˜ X ) uses mean squared error to ensure that the steganographic image looks similar to the cover image.

Original: We denote the objective in Equation 1 as ℓ ( ˜ X , M ) .
Revised: We denote the objective in Equation 1 as ℓ ( ˜ X , M ) .

Original: Several solvers can be used to solve Equation 1, but the most popular choices are iterative, gradient-based hill-climbing algorithms as shown in Algorithm 1.
Revised: Several solvers can be used to solve Equation 1, but the most popular choices are iterative, gradient-based hill-climbing algorithms as shown in Algorithm 1.

Original: Here η > 0 denotes the step size, and g ( · ) is an update function defined by the specific optimization method.
Revised: Here η > 0 denotes the step size, and g ( · ) is an update function defined by the specific optimization method.

Original: The perturbation δ is iteratively optimized, where ˜ X = X + δ , to minimize the loss ℓ within the image pixel constraints.
Revised: The perturbation δ is iteratively optimized, where ˜ X = X + δ , to minimize the loss ℓ within the image pixel constraints.

Original: Drawbacks of Existing Methods
Revised: Drawbacks of Existing Methods

Original: Existing learned methods are fast because single forward passes with the trained encoder and decoder are all that are needed for encoding and decoding, but they yield high error rates of up to 5-25% for 4 bpp.
Revised: Existing learned methods are fast because single forward passes with the trained encoder and decoder are all that are needed for encoding and decoding, but they yield high error rates of up to 5-25% for 4 bpp.

Original: It is also hard to incorporate additional constraints to these models without retraining.
Revised: It is also hard to incorporate additional constraints to these models without retraining.

Original: On the other hand, optimization-based approaches can result in lower error rates, but they are much slower (requiring thousands of iterations).
Revised: On the other hand, optimization-based approaches can result in lower error rates, but they are much slower (requiring thousands of iterations).

Original: Furthermore, their resulting recovery error depends heavily on the weights of the decoder and the initialization of δ (Kishore et al., 2021).
Revised: Furthermore, their resulting recovery error depends heavily on the weights of the decoder and the initialization of δ (Kishore et al., 2021).

Original: Especially with B ≥ 4 , the optimization can get stuck in local minima.
Revised: Especially with B ≥ 4 , the optimization can get stuck in local minima.

Original:  L EARNED S TEGANOGRAPHIC O PTIMIZATION
Revised:  L EARNED S TEGANOGRAPHIC O PTIMIZATION

Original: Ideally, we would like a method that is both fast and has low recovery error , so we combine ideas from learned methods and iterative optimization methods to propose Learned Iterative Steganography Optimization (LISO) .
Revised: Ideally, we would like a method that is both fast and has low recovery error , so we combine ideas from learned methods and iterative optimization methods to propose Learned Iterative Steganography Optimization (LISO) .

Original: LISO consists of an encoder, a decoder, and a critic network, but the encoder is iterative and it approximates the function g ( · ) in Algorithm 1.
Revised: LISO consists of an encoder, a decoder, and a critic network, but the encoder is iterative and it approximates the function g ( · ) in Algorithm 1.

Original: The optimization procedure can be viewed as a recurrent neural network with a hidden state that iteratively optimizes the perturbation δ with respect to the loss ℓ .
Revised: The optimization procedure can be viewed as a recurrent neural network with a hidden state that iteratively optimizes the perturbation δ with respect to the loss ℓ .

Original: At each iteration, it obtains the previous estimate δ t −and the gradient of ℓ as input and produces a new δ t .
Revised: At each iteration, it obtains the previous estimate δ t −and the gradient of ℓ as input and produces a new δ t .

Original: The hidden state allows LISO to learn what optimization steps are best suited for this task.
Revised: The hidden state allows LISO to learn what optimization steps are best suited for this task.

Original: After multiple iterative steps, the encoder outputs the steganographic image.
Revised: After multiple iterative steps, the encoder outputs the steganographic image.

Original: The decoder is a simple feed-forward convolutional neural network trained to retrieve the message from the steganographic image.
Revised: The decoder is a simple feed-forward convolutional neural network trained to retrieve the message from the steganographic image.

Original: The critic is a neural classifier (akin to GAN discriminators) trained to discriminate between cover images and steganographic images (Hayes &
Revised: The critic is a neural classifier (akin to GAN discriminators) trained to discriminate between cover images and steganographic images (Hayes &

Original: Danezis, 2017b).
Revised: Danezis, 2017b).

Original: As everything is differentiable, the iterative encoder, the decoder, and the critic can be jointly learned on a dataset of images.
Revised: As everything is differentiable, the iterative encoder, the decoder, and the critic can be jointly learned on a dataset of images.

Original: Algorithm δ 0 ←for t=1 to T do δ t ← δ t − 1 + η · g (cid:18) ∇ δ t − 1 ℓ ( X + δ t − 1 , M ) , X , δ t −(cid:19)
Revised: Algorithm δ 0 ←for t=1 to T do δ t ← δ t − 1 + η · g (cid:18) ∇ δ t − 1 ℓ ( X + δ t − 1 , M ) , X , δ t −(cid:19)

Original: ˜
Revised: ˜

Original: X ← X + δ T
Revised: X ← X + δ T

Original: [Figure]
Revised: [Figure]

Original: [Figure]
Revised: [Figure]

Original: LISO architecture.
Revised: LISO architecture.

Original: The LISO decoder and the critic have 3 convolutional blocks, each containing a convolutional layer (with 3 × 3 kernels and stride 1), batch-norm, and leaky-ReLU, similar to Zhang et al.
Revised: The LISO decoder and the critic have 3 convolutional blocks, each containing a convolutional layer (with 3 × 3 kernels and stride 1), batch-norm, and leaky-ReLU, similar to Zhang et al.

Original: In the decoder, the convolutional blocks are followed by another convolutional layer to obtain a H × W × B dimensional output.
Revised: In the decoder, the convolutional blocks are followed by another convolutional layer to obtain a H × W × B dimensional output.

Original: In the critic, the convolutional blocks are followed by an adaptive mean pooling layer to obtain a scalar output that denotes a prediction of whether an image has a hidden code.
Revised: In the critic, the convolutional blocks are followed by an adaptive mean pooling layer to obtain a scalar output that denotes a prediction of whether an image has a hidden code.

Original: The core of LISO is its encoder, which has a recurrent GRU-based update operator that functions like Algorithm 1.
Revised: The core of LISO is its encoder, which has a recurrent GRU-based update operator that functions like Algorithm 1.

Original: The function g ( · ) in Algorithm 1 is approximated using a fully convolutional network designed around a gated recurrent unit (GRU) (Cho et al., 2014).
Revised: The function g ( · ) in Algorithm 1 is approximated using a fully convolutional network designed around a gated recurrent unit (GRU) (Cho et al., 2014).

Original: The GRU has an internal state and keeps track of information relevant to the optimization (more details about the GRU cell are in Appendix A).
Revised: The GRU has an internal state and keeps track of information relevant to the optimization (more details about the GRU cell are in Appendix A).

Original: To avoid information loss, the LISO networks have no down-sampling/up-sampling layers, which means LISO can process images of any size.
Revised: To avoid information loss, the LISO networks have no down-sampling/up-sampling layers, which means LISO can process images of any size.

Original: At a high level, the LISO encoder (illustrated in Figure 2) takes as input the cover image X , the current perturbation δ t − 1 and the gradient of the loss with respect to the perturbed image ∇ δ t − 1 l ( X + δ t − 1 , M ) and predicts the perturbation δ t for the next step.
Revised: At a high level, the LISO encoder (illustrated in Figure 2) takes as input the cover image X , the current perturbation δ t − 1 and the gradient of the loss with respect to the perturbed image ∇ δ t − 1 l ( X + δ t − 1 , M ) and predicts the perturbation δ t for the next step.

Original: The GRU hidden state h 0 is initialized with a feature extractor (not shown) that is a simple 3-layer fully convolutional network that extracts features from the input image.
Revised: The GRU hidden state h 0 is initialized with a feature extractor (not shown) that is a simple 3-layer fully convolutional network that extracts features from the input image.

Original: The input to the GRU in subsequent steps x t is constructed by concatenating the extracted features from current perturbation δ t − 1 , the gradient ∇ δ t − 1 l ( X + δ t − 1 , M ) and the cover image X .
Revised: The input to the GRU in subsequent steps x t is constructed by concatenating the extracted features from current perturbation δ t − 1 , the gradient ∇ δ t − 1 l ( X + δ t − 1 , M ) and the cover image X .

Original: The GRU unit updates its own hidden state h t , and the hidden state is processed by additional convolutional layers to produce a gradient-type step update g t .
Revised: The GRU unit updates its own hidden state h t , and the hidden state is processed by additional convolutional layers to produce a gradient-type step update g t .

Original: The final update becomes δ t = δ t − 1 + η g t , where η is the step size for the new update.
Revised: The final update becomes δ t = δ t − 1 + η g t , where η is the step size for the new update.

Original: Perturbation δ t can also be clipped by a truncation factor to limit how much the X changes.
Revised: Perturbation δ t can also be clipped by a truncation factor to limit how much the X changes.

Original: The steganographic image, that is the final output of the LISO encoder, is produced through recurrent applications of the iterative encoder; the final steganographic image becomes ˜ X
Revised: The steganographic image, that is the final output of the LISO encoder, is produced through recurrent applications of the iterative encoder; the final steganographic image becomes ˜ X

Original: = X + η (cid:80) t g t .
Revised: = X + η (cid:80) t g t .

Original: Training.
Revised: Training.

Original: The entire LISO pipeline (the iterative encoder, decoder, and critic) is trained end-toend on a dataset of images.
Revised: The entire LISO pipeline (the iterative encoder, decoder, and critic) is trained end-toend on a dataset of images.

Original: As with GAN training, we optimize the critic and the encoder-decoder networks in alternating steps.
Revised: As with GAN training, we optimize the critic and the encoder-decoder networks in alternating steps.

Original: During the training, we compute loss for all intermediate updates with exponentially increasing weights ( γ T − t at step t ).
Revised: During the training, we compute loss for all intermediate updates with exponentially increasing weights ( γ T − t at step t ).

Original: With intermediate predictions denoted as ˜ X 1 , . .
Revised: With intermediate predictions denoted as ˜ X 1 , . .

Original: ˜ X T the loss is:
Revised: ˜ X T the loss is:

Original: [Equation]
Revised: [Equation]

Original: where γ ∈ (0 , 1) is a decay factor and L crit denotes the critic loss (with weight µ > 0 ).
Revised: where γ ∈ (0 , 1) is a decay factor and L crit denotes the critic loss (with weight µ > 0 ).

Original: Despite the predictions being sub-optimal from earlier iterations, we still make use of the loss from earlier iterations because they do provide useful update directions for later iterations.
Revised: Despite the predictions being sub-optimal from earlier iterations, we still make use of the loss from earlier iterations because they do provide useful update directions for later iterations.

Original: Note that this loss is similar to Equation 1, but there is an additional critic loss term that ensures that the steganographic image looks like a natural image (Zhang et al., 2019).
Revised: Note that this loss is similar to Equation 1, but there is an additional critic loss term that ensures that the steganographic image looks like a natural image (Zhang et al., 2019).

Original: As the critic loss is computed at all steps, the optimizer is encouraged to stay on or near the manifold of natural images throughout.
Revised: As the critic loss is computed at all steps, the optimizer is encouraged to stay on or near the manifold of natural images throughout.

Original: Inference.
Revised: Inference.

Original: The learned LISO iterative encoder and decoder are used during inference.
Revised: The learned LISO iterative encoder and decoder are used during inference.

Original: The iterative encoder performs a gradient-style optimization on the cover image to produce the steganographic
Revised: The iterative encoder performs a gradient-style optimization on the cover image to produce the steganographic

Original: [Table]
Revised: [Table]

Original: image with the desired hidden message.
Revised: image with the desired hidden message.

Original: Mathematical optimization algorithms like L-BFGS have strong theoretical convergence guarantees, which assure fast and highly accurate convergence within the vicinity of a global minimum, but for non-convex optimization problems they have a tendency to get stuck in local minima.
Revised: Mathematical optimization algorithms like L-BFGS have strong theoretical convergence guarantees, which assure fast and highly accurate convergence within the vicinity of a global minimum, but for non-convex optimization problems they have a tendency to get stuck in local minima.

Original: Although our learned optimizer lacks theoretical convergence guarantees, LISO is very efficient at finding local vicinity of good minima for natural images—it can reliably find solutions with only a few bits decoded incorrectly (on the order of 0.01%) as shown in
Revised: Although our learned optimizer lacks theoretical convergence guarantees, LISO is very efficient at finding local vicinity of good minima for natural images—it can reliably find solutions with only a few bits decoded incorrectly (on the order of 0.01%) as shown in

Original: Table 1.
Revised: Table 1.

Original: FNNS
Revised: FNNS

Original: (Kishore et al., 2021) works in a complementary manner to trained encoder-decoder networks and optimizes steganographic images using fixed networks and off-the-shelf optimization algorithms.
Revised: (Kishore et al., 2021) works in a complementary manner to trained encoder-decoder networks and optimizes steganographic images using fixed networks and off-the-shelf optimization algorithms.

Original: Consequently, we can use LISO in conjunction with FNNS; we refer to this procedure as LISO+(PGD) or LISO+(LBFGS), dependent on which optimization algorithm is used for FNNS optimization.
Revised: Consequently, we can use LISO in conjunction with FNNS; we refer to this procedure as LISO+(PGD) or LISO+(LBFGS), dependent on which optimization algorithm is used for FNNS optimization.

Original: Concretely, we encode a message into a cover image by using the LISO encoder, and then use L-BFGS/PGD to further reduce the error rate.
Revised: Concretely, we encode a message into a cover image by using the LISO encoder, and then use L-BFGS/PGD to further reduce the error rate.

Original: The error rate after LISO is already quite low and hence only a few additional L-BFGS iterations are required to reduce the error.
Revised: The error rate after LISO is already quite low and hence only a few additional L-BFGS iterations are required to reduce the error.

Original: Compared to FNNS, LISO can reliably achieve 0% error for up to 3 bpp, with drastically fewer iterations.
Revised: Compared to FNNS, LISO can reliably achieve 0% error for up to 3 bpp, with drastically fewer iterations.

Original:  E XPERIMENTS AND D ISCUSSION
Revised:  E XPERIMENTS AND D ISCUSSION

Original: We evaluate our method on three public datasets: 1) Div2k (Agustsson & Timofte, 2017) which is a scenic images dataset, 2) CelebA
Revised: We evaluate our method on three public datasets: 1) Div2k (Agustsson & Timofte, 2017) which is a scenic images dataset, 2) CelebA

Original: (Liu et al., 2018) which consists of facial images of celebrities, and 3) MS COCO (Lin et al., 2014) which contains images of common household objects and scenes.
Revised: (Liu et al., 2018) which consists of facial images of celebrities, and 3) MS COCO (Lin et al., 2014) which contains images of common household objects and scenes.

Original: For CelebA and MS COCO we use the first 1000 for validation and the following 1, for training.
Revised: For CelebA and MS COCO we use the first 1000 for validation and the following 1, for training.

Original: Note that 1,000 training images are sufficient for LISO to achieve SOTA performance, and using full datasets will only make training longer.
Revised: Note that 1,000 training images are sufficient for LISO to achieve SOTA performance, and using full datasets will only make training longer.

Original: The messages are random binary bit strings sampled from an independent Bernoulli distribution with p = 0 .
Revised: The messages are random binary bit strings sampled from an independent Bernoulli distribution with p = 0 .

Original: 5 , which is close to the distribution of compressed/encrypted messages.
Revised: 5 , which is close to the distribution of compressed/encrypted messages.

Original: During training, we set the number of encoder iterations T = 15 , the step size η = 1 , the decay γ = 0 .
Revised: During training, we set the number of encoder iterations T = 15 , the step size η = 1 , the decay γ = 0 .

Original: 8 and loss weights λ
Revised: 8 and loss weights λ

Original: = µ = 1 .
Revised: = µ = 1 .

Original: During inference, we use a smaller step size η = 0 .
Revised: During inference, we use a smaller step size η = 0 .

Original: 1 for a larger number of iterations T ; we iterate until the error rate converges.
Revised: 1 for a larger number of iterations T ; we iterate until the error rate converges.

Original: We show the average number of iterations required to minimize the recovery error in Table 3.
Revised: We show the average number of iterations required to minimize the recovery error in Table 3.

Original: The average number is consistently below the number of iterations used during training T = 15 , although some images require up to 25 iterations.
Revised: The average number is consistently below the number of iterations used during training T = 15 , although some images require up to 25 iterations.

Original: These results suggest that in practice LISO just needs a few iterations to achieve low recovery error rates.
Revised: These results suggest that in practice LISO just needs a few iterations to achieve low recovery error rates.

Original: Figure 3 shows how the recovery error decreases over time during testing.
Revised: Figure 3 shows how the recovery error decreases over time during testing.

Original: The monotonicity of the graphs indicates that the optimization loss is well aligned with recovery error and that LISO is successful at learning to find suitable descent directions (more details are in the subsequent optimization analysis).
Revised: The monotonicity of the graphs indicates that the optimization loss is well aligned with recovery error and that LISO is successful at learning to find suitable descent directions (more details are in the subsequent optimization analysis).

Original: The final steganographic images are stored in PNG format.
Revised: The final steganographic images are stored in PNG format.

Original: Image Steganography Performance.
Revised: Image Steganography Performance.

Original: Most traditional steganography methods hide < 1 bpp messages in images, and methods that hide large payloads of information usually hide structured information like images.
Revised: Most traditional steganography methods hide < 1 bpp messages in images, and methods that hide large payloads of information usually hide structured information like images.

Original: Very few methods are designed for hiding high payload arbitrary bit string messages in color images.
Revised: Very few methods are designed for hiding high payload arbitrary bit string messages in color images.

Original: We compare LISO with three other methods that are designed to do so,
Revised: We compare LISO with three other methods that are designed to do so,

Original: SteganoGAN (Zhang et al., 2019), FNNS (Kishore et al., 2021) and CHAT-GAN (Tan et al., 2021).
Revised: SteganoGAN (Zhang et al., 2019), FNNS (Kishore et al., 2021) and CHAT-GAN (Tan et al., 2021).

Original: Since the source code for CHAT-GAN was not available, we were only able to compare against the numbers provided in the paper on MS-COCO and these results are presented in Appendix E.
Revised: Since the source code for CHAT-GAN was not available, we were only able to compare against the numbers provided in the paper on MS-COCO and these results are presented in Appendix E.

Original: In
Revised: In

Original: Table 1, we evaluate LISO’s performance on image steganography in terms of both message recovery accuracy and image quality.
Revised: Table 1, we evaluate LISO’s performance on image steganography in terms of both message recovery accuracy and image quality.

Original: Following previous work (Zhang et al., 2019), we measure how much the steganographic image changes by computing the structural similarity index (SSIM) and peak signal-to-noise ratio (PSNR) (Wang et al., 2004) between the cover and steganographic images.
Revised: Following previous work (Zhang et al., 2019), we measure how much the steganographic image changes by computing the structural similarity index (SSIM) and peak signal-to-noise ratio (PSNR) (Wang et al., 2004) between the cover and steganographic images.

Original: In Appendix B, we also evaluate with the Learned Perceptual Image Patch Similarity (LPIPS) metric (Zhang et al., 2018) and find trends similar to that of PSNR and SSIM.
Revised: In Appendix B, we also evaluate with the Learned Perceptual Image Patch Similarity (LPIPS) metric (Zhang et al., 2018) and find trends similar to that of PSNR and SSIM.

Original: From Table 1, we observe that the error rates of LISO are an order of magnitude lower when compared to SteganoGAN.
Revised: From Table 1, we observe that the error rates of LISO are an order of magnitude lower when compared to SteganoGAN.

Original: Interestingly, the image quality as measured by PSNR scores is also superior.
Revised: Interestingly, the image quality as measured by PSNR scores is also superior.

Original: LISO is able to achieve an error rate of exactly 0% for payloads ≤ 3 bpp for all images when it is paired with a few steps of direct L-BFGS optimization (the numbers in Table 1 are averaged and for many samples 0% error is obtained just with LISO).
Revised: LISO is able to achieve an error rate of exactly 0% for payloads ≤ 3 bpp for all images when it is paired with a few steps of direct L-BFGS optimization (the numbers in Table 1 are averaged and for many samples 0% error is obtained just with LISO).

Original: Using a learned iterative method, we are able to achieve the same performance as that obtained from a direct optimization method (FNNS), but in far fewer optimization steps and time (see Table 4).
Revised: Using a learned iterative method, we are able to achieve the same performance as that obtained from a direct optimization method (FNNS), but in far fewer optimization steps and time (see Table 4).

Original: Essentially LISO’s ability to learn from past optimizations and to stay on the image manifold, allows it to achieve low error rates, high image quality, and initializations (for further L-BFGS optimization) near a good minimum.
Revised: Essentially LISO’s ability to learn from past optimizations and to stay on the image manifold, allows it to achieve low error rates, high image quality, and initializations (for further L-BFGS optimization) near a good minimum.

Original: Figure 4 shows the steganographic images produced by LISO under different payloads.
Revised: Figure 4 shows the steganographic images produced by LISO under different payloads.

Original: Qualitatively we observe that the image quality is quite good even when a large number of bits per pixel are hidden in the cover images.
Revised: Qualitatively we observe that the image quality is quite good even when a large number of bits per pixel are hidden in the cover images.

Original: The CelebA example shows a rare example where the hue changes slightly while the image remains un-pixelated, demonstrating the effectiveness of the discriminator; in contrast, the low-quality steganographic images produced by FNNS tend to be pixelated.
Revised: The CelebA example shows a rare example where the hue changes slightly while the image remains un-pixelated, demonstrating the effectiveness of the discriminator; in contrast, the low-quality steganographic images produced by FNNS tend to be pixelated.

Original: These color shifts disappear when a larger image quality factor λ or a more diverse dataset is used (A similar observation was made by Upchurch et al.
Revised: These color shifts disappear when a larger image quality factor λ or a more diverse dataset is used (A similar observation was made by Upchurch et al.

Original: (2017) for image transformations).
Revised: (2017) for image transformations).

Original: Different from previous image steganography methods that produce unnatural Gaussian noise, LISO’s perturbation is smooth and natural because its critic network helps to stay close to the manifold of natural images.
Revised: Different from previous image steganography methods that produce unnatural Gaussian noise, LISO’s perturbation is smooth and natural because its critic network helps to stay close to the manifold of natural images.

Original: We can also explicitly control the trade-off between error rate and image quality by changing the image quality factors λ and µ on the loss terms if desired.
Revised: We can also explicitly control the trade-off between error rate and image quality by changing the image quality factors λ and µ on the loss terms if desired.

Original: Additional qualitative images obtained by varying these are provided in Appendix J.
Revised: Additional qualitative images obtained by varying these are provided in Appendix J.

Original: [Figure]
Revised: [Figure]

Original: Optimization with LISO.
Revised: Optimization with LISO.

Original: In Figure 3, we compare optimizing with the LISO encoder against popular numerical optimization algorithms including projected gradient descent (Madry et al., 2017) and L-BFGS (Liu &
Revised: In Figure 3, we compare optimizing with the LISO encoder against popular numerical optimization algorithms including projected gradient descent (Madry et al., 2017) and L-BFGS (Liu &

Original: Nocedal, 1989) on the steganographic encoding task.
Revised: Nocedal, 1989) on the steganographic encoding task.

Original: Note that L-BFGS-Random is equivalent to FNNS-R and L-BFGS-Pretrained is equivalent to FNNS-D (Kishore et al., 2021).
Revised: Note that L-BFGS-Random is equivalent to FNNS-R and L-BFGS-Pretrained is equivalent to FNNS-D (Kishore et al., 2021).

Original: LISO converges faster than any other optimization algorithm
Revised: LISO converges faster than any other optimization algorithm

Original: and this validates our hypothesis that
Revised: and this validates our hypothesis that

Original: LISO can learn a descent direction that is better than the one found by common gradientbased optimization methods; LISO converges to 100 × lower loss and 80 × lower error rate.
Revised: LISO can learn a descent direction that is better than the one found by common gradientbased optimization methods; LISO converges to 100 × lower loss and 80 × lower error rate.

Original: This is because the LISO encoder can leverage information learned from optimizing many samples, while off-the-shelf gradient-based methods perform per-sample optimization.
Revised: This is because the LISO encoder can leverage information learned from optimizing many samples, while off-the-shelf gradient-based methods perform per-sample optimization.

Original: Furthermore, we show that recovery error rate from LISO can further be reduced by taking only a few additional L-BFGS steps.
Revised: Furthermore, we show that recovery error rate from LISO can further be reduced by taking only a few additional L-BFGS steps.

Original: This suggests that the LISO encoder output is quite close to the optimum and is a good initialization for using conventional optimization methods like L-BFGS or PGD .
Revised: This suggests that the LISO encoder output is quite close to the optimum and is a good initialization for using conventional optimization methods like L-BFGS or PGD .

Original: Steganography with JPEG Compression.
Revised: Steganography with JPEG Compression.

Original: JPEG (Wallace, 1992) is a commonly used lossy image compression method, which removes high-frequency components for reduced file size.
Revised: JPEG (Wallace, 1992) is a commonly used lossy image compression method, which removes high-frequency components for reduced file size.

Original: JPEGcompression-resistant steganography is hard because steganography and JPEG compression have opposing objectives; steganography attempts to encode information through small imperceptible changes and JPEG compression attempts to eliminate texture details.
Revised: JPEGcompression-resistant steganography is hard because steganography and JPEG compression have opposing objectives; steganography attempts to encode information through small imperceptible changes and JPEG compression attempts to eliminate texture details.

Original: General-purpose steganography methods have about 50% recovery error rate when decoding JPEG-compressed images.
Revised: General-purpose steganography methods have about 50% recovery error rate when decoding JPEG-compressed images.

Original: Many methods have been specifically developed to perform JPEG-resistant steganography to hide < 0 .bpp
Revised: Many methods have been specifically developed to perform JPEG-resistant steganography to hide < 0 .bpp

Original: messages (Zhang et al., 2015; Fan et al., 2011; Zhang et al., 2016; Holub et al., 2014).
Revised: messages (Zhang et al., 2015; Fan et al., 2011; Zhang et al., 2016; Holub et al., 2014).

Original: Some of these find perturbations specifically in low-frequency space to avoid being removed by compression.
Revised: Some of these find perturbations specifically in low-frequency space to avoid being removed by compression.

Original: HiDDeN (Zhu et al., 2018) and FNNS (Kishore et al., 2021) include differentiable JPEG layers to approximate compression as part of their network architecture.
Revised: HiDDeN (Zhu et al., 2018) and FNNS (Kishore et al., 2021) include differentiable JPEG layers to approximate compression as part of their network architecture.

Original: Following (Athalye et al., 2018), we adopt an approximate JPEG layer where the forward pass performs normal JPEG compression and the backward pass is an identity function.
Revised: Following (Athalye et al., 2018), we adopt an approximate JPEG layer where the forward pass performs normal JPEG compression and the backward pass is an identity function.

Original: We call this adapted method LISO-JPEG.
Revised: We call this adapted method LISO-JPEG.

Original: Table 2 compares LISO-JPEG with existing methods.
Revised: Table 2 compares LISO-JPEG with existing methods.

Original: LISO is able to find perturbations that won’t be lost in
Revised: LISO is able to find perturbations that won’t be lost in

Original: JPEG compression, while maintaining low error rate ( < 1E-01).
Revised: JPEG compression, while maintaining low error rate ( < 1E-01).

Original: The PSNR values for LISO-JPEG are low but qualitative 1bpp steganographic image examples from LISO-JPEG (see Figure 5) show that there is only a slight pixelation.
Revised: The PSNR values for LISO-JPEG are low but qualitative 1bpp steganographic image examples from LISO-JPEG (see Figure 5) show that there is only a slight pixelation.

Original: Image quality can be improved by increasing weight on the qualitative loss
Revised: Image quality can be improved by increasing weight on the qualitative loss

Original: L qua
Revised: L qua

Original: but this will cause a slight increase in the error rate.
Revised: but this will cause a slight increase in the error rate.

Original: As seen in Table 2, the
Revised: As seen in Table 2, the

Original: PSNR of FNNS-JPEG and LISO-JPEG are similar but LISO-JPEG has a significantly lower error rate.
Revised: PSNR of FNNS-JPEG and LISO-JPEG are similar but LISO-JPEG has a significantly lower error rate.

Original: Higher quality steganographic images can be obtained by training a LISO model with a higher weight on the qualitative loss L qua , but this will cause a slight increase in the error rate.
Revised: Higher quality steganographic images can be obtained by training a LISO model with a higher weight on the qualitative loss L qua , but this will cause a slight increase in the error rate.

Original: [Table] [Table]
Revised: [Table] [Table]

Original: Computational Time.
Revised: Computational Time.

Original: One of the advantages of using a learned method as opposed to an optimization method is that it is much faster.
Revised: One of the advantages of using a learned method as opposed to an optimization method is that it is much faster.

Original: The average inference time required for the different learned and optimization-based methods is presented in Table 4.
Revised: The average inference time required for the different learned and optimization-based methods is presented in Table 4.

Original: The fastest method is SteganoGAN because all that is required to use SteganoGAN is single forward passes.
Revised: The fastest method is SteganoGAN because all that is required to use SteganoGAN is single forward passes.

Original: The FNNS variants, on the other hand, are much slower.
Revised: The FNNS variants, on the other hand, are much slower.

Original: Our proposed method LISO, is slightly slower than SteganoGAN but not by a significant magnitude.
Revised: Our proposed method LISO, is slightly slower than SteganoGAN but not by a significant magnitude.

Original: The reported times were the average times on Div2k’s validation set and the methods were run on a Nvidia Titan RTX GPU.
Revised: The reported times were the average times on Div2k’s validation set and the methods were run on a Nvidia Titan RTX GPU.

Original: Steganalysis.
Revised: Steganalysis.

Original: To investigate the robustness of our method against statistical detection techniques, we use Stegexpose (Boehm, 2014), a tool devised for steganography detection using four well-known steganalysis approaches and find that the detection rate is lower than 25% for images produced by
Revised: To investigate the robustness of our method against statistical detection techniques, we use Stegexpose (Boehm, 2014), a tool devised for steganography detection using four well-known steganalysis approaches and find that the detection rate is lower than 25% for images produced by

Original: LISO.
Revised: LISO.

Original: Recently, more powerful neural-based methods are being used to detect steganography (see related work).
Revised: Recently, more powerful neural-based methods are being used to detect steganography (see related work).

Original: It is hard for any steganography method, including classical methods like WOW and
Revised: It is hard for any steganography method, including classical methods like WOW and

Original: S-UNIWARD, to evade detection from these neural methods even with low payload messages of about 0.4bpp (You et al., 2020).
Revised: S-UNIWARD, to evade detection from these neural methods even with low payload messages of about 0.4bpp (You et al., 2020).

Original: However, we show that in the following two scenarios we can evade detection by SiaStegNet (You et al., 2020).
Revised: However, we show that in the following two scenarios we can evade detection by SiaStegNet (You et al., 2020).

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table]
Revised: [Table]

Original: In the first scenario, “w/o defense”, the steganography model M is trained without any explicit precautions to avoid steganalysis detection.
Revised: In the first scenario, “w/o defense”, the steganography model M is trained without any explicit precautions to avoid steganalysis detection.

Original: We assume the attacker (i.e. the party applying steganalysis) knows the model architecture of M but has no access to the actual weights, exact training set, or hyperparameters.
Revised: We assume the attacker (i.e. the party applying steganalysis) knows the model architecture of M but has no access to the actual weights, exact training set, or hyperparameters.

Original: However, they can train a surrogate model M ′ in order to create their own training set of steganographic images.
Revised: However, they can train a surrogate model M ′ in order to create their own training set of steganographic images.

Original: To simulate this setting, we used a steganalysis model trained on CelebA to detect steganographic MS COCO images.
Revised: To simulate this setting, we used a steganalysis model trained on CelebA to detect steganographic MS COCO images.

Original: From Table 5 we see that in the “w/o defense” scenario, steganographic images from SteganoGAN and FNNS can be detected much more easily when compared to images from LISO.
Revised: From Table 5 we see that in the “w/o defense” scenario, steganographic images from SteganoGAN and FNNS can be detected much more easily when compared to images from LISO.

Original: In the second scenario, “w/ defense”, we take advantage of the fact that neural steganalysis methods are fully differentiable, and both LISO and FNNS involve gradient-based optimization.
Revised: In the second scenario, “w/ defense”, we take advantage of the fact that neural steganalysis methods are fully differentiable, and both LISO and FNNS involve gradient-based optimization.

Original: It is therefore possible to avoid detection by adding an additional loss term from the steganalysis system into the LISO optimization or the FNNS optimization.
Revised: It is therefore possible to avoid detection by adding an additional loss term from the steganalysis system into the LISO optimization or the FNNS optimization.

Original: Specifically, during evaluation we add the logit value of the steganographic class to the loss if an image is detected as steganographic.
Revised: Specifically, during evaluation we add the logit value of the steganographic class to the loss if an image is detected as steganographic.

Original: Note that we cannot add an additional loss term to SteganoGAN during inference because SteganoGAN just uses forward passes of a trained neural network for inference.
Revised: Note that we cannot add an additional loss term to SteganoGAN during inference because SteganoGAN just uses forward passes of a trained neural network for inference.

Original: We also tried training a SteganoGAN network with an auxiliary steganalysis loss and found that we couldn’t avoid detection even when we did so.
Revised: We also tried training a SteganoGAN network with an auxiliary steganalysis loss and found that we couldn’t avoid detection even when we did so.

Original: As seen in Table 5, we obtain single-digit detection accuracy rates for LISO in the “w/ defense” scenario for all bit rates.
Revised: As seen in Table 5, we obtain single-digit detection accuracy rates for LISO in the “w/ defense” scenario for all bit rates.

Original: Compared to FNNS, LISO is able to avoid detection more effectively.
Revised: Compared to FNNS, LISO is able to avoid detection more effectively.

Original: The image quality of steganographic images produced by LISO is also better than those produced by FNNS under this scenario.
Revised: The image quality of steganographic images produced by LISO is also better than those produced by FNNS under this scenario.

Original: We also tested LISO with two additional steganalysis systems, SRNet (Boroumand et al., 2018) and XuNet (Xu et al., 2016), and the corresponding results are presented in Appendix H.
Revised: We also tested LISO with two additional steganalysis systems, SRNet (Boroumand et al., 2018) and XuNet (Xu et al., 2016), and the corresponding results are presented in Appendix H.

Original:  C ONCLUSION
Revised:  C ONCLUSION

Original: We propose a novel iterative encoder-based method, LISO, for image steganography.
Revised: We propose a novel iterative encoder-based method, LISO, for image steganography.

Original: The LISO encoder is designed to learn the update rule of a general gradient-based optimization algorithm for steganography, and is trained simultaneously with a corresponding decoder.
Revised: The LISO encoder is designed to learn the update rule of a general gradient-based optimization algorithm for steganography, and is trained simultaneously with a corresponding decoder.

Original: It learns a more efficient dynamic update rule for steganography when compared to PGD or L-BFGS, and the learned decoder is particularly suitable for further L-BFGS optimization.
Revised: It learns a more efficient dynamic update rule for steganography when compared to PGD or L-BFGS, and the learned decoder is particularly suitable for further L-BFGS optimization.

Original: LISO also ensures that the steganographic image remains on the natural image manifold with the help of a critic, and produces high-quality steganographic images.
Revised: LISO also ensures that the steganographic image remains on the natural image manifold with the help of a critic, and produces high-quality steganographic images.

Original: LISO achieves state-of-the-art results for steganography, while being fairly fast.
Revised: LISO achieves state-of-the-art results for steganography, while being fairly fast.

Original: It is also flexible and can incorporate additional constraints, like producing JPEG-resistant steganographic images or making steganographic images undetectable by specific steganalysis systems.
Revised: It is also flexible and can incorporate additional constraints, like producing JPEG-resistant steganographic images or making steganographic images undetectable by specific steganalysis systems.

Original: In the future, we plan to investigate ways to increase image quality while maintaining low error for JPEG-resistant steganography.
Revised: In the future, we plan to investigate ways to increase image quality while maintaining low error for JPEG-resistant steganography.

Original: A CKNOWLEDGEMENTS
Revised: A CKNOWLEDGEMENTS

Original: This research is supported by grants from DARPA AIE program, Geometries of Learning (HR00112290078), DARPA Techniques for Machine Vision Disruption grant (HR00112090091), the National Science Foundation NSF (IIS-2107161, III1526012, IIS- and IIS-1724282), and the Cornell Center for Materials Research with funding from the NSF MRSEC program (DMR1719875).
Revised: This research is supported by grants from DARPA AIE program, Geometries of Learning (HR00112290078), DARPA Techniques for Machine Vision Disruption grant (HR00112090091), the National Science Foundation NSF (IIS-2107161, III1526012, IIS- and IIS-1724282), and the Cornell Center for Materials Research with funding from the NSF MRSEC program (DMR1719875).

Revised: We would also like to thank all the reviewers for their feedback

Original: A GRU O PERATIONS
Revised: A GRU O PERATIONS

Original: [Equation]
Revised: [Equation]

Original: As described in the paper, the Gated Recurrent Unit (GRU) is an integral part of the LISO encoder.
Revised: As described in the paper, the Gated Recurrent Unit (GRU) is an integral part of the LISO encoder.

Original: The operations of the GRU used in LISO are defined in Equation 3, where x t is the input to the
Revised: The operations of the GRU used in LISO are defined in Equation 3, where x t is the input to the

Original: GRU in t th iteration, h t is the GRU’s hidden state, and W z , W r , W h are GRU’s weight matrices.
Revised: GRU in t th iteration, h t is the GRU’s hidden state, and W z , W r , W h are GRU’s weight matrices.

Original: For LISO, x t is the concatenation of features extracted from the input image, the gradient from the loss, and the perturbation.
Revised: For LISO, x t is the concatenation of features extracted from the input image, the gradient from the loss, and the perturbation.

Original: B LPIPS R ESULTS
Revised: B LPIPS R ESULTS

Original: In Table 3 of the main paper, we used PSNR and SSIM to evaluate image similarity between the cover images and the corresponding steganographic images.
Revised: In Table 3 of the main paper, we used PSNR and SSIM to evaluate image similarity between the cover images and the corresponding steganographic images.

Original: In Table 6 we show the results of using (LPIPS)
Revised: In Table 6 we show the results of using (LPIPS)

Original: (Zhang et al., 2018), a newer perceptual image similarity metric, to evaluate image similarity between cover and steganographic images.
Revised: (Zhang et al., 2018), a newer perceptual image similarity metric, to evaluate image similarity between cover and steganographic images.

Original: We observe similar trends as with PSNR and
Revised: We observe similar trends as with PSNR and

Original: SSIM.
Revised: SSIM.

Original: [Table]
Revised: [Table]

Original: C E RROR VS I TERATION
Revised: C E RROR VS I TERATION

Original: Figure 6 shows how the recovery error rate decreases every iteration.
Revised: Figure 6 shows how the recovery error rate decreases every iteration.

Original: As we see, the error rate monotonically decreases and this implies that LISO learns a good descent direction.
Revised: As we see, the error rate monotonically decreases and this implies that LISO learns a good descent direction.

Original: We also see that 15-20 iterations are enough for the error rate to converge.
Revised: We also see that 15-20 iterations are enough for the error rate to converge.

Original: D L OSS FOR D IFFERENT O PTIMIZATION M ETHODS
Revised: D L OSS FOR D IFFERENT O PTIMIZATION M ETHODS

Original: Figure 7 is analogous to figure 4 in the main paper.
Revised: Figure 7 is analogous to figure 4 in the main paper.

Original: However, instead of seeing how the error rate decreases for different optimization methods, we see how the loss decreases.
Revised: However, instead of seeing how the error rate decreases for different optimization methods, we see how the loss decreases.

Original: Note that the first data point we plot for each curve is after 1 iteration and we do so to improve the visualization.
Revised: Note that the first data point we plot for each curve is after 1 iteration and we do so to improve the visualization.

Original: Similar to figure 4, we see that the loss for LISO optimization decreases much faster than any other method.
Revised: Similar to figure 4, we see that the loss for LISO optimization decreases much faster than any other method.

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: E C OMPARISON WITH CHAT-GAN
Revised: E C OMPARISON WITH CHAT-GAN

Original: Tan et al.
Revised: Tan et al.

Original: (2021) present steganography results for hiding 1-4 bpp messages in images from the
Revised: (2021) present steganography results for hiding 1-4 bpp messages in images from the

Original: COCO dataset using CHAT-GAN.
Revised: COCO dataset using CHAT-GAN.

Original: We train LISO using different λ weights to match the error rates of CHAT-GAN (as listed in their paper) as closely as possible and the results are presented in Table 7; we use λ = 100 for 1-2 bpp and λ = 20 for 3-4 bpp for training LISO.
Revised: We train LISO using different λ weights to match the error rates of CHAT-GAN (as listed in their paper) as closely as possible and the results are presented in Table 7; we use λ = 100 for 1-2 bpp and λ = 20 for 3-4 bpp for training LISO.

Original: From the table, we see that the error rates and SSIM values are comparable for both methods, but CHAT-GAN obtains better
Revised: From the table, we see that the error rates and SSIM values are comparable for both methods, but CHAT-GAN obtains better

Original: PSNR numbers.
Revised: PSNR numbers.

Original: This is likely due to the fact that CHAT-GAN has a specially designed feature attention module to hide bits imperceptibly.
Revised: This is likely due to the fact that CHAT-GAN has a specially designed feature attention module to hide bits imperceptibly.

Original: However, as evidenced by both the SSIM values and the qualitative images below, steganographic images from LISO visually look indistinguishable from the cover images despite having lower PSNR values (PSNR is a local statistic and it measures the absolute mean squared difference in pixel values and two images can look similar despite have a low
Revised: However, as evidenced by both the SSIM values and the qualitative images below, steganographic images from LISO visually look indistinguishable from the cover images despite having lower PSNR values (PSNR is a local statistic and it measures the absolute mean squared difference in pixel values and two images can look similar despite have a low

Original: PSNR).
Revised: PSNR).

Original: Moreover, note that the contributions of our paper are orthogonal to the contributions of Tan et al.
Revised: Moreover, note that the contributions of our paper are orthogonal to the contributions of Tan et al.

Original: We can also combine our iterative LISO method with the CHAT-GAN encoder network architecture (Tan et al., 2021) to take advantage of both methods and to perform steganography with higher payloads and harder images.
Revised: We can also combine our iterative LISO method with the CHAT-GAN encoder network architecture (Tan et al., 2021) to take advantage of both methods and to perform steganography with higher payloads and harder images.

Original: Capacity
Revised: Capacity

Original: Method
Revised: Method

Original: Error (%) ↓
Revised: Error (%) ↓

Original: PSNR ↑
Revised: PSNR ↑

Original: SSIM ↑
Revised: SSIM ↑

Original: [Table]
Revised: [Table]

Original: F C OMPARISON OF D IFFERENT S TEGANOGRAPHY M ETHODS
Revised: F C OMPARISON OF D IFFERENT S TEGANOGRAPHY M ETHODS

Original: Table 8 compares LISO with both learned methods like SteganoGAN (Zhang et al., 2019) and
Revised: Table 8 compares LISO with both learned methods like SteganoGAN (Zhang et al., 2019) and

Original: CHAT-GAN (Tan et al., 2021)
Revised: CHAT-GAN (Tan et al., 2021)

Original: [Table]
Revised: [Table]

Original: and optimization based methods methods like FNNS (Kishore et al., 2021).
Revised: and optimization based methods methods like FNNS (Kishore et al., 2021).

Original: We see that LISO has a trained encoder like learned methods
Revised: We see that LISO has a trained encoder like learned methods

Original: [Table]
Revised: [Table]

Original: but its learned encoder is iterative and emulates the optimization algorithm in optimization-based steganography methods.
Revised: but its learned encoder is iterative and emulates the optimization algorithm in optimization-based steganography methods.

Original: [Table]
Revised: [Table]

Original: G LISO RESULTS WITH MSE LOSS WEIGHT λ = 10 FOR HIGHER IMAGE QUALITY
Revised: G LISO RESULTS WITH MSE LOSS WEIGHT λ = 10 FOR HIGHER IMAGE QUALITY

Original: If higher image quality is desired
Revised: If higher image quality is desired

Original: [Table]
Revised: [Table]

Original: a higher mse loss weight λ can be used.
Revised: a higher mse loss weight λ can be used.

Original: Consequently, the image quality will be better but the error rate will be worse.
Revised: Consequently, the image quality will be better but the error rate will be worse.

Original: We repeat the experiments in Table 1 of the main paper with mse loss weight λ =
Revised: We repeat the experiments in Table 1 of the main paper with mse loss weight λ =

Original: [Table]
Revised: [Table]

Original: and show the results in Table 9.
Revised: and show the results in Table 9.

Original: As seen in the table
Revised: As seen in the table

Original: [Table]
Revised: [Table]

Original: the error rate is slightly worse (it’s still less than 1.5%)
Revised: the error rate is slightly worse (it’s still less than 1.5%)

Original: [Table]
Revised: [Table]

Original: but the image quality is better.
Revised: but the image quality is better.

Original: We can further increase the value of λ to obtain even better image quality
Revised: We can further increase the value of λ to obtain even better image quality

Original: [Table]
Revised: [Table]

Original: H A DDITIONAL S TEGANALYSIS
Revised: H A DDITIONAL S TEGANALYSIS

Original: In addition to SiaStegNet (You et al., 2020)
Revised: In addition to SiaStegNet (You et al., 2020)

Original: [Table]
Revised: [Table]

Original: we attempt to avoid detection from two other state-ofthe-art steganalysis systems:
Revised: we attempt to avoid detection from two other state-ofthe-art steganalysis systems:

Original: SRNet (Boroumand et al., 2018) and XuNet
Revised: SRNet (Boroumand et al., 2018) and XuNet

Original: (Xu et al., 2016).
Revised: (Xu et al., 2016).

Original: Results are reported in Table 10.
Revised: Results are reported in Table 10.

Original: For most cases
Revised: For most cases

Original: [Table]
Revised: [Table]

Original: the results are similar to SiaStegNet.
Revised: the results are similar to SiaStegNet.

Original: However
Revised: However

Original: [Table]
Revised: [Table]

Original: with XuNet we see a very high detection accuracy in the “w/o defense” scenario; this is because XuNet uses handcrafted kernels in addition to using a convolutional network to detect steganographic images.
Revised: with XuNet we see a very high detection accuracy in the “w/o defense” scenario; this is because XuNet uses handcrafted kernels in addition to using a convolutional network to detect steganographic images.

Original: Despite this, adding the loss XuNet allows us to evade detection from it (as seen from the “w/ defense” scenario).
Revised: Despite this, adding the loss XuNet allows us to evade detection from it (as seen from the “w/ defense” scenario).

Original: We can also achieve lower detection accuracy in the “w/o defense” scenario if a method like XuNet (with hand-crafted kernels) is used as a discriminator during LISO training
Revised: We can also achieve lower detection accuracy in the “w/o defense” scenario if a method like XuNet (with hand-crafted kernels) is used as a discriminator during LISO training

Original: [Table]
Revised: [Table]

Original: I E XPERIMENT RESULTS WITH HIGHER PAYLOADS
Revised: I E XPERIMENT RESULTS WITH HIGHER PAYLOADS

Original: Extending the results from the main paper, in Table 11, we evaluate LISO with 5-6 bits encoded per pixel.
Revised: Extending the results from the main paper, in Table 11, we evaluate LISO with 5-6 bits encoded per pixel.

Original: We see that we are able to get low error rates ( < 3 %) even for messages hiding 5-6bpp of information.
Revised: We see that we are able to get low error rates ( < 3 %) even for messages hiding 5-6bpp of information.

Original: However, the image quality is worse; as described in Appendix G we can get images with better image quality but a slightly worse error rate if we increase the weight on the MSE loss term.
Revised: However, the image quality is worse; as described in Appendix G we can get images with better image quality but a slightly worse error rate if we increase the weight on the MSE loss term.

Original: [Table]
Revised: [Table]

Original: J A DDITIONAL Q UALITATIVE R ESULTS
Revised: J A DDITIONAL Q UALITATIVE R ESULTS

Original: A few qualitative examples of steganographic images were presented in the main paper.
Revised: A few qualitative examples of steganographic images were presented in the main paper.

Original: Additional steganographic images produced by LISO with 1-4bpp of hidden information are shown in Figure 8.
Revised: Additional steganographic images produced by LISO with 1-4bpp of hidden information are shown in Figure 8.

Original: Stenographic images obtained with an increased mse weight λ = 10 are shown in Figure 9.
Revised: Stenographic images obtained with an increased mse weight λ = 10 are shown in Figure 9.

Original: As explained in the paper, we can use L-BFGS with LISO to further reduce the error rate obtained from LISO.
Revised: As explained in the paper, we can use L-BFGS with LISO to further reduce the error rate obtained from LISO.

Original: Figure 10 shows steganographic images obtained from LISO+L-BFGS and we see that there is no difference in visual quality even after the additional optimization.
Revised: Figure 10 shows steganographic images obtained from LISO+L-BFGS and we see that there is no difference in visual quality even after the additional optimization.

Original: In the experiments section of the main paper we show that LISO can avoid being detected by SiaStegNet (You et al., 2020) by using the gradient from SiaStegNet in LISO’s optimization network.
Revised: In the experiments section of the main paper we show that LISO can avoid being detected by SiaStegNet (You et al., 2020) by using the gradient from SiaStegNet in LISO’s optimization network.

Original: In
Revised: In

Original: Figure 11, we show sample images from the Div2k dataset that are generated in this way to avoid
Revised: Figure 11, we show sample images from the Div2k dataset that are generated in this way to avoid

Original: SiaStegNet detection.
Revised: SiaStegNet detection.

Original: Again we see no noticeable difference in visual quality.
Revised: Again we see no noticeable difference in visual quality.

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: [Figure] [Figure]
Revised: [Figure] [Figure]