CNN Based Adversarial Embedding with Minimum Alteration for Image Steganography (1803.09043v1)

Abstract: Historically, steganographic schemes were designed in a way to preserve image statistics or steganalytic features. Since most of the state-of-the-art steganalytic methods employ a ML based classifier, it is reasonable to consider countering steganalysis by trying to fool the ML classifiers. However, simply applying perturbations on stego images as adversarial examples may lead to the failure of data extraction and introduce unexpected artefacts detectable by other classifiers. In this paper, we present a steganographic scheme with a novel operation called adversarial embedding, which achieves the goal of hiding a stego message while at the same time fooling a convolutional neural network (CNN) based steganalyzer. The proposed method works under the conventional framework of distortion minimization. Adversarial embedding is achieved by adjusting the costs of image element modifications according to the gradients backpropagated from the CNN classifier targeted by the attack. Therefore, modification direction has a higher probability to be the same as the sign of the gradient. In this way, the so called adversarial stego images are generated. Experiments demonstrate that the proposed steganographic scheme is secure against the targeted adversary-unaware steganalyzer. In addition, it deteriorates the performance of other adversary-aware steganalyzers opening the way to a new class of modern steganographic schemes capable to overcome powerful CNN-based steganalysis.

• The paper introduces the AMA scheme that leverages CNN gradients to create stego images with minimal alterations that effectively deceive steganalyzers.
• It employs a distortion minimization framework, achieving a higher missed detection rate than conventional methods like J-UNIWARD.
• Experimental results show robust performance against both unaware and adversary-aware steganalyzers, marking a notable advancement in adversarial steganography.

CNN Based Adversarial Embedding with Minimum Alteration for Image Steganography

This paper presents a novel approach to image steganography, addressing the significant challenge posed by machine learning-based steganalysis. Traditionally, steganographic methods have aimed to preserve image statistics to avoid detection. However, with the increasing sophistication of steganalytic techniques, especially those employing deep learning models, the need for innovative countermeasures is evident. This research introduces an adversarial embedding method designed to produce stego images that both carry hidden information and effectively deceive convolutional neural network (CNN)-based steganalyzers.

The primary contribution of this work is the development of the Adversarial Embedding with Minimum Alteration (AMA) scheme, which exploits adversarial machine learning principles to enhance the security of steganographic processes. By leveraging the gradients backpropagated from the targeted CNN classifier, the EMA scheme selectively modifies image elements to generate stego images that have a higher probability of fooling the CNN steganalyzer. This modification is rooted in the distortion minimization framework, allowing for minimal alteration while ensuring effective adversarial impact.

Key highlights from the experimental results underscore the efficacy of the proposed AMA scheme. When tested against an adversary-unaware steganalyzer, the scheme demonstrated a significantly higher missed detection rate for stego images compared to traditional approaches such as J-UNIWARD. Even when faced with adversary-aware steganalyzers, which re-train with adversarial examples, the AMA scheme maintains a competitive edge, achieving better security performance with increased payloads.

Furthermore, the paper explores the dynamics of adversarial games between steganographers and steganalysts through iterative simulation. It reveals that the party with the most updated information gains a strategic advantage, highlighting the ongoing nature of adversarial interactions in the field.

The implications of this research are multifaceted. Practically, it offers a robust method for steganographers seeking to embed data securely in an era defined by sophisticated steganalysis. Theoretically, it enriches the discourse on adversarial machine learning, suggesting avenues for future exploration, such as the incorporation of the gradient amplitudes and the adaptation to steganalyzers that do not utilize backpropagation. This work also invites considerations of game-theoretic models to better understand the steganographic landscape in adversarial contexts.

In conclusion, the AMA scheme represents a significant advancement in steganographic security by innovatively applying adversarial embedding tactics. The approach not only enhances resistance to powerful steganalytics but also paves the way for future explorations into adversarial techniques that can further fortify the steganographic field.