CycleGAN, a Master of Steganography

TL;DR

CycleGAN can embed source image information into generated images imperceptibly, which helps it satisfy cyclic consistency but also makes it vulnerable to adversarial attacks, revealing a hidden security risk.

Contribution

This paper uncovers a novel property of CycleGAN where it secretly encodes source information, linking it to adversarial vulnerabilities and highlighting a security concern.

Findings

CycleGAN embeds source info into generated images imperceptibly.

The cyclic consistency loss increases vulnerability to adversarial attacks.

CycleGAN's training resembles generating adversarial examples.

Abstract

CycleGAN (Zhu et al. 2017) is one recent successful approach to learn a transformation between two image distributions. In a series of experiments, we demonstrate an intriguing property of the model: CycleGAN learns to "hide" information about a source image into the images it generates in a nearly imperceptible, high-frequency signal. This trick ensures that the generator can recover the original sample and thus satisfy the cyclic consistency requirement, while the generated image remains realistic. We connect this phenomenon with adversarial attacks by viewing CycleGAN's training procedure as training a generator of adversarial examples and demonstrate that the cyclic consistency loss causes CycleGAN to be especially vulnerable to adversarial attacks.