CNN Based Adversarial Embedding with Minimum Alteration for Image Steganography

TL;DR

This paper introduces a CNN-based adversarial embedding method for image steganography that minimizes alterations while fooling CNN steganalyzers, enhancing security against modern steganalytic techniques.

Contribution

It proposes a novel adversarial embedding technique that adjusts modification costs based on CNN gradients, effectively fooling CNN steganalyzers while maintaining low distortion.

Findings

Effective against targeted CNN steganalyzer

Degrades performance of other steganalyzers

Maintains image quality with minimal modifications

Abstract

Historically, steganographic schemes were designed in a way to preserve image statistics or steganalytic features. Since most of the state-of-the-art steganalytic methods employ a machine learning (ML) based classifier, it is reasonable to consider countering steganalysis by trying to fool the ML classifiers. However, simply applying perturbations on stego images as adversarial examples may lead to the failure of data extraction and introduce unexpected artefacts detectable by other classifiers. In this paper, we present a steganographic scheme with a novel operation called adversarial embedding, which achieves the goal of hiding a stego message while at the same time fooling a convolutional neural network (CNN) based steganalyzer. The proposed method works under the conventional framework of distortion minimization. Adversarial embedding is achieved by adjusting the costs of image element modifications according to the gradients backpropagated from the CNN classifier targeted by the attack. Therefore, modification direction has a higher probability to be the same as the sign of the gradient. In this way, the so called adversarial stego images are generated. Experiments demonstrate that the proposed steganographic scheme is secure against the targeted adversary-unaware steganalyzer. In addition, it deteriorates the performance of other adversary-aware steganalyzers opening the way to a new class of modern steganographic schemes capable to overcome powerful CNN-based steganalysis.