Solving the large syndrome calculation problem in steganography

TL;DR

This paper introduces a new embedding method for large code-based image steganography that minimizes distortion without requiring extensive memory, by embedding in the polynomial domain instead of the matrix domain.

Contribution

It proposes a novel approach to large syndrome calculation in steganography using polynomial domain embedding, reducing memory needs while maintaining computational efficiency.

Findings

Effective large code embedding with low memory requirement

Maintains computational complexity comparable to matrix-based methods

Introduces the LCDM code for distortion minimization

Abstract

In error correction code based image steganography, embedding using large length codes have not been researched extensively. This is due to the fact that the embedding efficiency decreases as the length becomes sufficiently larger and the memory requirement to build the parity matrix for large code is almost infeasible. However, recent studies have demonstrated that the embedding efficiency is not as important as minimizing the distortion. In light of the finding, we propose a embedding method using a large length codes which does not have such a large memory requirement. The proposed method solves the problem with the large parity matrix by embedding in the polynomial domain as oppose to matrix domain, while keeping the computational complexity equal to the matrix based methods. Furthermore, a novel embedding code called low complexity distortion minimization (LCDM) code is also presented as an example.

Equations

$$\varphi :Z_{256}^l\to Z_2^l$$

$$\varphi (j_1,\dots ,j_l)=(j_1\text{mod }2,\dots ,j_l\text{mod }2)$$

$$\sigma (\text{emA})\mapsto a_1+\cdots +a_l\cdot x^{l-1}=A(x)$$

$${\sigma }^{-1}(A(x))\mapsto (a_1,\dots ,a_l,0,\dots ,0)=\text{emA}$$

$$E_{base}(x)=rem\bigg{(}\frac{V(x)-M(x)}{G(x)}\bigg{)}$$

$$\mathbb{E}(x)=\{E_{base}(x)+F(x)G(x)\big{|}F(x)\in\mathbb{F}(x)\}$$

$${\sigma }^{-1}(E_{ideal}(x))={\text{emE}}_{ideal}$$

$${\text{emJ}}^{\prime }=\text{emJ}\oplus {\text{emE}}_{ideal}$$

$$M(x)=rem\bigg{(}\frac{V^{\prime}(x)}{G(x)}\bigg{)}$$

$$\displaystyle rem\bigg{(}\frac{G(x)P(x)+L(x)}{G(x)}\bigg{)}$$

$$\displaystyle rem\bigg{(}\frac{V^{\prime}(x)}{G(x)}\bigg{)}$$

$$M(x)$$

$$\sum _{l=1}^L{x}^{h_i}G(x)x^{(l-1)(n-k)}$$

$$=$$

Full text

1 Introduction

Image steganography is a data hiding technique with emphasis on the undetectability. In the past, numerous different linear error correction codes have been extensively used as an embedder in image steganography. The embedding is done like this: Linear codes provide the sender degrees of freedom to which modification can be made to the cover such that hidden message could not be be easily extracted. We refer to such modification to the cover as modifier vectors. The ideal modifier vector is the modifier vector which produces the best modified cover against steganlysis, a tool which detects whether an image has been modified or not.

In general, an error correcting linear code can be implemented based on matrix domain or polynomial domain. Many important papers in steganography wetpaper ; wetpaperimproved ; largepayloads ; lessdetectable ; f5 discuss embedding using techniques in matrix domain as oppose to in polynomial domain. This is mostly due to the fact that the researchers in steganography are more familiar with matrix operations than the polynomial operations.

There is also no work which focus specifically on embedding using a large code, due to the fact that embedding efficiency is decreased as the code length becomes larger. However, recent studies have shown that embedding efficiency is not as important as the distortion minimization. With this in mind, the proposed paper investigates embedding using large code.

However, syndrome calculation of a large code in matrix domain has a problem of the large parity matrix. Given that the code which is as large as the cover, the size of the parity matrix is too big for creating it.

The paper propose a solution in which large syndrome calculation problem is by showing an efficient embedding method which can be applied in polynomial domain. In order to simplify the content, several key ideas from error correction coding is explained more in simple terms such that non-advanced reader can understand.

For the rest of the paper, in Section 2, a literature review of the previous work is given. In Section 3, an improved implementation of embedding using polynomial code is presented. In Section 4, an example of a polynomial code called low complexity distortion minimization (LCDM) is shown. Finally, in section 5, a short example for embedding and extraction using LCDM is given.

With regards to notations, the matrices are denoted by italicized and bolded uppercase letters, whereas polynomials are denoted by italicized uppercase letters. Each value corresponding to a coordinate in vectors or polynomials are denoted using italicized lowercase letters.

2 Literature Review

In this section, past embedding schemes are discussed. The first part summarizes the past works on matrix embedding schemes, whereas the second part focuses on the polynomial embedding schemes.

One of the earliest idea of matrix embedding is suggest by Crandall crandall1998some . Later on, Westfeld f5 ’s paper showed that embedding via F5 implementation greatly reduce the amount of modification to the cover. Westfeld demonstrated the basic idea of syndrome coding; given a syndrome, there exists many modifier vectors such that all modifications to the cover using them result in the same syndrome. The ideal modifier cover is then defined to be the one with least modification. This basic idea was explored and generalized by many others like Winkler and Schönfeld winkler .

Winkler and Schönfeld winkler proposed a syndrome coding based on general binary linear codes $(n,k)$ for embedding. With the help from coset theory, they were able to manage to narrow down the search area for the modifying vector with a least Hamming weight from $2^{n}$ to $2^{k}$. Their method however needed all $2^{k}$ codewords; which they stored it in a look up table. Even though the improvement was significant, $2^{k}$ space requirement seemed unmanageable for large values of $k$. In addition to matrix embedding, Winkler and Schönfeld winkler proposed a technique based on binary polynomial code. It used the idea of preflipping bits and finding the modifying vector with least Hamming weight exhaustively. Unlike parity matrix implementation which has a deterministic form, the polynomial implementation lack such tools and thus less efficient. They concluded that parity matrix is more efficient in terms of embedding complexity.

In realistic situations, there are elements in the cover that are not modifiable. To remedy this problem, wet paper code was developed independently. The main idea of the wet paper code was to extend current embedding techniques so that cover can be divided between locked and unlocked elements. Elements that are locked cannot be modified and unlocked elements are modifiable. The papers proposed by Fridrich et al. wetpaper ; wetpaperimproved ; largepayloads explored wet paper code over non-shared selection channel. They argued that non-selection channel improved steganography security and was less vulnerable to steganalytic attacks. First, they pseudo-randomly created a matrix H, and depending on which elements are locked, submatrix D is derived by choosing corresponding columns from H. In the first paper wetpaper , they solved a set of linear equations to find the ideal modifier vector. In the second paper wetpaperimproved , they proposed using the meet-in-the-middle algorithm. In the third paper largepayloads , they proposed a totally different method by finding the closest codeword from a modifier vector. They also proved that random linear codes provide good embedding efficiency and their relative embedding capacity densely covers the range of large payloads, making them ideal as an embedder largepayloads .

In their second paper wetpaperimproved , they explain that finding modifier vector with the least Hamming weight becomes exponentially complex for large $n$ and small $k$. Also, the space requirement of storing H is also a problem. To remedy the initial problem, they propose breaking the cover and message into smaller chunks; which effectively solved the space requirement of H as well. There are other papers rankmetriccodes that proposed more efficient techniques to find the ideal modifier vector.

Reed-Solomon codes are a special case of BCH (Bose Chaudhuri Hocquenghem) code. It is important to note that error correcting codes are developed so that hardware implementation is easy. This is not the case in steganography, as embedding step occurs from the software side. Fontaine and Galand reedsolomon proposed an implementation using such codes for the wet paper coding. They showed that Reed-Solomon codes are optimal with respect to the number of locked positions. Their implementation used Lagrange interpolation and list decoding technique to optimally manage locked elements while finding all possible modifications to the cover.

Reinvestigating the problem of large look up table stated by Winkler and Schönfeld, Zhang et al. efficientembedder ; fastbch proposed data embedding using primitive binary BCH code. The method proposed creating two smaller look up tables to replace the $2^{k}$ table when primitive binary BCH code is used. The two smaller table is used to deterministically find solutions with modification vector with hamming weight 1 and 2. However, their method could only find up to Hamming weights of 4, and it was not clear if it it easy to extend the method for bigger Hamming weight modifier vectors.

In a different paper, Sachnev et al. lessdetectable showed that the least Hamming weight modifier vector does not always produce better results against steganalysis. Their proposed method used a distortion function to determine the local optimum (i.e., ideal modifier vector chosen from modifier vector of weight up to 4).

Syndrome trellis code has been used as well. The algorithm proposed by Filler et al. filler2011minimizing is based on the trellis code and it achieves better results when compared against other coding techniques. However, there is a significant tradeoff between the constraint length and the speed.

To summarize, there are two points to be made.

• •

Many steganography techniques are based on matrix manipulation. The latest finding suggests that unlike the initial assumption, the least number of modification to the cover does not necessarily guarantee the best modified cover. The space requirement of generating large H and non-linear complexity problem of the cover embedding makes preference to block embedding.

• •

Polynomial based techniques have not been explored in depth, and even the existing implementations are an exhaustive search and don’t have a deterministic form to find the solutions.

In the following section, we will propose a general polynomial embedding scheme based on polynomial codes that is efficient and can accommodate cover embedding. Then, a novel embedding code, low complexity distortion minimization (LCDM) code is proposed, which has an efficient distortion minimization process.

3 Proposed Method: Improved Embedding Based on Polynomial Code

When embedding using a large code, the space requirement and computational effort to finding the solution have to be considered.

Matrix based implementation methods suffer from the large parity matrix problem when using one large length code is used for embedding. For an image with $n$ pixels, using (n,k) linear code, the memory requirement for a binary parity matrix of size is $\frac{\text{matrix size}\times\text{1 bit}\times 1\text{ Byte}}{8\text{ bit}}$ $=\frac{n\times(n-k)}{8}=\frac{n^{2}-n\times k}{8}$ Byte. On the other hand, polynomial based implementation only requires to store generating polynomial $G(x)$, which is only $\frac{\text{(degree of }G(x)+1)\times 1\text{ bit}\times 1\text{ Btye}}{8\text{ bit}}=\frac{n-k+1}{8}$ Byte. For an image size of $1000\times 700$, with embedding 0.1 bits per pixel, memory requirement of the parity matrix is 6.125 GB, whereas for generating polynomial, it is only 8.75 KB. It is clear that the difference in memory requirement for the polynomial method is much lower and feasible.

However, unlike matrix based methods, there are no known explicit formula for for finding the modification polynomial; earlier work by Winkler and Schönfeld, only gave an exhaustive method, which requires $2^{n}$ number of trials to find the solutions.

The proposed method improves upon Winkler and Schönfeld’s work on the polynomial based implementation by giving an explicit formula for finding the modification polynomial, which finds $2^{k}$ solutions.

3.1 Setup

Before describing the proposed method, we formally define polynomial code, in the definition of the error correction code, as a $(n,k)$ linear cyclic code, where all codewords are length of $n$ and divisible by generating polynomial $G(x)$, a polynomial with degree $n-k$.

In the context of steganography, the syndrome, which is the remainder after dividing the cover polynomial by the $G(x)$, is the secret message of length $n-k$.

In this paper, polynomials with coefficients from $Z_{2}$, denoted as $Z_{2}[x]$ is used to explain the concept. This idea can be easily extended to polynomials with coefficients from different Galois Fields.

Let message be $\textbf{\em M}=(m_{1},\ldots,m_{n-k})\in Z_{2}^{n-k}$ and the original cover be $\textbf{\em J}=(j_{1},\ldots,j_{n})$, where each $j_{i}$ takes discrete values from 0 to 255 (for 8 bit case) for an image with $n$ number of pixels. The cover is first converted into binary values using modulo 2:

[TABLE]

[TABLE]

The processed cover is $\textbf{\em V}=\phi(\textbf{\em J})$.

A trivial bijective map from vector to polynomial representation is described as follow: $\sigma$ is a bijective map from binary vector $\textbf{\em A}\in Z_{2}^{n}$ to a polynomial over $Z_{2}$ with degree less than $n$ and vice versa for $\sigma^{-1}$.

For example, if $\textbf{\em A}=(a_{1},\ldots,a_{l},0,\ldots,0)\in Z_{2}^{n}$,

[TABLE]

[TABLE]

where $l<n$, and ‘+’ and ‘$\cdot$’ represents addition and multiplication in $Z_{2}[x]$, respectively.

3.2 Embedding

Embedding is done in four steps. In the first step, the base modifier polynomial $E_{base}(x)$ is evaluated. $E_{base}(x)$ is used as the basis for finding all possible modification polynomial, which would cause the syndrome to be the same as the intended message $M$. In the second step, set of all possible modifier polynomials are found. In the third step, the modifier polynomial which results in the lowest distortion is chosen. Lastly, the modification is reflected to the cover image.

3.2.1 Base modifier polynomial

Base modifier polynomial $E_{base}(x)$ is obtained using following equation using $E_{base}(x)$:

[TABLE]

where $rem$ is a function that evaluates the remainder after the long division, using operations from $Z_{2}[x]$. $E_{base}(x)$ is used as a base polynomial to find all other distinct solutions.

Definition 1

rem Let $L(x),G(x)$ be polynomials from $Z_{2}[x]$ and suppose $L(x)=P(x)G(x)+R(x)$, where degree of $R(x)$ is less than degree of $G(x)$. Then, rem\big{(}\frac{L(x)}{G(x)}\big{)}=R(x)

Corollary 1

Let $L(x),G(x)$ be polynomials from $Z_{2}[x]$ and degree of $L(x)$ is less than degree of $G(x)$. Then, rem\big{(}\frac{L(x)}{G(x)}\big{)}=L(x)

3.2.2 All possible modifier polynomials

Let $\mathbb{E}(x)$ be the set of all possible modifier polynomials:

[TABLE]

where $\mathbb{F}(x)$ is the set of all binary polynomials with degree less than $k$.

3.2.3 Ideal modifier polynomial

The ideal modifier polynomial $E_{ideal}(x)\in\mathbb{E}(x)$, is the modifier polynomial which causes the least distortion. An example of this step using additive distortion function is shown in the later section as an example.

3.2.4 Generating modified cover

Then, the modified cover $\textbf{\em J}^{\prime}$ is determined as follows:

1. Transform the ideal modifier polynomial into the vector form:

[TABLE]

2. Use $\textbf{\em E}_{ideal}$ and the cover J to obtain the modified cover $\textbf{\em J}^{\prime}$:

[TABLE]

where $\oplus$ is a bitwise XOR function. Note that the proposed method can be easily extended to accommodate modification of $\{-1,0,1\}$, as + and - are equivalent operation under $Z_{2}$.

3.3 Extraction

When $\textbf{\em J}^{\prime}$ is received, modified binary cover $V^{\prime}(x)=\sigma(\phi(\textbf{\em J}))$ is recovered. The following is used to extract $M(x)$:

[TABLE]

Then, $\textbf{\em M}=\sigma^{-1}(M(x))$.

3.4 Correctness

The fact that $\mathbb{E}(x)$ represents all possible modifier polynomial and that the embedding and extraction is correct is proven using elementary operations from $Z_{2}[x]$. To aid with understanding, we provide Lemma 1.

Lemma 1

(Remainder reduction)* Let $P(x),G(x),L(x)$ be polynomials from $Z_{2}[x]$. Then, rem\big{(}\frac{G(x)P(x)+L(x)}{G(x)}\big{)}=rem\big{(}\frac{L(x)}{G(x)}\big{)}*

Proof

Suppose $L(x)=G(x)P_{1}(x)+L_{1}(x)$, where degree of $L_{1}(x)$ is less than degree of $G(x)$. Then,

[TABLE]

and rem\big{(}\frac{L(x)}{G(x)}\big{)}=L_{1}(x)

$\therefore$ rem\big{(}\frac{G(x)P(x)+L(x)}{G(x)}\big{)}=rem\big{(}\frac{L(x)}{G(x)}\big{)} as required.

Theorem 3.1

(Correctness of embedding and extraction)* Suppose modified binary cover is $V^{\prime}(x)$ and generator polynomial is $G(x)$, then message polynomial M(x)=rem\big{(}\frac{V^{\prime}(x)}{G(x)}\big{)}*

Proof

Suppose $E(x)=E_{base}(x)+F(x)G(x)$ for some $F(x)\in\mathbb{F}(x)$, and $V(x)=Q(x)G(x)+R(x)$, where degree of $R(x)$ is smaller than the degree of $G(x)$. Then,

[TABLE]

as required.

Theorem 3.2

$\mathbb{E}(x)$* represent the set of all possible $2^{k}$ modifier polynomials.*

Proof

There are $2^{k}$ distinct possible $E(x)\in\mathbb{E}(x)$ by definition, and all of them are valid modifier polynomials by Theorem 1. To prove that there are no other solutions, we use proof by contradiction.

Suppose there is a polynomial $Q(x)\notin\mathbb{E}(x)$ with degree less than $n$, but is a valid modifier polynomial. Let $V(x)=P(x)G(x)+R(x)$ and $Q(x)=P_{1}(x)G(x)+R_{1}(x)$, where degrees of $R(x)$ and $R_{1}(x)$ are each less then the degree of $G(x)$. Then,

[TABLE]

And,

[TABLE]

But, this would imply that $R_{1}(x)=E_{base}(x)$, which would mean

$P_{1}(x)G(x)+E_{base}(x)=Q(x)\in\mathbb{E}(x)$, which is a contradiction. Therefore, $E(x)\in\mathbb{E}(x)$ represent set of all valid modifier polynomials. (Note: Theorem 1 and 2 are quite obvious when coset theory is used, but the proofs are provided for the none advanced readers)

4 Proposed Code: Low Complexity Distortion Minimization Code

Global distortion minimization process is computationally and memory intensive when a large code is used for embedding. In this section, a code called Low Complexity Distortion Minimization (LCDM) Code is proposed, which is specifically designed to have low complexity in distortion minimization process.

$(n,k)$ LCDM code sets $G(x)=1+x^{n-k}$, where $n$ is the length of the cover and $n-k$ is the length of the message bits. The embedding and extraction are exactly the same as presented before, as LCDM is a polynomial code. However, LCDM code is a simple example and more research on developing a new code with restriction on $G(x)$ should be done.

For the rest of the section, the additive distortion minimization process called distortion family finding algorithm is explained and its computational complexity is discussed.

4.1 Distortion Minimization Process: Distortion Family Finding Algorithm

The main idea behind LCDM is to reduce the computation in distortion minimization using the particular structure of $G(x)$ with distortion family finding algorithm (DFFA). Before discussing LCDM, two definitions are defined to help with the understanding of DFFA.

Definition 2

Head polynomials of $E_{base}(x)$ are the single non-zero terms in $E_{base}(x)=x^{h_{1}}+\ldots+x^{h_{i}}+\ldots$. For example, if $E_{base}(x)=1+x^{5}$, then $1$ and $x^{5}$ are the two head polynomials.

Definition 3

In $(n,k)$ LCDM code, cyclic shifts of head polynomials are polynomials which are different multiple of $n-k$ position shifts to a head polynomial $x^{h_{i}}$: $x^{h_{i}+n-k},$ $\ldots,x^{h_{i}+L(n-k)},\ldots$, where $L\leq\frac{n-1-h_{i}}{n-k}$ is a number of cyclic shifts by $(n-k)$ positions. For example, let $n=15$, $n-k=4$, and $x^{h_{i}}=x^{5}$ then, $L\in\{1,2\}$ and cyclic shifts of $x^{5}$ are $x^{5+4},x^{5+8}$.

Corollary 2

Cyclic shifts of $x^{h_{i}}$ in $(n,k)$ LCDM code is equivalent to adding $x^{h_{i}}$ with $\sum_{l=1}^{L}x^{h_{i}}G(x)x^{(l-1)(n-k)}$.

Proof

For $(n-k)$ LCDM code, $G(x)=1+x^{n-k}$, therefore

[TABLE]

Therefore $x^{h_{i}}+\sum_{l=1}^{L}x^{h_{i}}G(x)x^{(l-1)(n-k)}=x^{h_{i}+L(n-k)}$, i.e., $L$ cyclic shifts of $x^{h_{i}}$ as required.

DFFA works like this:

Let $E_{base}(x)=x^{h_{1}}+\ldots+x^{h_{i}}+\ldots$.

For each $x^{h_{i}}$, do the following:

Find the distortion associated with modifying $x^{h_{i}}$ and its cyclic shifts 2. 2.

Record the position which gives the lowest distortion

Once this is repeated for all head polynomials, let $E_{\text{ideal}}(x)$ be the polynomial with non zero terms corresponding to the positions recorded from step 2. A small example is provided in the next section to aid with understanding.

Notice that polynomials within a family are all the same, because by Lemma 1, adding multiples of $G(x)$ will produce the same syndrome as the corresponding head polynomial.

4.2 Complexity of the distortion minimization

The computational complexity of DFFA is linear relative to $n$, length of the cover. For a each family, number of comparisons required is equal to the number of polynomials in the family i.e $\frac{n}{n-k}$. Since this has to be done for every non-zero coefficients in $E_{base}(x)$, the total comparisons is equal to the product of number of cycles and the number of non-zero coefficients in $E_{base}(x)$. In average, $E_{base}(x)$ will have $\frac{n-k+1}{2}$ number of non-zero coefficients. Therefore, the average case complexity is $\frac{n}{n-k}\times\frac{n-k-1}{2}\doteq\frac{n}{2}$, the worst case complexity is $\frac{n}{n-k}\times(n-k-1)\doteq n$ and the best case complexity is when no modification is required. Thus distortion minimization is linear relative to $n$.

5 Example of LCDM

In this section, a small hands on example will be demonstrated to assist understanding.

Let $\textbf{\em J}=(163,18,153,20,100,26,15,212,243,53,86)$,

$\textbf{\em M}=(1,0,1)$,

$G(x)=1+x^{3}$, and

$\textbf{\em D}=(223,3,12,4,163,43,2,12,1,23,2)$

Then, $n=11$, $n-k=3$,

$\textbf{\em V}=\phi(\textbf{\em J})=(1,0,1,0,0,0,1,0,1,1,0),$

$V(x)=\sigma(\textbf{\em V})=1+x^{2}+x^{6}+x^{8}+x^{9}$, and

$M(x)=\sigma(\textbf{\em M})=1+x^{2}$.

$\therefore$ $E_{base}(x)=rem(\frac{V(x)-M(x)}{G(x)})=rem(\frac{x^{6}+x^{8}+x^{9}}{1+x^{3}})=x^{2}$.

Since $x^{2}$ is the only non-zero term of the base modifier polynomial, distortion family finding algorithm needs to run for only one family, i.e $x^{h}=x^{2}$ case.

Cyclic shifts of $x^{2}$ by $n-k=3$ are:

$x^{2}$ 2. 2.

$x^{5}=x^{2}+x^{2}G(x)$ 3. 3.

$x^{8}=x^{2}+x^{2}G(x)+x^{2}G(x)x^{3}$

The distortions in respective positions are 12, 43, and 1, making $x^{8}$ the ideal modifier polynomial. Therefore $\textbf{\em E}_{ideal}=\sigma^{-1}(x^{8})=(0,0,0,0,0,0,0,0,1,0,0)$ and

\textbf{\em J}^{\prime}=\textbf{\em J}\oplus E_{\text{ideal}}=(163,18,153,20,100,26,15,212,\textbf{{\color[rgb]{1,0,0}242}},53,86).

To verify that the intended $M$ can be retrieved from the modified cover $\textbf{\em J}^{\prime}$:

$V^{\prime}(x)=\sigma^{-1}(\phi(\textbf{\em J}^{\prime}))=1+x^{2}+x^{6}+x^{9}$

Then, $rem(\frac{V^{\prime}(x)}{G(x)})=rem(\frac{1+x^{2}+x^{6}+x^{9}}{1+x^{3}})=1+x^{2}$, and

$\sigma^{-1}(1+x^{2})=(1,0,1)=\textbf{\em M}$ as required.

6 Conclusion

In this paper, an improved embedding technique based in polynomial domain is proposed. We proposed an improved implementation based on polynomial code, which can find all possible solutions with an explicit formula. The space requirement is dwindled down from a matrix with size $(n)\times(n-k)$ to a vector with size $n-k$. A novel embedding code called LCDM, specifically designed for steganography is also presented. The algorithm has linear complexity relative to the cover size, and therefore can be used to embed the whole cover.