Exploiting Adversarial Embeddings for Better Steganography

Abstract

This work proposes a protocol to iteratively build a distortion function for adaptive steganography while increasing its practical security after each iteration. It relies on prior art on targeted attacks and iterative design of steganalysis schemes. It combines targeted attacks on a given detector with a min max strategy, which dynamically selects the most difficult stego content associated with the best classifier at each iteration. We theoretically prove the convergence, which is confirmed by the practical results. Applied on J-Uniward this new protocol increases P err from 7% to 20% estimated by Xu-Net, and from 10% to 23% for a non-targeted steganalysis by a linear classifier with GFR features. CCS CONCEPTS • Security and privacy → Domain-specific security and privacy architectures;

Explicit Optimization of min max Steganographic Game

“…This paper uses the adversarial attack presented in section II as a potential candidate, and two different CNNs, namely XU-Net [15] and SRNet [12], as detectors. It is an extension of the paper published in [32] in following directions:…”

Optimizing Additive Approximations of Non-additive Distortion Functions

“…In this sense, the method is general. The experimental evaluation demonstrates its advantages with respect to ADV-EMB by improving the security of a steganographic algorithm found by min max protocol [5] by 11% when the distortion function is a deep neural network with a Xu-Net [32] architecture.…”

“…Yet, the convergence of GANs is difficult to achieve in practice. An alternative to GANs is [5] which does not use the fixed estimator of embedding changes. Instead, the distortions associated to each DCT sample are optimized by means of adversarial embedding (ADV-EMB) [29] for a given image and steganalyzer.…”

“…Instead, the distortions associated to each DCT sample are optimized by means of adversarial embedding (ADV-EMB) [29] for a given image and steganalyzer. The main contribution of [5] and [4] was to show, how to construct iteratively steganalyzers without suffering from the convergence issues of ASO.…”

“…The set of steganalyzers created by the min max protocol in [5] plays the role of non-additive distortion functions, as they measure the detectability of a given image. Indeed the adversaries (here the classifiers) capture mid-range dependencies between DCT coefficients which are by definition non-additive.…”