Selection-Channel-Aware Rich Model for Steganalysis of ... · an Arbitrary Domain Selection-Channel-Aware Rich Model for Steganalysis of Digital Images7 / 18. Selection channel recoverability,

Selection-Channel-Aware Rich Model for Steganalysisof Digital Images

Tomáš Denemark, Vahid Sedighi, Rémi Cogranne, Vojtech Holub, andJessica Fridrich

Selection-Channel-Aware Rich Model for Steganalysis of Digital Images 1 / 18

Steganography and steganalysis

I Steganography is the art of secret communication

Emb(X ,m,k)

message m

key k

cover X Ext(Y ,k)

key k

message m

channel withpassive warden

stego Y

I Steganographer’s jobModify a cover image to stego image so that it contains a secret message(by flipping LSBs, changing DCT coefficients, ...).Goal: make the embedding changes statistically undetectable.

I Warden’s job: Distinguish between cover and stego images by buildinga detector. If cover source is known, the best detection is achieved usingfeature-based steganalysis and machine learning.


Steganography in practice

I SenderSpecifies the cost of changing each pixel in the cover, ρij ≥ 0.Embeds the message by minimizing the distortion in the form of a sumof costs of all changed pixels, ∑xij 6=yij ρij .Problem is equivalent to source coding with a fidelity constraint.

Can be implemented with syndrome-trellis codes that operate near therate–distortion bound [Filler 2010].

I RecepientExtracts the secret message using the parity-check matrix of the sharedsyndrome-trellis code.


Content-adaptive steganography

I Embedding prefers changing pixels in textured / noisy areas

cover stego changes

selectionchannel


Content-adaptive steganography

I Embedding prefers changing pixels in textured / noisy areas

cover stego changes

selectionchannel


Selection channel

I Formally, the selection channel are the probabilities of changing pixel ij :

pij =e−λρij

1+ e−λρij,

I λ ≥ 0 parameter controlling the payloadI ρij pixel “costs” computed from cover image xI costs dictated by content + noise

I Since stego changes are subtle: ρij from cover ≈ ρij from stego image


Selection channel recoverability, WOW

0 0.1 0.2 0.3 0.4 0.5 0.60

0.2

0.4

0.6

Pij (cover)

Pij

(ste

go)

[Holub, IEEE WIFS 2012] Designing Steganographic Distortion UsingDirectional Filters


Selection channel recoverability, S-UNIWARD

0 0.1 0.2 0.3 0.4 0.5 0.60

0.2

0.4

0.6

Pij (cover)

Pij

(ste

go)

[Holub, EURASIP 2014] Universal Distortion Function for Steganography inan Arbitrary Domain


Selection channel recoverability, HILL

0 0.1 0.2 0.3 0.4 0.5 0.60

0.2

0.4

0.6

Pij (cover)

Pij

(ste

go)

[Li, ICIP 2014] A New Cost Function for Spatial Image Steganography


Using Selection Channel for Steganalysis

I [BOSS, IH 2011] no successful attack on HUGO based on approximateknowledge of the selection channel.

I [Schöttle et al., WIFS 2012] improved WS detector for naivecontent-adaptive LSB replacement.

I [Denemark, SPIE 2014] first successful attack on modern stego schemethat utilized an artifact in selection channel.

I [Tang, ACM IH & MMSec 2014] thresholded SRM – first generalpurpose attack using selection channel.

I [Denemark, WIFS 2014] maxSRMd2 (this presentation)


Spatial Rich Model (SRM)

cover X

noise residual zquantized residual r

−2 0 −1 0 −1 2 −2

−1 −2 0 0 −2 1 −1

1 −3 3 2 1 0 −1

0 0 0 −3 −2 −2 −1

−1 0 −3 0 −2 −1 −1

−1 1 3 −2 2 0 0

−2 1 −1 −2 −1 −3 1

L C E R

fN−2 fN−1 fN fN+1 fN+2

...

[-1

, -1,

0,2

][

-1, -

1,0,

2]

[-1

, -1,

0,3

]

...

co-occurrence vector

X z r

+1

I zij = xi ,j −Pred(N (xij))

I Pred(N (xij)) ... pixelpredictor onneighborhood N

I linear and min/maxfilters

I zij has narrower dynamicrange

I better SNR (stego noiseto image content)

I zij → rij = QQ(zij)

I Q = {−Tq,−(T −1)q,. . . ,Tq}

I T ... truncation thresholdI q ... quantization step

(SRM uses q = 1,1.5,2)

I collect quartets of valuesI horizontal and vertical

directions

I 4D co-occurrence matrixI symmetrization



cover X

noise residual z

quantized residual r

0 2 −1 1 2 1 3

−2 1 −1 −3 2 1 1

1 2 −2 0 2 −3 1

−1 2 −1 2 2 2 −2

−2 −2 2 −1 1 −1 −1

−2 0 2 1 −2 −1 0

1 0 −1 −1 −1 −2 −1

L C E R


...

[-1

, -1,

0,2

][

-1, -

1,0,

2]

[-1

, -1,

0,3

]

...


X

z r

+1







I Q = {−Tq,−(T −1)q,. . . ,Tq}


(SRM uses q = 1,1.5,2)


directions




cover Xnoise residual z

quantized residual r

1 0 −1 1 1 1 1

0 2 1 2 −1 3 2

−2 −1 −3 0 2 0 1

1 −1 −1 3 3 1 1

1 3 2 −2 0 0 2

2 1 0 2 −2 2 −1

−2 −2 3 −2 −2 2 −1

L C E R


...

[-1

, -1,

0,2

][

-1, -

1,0,

2]

[-1

, -1,

0,3

]

...


X z

r

+1







I Q = {−Tq,−(T −1)q,. . . ,Tq}


(SRM uses q = 1,1.5,2)


directions




cover Xnoise residual zquantized residual r

−2 1 −2 0 −2 −2 0

−1 −2 −1 2 1 −1 1

0 2 −1 −2 0 2 2

−2 1 −2 1 −3 −2 0

−1 −3 1 −1 1 −2 2

2 2 0 −1 −1 −2 2

3 −1 −1 −2 −3 −3 0

L C E R


...

[-1

, -1,

0,2

][

-1, -

1,0,

2]

[-1

, -1,

0,3

]

...


X z r

+1







I Q = {−Tq,−(T −1)q,. . . ,Tq}


(SRM uses q = 1,1.5,2)


directions




cover Xnoise residual zquantized residual r

2 0 −1 3 −2 1 −1

−2 −2 −1 −2 2 2 2

−1 0 −3 2 2 −2 1

0 3 2 0 1 −1 2

0 1 2 2 −1 1 −2

−3 1 1 3 −1 1 0

0 0 −2 1 −2 1 2

L C E R


...

[-1

, -1,

0,2

][

-1, -

1,0,

2]

[-1

, -1,

0,3

]

...


X z r

+1







I Q = {−Tq,−(T −1)q,. . . ,Tq}


(SRM uses q = 1,1.5,2)


directions



Co-occurrences in maxSRMd2

−3 2 −1 −1 −2 −1 2

−1 −3 2 −1 1 −2 0

2 0 −1 1 3 0 0

2 −1 2 −1 −1 2 −2

−3 0 2 −1 2 −2 3

0 0 −3 0 2 1 0

1 2 3 0 3 1 −2

L C

E R


...

[-1

, -1,

0,2

][

-1, -

1,0,

2]

[-1

, -1,

0,3

]

...


X z r

P

+max(P(L),P(C),P(E),P(R))


directionsI twice as many

symmetries

I 4D co-occurrence matrixI utilize embedding

probabilitiesI symmetrization


Co-occurrences in maxSRMd2

−1 1 3 0 0 −3 −2

−2 3 −1 1 0 −3 3

2 −2 −2 1 0 −2 2

2 −1 1 2 0 0 0

−2 −2 −2 0 −2 2 1

−2 3 2 2 2 −1 2

−1 −1 −2 2 −3 1 1

L C

E R


...

[-1

, -1,

0,2

][

-1, -

1,0,

2]

[-1

, -1,

0,3

]

...


X z r P

+max(P(L),P(C),P(E),P(R))


directionsI twice as many

symmetries

I 4D co-occurrence matrixI utilize embedding

probabilitiesI symmetrization


Detection gain w.r.t. SRM (WOW)

0 0.1 0.2 0.3 0.4 0.50

0.1

0.2

0.3

0.4

0.5

0.05

Payload (bpp)

PE

SRMmaxSRMd2 (α = α)maxSRMd2 (α = 0.1)


Detection gain w.r.t. SRM (S-UNIWARD)

0 0.1 0.2 0.3 0.4 0.50

0.1

0.2

0.3

0.4

0.5

0.05

Payload (bpp)

PE



Detection gain w.r.t. SRM (HILL)

0 0.1 0.2 0.3 0.4 0.50

0.1

0.2

0.3

0.4

0.5

0.05

Payload (bpp)

PE



Co-occurrences in thresholded SRM (tSRM)

−1 1 1 3 1 1 −1

1 0 0 2 0 −3 1

2 2 2 −1 −2 0 −3

0 −3 −1 −2 0 −1 −2

−2 −1 2 0 3 1 1

0 3 2 1 2 3 −3

−1 −2 −1 3 −1 0 −1

L C E R


...

[-1

, -1,

0,2

][

-1, -

1,0,

2]

[-1

, -1,

0,3

]

...


X z r

ρ

if ρ(L) < T ,+1


directions

I 4D co-occurrence matrixI utilize only some valuesI symmetrization


Co-occurrences in thresholded SRM (tSRM)

2 −1 3 2 2 −1 2

0 1 1 −3 −2 0 1

0 2 3 1 1 −2 1

−2 2 −1 0 −2 0 −1

0 2 −2 2 −3 −2 3

−2 −3 1 0 2 0 0

−1 −2 3 −1 −1 1 −2

L C E R


...

[-1

, -1,

0,2

][

-1, -

1,0,

2]

[-1

, -1,

0,3

]

...


X z r ρ

if ρ(L) < T ,+1


directions

I 4D co-occurrence matrixI utilize only some valuesI symmetrization


Comparison between maxSRMd2 and tSRM (WOW)

0 0.1 0.2 0.3 0.4 0.5

0.05

0.1

0.05

Payload (bpp)

Gai

nin

PE

maxSRMd2tSRM


Comparison between maxSRM and tSRM (S-UNIWARD)

0 0.1 0.2 0.3 0.4 0.5

0

1

2

3

4

·10−2

0.05

Payload (bpp)

Gai

nin

PE

maxSRMd2tSRM


Summary

I maxSRM is a general-purpose feature set capable of utilizing theselection channel for detection of content-adaptive steganography

I Overly content-adaptive embedding hurts security (WOW)I When designing steganography, selection-channel attacks need to be

consideredI often, improvement w.r.t. SRM leads to bigger loss w.r.t. maxSRM

I Matlab code available from http:\\dde.binghamton.edu\download


http:\\dde.binghamton.edu\download

Selection-Channel-Aware Rich Model for Steganalysis of ... · an Arbitrary Domain Selection-Channel-Aware Rich Model for Steganalysis of Digital Images7 / 18. Selection channel recoverability,

Documents