Security steganography scheme based on image disturbance adversarial training

Abstract

The invention discloses a security steganography scheme based on image disturbance adversarial training, which comprises the following steps: determining a secret message, and encrypting the secret message to obtain an encrypted message; constructing an improved distortion function generation framework and performing training to obtain a pre-training model; obtaining a carrier image, and calculating a distortion probability matrix of the carrier image based on the pre-training model; and coding the encrypted message into a carrier image based on the distortion probability matrix and adversarial disturbance to obtain a secret-containing image, and completing safe steganography. According to the method, encryption measures are taken for the secret message, so that the security in the information transmission and storage process is further enhanced; the distortion cost of each image pixel is estimated based on the training model, and is incorporated into the loss function so as to be adaptively superposed on the carrier image, so that the visual quality and the undetectability of the steganographic image can be remarkably improved, improvement is performed from the aspects of safety and the visual quality, and enlightenment and reference are provided for subsequent related research.

Description

Technical Field

[0001] The present invention belongs to the technical field of image steganography, and in particular relates to a secure steganography scheme based on image perturbation adversarial training. Background Art

[0002] Image steganography is an advanced information hiding technique that cleverly embeds confidential information into seemingly ordinary carrier images while striving to maintain the quality and appearance of the original image without significant impact. This technique relies on the inherent high redundancy of the image itself, making the embedding process of secret information almost invisible and difficult to be detected by the naked eye or conventional detection methods, thereby achieving the purpose of secret transmission and communication of information. Steganography has been widely used in fields such as watermarking, copyright authentication, and private information storage. Traditional steganography tools use pixel statistics to hide information in images. The secret information hidden by these methods can be recovered with a 0% error rate, but in order to avoid being detected by steganalysis tools, they can only hide up to 0.5 bits of information per pixel. Driven by data-driven deep learning technology, recent methods propose training deep encoder-decoder networks, which have become the mainstream direction of current steganography research due to their large embedding capacity and good undetectability. However, this type of method also has some problems. First, the accuracy of the recovered message is not high, and it is difficult to deploy in some scenarios with high accuracy requirements. Second, the network structure after training is complex, causing the number of parameters of the encoder and decoder to exceed the secret message itself, which poses security issues when transmitting it to the recipient.

[0003] Therefore, in order to take advantage of the deep neural network in terms of steganographic capacity and circumvent the two problems mentioned above, researchers proposed fixed neural network steganography (FNNS), which avoids training the steganographic network and uses random or pre-trained FNN for data embedding and extraction. This type of scheme keeps the neural network parameters fixed and modifies the carrier image in a manner similar to adversarial perturbations so that the FNN can decode the secret information from the stego image, and the extraction accuracy can be as high as 100% at an embedding rate of 3bpp. At the same time, this method does not require network training and alleviates the problem of transmitting the steganographic network. However, there are two obvious problems with this method. First, if the FNN is leaked, or the attacker trains a similar network, he can easily extract the secret information from the stego image. Second, because the adversarial perturbation is directly superimposed on the carrier image, the visual effect of the secret image is poor.

[0004] Based on this, in order to effectively solve the above-mentioned problems existing in the existing FNNS scheme, the present invention proposes a secure steganography scheme under an adversarial perturbation training strategy to improve the security and visual quality of the existing FNNS scheme. Summary of the invention

[0005] In order to solve the above technical problems, the present invention proposes a secure steganography scheme based on image perturbation adversarial training to solve the problems existing in the above-mentioned prior art.

[0006] To achieve the above objectives, the present invention provides a secure steganography scheme based on image perturbation adversarial training, comprising:

[0007] Determining a secret message, and encrypting the secret message to obtain an encrypted message;

[0008] Build an improved distortion function generation framework and perform training to obtain a pre-trained model;

[0009] Acquire a carrier image, and calculate a distortion probability matrix of the carrier image based on a pre-trained model;

[0010] The encrypted message is encoded into the carrier image based on the distortion probability matrix and the adversarial perturbation to obtain a secret image and complete secure steganography.

[0011] Optionally, the formula for encrypting the secret message is as follows:

[0012] Sk_d = AES(reshape(S), k)

[0013] Wherein, SK_d represents the encrypted message, reshape() represents converting the message into a one-dimensional format, k represents the encryption key, and S represents the secret message, wherein the width and height of the secret message are the same as the height and width of the carrier image.

[0014] Optionally, the improved distortion function generation framework includes a generator based on a U-net architecture, a dual tanh activation function, and an enhanced steganalyzer based on a convolutional neural network and combined with multiple high-pass filters as discriminators, wherein a CBAM attention mechanism is introduced in the generator based on the U-net architecture.

[0015] Optionally, the distortion probability matrix is ​​calculated based on a generator of a pre-trained model.

[0016] Optionally, the process of obtaining a confidential image includes: constructing a composite loss function based on the distortion probability matrix, setting the number of training times and the number of L-BFGS algorithm iterations, using the L-BFGS algorithm, performing adversarial perturbation optimization training by minimizing the composite loss function until the number of iterations is reached, cropping the perturbation obtained from each training and adding it to the carrier image until the number of training times is met to obtain a confidential image.

[0017] Optionally, the composite loss function is as follows:

[0018]

[0019] Among them, <,> represents the inner product of the matrix, DPM represents the distortion probability matrix, λ1, λ2 represent the weights for controlling the two losses, SK_d is the encrypted message, cover is the carrier image, and stego is the secret image.

[0020] Optionally, the method further includes: before encoding the encrypted message into the carrier image, normalizing the carrier image, and after obtaining the encrypted image, denormalizing the encrypted image.

[0021] Compared with the prior art, the present invention has the following advantages and technical effects:

[0022] The present invention provides a secure steganography scheme based on image perturbation adversarial training, which determines a secret message, encrypts the secret message to obtain an encrypted message; constructs an improved distortion function generation framework and performs training to obtain a pre-trained model; obtains a carrier image, and calculates the distortion probability matrix of the carrier image based on the pre-trained model; encodes the encrypted message into the carrier image based on the distortion probability matrix and adversarial perturbation to obtain a secret image, thereby completing secure steganography.

[0023] According to the high accuracy of FNNS message extraction, the present invention adopts encryption measures for secret messages, further enhancing the security of the FNNS scheme, because even if the disguised image is intercepted, the secret information cannot be effectively decoded without the correct key, thereby greatly improving the security of information transmission and storage, so that the algorithm of the present invention meets the Kerckhoff principle.

[0024] This paper proposes a new perturbation superposition strategy, which estimates the distortion cost of each image pixel based on the training model and incorporates it into the loss function to adaptively superimpose it on the carrier image. Experimental results show that it can significantly improve the visual quality and undetectability of the steganographic image.

[0025] The present invention has made improvements from the perspectives of safety and visual quality, and provided inspiration and reference for subsequent related research. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0027] Figure 1 is a flow chart of a method according to an embodiment of the present invention;

[0028] Figure 2 The figure is a flow chart of generating a distortion probability matrix according to an embodiment of the present invention. DETAILED DESCRIPTION

[0029] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0030] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0031] Embodiment 1

[0032] like Figure 1 As shown, this embodiment provides a secure steganography solution based on image perturbation adversarial training, including:

[0033] Carrier image cover∈[0,255] H*W*3 is an RGB color image with height H and width W. The secret message is a∈{0,1} H*W*D , where H and W are the height and width of the message matrix, and D represents the dimension of the message, which can control the embedding rate. For the perturbed image, this embodiment refers to the common practice in steganography as the secret image stego∈[0,255] H*W*3 , the sender sends stego to the receiver, and the receiver uses a fixed neural network as a message extractor to recover the secret message, thus completing a covert communication. The purpose of this invention is to continuously optimize the anti-disturbance and achieve [0,255] through a pre-trained FNN H*W*3 →{0,1} H*W*D , under the premise of ensuring visual quality and security, the FNN (stego) is made as close as possible to the secret message S. Compared with the original FNNS solution, this embodiment mainly makes the following improvements.

[0034] Secret message protection based on AES encryption algorithm:

[0035] Due to the high error rate of message extraction, it is difficult for the information hiding algorithm based on deep learning to extract the encrypted secret message, because the conventional block cipher has a very strong diffusion effect, and the change of one or several bits will affect the extraction of the plaintext. However, the steganographic scheme based on FNN has the ability to extract the secret message with 100% accuracy when the embedding rate is 3bpp. Therefore, in order to improve the security of the algorithm, this embodiment encrypts the secret message, and the encryption algorithm adopts the classic AES algorithm. The AES encryption algorithm has a solid mathematical foundation, no obvious algorithm weaknesses, and has a high resistance to cryptanalysis. At the same time, the AES encryption algorithm can perform encryption and decryption operations at a faster speed during the implementation process, and will not take up a lot of storage space and memory. In addition, the AES algorithm is applicable to a variety of platforms and various software and hardware environments. The encryption algorithm of the secret message in this embodiment is shown in formula (1).

[0036] Sk_d=AES(reshape(S),k) (1)

[0037] Among them, Sk_d∈{0,1} H*W*D represents the encrypted message; reshape represents converting the message into a one-dimensional format; k represents the encryption key, which can be 128 bits, 192 bits, or 256 bits. After the encryption, the number of 0s and 1s is closer, indicating a more uniform distribution and stronger randomness. Even if the encrypted secret message can be successfully extracted, it will not arouse obvious suspicion, making covert communication more covert and improving the security of covert communication from another aspect.

[0038] Construction of distortion probability matrix based on UT-GAN;

[0039] In the existing FNNS scheme, the probability of embedding each pixel is the same, which is obviously inappropriate. Because the carrier image will modify some pixel values ​​after embedding secret information, the difference between the modified pixel values ​​at different positions and the original image is different. At the same time, the distortion caused by modifying the carrier image where the texture is complex is usually less than that caused by modifying the smooth texture. This embodiment proposes an improved distortion function generation framework for steganography. The framework includes three modules: a generator with a U-Net architecture, which is used to convert the cover image into an embedding change probability map; a dual tanh activation function that does not require pre-training, which is used to approximate the optimal embedding simulator while maintaining the gradient norm in adversarial training; and an enhanced steganalyzer based on a convolutional neural network and combined with multiple high-pass filters as discriminators. The carrier image of this embodiment is a 3-channel color RGB image, so the dimensions of the input of the generator and the input of the discriminator are both 3. At the same time, this embodiment adds a CBAM (Convolutional BlockAttention Module) attention mechanism to the U-net-based generator to better retain effective features and improve training efficiency. The process of generating a distortion probability matrix based on the improved distortion function generation framework UT-GAN is shown in the figure. The generator of the pre-trained model obtained after training is used to calculate the distortion probability matrix of the carrier image.

[0040] Loss function design after introducing carrier distortion;

[0041] This embodiment calculates the image distortion value after disturbance superposition according to the distortion probability matrix. The larger the value, the greater the distortion of the stego image, and vice versa. Based on this, a composite loss function consisting of carrier image pixel distortion and message distortion is designed, as shown in formula (2).

[0042]

[0043] Where <,> represents the inner product of the matrix, which is performed on all dimensions of the secret message. λ1,λ2 are the weights that control the two losses. Sk represents the encrypted secret message, Sk_d represents the decoded secret message, and DPM represents the distortion probability matrix, which is generated by the improved UT-GAN and can control the distribution of the adversarial perturbation values, so that the perturbation values ​​with relatively large values ​​are embedded in the complex texture area, and the perturbation values ​​with relatively small values ​​are embedded in the smooth texture area.

[0044] This embodiment uses the unconstrained L-BFGS algorithm to optimize the objective function for adversarial perturbations. It can track the second-order gradient statistics, thereby accelerating the optimization speed. In order to conduct effective training, this paper normalizes and denormalizes the carrier image cover and the secret image stego in the algorithm flow, and uses norm and denorm to represent them respectively. The specific training steps are shown in Table 1.

[0045] Table 1

[0046]

[0047] Experimental results and analysis:

[0048] This embodiment experiments on three different datasets, namely MS-COCO, Div2k and CelebA. In order to prepare the experimental data, different processing methods are used for different datasets. For the Div2k dataset containing diverse high-quality images, this embodiment uses the entire verification set as the mask image of this article. For MS-COCO and CelebA, two large-scale natural scene and face datasets, 100 images are randomly selected as the carrier images of this article. To ensure consistency and efficiency, the images of all datasets are adjusted to a fixed resolution of 256×256. During the encryption process, the encryption key length in the AES encryption algorithm is 128 bits, and the ECB mode is used. In view of the actual situation that the algorithm of the present invention has a high decoding accuracy, the Decoder trained in SteganoGAN is selected as the FNN model.

[0049] Evaluation criteria:

[0050] This embodiment uses a common evaluation criterion for information hiding algorithms to evaluate the performance of the proposed algorithm.

[0051] (1) Embedding rate

[0052] The steganographic embedding rate refers to the ratio between the amount of secret information embedded in an image or other media and the amount of original carrier data. This indicator is used to measure the effectiveness and efficiency of the steganography algorithm. Generally speaking, the higher the embedding rate, the greater the amount of secret information that can be embedded without significantly changing the carrier data. In this embodiment, the embedding rate is the expression of the secret message s∈{0,1} H*W*D The D in is expressed in bpp (bit per pixel).

[0053] (2) Bit Error Rate

[0054] The bit error rate (BER) is an important indicator to measure the accuracy of the embedding and extraction process. The bit error rate represents the ratio of the number of erroneous bits in the secret information extracted from the carrier to the total number of extracted bits. The lower the bit error rate, the higher the accuracy of the embedding and extraction process. Its calculation method is shown in formula (3).

[0055]

[0056] Where ||||1 is the L1 norm and [] is the rounding operation.

[0057] (3)PSNR

[0058] PSNR (Peak Signal-to-Noise Ratio) is one of the commonly used indicators for measuring image quality. It is used to compare the difference between the carrier image and the processed image, and is highly correlated with human visual perception. It is usually used to evaluate the effects of image compression, reconstruction, denoising and other processing methods. In this embodiment, it is used to measure the distortion of encrypted images. The larger the value, the better the quality. The specific calculation method is shown in formula (4) and formula (5).

[0059]

[0060] PSNR = 20log 10 (max X )-10log 10 (MSE) (5)

[0061] (4)SSIM

[0062] SSIM (Structural Similarity Index) is an image quality metric used to evaluate the similarity between two images. Unlike PSNR, SSIM not only considers the difference between pixels, but also the structural information of the image, including features such as brightness, contrast, and structure. The SSIM value ranges from 0 to 1, and the closer the value is to 1, the more similar the two images are.

[0063]

[0064] Among them, μ1, μ2 represent the mean of cover and stego respectively, σ 12 represents the covariance between cover and stego, σ1 and σ2 represent the variance of cover and stego respectively.

[0065] This embodiment uses the characteristic of the existing FNNS scheme with a zero bit error rate and uses a key to encrypt secret messages, thereby fundamentally solving the security issues faced by the FNNS algorithm. The sender can transmit the secret image and the pre-trained decoder through an open channel, solving the problem of deep steganography, especially the problem of transmitting the neural network model based on the codec network. At the same time, in order to improve the visual invisibility and undetectability of the FNNS algorithm, the UT-GAN is modified in combination with the attention mechanism. Through the improved UT-GAN, the purpose of controlling the perturbation superposition method of the distortion cost matrix is ​​achieved. Experiments show that the improvement measures in this article effectively improve the security and visual invisibility of FNNS.

[0066] The above are only preferred specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A secure steganography scheme based on image perturbation adversarial training, characterized in that: The following steps are involved: Determining a secret message, and encrypting the secret message to obtain an encrypted message; Build an improved distortion function generation framework and perform training to obtain a pre-trained model; Acquire a carrier image, and calculate a distortion probability matrix of the carrier image based on a pre-trained model; The encrypted message is encoded into the carrier image based on the distortion probability matrix and the adversarial perturbation to obtain a secret image and complete secure steganography.

2. The secure steganography scheme based on image perturbation adversarial training according to claim 1 is characterized in that: The formula for encrypting the secret message is as follows: Sk_d = AES(reshape(S), k) Among them, Sk_d represents the encrypted message, reshape() represents converting the message into a one-dimensional format, k represents the encryption key, and S represents the secret message, wherein the width and height of the secret message are the same as the height and width of the carrier image.

3. The secure steganography scheme based on image perturbation adversarial training according to claim 1 is characterized in that: The improved distortion function generation framework includes a generator based on a U-net architecture, a dual tanh activation function, and an enhanced steganalyzer based on a convolutional neural network and combined with multiple high-pass filters as discriminators, wherein a CBAM attention mechanism is introduced into the generator based on the U-net architecture.

4. The secure steganography scheme based on image perturbation adversarial training according to claim 1 is characterized in that: The distortion probability matrix is ​​calculated based on a generator of a pre-trained model.

5. The secure steganography scheme based on image perturbation adversarial training according to claim 1, characterized in that: The process of obtaining a secret image includes: constructing a composite loss function based on the distortion probability matrix, setting the number of training times and the number of L-BFGS algorithm iterations, using the L-BFGS algorithm, performing adversarial perturbation optimization training by minimizing the composite loss function until the number of iterations is reached, cropping the perturbation obtained from each training and adding it to the carrier image until the number of training times is met to obtain a secret image.

6. The secure steganography scheme based on image perturbation adversarial training according to claim 5 is characterized in that: The composite loss function is as follows: Among them, <,> represents the inner product of the matrix, DPM represents the distortion probability matrix, λ1, λ2 represent the weights for controlling the two losses, Sk represents the encrypted secret message, Sk_d represents the decoded secret message, cover is the carrier image, and stego is the secret image.

7. The secure steganography scheme based on image perturbation adversarial training according to claim 1, characterized in that: Also includes: Before encoding the encrypted message into the carrier image, the carrier image is normalized, and after obtaining the encrypted image, the encrypted image is denormalized.

Images