A parallel-adversarial-based generative image steganography method and system

Abstract

The application discloses a kind of based on parallel confrontation's generative image steganography method, system, electronic equipment and computer readable storage medium, belong to image steganography technical field.The application proposes a kind of based on adding channel attention mechanism U-Net structure generation confrontation sample, enhance the security of multiple confrontation network architecture of existing steganography method, original image is generated by generator generation confrontation noise, and confrontation noise is reasonably distributed to original image to generate confrontation sample, and the steganography image generated by using the generated confrontation sample as carrier image through existing steganography algorithm can resist the detection of several most advanced steganalysis of present time;Solve the problem that " cannot resist the simultaneous detection of multiple steganalysis and cannot resist the detection of most advanced steganalysis of present time" in prior art.

Description

Technical Field

[0001] This application relates to the field of image steganography technology, and in particular to a generative image steganography method and system based on parallel adversarial approaches. Background Technology

[0002] The statements in this section merely refer to the background art relevant to this application and do not necessarily constitute prior art.

[0003] Information hiding is a new method for solving media information security issues proposed in recent years in the fields of information security and multimedia signal processing. It refers to the technique of hiding secret information within publicly available media information, making it difficult for people to detect its presence through direct visual and auditory means. Image steganography, as a method of information hiding, has always attracted much attention. It aims to hide secret information in public images in a way that is not easily detected.

[0004] Existing image steganography techniques can only improve the security of algorithms against one type of steganalysis, and cannot resist simultaneous detection by multiple steganalysis techniques or even the most advanced steganalysis techniques available today, posing new challenges to media information security. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this application provides a generative image steganography method, system, electronic device, and computer-readable storage medium based on parallel adversarial methods. This improves the security of the steganography method, enabling it to resist simultaneous detection by multiple steganalysis analyzers and enhancing information security.

[0006] Firstly, this application provides a generative image steganography method based on parallel adversarial approaches;

[0007] A generative image steganography method based on parallel adversarial approaches includes:

[0008] A generative parallel adversarial steganalysis model is constructed, comprising a generator, a stegwriter, and a multiple steganalysis network. The generator adds adversarial noise to the original image to generate adversarial samples. The stegwriter generates a steganalysis image from the original image or the adversarial samples. The multiple steganalysis network determines whether the steganalysis image contains secret information.

[0009] Based on the judgment results of the multiple steganalysis network, the loss functions of the generator and the multiple steganalysis network are constructed respectively. The generator and the multiple steganalysis network are then trained adversarially based on the loss functions of the three networks to obtain the trained generative parallel adversarial steganalysis model.

[0010] The trained generative parallel adversarial steganography model is used to obtain a steganalysis image corresponding to the original image.

[0011] Furthermore, the multiple steganalysis network includes a multiple steganalysis optimization network and a multiple steganalysis adversarial network. The multiple steganalysis optimization network optimizes multiple steganalyzers, and the optimized multiple steganalyzers constitute the multiple steganalysis adversarial network.

[0012] Furthermore, the original image and its corresponding adversarial example are used to train the multiple steganalysis optimization network. The objective function for optimization is:

[0013]

[0014] Where x is the original image, D1(x) represents the probability of the real image, and G(x) is the adversarial sample generated from the input original image.

[0015] Furthermore, the multi-steganography analysis optimization network is trained using the original image and its corresponding steganalyte, with the objective function being:

[0016]

[0017] Where x is the original image, SD2() represents the probability that the steganalysis network judges it as an image without embedded secret information, and S(x) is the steganalyte generated by inputting the original image into the steganalyte.

[0018] Furthermore, the adversarial network for multiple steganalysis is trained using adversarial examples and their corresponding steganalytes, with the objective function being optimized as follows:

[0019]

[0020] Where x is the original image, G(x) is the adversarial sample generated from the input original image, SD1(()) is the probability that the adversarial sample is the original image, D2(()) is the probability that the adversarial sample is an image without embedded secret information, and S(G(x)) is the steganalyte generated by inputting the adversarial sample into the steganalyte.

[0021] Furthermore, the generator includes a downsampling convolutional block, a channel attention module, an upsampling convolutional block, and an output layer connected in sequence. The downsampling convolutional block includes a downsampling convolutional layer, a batch normalization layer, and a ReLU activation function. The first upsampling convolutional block includes a deconvolutional layer and a batch normalization layer. The second to sixth upsampling convolutional blocks include a deconvolutional layer, a batch normalization layer, and a ReLU activation function. The output layer includes a ReLU activation function, a deconvolutional layer, and a sigmoid activation function.

[0022] Furthermore, the loss function of the generator is:

[0023]

[0024] Where n is the number of steganalysis analyzers, and α, β, and λ are weighting parameters. The loss function of the steganalysis is... To analyze the loss function of the adversarial network through multiple steganography analyses, L m This is the image distortion loss function between the original image and the adversarial sample.

[0025] Furthermore, the multiple steganalysis network is a combination of the SRNet network structure and the Zhu-Net network structure.

[0026] Secondly, this application provides a generative image steganography system based on parallel adversarial mechanisms;

[0027] A generative image steganography system based on parallel adversarial mechanisms includes:

[0028] The model building module is configured to: build a generative parallel adversarial steganalysis model including a generator, a stegwriter and a multi-steganalysis network, wherein the generator adds adversarial noise to the original image to generate adversarial samples, the stegwriter generates a steganalysis image from the original image or adversarial samples, and the multi-steganalysis network determines whether the steganalysis image contains secret information.

[0029] The adversarial training module is configured to: construct loss functions for the generator and the multiple steganalysis network respectively based on the judgment results of the multiple steganalysis network; and perform adversarial training on the generator and the multiple steganalysis network based on the loss functions of the three networks to obtain the trained generative parallel adversarial steganalysis model.

[0030] The image steganography module is configured to obtain a steganalysis image corresponding to the original image based on a trained generative parallel adversarial steganography model.

[0031] Thirdly, this application provides an electronic device;

[0032] An electronic device includes a memory and a processor, as well as computer instructions stored in the memory and running on the processor, wherein the computer instructions, when executed by the processor, perform the steps of the above-described generative image steganography method based on parallel adversarial processing.

[0033] Fourthly, this application provides a computer-readable storage medium;

[0034] A computer-readable storage medium for storing computer instructions, which, when executed by a processor, complete the steps of the above-described generative image steganography method based on parallel adversarial processing.

[0035] Compared with the prior art, the beneficial effects of this application are:

[0036] 1. This application generates adversarial examples using a U-Net framework with added lightweight channel attention modules, which can resist the steganalytic architecture of multiple steganalysis networks. The original image is processed by our generator to generate adversarial noise, which is reasonably distributed into the original image to generate adversarial examples. The generated adversarial examples are used as carrier images, and the steganalytic images generated by existing steganalysis algorithms can resist the detection of several of the most advanced steganalysis analyzers.

[0037] 2. This application designs a lightweight channel attention module to fully utilize channel correlation and dynamically adjust the embedding position of adversarial noise in the original image, thereby enabling the generated adversarial examples to have higher image quality and better perturbation ability to steganalysis networks.

[0038] 3. To further improve the image quality of adversarial examples and their ability to perturb steganalysis networks, this application sets up a training network that simultaneously opposes multiple steganalysis networks. The total loss of the generator is a weighted combination of the discriminative loss and mean squared error loss of the multiple steganalysis networks. The number of steganalysis networks and the location of the channel attention module are determined through ablation experiments. Finally, the weight coefficients in the loss function are determined. Compared with adversarial examples generated by other methods, the adversarial examples generated by the technical solution adopted in this application have a stronger perturbation ability against several of the most advanced steganalysis networks. Attached Figure Description

[0039] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments of this application and their descriptions are used to explain this application and do not constitute an undue limitation of this application.

[0040] Figure 1 A schematic diagram of the framework of a generative parallel adversarial steganography model is provided for embodiments of this application;

[0041] Figure 2 This is a schematic diagram of the network structure of the generator provided in an embodiment of this application;

[0042] Figure 3 This is a schematic diagram of the SRNet network structure provided in the embodiments of this application;

[0043] Figure 4 This is a schematic diagram of the Zhu-Net network structure provided in the embodiments of this application;

[0044] Figure 5 A schematic diagram of the original image and adversarial samples and their histogram distribution provided for embodiments of this application;

[0045] Figure 6The diagrams provided in this application are schematic diagrams of the distribution of PSNR and SSIM of generated adversarial samples, where (a) is a schematic diagram of the distribution of PSNR of generated adversarial samples and (b) is a schematic diagram of the distribution of SSIM of generated adversarial samples. Detailed Implementation

[0046] It should be noted that the following detailed descriptions are exemplary and intended to provide further explanation of this application. Unless otherwise specified, all technical and scientific terms used in this application have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.

[0047] It should be noted that the terminology used herein is for the purpose of describing particular implementations only and is not intended to limit the exemplary implementations according to this application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. Furthermore, it should be understood that the terms “comprising” and “having”, and any variations thereof, are intended to cover non-exclusive inclusion, for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such process, method, product, or apparatus.

[0048] Where there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0049] Example 1

[0050] Existing image steganography techniques can only improve algorithm security against one steganalysis, and cannot resist simultaneous detection by multiple steganalysis analyzers or the detection by the most advanced steganalysis analyzers available today. Therefore, this application provides a generative image steganography method based on parallel adversarial mechanisms.

[0051] Next, combined Figure 1-6 This embodiment discloses a generative image steganography method based on parallel adversarial approaches, which includes the following steps:

[0052] S1. Construct a generative parallel adversarial steganalysis model that includes a generator, a stegon, and a multiple steganalysis network. The generator adds adversarial noise to the original image to generate adversarial samples. The stegon generates a steganalysis image from the original image or the adversarial samples. The multiple steganalysis network determines whether the steganalysis image contains secret information.

[0053] The network structure of the generator is as follows Figure 2As shown, the system includes 16 processing units. Groups 1-8 form a contraction path. Groups 1-7 each contain downsampling convolutional blocks with a stride of 2. Each downsampling convolutional block consists of a downsampling convolutional layer, a batch normalization layer, and a ReLU activation function, all connected in sequence. Each downsampling convolutional block is connected to a channel attention module. Group 8 consists of downsampling convolutional blocks. Groups 9-15 form an expansion path. Each group contains upsampling convolutional blocks with a stride of 2. Group 9's upsampling convolutional blocks consist of a deconvolutional layer and a batch normalization layer, connected in sequence. Groups 10-15's upsampling convolutional blocks consist of a ReLU activation function, a deconvolutional layer, and a batch normalization layer, connected in sequence. Group 16 is the output layer, consisting of a ReLU activation function, a deconvolutional layer, a Sigmoid activation function, and a ReLU activation function, connected in sequence. By using a method of skipping within the same layer, the output of the i-th processing unit is concatenated with the output of the (16-i)-th processing unit as the input of the (16-i+1)-th processing unit.

[0054] The network structure parameters of the generator are shown in the table below:

[0055] Table 1 Generator Network Structure Parameters

[0056]

[0057]

[0058] The channel attention module designed in this embodiment adjusts the channels according to their importance.

[0059] Attention mechanisms in deep learning enable networks to focus on important features while ignoring irrelevant ones. In adversarial example generation, adversarial noise is embedded by fusing it with features from the original image. These features have varying importance in perturbating the final steganalysis network; therefore, attention mechanisms may help improve the adversarial examples' resistance to steganalysis. Furthermore, adding adversarial noise at appropriate locations in different channels has varying effects on the quality of the generated adversarial example images; channel attention mechanisms may help improve the quality of the generated images. Hard attention mechanisms select a subset of input data elements and completely discard the rest. Due to its non-differentiability, it is often associated with reinforcement learning. In our adversarial example generation, the information of the carrier image needs to be preserved as much as possible, rather than discarded. Moreover, reinforcement learning training is often inefficient. Self-attention mechanisms capture the inherent relationships between image patches in computer vision. Since adversarial example generation considers overall image information, its direct contribution is small. Therefore, we choose soft attention mechanisms, which assign a weight between 0 and 1 to features to indicate the degree of attention required.

[0060] Soft attention mechanisms mainly include spatial attention and channel attention. The former allows the network to find suitable image regions, while the latter helps to focus on favorable channels in the feature map. Spatial attention uses an attention model to generate a mask that indicates the attention sensitivity of the original image; this is a form of spatial attention. The larger the value in the mask, the higher the risk of visual detection due to changes in the corresponding pixels. However, the less attention-sensitive regions shown by spatial attention are not complex textures or edge regions, which are considered safe for adaptive steganography. Since convolutional layers themselves have the effect of edge detection and texture extraction, we believe that the functionality of adding a spatial attention model is limited. This prompts us to investigate the impact of channel attention on image steganography. In our method, convolutional layers are the basic building blocks. They convert the image into a multi-channel feature map so that adversarial noise can be added to these channel features. When processing the input feature map, classical convolutional operations cannot capture the overall information within the channels and the dependencies between channels, resulting in some meaningless channels in the output feature map. In the output adversarial examples, meaningless channels may further transform into unnecessary noise, which is detrimental to the image quality of the adversarial examples. Therefore, we should emphasize important channels and suppress meaningless channels. To address this, we designed a channel attention module that adjusts channels based on their importance.

[0061] Let the input feature map F be denoted as First, the interdependencies between channels are used to derive the weight vector, where each weight reflects the importance of each channel. Then, the weights are multiplied by the corresponding channels to scale the features, outputting a recalibrated feature map U. The channel attention mechanism assigns different weights to different channels of the input feature map F to represent their importance; the larger the weight, the more important the channel.

[0062] Specifically, spatial information is aggregated in each channel of the feature map F using average pooling, and the result is calculated using the following formula:

[0063]

[0064] Pooling compresses the global information of each channel into a scalar, serving as spatial feature statistics. To derive weights representing the importance of each channel from these statistics, we perform linear and nonlinear operations on them. Specifically, we use a shared network consisting of two fully connected layers to propagate f. avg Next, the eigenvectors are converted into channel weight vectors using the Sigmoid function. That is, the weight vectors. It can be obtained from the following formula:

[0065] s=σ(W2((1f avg )))

[0066] Here, δ and σ represent the ReLU and sigmoid activation functions, respectively, and W1 and W2 refer to the weights of each layer. It's important to note that the hidden layers reduce the dimensionality of the input to balance model performance and computational complexity. Referring to research on related channel attention mechanisms, we set the breakdown coefficient τ to 16, which is the optimal configuration. Finally, each element of s (as a scalar) is multiplied by each channel of F to compute U = [U...]. 1 U 2 , ..., U m The calculation of the m-th channel of U can be expressed as:

[0067] U m = m F m

[0068] In this way, useless channels are suppressed by multiplying with lower weights, and vice versa. After modifying the channels, U has a stronger ability to generate noise-resistant data.

[0069] The steganography is based on the UT-SCA-GAN model, which uses the Tanh-simulator function instead of the TES activation function and employs a more compact U-Net generator.

[0070] Multiple steganalysis networks include multiple steganalysis optimization networks and multiple steganalysis adversarial networks. The multiple steganalysis optimization network optimizes multiple steganalyzers, and the optimized multiple steganalyzers constitute the multiple steganalysis adversarial network.

[0071] This embodiment selects two steganalyst architectures: SRNet and Zhu-Net. SRNet is a 48-layer deep learning steganalysis model that utilizes residual networks to simulate the feature selection process of traditional SRM. SRNet can be applied not only to the spatial domain but also performs well in the JPEG domain. SRNet increases the number of layers in its network structure and uses a residual structure to address the gradient explosion and vanishing issues that occur during backpropagation when the network has a high number of layers, helping the network to converge to a globally optimal or near-optimal solution more easily during training. Zhu-Net makes significant improvements over previous steganalysis networks. It is the first to introduce an improved 3×3 filter kernel in the preprocessing layer, using a combination of 25 3×3 filter kernels and 5 5×5 filter kernels instead of the original 30 5×5 filter kernels. This reduces the parameters in the preprocessing layer, making it easier to fit the model. To make the network more sensitive to signal-to-noise ratio information and learn more effective information, Zhu-Net uses only ReLU as the activation function for each layer and introduces spatial pyramid pooling into steganalysis to replace the global average pooling operation before the fully connected layers. Zhu-Net also uses two different depth-separating convolutional modules to obtain spatial residual features and channel residual features.

[0072] S2. Train the generative parallel adversarial steganography model, where X is the original image; the specific training steps are as follows:

[0073] S201. Input the original image X into a U-Net-based generator with added channel attention module, output adversarial noise V, add the adversarial noise to the original image to generate adversarial samples X_V with the same distribution as the original image X; the formula is as follows:

[0074] V = f G (X,θ G )

[0075] X_V = Add(X, V)

[0076] By adjusting the magnitude of the adversarial noise in the final output, the adversarial noise can be controlled within a certain intensity. Finally, the adversarial noise is added to the original image and the pixel values ​​are limited to a certain range to generate adversarial samples.

[0077] S202. Input the generated adversarial sample X_V and the original image X into the multiple steganalysis optimization network, and train the multiple steganalysis optimization network. The multiple steganalysis optimization network improves the image quality of the generated adversarial sample by distinguishing between the generated adversarial sample and the real image; the objective function of optimization is:

[0078]

[0079] Here, SD1() represents the probability of the real image, and G(x) is the adversarial sample generated from the original input image X.

[0080] Record the discriminant loss SDO_loss1, and calculate the pixel space mean square error loss MSE_loss between the generated adversarial example and the original image. The loss function for the discriminant loss SDO_loss1 is:

[0081]

[0082] Where x1 and x2 are the probabilities of the original image and the generated adversarial example, respectively, and x1′ and x2′ are the labels corresponding to the input original image and the generated adversarial example, respectively.

[0083] The loss function for pixel spatial mean square error loss (MSE_loss) is:

[0084]

[0085] S203. Input the original image X into the steganalyzer and output its steganalyte X_S. Input X and X_S into the multiple steganalyzer optimization network SON respectively, and train and optimize the steganalyzer network model parameters. The objective function for optimization is:

[0086]

[0087] Where SD2(x) represents the probability that the steganalysis network judges it as an image without embedded secret information, and S(x) is the steganalysis image X_S generated by inputting the original image X into the stegwriter SN.

[0088] S204. Input the generated adversarial sample X_V into the stegwriter, and the output is the steganalytic image X_V_S. Input X_V and X_V_S into a multi-steganalysis adversarial network constructed with the optimized steganalytic analyzer to verify the anti-steganalysis capability of the generated steganalytic image. The optimization objective function is:

[0089]

[0090] Where G(x) is the adversarial sample X_V generated from the original image X, SD1(G(x)) represents the probability that the steganalysis network determines the adversarial sample to be the original image, SD2(G(x)) represents the probability that the steganalysis network determines the adversarial sample to be an image without embedded secret information, and S(G(x)) is the steganalysis image X_V_S generated by inputting the adversarial sample X_V into the stegon SN.

[0091] And record the steganalysis loss SDO_loss2. The loss function for steganalysis loss SDO_loss2 is:

[0092]

[0093] Where y1 and y2 are the outputs of the steganalysis SD after passing through the softmax layer, and y1′ and y2′ are the labels corresponding to the input real image and steganalysis image, respectively.

[0094] S205, dynamically weighted superposition of multiple steganalysis discriminant losses SDO_loss1, SDO_loss2 and mean squared error loss MSE_loss, are used as the joint loss function of the generator.

[0095] The generator G engages in adversarial training against a multi-stenographic analysis adversarial network (SAN), attempting to mislead the steganalyzer SD into making incorrect judgments. The generator's loss is an inverse weighted sum of two losses, SDO_loss1 and SDO_loss2. Simultaneously, to ensure the visual quality of the generated adversarial examples, a pixel spatial mean square error loss (MSE_loss) is introduced into the total loss to promote higher PSNR values ​​in the generated adversarial examples. Therefore, the total loss of generator G is:

[0096]

[0097] n represents the number of steganalysis networks that are simultaneously adversarial during training. In the initial stage of our study, the simultaneous adversarial quadruple steganalysis network was slow to train and produced poor-quality adversarial sample images. After ablation experiments and weight adjustments to the loss function, the number of steganalysis networks was reduced to 2.

[0098] In this embodiment, λ = 0.2, α and β are dynamic weights; initially, α = 0.4, β = 0.6; ultimately, α = 0, β = 1; k1 = k2 = 0.5

[0099] S206. The parameters of the generator and the multiple steganalysis network are updated by iterative optimization. SOD_loss1, MSE_loss and SDO_loss2 are minimized respectively to ensure that the multiple adversarial steganalysis network for generating adversarial examples converges quickly and stably, generating adversarial examples with high image quality and large perturbation to the steganalysis network.

[0100] The overall objective function for model optimization is:

[0101]

[0102] S3. Obtain the steganalysis image corresponding to the original image based on the trained generative parallel adversarial steganalysis model.

[0103] To verify the information hiding performance of the generative steganography network based on U-net, this embodiment uses the classic BOSSBase dataset for steganography and steganalysis experiments. Before the experiment, 512×512 BOSSBase images were resized to 256×256 using the default parameters in MATLAB. 8000 images were randomly selected from 10000 BOSSBase images as the training set, and the remaining 2000 images were used for experimental result testing and performance verification.

[0104] The experiment used an Adam optimizer with a learning rate of 0.0001 to train the generator network model (α = 0.5, β = 0.99). During the training phase, 16 original images X were used as input in each iteration to generate corresponding adversarial examples X_V. The original images X and adversarial examples X_V were then input into a multi-steganalysis analyzer to adversarially improve the visual quality of the generated images. The multi-loss was recorded. Then, a steganalysis image X_S is generated by embedding 0.4 bpp secret information into the real image X using different steganalysis algorithms. X and X_S are then simultaneously input into the steganalysis optimization network SON to optimize the network model parameters. On the other hand, a multi-adversarial network SAN is constructed based on the trained steganalysis analyzer SD. The generated adversarial sample X_V and the steganalysis image X_V_S generated using it are input into the steganalysis network for verification, and the loss is recorded. Finally, the weighted sum of the mean squared error loss (MSE_loss) of the adversarial examples and the original images is used as a new loss, which is then used in the next round of adversarial example generation optimization. Through iterative adversarial optimization, the anti-steganography capability and visual quality of the generated adversarial examples are improved. After training, another 2000 original images are selected from the BOSS Base dataset. Based on the trained multi-adversarial steganography network, adversarial examples with high perturbation to the steganalysis network and good image quality are generated. Random information is embedded into the adversarial examples using the 0.4bpp ASDL-GAN and UT-SCA-GAN embedding algorithms to construct a test set for evaluating the quality and steganalytic performance of the generated steganographic images.

[0105] As the number of model iterations increases, the adversarial examples generated by the generator become increasingly similar to the original images. Six images are randomly selected for verification, and histogram analysis is performed to compare the similarity of their histogram distributions. Figure 5 As shown, Figure 5The image shows a comparison between six randomly selected generative adversarial examples and the original image. The first column represents the original image, the second column represents the generative adversarial example, and the third and fourth columns are the histogram distributions of the original image and the generative adversarial example, respectively. The comparison shows that the histogram distributions of the generative adversarial example and the original image are basically the same. The calculation results also indicate that the PSNR values ​​of the generative adversarial example and the original image are greater than 40 dB, indicating a very high degree of similarity.

[0106] To further verify the visual quality of the generated images and obtain more detailed standard values ​​to evaluate the performance of the generative network, PSNR and SSIM, two of the most common image quality evaluation metrics, were used in the experimental phase to evaluate the quality of the generated images. PSNR assesses the visual quality of an image by calculating the error between corresponding pixels. This metric is positively correlated with the visual quality ratings given by human visual experts; the higher the PSNR value, the more similar the image and the less distortion. PSNR is calculated using the following formula:

[0107]

[0108]

[0109] Where W and H are the width and height of the image, x i,j y i,j This represents the pixels at the same spatial location in two images, where n is the number of pixels.

[0110] SSIM (Structural Similarity Indicator) is a metric for measuring the similarity between two images. It measures image quality in three ways: brightness, contrast, and structure. SSIM can be obtained using the following formula:

[0111]

[0112] Where μ X ,μ Y , These are the mean and variance of X and Y, respectively, and σ XY It is covariance.

[0113] Figure 6 (a)- Figure 6 (b) shows the PSNR and SSIM distribution of adversarial examples generated based on the validation set, where the horizontal axis represents the number of images and the vertical axis represents the PSNR and SSIM values ​​of the images. Figure 6The results show that the average PSNR of the 2000 generated adversarial examples is 40.3556 dB; more than 99.55% of the images have a PSNR greater than 39 dB, and more than 75% of the generated adversarial examples have a PSNR greater than 40 dB. On the other hand, the average SSIM value of the generated adversarial examples is 0.9625; more than 69.85% of the generated examples have an SSIM greater than 0.955, and more than 55.6% of the adversarial examples have an SSIM greater than 0.960. The generated adversarial examples exhibit high image similarity and excellent visual quality compared to the original images. Experimental results demonstrate that our generator based on U-Net with added channel attention modules can output high-quality adversarial examples. Compared to generative adversarial network algorithms that generate random images based on original noise, this algorithm has advantages such as controllable generation targets, large generated image size, and high quality. It can generate high-quality adversarial examples with controllable content according to information steganography needs, enhancing information hiding capabilities and facilitating better covert communication effects.

[0114] Table 2. Experimental Results of Steganography Network Ablation

[0115]

[0116] As shown in Table 3, the combination of SRNet and Zhu-Net steganalysis networks achieved excellent results in both the PSNR of generated adversarial examples and the perturbation of the four steganalysis networks. The horizontal rows in the table represent the steganalysis network structures used in the experiments, the average PSNR of generated adversarial examples, the maximum PSNR of generated adversarial examples, the false negative rate of the four steganalysis networks for steganalysis images generated using adversarial examples, and the model training time for steganalysis images generated using the original images. The vertical columns represent the combination of different steganalysis network structures in the ablation experiments.

[0117] Table 3. Ablation Experiment Results of Channel Attention Module

[0118]

[0119]

[0120] As shown in Table 3, the PSNR of adversarial examples generated by adding channel attention simultaneously in the encoding, decoding, and encoding / decoding stages, and the perturbation effect on the four steganalysis networks, are not significantly different. When the channel attention module is added in the encoding stage, the average PSNR and steganalysis resistance of the generated adversarial examples achieve the best results, with a PSNR of 40.3556. This also results in false negative rates of 100%, 94.7%, 92.4%, and 95.4% for Xu-Net, Ye-Net, SRNet, and Zhu-Net, respectively. However, removing the channel attention module leads to varying degrees of decrease in both the PSNR and steganalysis resistance of the generated adversarial examples. Experimental results show that the channel attention module significantly improves performance across all evaluation criteria. Channel attention emphasizes generating more adversarial noise with strong steganalysis resistance and dynamically adjusts the placement of adversarial noise in the original image to ensure the quality of the adversarial example image, while suppressing the generation of meaningless and redundant adversarial noise, thereby improving the quality of the adversarial example image.

[0121] Table 4 Experimental results of MSE_Loss weight λ

[0122]

[0123] Table 4 shows the PSNR and SSIM evaluation results of generated adversarial examples under different λ values, as well as the false detection rates of the four steganalysis networks. As can be seen from Table 4, when λ = 0.2, the average PSNR of the generated image is 40.3556 and the SSIM is 0.9625, resulting in false detection rates of 100%, 94.7%, 93.1%, and 95.4% for Xu-Net, Ye-Net, SRNet, and Zhu-Net, respectively. At this value, the quality of the generated adversarial example image is optimal, and the resistance to steganalysis is also strong. We consider this to be the optimal balance and the most ideal MSE_loss weight. Therefore, in this embodiment, the weight of MSE_loss in the generator loss function is set to 0.2.

[0124] Table 5. Experimental results of discriminant loss weights α and β

[0125]

[0126]

[0127] Note: The Dynamic column represents the dynamic weighting scheme set in this plan.

[0128] Table 5 shows the optimal PSNR and SSIM values ​​achieved after 150 epochs under different α and β settings, as well as the false negative rates of the four steganalysis networks. As can be seen from Table 5, when α = 0.5 and β = 0.5, the average PSNR for adversarial examples is 39.3516 and the SSIM is 0.9616, with false negative rates of 100%, 94.6%, 91.3%, and 93.9%, respectively. When α = 0.4 and β = 0.6, the PSNR for adversarial examples is 38.9943 and the SSIM is 0.9572, with false negative rates of 100% for the four steganalysis networks. The false negative rates (FNRs) of the four steganalysis networks were 94.8%, 91.6%, and 94.8%, respectively. When α = 0.3 and β = 0.7, the adversarial sample PSNR was 39.2875 and the SSIM was 0.9614, with FNRs of 100%, 95.3%, 90.6%, and 94.6%, respectively. When α = 0.2 and β = 0.8, the adversarial sample PSNR was 39.1375 and the SSIM was 0.9594, with FNRs of 94.8%, 91.6%, and 94.8%, respectively. The false negative rates (FNRs) reached 100%, 95.3%, 90.6%, and 94.6%, respectively. When α = 0.1 and β = 0.9, the adversarial sample PSNR reached 39.4312 and the SSIM reached 0.9620, with the false negative rates of the four steganalysis networks reaching 100%, 94.3%, 92.2%, and 95.1%, respectively. In the Dynamic column, the optimal PSNR value for adversarial samples reached 40.3556 and the SSIM value reached 0.9625, with the false negative rates of the four steganalysis networks reaching 100%, 94.7%, 92.4%, and 95.4%, respectively. This column is based on the experimental results obtained using the α and β dynamic weight scheme. In the experiment, the initial α = 0.4 and β = 0.6 were first set. In the first 100 epochs of model training, the parameter α was reduced by 1% per epoch, and the parameter β was increased by 1% per epoch. After 100 epochs, α = 0 and β = 1.0 were set. The reason for this parameter design is that after 100 epochs of training in our model, the gradients provided by the multiple original images and the discriminative loss SDO1_loss for generative adversarial examples become essentially fixed, weakening their effect on generator optimization. To promote the generation of adversarial examples with higher image quality and stronger resistance to steganalysis, after 100 epochs, the generator no longer accepts the loss provided by SDO1_loss; instead, the generator loss function is set to α = 0 and β = 1.0. At this point, only the steganalysis adversarial network (SAN) is used to optimize the steganalysis resistance of the generated adversarial examples.

[0129] Table 6. Experimental results of weight assignments k1 and k2 for SRNet and Zhu-Net.

[0130]

[0131] In our previous experiments, we conducted ablation studies on multiple steganalysis network structures, ultimately leaving only SRNet and Zhu-Net. In the generator loss function, there is also a weight allocation issue between SRNet and Zhu-Net: the SRNet loss corresponds to weight k_1, and the Zhu-Net loss corresponds to weight k_2. By assigning different weights to the two steganalysis networks, the degree of perturbation exerted by the generated adversarial examples on the two networks also differs.

[0132] Table 6 shows the image quality of generated adversarial examples under different weight assignments of SRNet and Zhu-Net, and the perturbation effect on different steganalysis networks.

[0133] The data in the table shows that when k_1 = 0.5 and k_2 = 0.5, both the image quality of generated adversarial examples and the perturbation effect on the four steganalysis networks are optimal. When other weight allocations are chosen, Xu-Net maintains complete resistance, while the perturbation effect on Ye-Net decreases to varying degrees. When k_1 = 0.6 and k_2 = 0.4, the PSNR and SSIM of the generated adversarial examples decrease slightly, and the perturbation effect on Ye-Net decreases slightly. Although this slightly increases the false negative rate of SRNet by 0.5%, it significantly decreases the false negative rate of Zhu-Net by 3.3%. When k_1 = 0.4 and k_2 = 0.6, the PSNR and SSIM of the generated adversarial examples and the perturbation effect on Zhu-Net are slightly improved, but the false negative rate of SRNet decreases significantly by 2.9%. When k_1 = 0.7, k_2 = 0.3 and k_1 = 0.3, k_2 = 0.7, the PSNR and SSIM of the generated images decreased slightly again, and the perturbation effect of the generated adversarial examples on Zhu-Net and SRNet was significantly reduced, with the false negative rate of both networks falling below 90%. When k_1 = 0.8, k_2 = 0.2 and k_1 = 0.2, k_2 = 0.8, the image quality of the generated adversarial examples decreased significantly, with the PSNR of the generated adversarial examples only around 37, and the generated adversarial examples were more inclined to oppose a single steganalysis network.

[0134] Example 2

[0135] This embodiment discloses a generative image steganography system based on parallel adversarial mechanisms, including:

[0136] The model building module is configured to: build a generative parallel adversarial steganalysis model including a generator, a stegwriter and a multi-steganalysis network, wherein the generator adds adversarial noise to the original image to generate adversarial samples, the stegwriter generates a steganalysis image from the original image or adversarial samples, and the multi-steganalysis network determines whether the steganalysis image contains secret information.

[0137] The adversarial training module is configured to: construct loss functions for the generator and the multiple steganalysis network respectively based on the judgment results of the multiple steganalysis network; and perform adversarial training on the generator and the multiple steganalysis network based on the loss functions of the three networks to obtain the trained generative parallel adversarial steganalysis model.

[0138] The image steganography module is configured to obtain a steganalysis image corresponding to the original image based on a trained generative parallel adversarial steganography model.

[0139] It should be noted that the model building module, adversarial training module, and image steganography module mentioned above correspond to the steps in Embodiment 1. The examples and application scenarios implemented by these modules and their corresponding steps are the same, but they are not limited to the content disclosed in Embodiment 1. It should also be noted that these modules, as part of the system, can be executed in a computer system, such as a set of computer-executable instructions.

[0140] Example 3

[0141] Embodiment 3 of the present invention provides an electronic device, including a memory and a processor, as well as computer instructions stored in the memory and running on the processor. When the computer instructions are executed by the processor, they complete the steps of the above-mentioned generative image steganography method based on parallel adversarial methods.

[0142] Example 4

[0143] Embodiment 4 of the present invention provides a computer-readable storage medium for storing computer instructions, which, when executed by a processor, complete the steps of the above-described generative image steganography method based on parallel adversarial processing.

[0144] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0145] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0146] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment, whereby a series of operational steps are performed to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0147] The descriptions of each embodiment in the above embodiments have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0148] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A generative image steganography method based on parallel adversarial approaches, characterized in that, include: A generative parallel adversarial steganography model is constructed, comprising a generator, a stegwriter, and a multiple steganalysis network. The generator adds adversarial noise to the original image to generate adversarial examples. The stegwriter generates a steganalysis image from the original image or the adversarial examples. The multiple steganalysis network determines whether the steganalysis image contains secret information. The generator comprises a downsampling convolutional block, a channel attention module, an upsampling convolutional block, and an output layer connected in sequence. The downsampling convolutional block includes a downsampling convolutional layer, a batch normalization layer, and a ReLU activation function. The first upsampling convolutional block includes a deconvolutional layer and a batch normalization layer. The second to seventh upsampling convolutional blocks include a deconvolutional layer, a batch normalization layer, and a ReLU activation function. The output layer includes a ReLU activation function, a deconvolutional layer, and a sigmoid activation function. The loss function of the generator is: Where n is the number of steganalysis analyzers, and α, β, and λ are weighting parameters. The loss function of the steganalysis is... To analyze the loss function of the adversarial network through multiple steganography analyses, L m This is the image distortion loss function between the original image and the adversarial sample; The steganalysis analyzer in the multi-steganalysis network is a combination of the SRNet network structure and the Zhu-Net network structure; Based on the judgment results of the multiple steganalysis network, loss functions for the generator and the multiple steganalysis network are constructed respectively. The generator and the multiple steganalysis network are then trained adversarially based on their loss functions to obtain the trained generative parallel adversarial steganalysis model. The trained generative parallel adversarial steganography model is used to obtain a steganalysis image corresponding to the original image.

2. The generative image steganography method based on parallel adversarial approaches as described in claim 1, characterized in that, The multiple steganalysis network includes a multiple steganalysis optimization network and a multiple steganalysis adversarial network. The multiple steganalysis optimization network optimizes multiple steganalyzers, and the optimized multiple steganalyzers constitute the multiple steganalysis adversarial network.

3. The generative image steganography method based on parallel adversarial approaches as described in claim 2, characterized in that, The multiple steganalysis optimization network is trained using the original image and its corresponding adversarial example. The objective function for optimization is: Where x is the original image, SD1(x) represents the probability of the real image, and G(x) is the adversarial sample generated from the input original image; Furthermore, the multi-steganography analysis optimization network is trained using the original image and its corresponding steganalyte, with the objective function being: Where x is the original image, SD2(x) represents the probability that the steganalysis network judges it as an image without embedded secret information, and S(x) is the steganalyte generated by inputting the original image into the steganalyte.

4. The generative image steganography method based on parallel adversarial approaches as described in claim 2, characterized in that, The adversarial network for multiple steganalysis is trained using adversarial examples and their corresponding steganalytes. The objective function for optimization is: Where x is the original image, G(x) is the adversarial sample generated from the input original image, SD1(G(x)) is the probability that the adversarial sample is the original image, SD2(G(x)) is the probability that the adversarial sample is an image without embedded secret information, and S(G(x)) is the steganalyte generated by inputting the adversarial sample into the steganalyte.

5. A generative image steganography system based on parallel adversarial mechanisms, characterized in that, include: The model building module is configured to: build a generative parallel adversarial steganalysis model including a generator, a stegwriter and a multi-steganalysis network, wherein the generator adds adversarial noise to the original image to generate adversarial samples, the stegwriter generates a steganalysis image from the original image or adversarial samples, and the multi-steganalysis network determines whether the steganalysis image contains secret information. The generator comprises a downsampling convolutional block, a channel attention module, an upsampling convolutional block, and an output layer connected in sequence. The downsampling convolutional block includes a downsampling convolutional layer, a batch normalization layer, and a ReLU activation function. The first upsampling convolutional block includes a deconvolutional layer and a batch normalization layer. The second to seventh upsampling convolutional blocks include a deconvolutional layer, a batch normalization layer, and a ReLU activation function. The output layer includes a ReLU activation function, a deconvolutional layer, and a sigmoid activation function. The loss function of the generator is: Where n is the number of steganalysis analyzers, and α, β, and λ are weighting parameters. The loss function of the steganalysis is... To analyze the loss function of the adversarial network through multiple steganography analyses, L m This is the image distortion loss function between the original image and the adversarial sample; The steganalysis analyzer in the multi-steganalysis network is a combination of the SRNet network structure and the Zhu-Net network structure; The adversarial training module is configured to: construct loss functions for the generator and the multiple steganalysis network respectively based on the judgment results of the multiple steganalysis network; and perform adversarial training on the generator and the multiple steganalysis network based on the loss functions of the two to obtain the trained generative parallel adversarial steganalysis model. The image steganography module is configured to obtain a steganalysis image corresponding to the original image based on a trained generative parallel adversarial steganography model.

6. An electronic device, characterized in that, It includes a memory and a processor, as well as computer instructions stored in the memory and running on the processor, which, when executed by the processor, perform the method according to any one of claims 1-4.

7. A computer-readable storage medium, characterized in that, Used to store computer instructions, which, when executed by a processor, perform the method described in any one of claims 1-4.

Images