An end-to-end approach to detecting adversarial steganography

Abstract

The present invention discloses an end-to-end method for detecting adversarial steganography. This method addresses the problem that adding adversarial perturbations to steganography methods makes it difficult for steganalysis models to detect adversarial steganography. The method utilizes confidence artifacts and pixel artifacts to detect adversarial steganographic images. By designing a confidence loss function to amplify the confidence artifacts caused by the adversarial perturbation, more easily detectable gradient flow information is obtained, which is then input into a designed gradient subnet for feature extraction. Simultaneously, the image is divided into two sub-blocks and scrambled up and down to destroy the adversarial perturbation. The feature similarity between the two image sub-blocks is used to reduce the classification difference between the adversarial perturbation and the stegoscopy noise, highlighting its difference from natural noise, thereby reducing the negative impact of the adversarial perturbation. The method of the present invention is simple to calculate and easy to implement. It can effectively improve the detection accuracy of adversarial steganography and has practical value.

Description

Technical Field

[0001] The present invention relates to the technical field of information hiding, and in particular to a method for end-to-end detection of anti-steganography. Background Art

[0002] Image steganography aims to conceal secret information within an image, enabling information transmission without attracting third-party attention. The goal of steganalysis detection is to detect secret communications established through steganography. With the continuous development of steganography, corresponding steganalysis technologies are also rapidly evolving. Since the 2014 paper (Shunquan Tan, Bin Li, Signal and Information Processing Association Annual Summit and Conference, 2014, pp. 1-4) first applied convolutional neural networks (CNNs) to steganalysis, the detection performance of CNN-based steganalysis models has continued to improve. To enhance the security of steganography against adversarial analysis models, steganalysis researchers have proposed a defense method against deep learning analysis models, namely adversarial steganography. Adversarial examples involve adding small perturbations to the model to cause it to produce erroneous output. Adversarial steganography transforms stego-images into adversarial examples, aiming to carry secret information while evading detection by the analysis model. Adversarial steganography methods are typically heuristic, capturing specific details to deceive steganalyzers. For example, the paper (Solène Bernard, Tomás Pevny, Patrick Bas, John Klein, ACM Workshop on Information Hiding and Multimedia Security. 2019, 216-221) iteratively constructs an enhanced carrier image through a fast gradient algorithm based on adversarial samples until the generated secret image can deceive the pre-trained steganalyzer. The paper (M.Liu, W.Luo, P.Zheng, and J.Huang, IEEE Transactions on Information Forensics and Security, 2021, 16: 4621-4634) proposes the method MAE, which combines the gradient of the carrier image and the gradient of the secret image to determine the direction of cost modification, further improving the security of the steganography method. These adversarial steganography methods have brought huge challenges to the task of steganalysis, and people have tried to reduce the negative impact of adversarial samples on deep learning models. Adversarial training is a common method to defend against adversarial samples, which trains a more robust network by using a mixture of normal samples and adversarial samples as a training set. During training, the spatial instability of adversarial examples can be exploited to preprocess the input images, such as through JPEG compression, scaling, or adding noise. However, this approach introduces additional noise, reducing the accuracy of steganalysis detection. Another straightforward solution is to eliminate adversarial noise, such as using autoencoders to remove adversarial perturbations in input samples or employing noise reduction techniques to remove adversarial noise.However, in steganalysis, removing noise can also remove the stegano-noise, causing the stegano-noise to fail. Another approach is to add additional image categories, known as adversarial examples, to distinguish between normal and adversarial examples. This approach is more effective for multi-classification tasks, as the model outputs more confidence information. However, steganalysis, as a binary classification task, has less confidence information, and stegano-noise and adversarial noise are very similar, both added to texture-rich areas, making them difficult to distinguish. Effective methods for detecting adversarial stegano-noise are rare, and even end-to-end methods do not exist. End-to-end refers to the input being raw data and the output being the final result, with only a single model processing the intermediate steps, eliminating the need for human intervention. A sampling-based stegano-analysis defense approach was proposed in the paper (Chuan Qin, Na Zhao, Weiming Zhang, Nenghai Yu, IEEE International Conference on Acoustics, Speech and Signal Processing, 2022, 3079–3083). This approach uses segmented sampling to bypass sparse adversarial perturbations and extract effective features. However, due to the segmentation and sampling of the image, some important global steganographic features are lost, resulting in low detection accuracy for non-adversarial steganography. This method uses a deep feature + ensemble classifier architecture, not an end-to-end detection approach. To address the problem of adversarial steganography detection, this paper utilizes confidence artifacts and pixel artifacts to design a confidence loss function to amplify confidence artifacts. It also uses image block scrambling and a feature similarity function to reduce the negative impact of adversarial perturbations on the model. A dual-stream CNN network is used for feature extraction and classification, improving detection performance against adversarial steganography. Summary of the Invention

[0003] To overcome the above shortcomings of the prior art, the purpose of the present invention is to improve the detection accuracy of adversarial steganography. Through a two-stream CNN network that utilizes confidence artifacts and pixel artifacts, it can effectively detect adversarial steganographic images, resist the negative effects of adversarial perturbations, and improve the detection performance of adversarial steganography.

[0004] The technical solutions for implementing the present invention are as follows:

[0005] This paper proposes an end-to-end method for detecting adversarial steganography, which effectively detects steganographic images subjected to adversarial perturbations. The method uses confidence artifacts and pixel artifacts to classify images using a two-stream convolutional neural network. The network consists of a gradient subnet and an image subnet. A gradient flow is obtained using a confidence loss function, and confidence artifacts are amplified. The obtained gradient flow is then fed into the gradient subnet to detect the presence of adversarial perturbations in the image. Simultaneously, the image is divided into two scrambled blocks and fed into the image subnet for feature extraction. Features obtained from different image subblocks are fused, and the features output by the two subnets are used for final classification. The method includes the following key steps:

[0006] Step 1: Take the trained steganalysis model as the attacked model T, input the steganalysis image dataset to be detected, and calculate the confidence loss function L designed by the present invention. conf :

[0007]

[0008]

[0009] Where n is the number of image categories, v i is the one-hot encoding of the output result, l i Is the component of the output result in dimension i. The confidence loss function L conf Back propagation is performed to obtain the gradient information of the image, and the two-dimensional confidence artifact is magnified into a multi-dimensional gradient artifact;

[0010] Step 2: The gradient information is input into the gradient subnet for feature extraction to obtain a 128-dimensional feature vector;

[0011] Step 3: At the same time as step 2, the image dataset is input into the image subnet for feature extraction. In the image subnet, an H×W image is divided into two The two image sub-blocks are scrambled up and down to destroy the distribution of the adversarial perturbation and reduce the impact of the adversarial perturbation on model detection. The two image sub-blocks are simultaneously input into the image sub-network for feature extraction, and two sets of feature vectors f1 and f2 are obtained. The two sets of feature vectors are fused:

[0012]

[0013] represents the i-th dimension of feature f1, min(·), max(·), mean(·), and var(·) represent the calculation of minimum, maximum, mean, and variance, respectively. The four sets of statistical vectors obtained are the features output by the image subnet;

[0014] Step 4: Concatenate the features output by the image subnet and the gradient subnet, input them into the fully connected network for classification, obtain the network's predicted value, and calculate the contrast loss L at the same time. CTR and classification loss L CLA :

[0015]

[0016] L CLA =-[y*log(p)+(1-y)log(1-p)]

[0017] Where y∈{0,1} refers to the image label (0 for cover and 1 for stego), m is the threshold parameter, and p is the probability that the model outputs the label y=1. The contrastive loss function evaluates whether the noise of two sub-images is similar. Natural noise in different regions of the same image is similar, while unnatural noise varies significantly. Therefore, we set the auxiliary optimization objective of the image sub-network as follows: the cover sub-image features are as similar as possible, and the stego sub-image features are as different as possible. The total loss function is then calculated:

[0018] L=L CLA +λL CTR

[0019] λ is the trade-off parameter of contrast loss. During the model training process, by minimizing the total loss and performing back propagation, the parameters of the image subnet, gradient subnet, and fully connected network are updated to optimize the detection effect of the model.

[0020] Step 5: When the set upper limit of training times is reached, stop training and obtain the detection model M for adversarial steganography.

[0021] By adopting the above means, compared with the prior art, the beneficial effects of the present invention are:

[0022] In a two-stream convolutional neural network, confidence artifacts and pixel artifacts are used to detect adversarial steganography. Gradient information is back-propagated through a designed confidence loss function, amplifying two-dimensional confidence artifacts into multi-dimensional gradient artifacts. By scrambling the image in blocks and optimizing the model using a feature similarity function, the negative impact of adversarial perturbations on the model is effectively reduced. This method demonstrates good results in detecting steganographic images with adversarial perturbations and in training on adversarial steganographic datasets. It can be applied to both spatial and JPEG domain steganalysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 It is a schematic diagram of the process of the present invention.

[0024] Figure 2This is a framework diagram of the two-stream convolutional neural network model for detecting adversarial steganography in the present invention.

[0025] Figure 3 This figure compares the experimental results of the present invention with those of existing methods on the BOSSBase and BOWS2 datasets. DETAILED DESCRIPTION

[0026] The present invention will be further described below with reference to the accompanying drawings and specific embodiments.

[0027] Aiming at the problem of detecting countermeasures against steganography. Figure 1 The specific steps of the present invention are as follows:

[0028] S1: Take the steganalysis detection model that has been trained on a regular steganalysis image dataset as the attacked model T. Although only a specific model is used as the attack target here, the confidence artifacts obtained are universal because the adversarial samples for different models have similarities. Input the image dataset to be detected and calculate the confidence loss function L conf :

[0029]

[0030]

[0031] Where n is the number of image categories, v i is the one-hot encoding of the output result, l i Is the component of the output result in dimension i. The confidence loss function L conf Backpropagation is performed to obtain the gradient information of the image, and the two-dimensional confidence artifact is amplified into a multi-dimensional gradient artifact, which helps to better identify the existence of adversarial perturbations.

[0032] S2: The obtained gradient information is input into the gradient subnet for feature extraction. Figure 2Framework diagram. The gradient subnet adopts a structure similar to SRNet (M. Boroumand, M. Chen, and J. Fridrich, IEEE Trans. Inform. Forensic Secur., vol. 14, no. 5, pp. 1181–1193, May 2019). Different Types represent different network blocks in SRNet. The output channels and number of network layers have been modified. The numbers in parentheses indicate the output channels. To extract the features of gradient information, a separate gradient subnet operates on the absolute value of the gradient. The gradient subnet uses a spatial rich model (SRM) filter kernel to initialize the first layer parameters. Shortcut connections are used to retain weak perturbations. Average pooling layers are only used later in the network to preserve information integrity. Finally, global average pooling is used to obtain a compact 128-dimensional feature vector.

[0033] S3: At the same time as S2, the image dataset is input into the image subnet for feature extraction. The image subnet and gradient subnet have different structures and parameters are not shared. For the specific network structure, see Figure 2 Framework diagram, where the image subnet adopts the network structure LWENet proposed in the literature (ShaoweiWeng, Mengfei Chen, Lifang Yu, Shiyao Sun, IEEE Signal Process. Letter, 2022, 29: 1888-1892). In the image subnet, an H×W image is divided into two The image sub-blocks are then scrambled up and down to disrupt the distribution of the adversarial perturbation and reduce its impact on model detection. To prevent the loss of global image features, the image is divided into only two blocks. The up and down scrambling of the image sub-blocks does not affect the extraction of global features. The two image sub-blocks are simultaneously input into the image subnet for feature extraction, resulting in two sets of feature vectors f1 and f2. Feature fusion is performed on the two sets of feature vectors:

[0034]

[0035] f1 (i) represents the i-th dimension of feature f1, min(·), max(·), mean(·) and var(·) represent the calculation of minimum, maximum, mean and variance respectively. The four sets of statistical vectors obtained are the features output by the image subnet.

[0036] S4: Concatenate the features output by the image subnet and the gradient subnet, input them into the fully connected network for classification, obtain the predicted value of the model output, and calculate the contrast loss L at the same time CTR and classification loss L CLA :

[0037]

[0038] L CLA =-[y*log(p)+(1-y)log(1-p)]

[0039] Where y∈{0,1} refers to the label of the image (0 for cover and 1 for stego), m is the threshold parameter, and p refers to the probability of the model output label y=1. Based on the fact that natural noise in different regions of the same image is similar, while unnatural noise is quite different, the feature similarity function is used to evaluate whether the noise of two sub-images is similar, and it is set as the optimization target of the image subnet. In other words, unlike the gradient subnet that identifies adversarial perturbations as a different type of noise, the image subnet regards both adversarial perturbations and stego noise as unnatural noise sources, thus avoiding the difficulty of distinguishing adversarial perturbations separately. Both subnets make significant contributions to the detection of adversarial steganography. Finally, the total loss function is calculated:

[0040] L=L CLA +λL CTR

[0041] λ is the trade-off parameter of contrast loss. During the training process of the model, by minimizing the total loss and performing back propagation, the parameters of the image subnet, gradient subnet and fully connected network are updated to optimize the detection effect of the model.

[0042] S5: When the set upper limit of training times is reached, the training is stopped to obtain the detection model M for adversarial steganography.

[0043] The following is a specific experiment to illustrate the effectiveness of this method

[0044] Given an attacked model T trained on the BOSSBase and BOWS2 datasets using the S-UNIWARD steganography algorithm at an embedding ratio of 0.4, the detection accuracy of the pre-trained model decreases to varying degrees when the test set consists of images with adversarial perturbations. The dataset is divided into training, validation, and test sets in a ratio of 7:1:2. After steganography of the carrier image, a conventional steganographic image is generated. The adversarial perturbation MAE is then applied to this image to produce an adversarial steganographic image. The conventional steganographic image and the carrier image are combined as the training and validation sets, while the adversarial steganographic image and the carrier image are combined as the test set to verify that the proposed method is effective against adversarial perturbations even without adversarial training.

[0045] Step 1: First, input the training set images into the attacked model T and calculate the confidence loss L conf , and obtain the corresponding gradient information after back propagation.

[0046] Step 2: Input the gradient information into the gradient subnet to extract features. The gradient subnet uses the SRM filter kernel to initialize the first layer parameters, utilizes shortcut connections to preserve weak perturbations, and uses average pooling layers only in the later stages of the network to preserve information integrity. Finally, global average pooling is used to obtain a compact 128-dimensional feature vector.

[0047] In step 3, at the same time as step 2, the training set images are divided into two sub-blocks and scrambled up and down. The two image sub-blocks are respectively input into the image subnet to extract features. The maximum, minimum, mean, and variance of each dimension of the two sets of features are calculated to obtain four sets of 384-dimensional statistical vectors as the fused features.

[0048] Step 4: Concatenate the features output by the image subnet and the gradient subnet, input them into the fully connected network for classification, and obtain the predicted value of the model output. During the training process, set dropout = 0.5 to prevent the model from overfitting. Based on the predicted value of the model output, calculate the contrast loss L CTR and classification loss L CLA , then calculate and minimize the total loss function L, perform backpropagation, and update the parameters of the image subnet, gradient subnet, and fully connected network.

[0049] Step 5: After 200 epochs of training, stop training and obtain the detection model M for adversarial steganography. Input the test set images into the model for classification to evaluate the detection effect of the model.

[0050] Depend on Figure 3 Experimental results demonstrate that this method can effectively detect adversarial steganography and resist the negative effects of adversarial perturbations, even without adversarial training. Compared to other existing steganalysis detection methods, this method achieves the highest detection accuracy for adversarial steganography, even surpassing traditional steganalysis methods like SRM, which rely solely on manual feature extraction.

Claims

1. An end-to-end method for detecting adversarial steganography, designed to effectively detect steganographic images subjected to adversarial perturbations. This method uses confidence artifacts and pixel artifacts to classify images using a two-stream convolutional neural network. The two-stream convolutional neural network consists of a gradient subnet and an image subnet. A gradient stream is obtained using a confidence loss function and fed into the gradient subnet to detect the presence of adversarial perturbations in the image being tested. Simultaneously, the image being tested is divided into two scrambled blocks and fed into the image subnet for feature extraction. Features obtained from different image subblocks are fused, and the features output by both subnets are used for final classification. The main steps include: Step 1: Use the trained steganalysis model as the attacked model T, input the steganalysis image dataset to be detected, and calculate the confidence loss function L conf : Where n is the number of image categories, v i is the one-hot encoding of the output result, l i Is the component of the output result in dimension i, e refers to the natural logarithm; the confidence loss function L conf Back propagation is performed to obtain the gradient information of the image. After this step, the two-dimensional confidence artifact is amplified into a multi-dimensional gradient artifact; Step 2: The gradient information is input into the gradient subnet for feature extraction to obtain a 128-dimensional feature vector; Step 3: At the same time as step 2, the image dataset is input into the image subnet for feature extraction. An H×W image is divided into two The two image sub-blocks are scrambled up and down, and the two image sub-blocks are simultaneously input into the image sub-network for feature extraction to obtain two sets of feature vectors f1 and f2. The two sets of feature vectors are fused: f1 (i) represents the i-th dimension of feature f1, min(·), max(·), mean(·), and var(·) represent the calculation of minimum, maximum, mean, and variance, respectively. The four sets of statistical vectors obtained are the features output by the image subnet; Step 4: Concatenate the features output by the image subnet and the gradient subnet, input them into the fully connected network for classification, obtain the network's predicted value, and calculate the contrast loss L at the same time. CTR and classification loss L CLA : L cLA =-[y*log(p)+(1-y)log(1-p)] Where y∈{0,1} refers to the image label, 0 represents cover, 1 represents stego, m is the threshold parameter, and p refers to the probability of the model output label y=1. The auxiliary optimization goal of the image subnetwork is set as follows: the sub-image features of the cover are as similar as possible, and the sub-image features of the stego are as different as possible. Then calculate the total loss function: L=L CLA +λL CTR λ is the trade-off parameter of contrast loss. During the model training process, by minimizing the total loss and performing back propagation, the parameters of the image subnet, gradient subnet, and fully connected network are updated to optimize the detection effect of the model. Step 5: When the set upper limit of training times is reached, stop training and obtain the detection model M for adversarial steganography.

Images