A robust steganography method against JPEG compression

Abstract

The present invention relates to a robust steganography method resistant to JPEG compression, comprising: constructing a training set and a test set; constructing a JPEG residual model, and training the JPEG residual model using the training set in batches; then constructing a steganalysis model comprising a steganalysis network, a discriminator, a trained JPEG residual network, and an extraction network; and training the steganalysis model using the training set in batches to obtain a trained steganalysis network and a trained extraction network; finally, selecting a carrier image to be tested from the test set, inputting the carrier image to be tested and secret information to be embedded into the trained steganalysis network to obtain a stegographed carrier image; and sequentially passing the stegographed carrier image through the trained JPEG residual network and the trained extraction network to extract the secret information. This method enables the stegographed image to resist attacks from real JPEGs and improves the information extraction rate.

Description

Technical Field

[0001] The present invention relates to the field of steganography technology, and in particular to a robust steganography method resistant to JPEG compression. Background Art

[0002] In recent years, with the continuous development of Internet technology and the widespread application of information technology, information security issues have become increasingly important. More and more companies, government agencies, and individuals have begun to pay attention to information security issues and have begun to take various measures to protect information security.

[0003] Among them, steganography, as a common information protection technology, can embed secret information in multimedia carriers such as images, audio, and video, so that this information is not perceived by the outside world and has received widespread attention and application; robust steganography is a steganography technology that can resist common attack methods. It can ensure the security and integrity of information during information transmission and prevent tampering and leakage by third parties; and the robust steganography method against JPEG compression is a steganography method based on the JPEG compression algorithm. It can maintain the integrity of the embedded information after compression, thereby ensuring that the embedded information can remain intact after compression and will not be destroyed by the compression algorithm, and can resist common attack methods such as compression, cropping, rotation, etc., and has great advantages in information protection.

[0004] With the development of social networks, using online social networks for image steganographic transmission has become a future trend. JPEG, a commonly used image processing operation on online social networks, often has its compression process unknown to users. Therefore, JPEG compression-resistant steganography based on online social networks faces challenges.

[0005] At present, many robust steganography methods based on JPEG compression resistance have been proposed and widely used. For example, Reference 1 [Zhu, Jiren, et al. "Hidden: Hiding data with deep networks." Proceedings of the European conference on computer vision (ECCV). 2018] proposed simulating JPEG compression, using JPEG-Mask to discard high-frequency coefficients, retaining a certain number of low-frequency coefficients, and using JPEG-Drop to progressively filter the coefficients. Since the JPEG-Mask method requires modifications in specific pixels, it will affect the image quality, resulting in reduced image clarity and color saturation, and sometimes causing noise and distortion, which can be easily detected by analysts. Since the JPEG-Drop method needs to process the original image, it needs to save the original image, which increases the storage and transmission costs. In addition, the method randomly deletes some pixels in the image, which affects the image quality. For example, in Reference 2 [Luo X, Zhan R, Chang H, et al. Distortion agnostic deepwatermarking [C] / / Proceedings of the IEEE / CVF Conference on Computer Vision and Pattern Recognition. 2020: 13548-13557] and Reference 3 [Ahmadi M, Norouzi A, Karimi N, et al. ReDMark: Framework for residual diffusion watermarking based on deepnetworks [J]. Expert Systems with Applications, 2020, 146: 113157], a series of differentiable functions are designed to simulate each step of JPEG compression. However, the end-to-end training differential simulated JPEG compression (OEDS) method meets the requirements of backpropagation gradients, but due to the lack of the natural defect of replacing real noise with simulation, the results are not satisfactory.

[0006] Furthermore, all of the aforementioned steganographic algorithms are designed for compression in digital channels and are not applicable to the lossy channels of real online social networks. Furthermore, they introduce complex distortions on the user side and in lossy online networks. Operations performed on the user side can be divided into two categories: 1) after downloading the image from the platform (post-filtering), and 2) before uploading to the platform (pre-filtering). The first type is closely related to image denoising, as the distortion caused by the platform can be considered signal-dependent noise. Although image denoising techniques have been extensively studied, many existing algorithms are not well suited for online image platforms. This is because denoising must be performed on each image each time it is downloaded, a strategy that is cumbersome and impractical. Furthermore, the complex distortions introduced by these platforms pose significant challenges to noise modeling, significantly limiting denoising performance in practice. Consequently, the information embedded in the stego-images generated by the JPEG-resistant steganographic algorithms designed based on the above methods cannot be fully extracted after a real-world JPEG compression attack.

[0007] Therefore, further improvements need to be made to the existing technology. Summary of the Invention

[0008] The technical problem to be solved by the present invention is to provide a robust steganography method resistant to JPEG compression, which can make the steganographic image resist the attack of real JPEG and improve the information extraction rate, in view of the above-mentioned existing technologies.

[0009] The technical solution adopted by the present invention to solve the above technical problems is: a robust steganography method resistant to JPEG compression, characterized by comprising the following steps:

[0010] S1. Obtain multiple images and construct them into training sets and test sets;

[0011] S2. constructing a JPEG residual model; the constructed JPEG residual model includes a JPEG simulation layer and a JPEG residual network connected in sequence;

[0012] S3, train the JPEG residual model in S2 using the training set in batches to obtain the trained JPEG residual network;

[0013] The specific process of training the JPEG residual model using any image x in the training set is:

[0014] S3-1. Input the image x into the JPEG residual model to obtain a first output image M(x);

[0015]

[0016] Where S(x) is the output image obtained by inputting image x into the JPEG simulation layer; The output image obtained by inputting S(x) into the JPEG residual network;

[0017] S3-2, performing real JPEG compression on the image x to obtain a second output image real(x);

[0018] S3-3. Calculate the first loss function based on M(x) and real(x);

[0019] S3-4. Reversely update the network parameters in the JPEG residual network according to the first loss function, thereby obtaining a JPEG residual network after one training step.

[0020] S4. Construct a steganalysis model. The constructed steganalysis model includes a steganalysis network, a discriminator, a JPEG residual network trained in S3, and an extraction network.

[0021] S5. Train the steganographic model in S4 using the training set in batches to obtain a trained steganographic network and a trained extraction network;

[0022] The specific process of training the steganography model using any image x′ in the training set is:

[0023] S5-1. Select any image x′ from the training set as the carrier image, and input the carrier image x′ and the original secret information M into the steganalysis network to obtain the steganalysis image Ste(x′) embedded with the secret information. Then input the steganalysis image Ste(x′) embedded with the secret information and the carrier image x′ into the discriminator to obtain the discrimination result.

[0024] S5-2, input the steganographic image Ste(x′) after embedding the secret information into the JPEG residual network trained in S3 to obtain the JPEG compressed image

[0025] S5-3. JPEG compressed image Input into the extraction network to extract the secret information M′;

[0026] S5-4. A second loss function is calculated based on the discriminator's discrimination result and the true result corresponding to the carrier image x′. The second loss function is used to reversely update the network parameters of the discriminator and the steganalysis network, thereby obtaining the discriminator and the steganalysis network after one training cycle. A third loss function is also calculated based on the secret information M′ and the original secret information. The third loss function is used to reversely update the network parameters of the extraction network, thereby obtaining the extraction network after one training cycle.

[0027] S6. Randomly select a carrier image y to be tested in the test set, input the carrier image y to be tested and the secret information to be embedded into the trained steganographic network to obtain the steganographic carrier image; and sequentially pass the steganographic carrier image through the trained JPEG residual network and the trained extraction network to extract the secret information.

[0028] Preferably, the JPEG simulation layer in S2 is JPEG-SS or JPEG-MASK.

[0029] Preferably, the JPEG residual network in S2 adopts a neural network, which may be a convolutional neural network, a BP neural network or other neural networks in the prior art.

[0030] Preferably, the original secret information M in S5-1 is randomly generated secret information of binary bits.

[0031] In order to reduce the error between the simulated JPEG simulation layer and the real JPEG and to resist the JPEG attack caused by the real online social network channel, S3-2 uses the existing online social network to perform real JPEG compression on the image, simulates the quality factor function of JPEG compression, and then samples from the simulated quality factor function as the quality factor of the JPEG simulation layer and the real JPEG compression.

[0032] Compared with the existing technology, the advantages of the present invention are: by constructing a JPEG residual model with a JPEG simulation layer and a JPEG residual network, the error between the model and the real JPEG is further reduced. The steganography model designed based on this JPEG residual network has better performance than the existing method after being attacked by a real JPEG, so that the steganographic image can resist the attack of the real JPEG and the JPEG attack caused by online social network channels. The information extraction rate is further improved, and can even be improved by 100%. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 Schematic diagram of a JPEG residual model in an embodiment of the present invention;

[0034] Figure 2 Schematic diagram of a steganographic model in an embodiment of the present invention. DETAILED DESCRIPTION

[0035] The present invention will be described in further detail below with reference to the accompanying drawings and embodiments.

[0036] The robust steganography method against JPEG compression in this embodiment includes the following steps:

[0037] S1. Obtain multiple images and construct them into training sets and test sets;

[0038] S2. constructing a JPEG residual model; the constructed JPEG residual model includes a JPEG simulation layer and a JPEG residual network connected in sequence;

[0039] In this embodiment, the JPEG simulation layer is JPEG-SS or JPEG-MASK, where JPEG-SS and JPEG-MASK are both differentiable JPEG compression technologies, both of which are prior art and will not be further described here. JPEG-Masks uses a masking method to set the lower right corner of the DCT coefficient matrix to 0, retaining only the values ​​of the upper left 25 elements; the JPEG residual network uses a neural network, which can be a convolutional neural network, a BP neural network, or the like in the prior art;

[0040] S3, train the JPEG residual model in S2 using the training set in batches to obtain the trained JPEG residual network;

[0041] like Figure 1 As shown in , the specific process of training the JPEG residual model using any image x in the training set is:

[0042] S3-1. Input the image x into the JPEG residual model to obtain a first output image M(x);

[0043]

[0044] Where S(x) is the output image obtained by inputting image x into the JPEG simulation layer; The output image obtained by inputting S(x) into the JPEG residual network;

[0045] S3-2, performing real JPEG compression on the image x to obtain a second output image real(x);

[0046] In this embodiment, an existing online social network (such as QQ, WeChat, DingTalk, or other commonly used social networks) is used to perform real JPEG compression on the image, and a quality factor function of JPEG compression is simulated. Then, samples are sampled from the simulated quality factor function as the quality factor for the JPEG simulation layer and the real JPEG compression.

[0047] S3-3. Calculate the first loss function based on M(x) and real(x);

[0048] The calculation of the first loss function is a prior art and will not be further described here;

[0049] S3-4. Reversely update the network parameters in the JPEG residual network according to the first loss function, that is, obtain the JPEG residual network after one training is completed; updating the network parameters in the JPEG residual network is also a prior art and will not be elaborated here;

[0050] S4. Construct a steganalysis model. The constructed steganalysis model includes a steganalysis network, a discriminator, a JPEG residual network trained in S3, and an extraction network.

[0051] S5. Train the steganographic model in S4 using the training set in batches to obtain a trained steganographic network and a trained extraction network;

[0052] like Figure 2 As shown in Figure 2, the specific process of training the steganography model using any image x′ in the training set is as follows:

[0053] S5-1. Select any image x′ from the training set as the carrier image, and input the carrier image x′ and the original secret information M into the steganalysis network to obtain the steganalysis image Ste(x′) embedded with the secret information. Then input the steganalysis image Ste(x′) embedded with the secret information and the carrier image x′ into the discriminator to obtain the discrimination result.

[0054] Figure 2 Where Ste(x′) = E(x′,M), where E(x′,M) represents the stego-image embedded with the secret information obtained by inputting the carrier image x′ and the original secret information M into the steganalysis network.

[0055] In this embodiment, the original secret information M is a randomly generated secret information of binary bits;

[0056] S5-2, input the steganographic image Ste(x′) after embedding the secret information into the JPEG residual network trained in S3 to obtain the JPEG compressed image Figure 2 middle

[0057] S5-3. JPEG compressed image Input into the extraction network D to extract the secret information M′;

[0058] Figure 2 middle

[0059] S5-4. A second loss function is calculated based on the discriminator's discrimination result and the true result corresponding to the carrier image x′. The second loss function is used to reversely update the network parameters of the discriminator and the steganalysis network, thereby obtaining the discriminator and the steganalysis network after one training cycle. A third loss function is also calculated based on the secret information M′ and the original secret information. The third loss function is used to reversely update the network parameters of the extraction network, thereby obtaining the extraction network after one training cycle.

[0060] The above-mentioned methods for updating the network parameters in the discriminator, steganalysis network, and extraction network are all existing technologies and will not be elaborated here.

[0061] S6. Randomly select a carrier image y to be tested in the test set, input the carrier image y to be tested and the secret information to be embedded into the trained steganographic network to obtain the steganographic carrier image; and sequentially pass the steganographic carrier image through the trained JPEG residual network and the trained extraction network to extract the secret information.

[0062] This embodiment also relates to a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the computer program executes the above-mentioned robust steganography method against JPEG compression.

[0063] In this embodiment, for the JPEG residual network, the target quality factor (QF) of the input original image, when compressed through the JPEG simulation layer and the real JPEG, is set based on the compression quality factor of a real online social network. To ensure that the error between the JPEG residual network and the real JPEG compression is sufficiently small and more closely matches the JPEG processing of images in real online social network transmission channels, the compression changes of commonly used online social networks on images are first studied to simulate the quality factor function of JPEG compression. This simulated quality factor function is then sampled and used as the quality factor for the JPEG simulation layer and the real JPEG network. Therefore, this designed residual network not only reduces the error between the simulated JPEG simulation layer and the real JPEG, but also allows the steganalysis network designed based on this residual network model to resist JPEG attacks caused by real online social network channels.

Claims

1. A robust steganography method resistant to JPEG compression, characterized by The steps include: S1. Obtain multiple images and construct them into training sets and test sets; S2. constructing a JPEG residual model; the constructed JPEG residual model includes a JPEG simulation layer and a JPEG residual network connected in sequence; S3, train the JPEG residual model in S2 using the training set in batches to obtain the trained JPEG residual network; The specific process of training the JPEG residual model using any image x in the training set is: S3-1. Input the image x into the JPEG residual model to obtain a first output image M(x); Where S(x) is the output image obtained by inputting image x into the JPEG simulation layer; The output image obtained by inputting S(x) into the JPEG residual network; S3-2, performing real JPEG compression on the image x to obtain a second output image real(x); S3-3. Calculate the first loss function based on M(x) and real(x); S3-4. Reversely update the network parameters in the JPEG residual network according to the first loss function, thereby obtaining a JPEG residual network after one training step. S4. Construct a steganalysis model. The constructed steganalysis model includes a steganalysis network, a discriminator, a JPEG residual network trained in S3, and an extraction network. S5. Train the steganographic model in S4 using the training set in batches to obtain a trained steganographic network and a trained extraction network; The specific process of training the steganography model using any image x′ in the training set is: S5-1. Select any image x′ from the training set as the carrier image, and input the carrier image x′ and the original secret information M into the steganalysis network to obtain the steganalysis image Ste(x′) embedded with the secret information. Then input the steganalysis image Ste(x′) embedded with the secret information and the carrier image x′ into the discriminator to obtain the discrimination result. S5-2, input the steganographic image Ste(x′) after embedding the secret information into the JPEG residual network trained in S3 to obtain the JPEG compressed image S5-3. JPEG compressed image Input into the extraction network to extract the secret information M′; S5-4. A second loss function is calculated based on the discriminator's discrimination result and the true result corresponding to the carrier image x′. The second loss function is used to reversely update the network parameters of the discriminator and the steganalysis network, thereby obtaining the discriminator and the steganalysis network after one training cycle. A third loss function is also calculated based on the secret information M′ and the original secret information. The third loss function is used to reversely update the network parameters of the extraction network, thereby obtaining the extraction network after one training cycle. S6. Randomly select a carrier image y to be tested in the test set, input the carrier image y to be tested and the secret information to be embedded into the trained steganographic network to obtain the steganographic carrier image; and sequentially pass the steganographic carrier image through the trained JPEG residual network and the trained extraction network to extract the secret information.

2. The robust steganography method according to claim 1, characterized in that: The JPEG simulation layer in S2 is JPEG-SS or JPEG-MASK.

3. The robust steganography method according to claim 2, characterized in that: The JPEG residual network in S2 adopts a neural network.

4. The robust steganography method according to claim 1, characterized in that: The original secret information M in S5-1 is randomly generated secret information in binary bits.

5. The robust steganography method according to any one of claims 1 to 4, characterized in that: In the S3-2, an existing online social network is used to perform real JPEG compression on the image, a quality factor function of JPEG compression is simulated, and then sampling is performed from the simulated quality factor function as the quality factor of the JPEG simulation layer and the real JPEG compression.

Images