An anti-cropping image steganography method based on a generative adversarial network

Abstract

The application relates to the field of content security in cyberspace security, and discloses an anti-cropping image steganography method based on a generative adversarial network, wherein a coding-decoding network is constructed by using a GAN network and a DenseNet connection, and various noises are added to a model training process to improve the robustness of the model. The application constructs a coding-decoding network based on a GAN network and a DenseNet connection, adds noise training to the model, simulates noise attacks encountered in a real transmission process, improves the robustness of a stego image, and improves the decoding accuracy of a decoder; when the stego image is cropped, the decoder still has a higher possibility of restoring complete hidden information; meanwhile, a larger steganography capacity can be maintained, which is 3-6 times the capacity of 0.2 bpp-0.4 bpp of a traditional method, and the image quality is high, and the steganography has good concealment for general steganalysis tools.

Description

Technical Field

[0001] This invention relates to the field of content security in cyberspace security, specifically to a method for resisting cropped image steganography based on generative adversarial networks. Background Technology

[0002] Steganography is a technique that hides messages within a carrier for transmission without alerting attackers. Today, image steganography is used in various fields such as digital communication, copyright protection, information authentication, and e-commerce, playing a vital role in protecting data security.

[0003] Traditional image steganography algorithms can be broadly categorized into three types: spatial domain-based, frequency domain-based, and adaptive steganography. The most commonly used spatial domain steganography algorithm is LSB (Less Significant Bits), which embeds information by modifying the least significant bit of the image. However, LSB has poor concealment, resulting in low-quality steganalytes that can be easily detected by common steganalysis methods. Frequency domain steganography algorithms perform image steganography in various frequency domains, often using DCT coefficients to embed the hidden information into the Discrete Cosine Transform (DCT) domain of the carrier image. Generally, image steganography techniques using DCT have relatively low steganalysis capacity. Adaptive steganography algorithms can automatically find suitable steganographic regions in the image (typically regions with complex textures). Although adaptive algorithms employ a strategy of minimizing embedding distortion, they still do not completely eliminate the alterations made to the carrier image by the manually designed steganography algorithm during the embedding of secret information, making them easily detectable by steganalysis tools.

[0004] In recent years, various deep learning-based image steganography algorithms have been proposed. SGAN and SSGAN both use Generative Adversarial Networks (GANs) to generate more suitable carrier images, and then utilize traditional steganography algorithms to hide and extract information. Methods such as HiDDeN, Udh, DCGAN, and SteganoGAN all utilize deep learning to embed and extract hidden information from carrier images, expanding steganography capacity and improving steganography security. In practical applications, steganography images are susceptible to cropping attacks during transmission, which can cause the loss of some features, thus damaging and irrecovering the hidden information.

[0005] Chinese Patent Application No. 2020111092360 discloses "A Controllable Image Steganography Method Based on Conditional Generative Adversarial Networks," which includes the following steps: training a generative adversarial network using noise samples, conditional information, and natural images, wherein the generative adversarial network includes a generator for generating images and a discriminator for discriminating images; training an extractor using the generated images and corresponding driving noise; the sender converts secret information into noise signals and inputs the noise signals and selected conditional information into the trained generator to generate a steganographic image with controllable content; the receiver receives the steganographic image, inputs it into the trained extractor, extracts the noise signals from the steganographic image, and restores the noise signals back to the secret information.

[0006] Chinese patent application number 2020110853627 discloses "A Reference-Free Robust Image Steganography Method," which uses a GAN model as an image generator and pre-trains the GAN model; establishes a mapping from secret information to noise; takes the secret information as input and outputs a steganographic image; an image processing layer receives the steganographic image generated by the GAN model, adds simulated interference, and passes it to a decoder for decoding; using an existing neural network model as the decoder, the steganographic image with added interference is taken as input, converted into noise by the neural network, and the noise is mapped to obtain the secret information. This patented method can make the generated image robust by combining an image processing layer and a decoder with a convolutional neural network structure with any generator that directly generates images driven by noise.

[0007] Chinese patent application number 2020108201112 discloses a "GAN-based method for synthesizing steganography on carrier images," which includes: cropping each image in the dataset into images of the same size and assembling them into a real image dataset; constructing a generator network G, a discriminator network D, an evidence-gathering network F, and an extraction network E, and initializing the parameters in the generator network G, discriminator network D, and extraction network E, with the parameters in the evidence-gathering network F set to preset values; training the initialized generator network G, discriminator network D, and extraction network E using batch training to obtain trained generator network G, discriminator network D, and extraction network E; inputting the secret information to be embedded and a preset key into the trained generator network G to obtain a synthesized carrier image; and inputting the synthesized carrier image and the aforementioned preset key into the trained extraction network E to extract the secret information. This patent requires the use of a preset key for mapping during the embedding and extraction of secret information, and the dataset needs to be cropped to the same size.

[0008] The inventor has designed an anti-cropping image steganography method that is different from the three patents mentioned above. A search revealed no identical patent documents. Summary of the Invention

[0009] To address the shortcomings of existing traditional methods, such as low steganalysis capacity, poor concealment, low steganalysis image quality, and inability to recover hidden information under attack, this invention provides an anti-cropping image steganography based on generative adversarial networks (ACIS). This method constructs an encoder-decoder network based on a GAN network and DenseNet connections. By adding noise to the model during training, it simulates noise attacks encountered in real-world transmission, thereby improving the robustness of the steganalysis image and enhancing the decoding accuracy of the decoder. Even when the steganalysis image is cropped, the decoder still has a high probability of recovering the complete hidden information. Simultaneously, this method maintains a large steganalysis capacity (up to 1.37 bpp), which is 3-6 times that of traditional methods (0.2-0.4 bpp), and produces high-quality images with good concealment against common steganalysis tools.

[0010] The technical solution of this invention is:

[0011] A crop-resistant image steganography method based on generative adversarial networks (GANs) is proposed. The steganography model uses a GAN network and a DenseNet connection to construct an encoder-decoder network, and incorporates various noises into the model training process to improve its robustness. The epoch is set to 10, and the method includes the following steps:

[0012] Step 1: The hidden data and the carrier image are concatenated and fed into the encoder for training to generate the hidden image;

[0013] Step 2: The evaluator provides feedback to the encoder by comparing the differences between the carrier image and the encrypted image, making the encrypted image generated by the encoder more realistic.

[0014] Step 3: Add various noises to the generated encrypted image to simulate a cropping attack on the encrypted image, thereby improving the robustness of the decoder in the case of a cropping attack.

[0015] Step 4: Train the decoder using the noisy image and reduce the loss of recovered and hidden data to improve decoding accuracy.

[0016] Specifically: Step 1, use the COCO dataset as training images, crop the image size to 360×360 pixels, set the training payload = 2 bpp, En(G,M) represents the encoder, G is the carrier image, M is the random information to be hidden in G, D is the effective payload in bpp, the image resolution is W×H, Cat(X,Y): (X,Y)→φ∈R (D+D')×W×HThis represents the connection of two tensors along the D-axis. The carrier image is processed using convolutional blocks to obtain tensor a as given by formula (1). Then, the information M to be hidden in image G is connected to tensor a, and tensor b is obtained using formula (2). Tensors c, d, and e are then obtained using formula (3). Finally, features of the carrier image G are added before generating the hidden image to improve its quality. The hidden image S is then output, as shown in formula (4). To improve the image quality of the hidden image, the similarity between the carrier image G and the hidden image S is analyzed using mean squared error, and the image reconstruction loss L... E As indicated by formula (5), the carrier image G and the carrier image S have the same resolution W×H.

[0017] a = Conv 3→32 (G) (1)

[0018] b = Conv 32+D→32 (Cat(a,M)) ​​(2)

[0019]

[0020] S = En(G,M) (4)

[0021]

[0022] Step 2: To provide feedback on the encoder's performance and generate more realistic images, an evaluation network Cn(S) is introduced. Mean(X):(X)∈R D×W×H →R D This represents the adaptive average spatial pooling operation. The evaluator compares the carrier image with the dense image and provides a score feedback to the encoder, making the dense image generated by the encoder more realistic. The specific process is shown in formula (6):

[0023]

[0024] Step 3: The encrypted image S generated by the encoder will have random noise added to it to remove some image features before it is fed into the decoder for training, in order to improve the decoding accuracy of the decoder under complex conditions. The specific process is shown in formula (7). n is the added noise, and Noise is the noise layer. The encrypted image S with added noise N It will be sent to the decoder for training.

[0025] S N =Noise 3→3 (S,n) (7)

[0026] Step 4: Use the noise-added, high-density image S N Training decoder De(S) N And obtain the recovered data. The process is shown in Equation (8), and then the cross-entropy loss function (Equation (9)) is used to reduce the loss L of the recovered data and the hidden data. M Improving decoding accuracy allows trained models to better recover data when images are cropped, thus enhancing decoding accuracy.

[0027]

[0028] L M =CrossEntropy(De(En(G,M)),M) (9)

[0029] This invention has the following characteristics:

[0030] 1. This invention employs a deep learning-based image steganography algorithm to construct an encoder-decoder network based on a GAN network. An evaluator is built in this network to improve the realism of the steganographic image. While attempting to write more information into the carrier image, the encoder also improves the similarity between the steganographic image and the carrier image. This enables the encoder to have adaptive encoding capabilities in order to improve image quality. It will write information into areas with complex image textures to reduce the modification of the carrier image and also improve the concealment.

[0031] 2. Add noise to the image during training to simulate an attack, thereby improving the robustness of the decoder in the event of a cropping attack.

[0032] 3. Adding noise to an image results in the loss of some features, causing the vanishing gradient problem during subsequent training. DenseNet connections were used in the encoder and decoder construction, increasing the number of features during training. This allows the encoder to write more information than without DenseNet connections, improving steganography capacity. Simultaneously, the decoder gains more features, recovering more information even with incomplete images, thus improving decoding accuracy. Attached Figure Description

[0033] Figure 1 This is a network structure diagram of the present invention;

[0034] Figure 2 These are specific effect diagrams showing the pruning of different steganography algorithms;

[0035] Figure 3 These are illustrations showing the effect of the present invention in steganographically writing random characters of 8, 16, 32, and 64 bytes;

[0036] Figure 4 This is the ROC curve of the steganalysis results;

[0037] Figure 5 This is a comparison chart of the adaptive capabilities of steganography algorithms. Detailed Implementation

[0038] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0039] A crop-resistant image steganography method based on generative adversarial networks (GANs) is proposed. The steganography model constructs an encoder-decoder network based on GAN and DenseNet connections, and incorporates various noises into the model training process to improve robustness. The epoch is set to 10. The specific network structure is as follows: Figure 1 As shown. Includes the following steps:

[0040] Step 1: The hidden data and the carrier image are concatenated and fed into the encoder for training to generate the hidden image;

[0041] Step 2: The evaluator provides feedback to the encoder by comparing the differences between the carrier image and the encrypted image, making the encrypted image generated by the encoder more realistic.

[0042] Step 3: Add various noises to the generated encrypted image to simulate a cropping attack on the encrypted image, thereby improving the robustness of the decoder in the case of a cropping attack.

[0043] Step 4: Train the decoder using the noisy image and reduce the loss of recovered and hidden data to improve decoding accuracy.

[0044] Specifically: Step 1, use the COCO dataset as training images, crop the image size to 360×360 pixels, set the training payload to 2 bpp, En(G,M) represents the encoder, G is the carrier image, D is the effective payload in bpp, the image resolution is W×H, and M is a binary data tensor of shape D×W×H, M∈{0,1} (D×W×H) Cat(X,Y): (X,Y)→φ∈R (D+D')×W×H This represents the connection of two tensors along the D-axis. The carrier image is processed using convolutional blocks to obtain tensor a as given by formula (1). Then, the information M to be hidden in image G is connected to tensor a, and tensor b is obtained using formula (2). Tensors c, d, and e are then obtained using formula (3). Finally, features of the carrier image G are added before generating the hidden image to improve its quality. The hidden image S is then output, as shown in formula (4). To improve the image quality of the hidden image, the similarity between the carrier image G and the hidden image S is analyzed using mean squared error, and the image reconstruction loss L... E As indicated by formula (5), the carrier image G and the carrier image S have the same resolution W×H.

[0045] a = Conv 3→32 (G) (1)

[0046] b = Conv 32+D→32 (Cat(a,M)) ​​(2)

[0047]

[0048] S = En(G,M) (4)

[0049]

[0050] Step 2: To provide feedback on the encoder's performance and generate more realistic images, an evaluation network Cn(S) is introduced. Mean(X):(X)∈R D×W×H →R D This represents the adaptive average spatial pooling operation, which calculates a one-dimensional label tensor score. The network consists of three convolutional layers and uses the mean squared error loss function to train the evaluator. During training, the label of the carrier image is 1, and the label of the dense image is 0. After multiple iterations, the evaluator and encoder are trained adversarially until the evaluator can no longer distinguish between real and fake dense images generated by the encoder, that is, the evaluation network's label value for the dense image is close to 1. The specific process is shown in formula (6):

[0051]

[0052] Step 3: The encrypted image S generated by the encoder will have random noise added to it to remove some image features before it is fed into the decoder for training, in order to improve the decoding accuracy of the decoder under complex conditions. The specific process is shown in formula (7). n is the added noise, and Noise is the noise layer. The encrypted image S with added noise N This will be sent to the decoder for training. The random noise includes Crop, Cropout, Drop, Dropout, Scale, Compression, and Gaussian Noise. The noise layer randomly adds one of these noise types to the carrier image S to obtain the noisy image S. N Crop means cropping, randomly removing 0-20% of the area, and filling the cropped area with NULL. Cropout means randomly cropping 0%-20% of the area and then filling it with the corresponding area from the carrier image. Drop means randomly discarding pixels from the image and then filling them with NULL. Dropout means randomly discarding pixels and then filling them with the corresponding points from the carrier image. Scale means randomly scaling, proportionally reducing the image to 80%-100% of its original size, and filling the blank areas with NULL. Compression uses DCT transform to generate JPEG compression and sets the high-frequency coefficients to zero. GaussianNoise adds Gaussian noise to each pixel with a standard deviation of 2.

[0053] S N =Noise 3→3 (S,n) (7)

[0054] Step 4: Use the noise-added, high-density image S N Training decoder De(S) N And obtain the recovered data. The process is shown in Equation (8), and then the cross-entropy loss function (see Equation (9)) is used to calculate the loss L between the recovered data and the hidden data. M Improve decoding accuracy. The decoder ultimately recovers the data. There is a loss function between it and the hidden data M. The decoder is trained to minimize the loss value in order to improve the decoding accuracy. It strives to keep the recovered data consistent with the hidden data, so that the trained model can better recover the data when subjected to image cropping and improve the decoding accuracy.

[0055]

[0056] L M =CrossEntropy(De(En(G,M)),M) (9)

[0057] The network structure of this invention is built upon the connection of a GAN network and a DenseNet network. This network can steganalyze images of any resolution and extract hidden information from them. 1000 images of varying sizes were randomly selected from the COCO dataset as the test set for comparative experiments. To verify whether the hidden information of the steganalyzed images generated by the ACIS model can still be completely extracted even after cropping, the experiment was set up as follows:

[0058] 1. For each steganography algorithm, two scenarios were set up: cropping by 10% and cropping by 20%. The decoding accuracy of the steganographic image generated by each algorithm was tested when it was cropped. Figure 2 The implementation details of the clipping are shown in Table 1 and Table 2, and the decoding accuracy results are presented in Table 1 and Table 2.

[0059] 2. In both cases, 8, 16, 32, and 64 bytes of random characters are steganographically written to the carrier image, respectively. The characters consist of numbers and uppercase and lowercase English letters.

[0060] 3. To simulate real-world transmission, the accuracy is not calculated using the number of correctly recovered bits, because when the recovered number of bits is not a multiple of 8, it is impossible to reconstruct the specific text information. Therefore, the accuracy defined here is formula (10):

[0061]

[0062] For example, a complete information recovery is achieved only when the input information is "XCz9TWMmL" and the decoded information from the image is also "XCz9TWMmL". An accuracy rate of 0.567 means that 567 images can be completely recovered from the hidden information.

[0063] The results in Tables 1 and 2 show that when truncation occurs, the traditional methods F5 and LSB become completely ineffective, with decoding accuracy essentially zero, making it almost impossible to fully recover the hidden information for secret message transmission. In contrast, ACIS and SteganoGAN, both deep learning-based steganography algorithms, possess a certain degree of resistance to truncation. With a 10% truncation, ACIS and SteganoGAN achieve the highest decoding accuracy when steganizing 8 bytes, reaching 0.795 and 0.484 respectively, with ACIS outperforming SteganoGAN by 31.1%. With a 64-byte steganography, the decoding accuracies reach 0.670 and 0.438 respectively, with ACIS outperforming SteganoGAN by 23.2%. Even with a 20% truncation, ACIS consistently outperforms SteganoGAN. Under truncation conditions, ACIS's accuracy is at least 23% higher than SteganoGAN, demonstrating significantly better resistance to truncation compared to other algorithms. The ACIS-generated images are of high quality, with a PSNR of 35.15 and an SSIM of 0.89. Figure 3 The image shows the results of ACIS steganography with 8, 16, 32, and 64 bytes of random characters, demonstrating high image quality. To evaluate ACIS's resistance to steganalysis, the widely used open-source tool StegExpose was used to perform steganalysis tests on the ACIS-generated steganalysis images. This tool combines four well-known steganalysis methods: sample pair analysis, RS analysis, Chi Squared Attack, and Primary Sets. To measure the effectiveness of ACIS in circumventing these steganalysis methods, 1000 images were randomly selected from the COCO dataset, and 64 bytes of random information (numbers and uppercase / lowercase English letters) were written to each image to generate steganalysis images. StegExpose was then used for steganalysis, and the results were statistically analyzed and plotted as ROC curves. Figure 4 The area under the ROC curve shown is 0.52, indicating that the steganalysis method of this tool can be effectively circumvented by the densely packed image generated by ACIS. Figure 5As shown, the amount of hidden information contained in the coded image reaches the maximum capacity of the image. The difference map is the pixel difference between the coded image and the original image. It can be seen from the difference map that the LSB method does not have adaptive steganography capability, while the ACIS method does. The ACIS model will write the information to be hidden in the complex texture area of ​​the image, which increases the difficulty of detection by the steganalysis tool. This is also the main reason why ACIS can avoid steganalysis.

[0064] Table 1:

[0065]

[0066] Table 2:

[0067]

[0068] This invention fully considers that most existing image steganography methods focus on increasing steganalytic capacity and improving the undetectability of steganographic images, while research on the integrity of information extraction after cropping is relatively limited. To address the problem of information loss after cropping, this invention proposes a crop-resistant image steganography method based on generative adversarial networks (GANs). This invention constructs an encoder-decoder network based on a GAN network. During training, a noise layer is added to simulate cropping attacks, improving the model's robustness. To reduce the impact of the vanishing gradient problem, DenseNet is used for connection, and the ACIS network structure is adjusted to improve decoding accuracy. Experimental results show that even after a 20% crop, over 70% of the steganographic image generated by ACIS can still be completely recovered, effectively evading detection by steganalysis tools while maintaining a high effective steganalytic payload capacity (1.37 bpp) and high-quality images.

[0069] In summary, the key components of the architecture proposed in this invention are the structure of the encoder, decoder, and evaluator, as well as the addition of noise. The encoder-decoder network built based on GAN networks enables encrypted images to possess higher image quality and stealth, while also significantly increasing the steganography capacity. The addition of noise improves the model's robustness, resulting in higher decoding accuracy when subjected to cropping attacks.

[0070] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Any simple modifications, equivalent changes, and alterations made to the above embodiments without departing from the technical essence of the present invention shall still fall within the scope of the present invention.

Claims

1. A method for steganography of anti-cropping images based on a generative adversarial network, characterized in that: The steganographic model uses a GAN network and DenseNet connection to build an encoding-decoding network, and adds multiple noises to the model training process to improve the model robustness, sets the Epoch to 10, including the following steps: Step 1, using COCO dataset as training image, image size is cropped to 360x360 pixels, set training payload = 2bpp, represents the encoder, is the carrier image, is the random information to be hidden in , is the payload bpp, the image resolution is , represents the connection of two tensors along axis; the carrier image is processed by convolution block to obtain the tensor given by formula (1) , and the information that needs to be hidden in the image is connected to the tensor , then processed by formula (2) to obtain the tensor , and then processed by formula (3) to obtain the tensor , , , finally the feature of the carrier image is added to improve the quality of the stego image, and then the stego image is output, see formula (4); to improve the image quality of the stego image, the similarity between the carrier image and the stego image is analyzed using mean square error, and the image reconstruction loss is represented by formula (5), the carrier image and the stego image have the same resolution ; ； ； ； ； ； Step 2, To provide feedback to the performance of the encoder and generate more realistic images, an evaluation network is introduced ; denotes the adaptive average spatial pooling operation. The evaluator gives a score feedback to the encoder by comparing the carrier image with the stego image, so that the stego image generated by the encoder is more realistic. The specific process is shown in formula (6): ； Step 3, stego image generated by encoder The random noise will be added to the stego image, and part of the image features will be removed before being sent to the decoder for training to improve the decoding accuracy of the decoder in complex situations. The specific process is shown in equation (7), The added noise is The stego image with added noise is It will be sent to the decoder for training. ； Step 4, using the noise-added stego image Training the decoder And get the recovered data , see formula (8), and then use the cross-entropy loss function to reduce the loss of recovered data and hidden data Improve decoding accuracy, see formula (9), so that the trained model can better recover data when the image is cropped, and improve the decoding accuracy; ； 。

Images