Generative steganography detection method guided by mutual information

Abstract

The invention discloses a mutual information guided generative steganography detection method, which comprises the following steps of: establishing a mutual information optimization detection model by taking mutual information among different image blocks in a generative steganography image as an optimization target of a network, and adding a feature discrimination loss item to further guide the optimization of the model. Classification features are extracted by using an image classification model pre-trained on a large-scale data set and are used for final classification to improve generalization of the model, and finally a target model is obtained. The method overcomes the defect that carrier-free generative steganography cannot be detected in the prior art, is easy to implement, can effectively improve the detection precision of the generative steganography, and has practical value.

Description

Technical Field

[0001] The present invention relates to the technical field of information hiding, and in particular to a detection method for generative steganography. Background Art

[0002] Image steganography aims to hide secret information in an image carrier so as to transmit information without attracting the attention of a third party. The purpose of steganalysis detection is to detect secret communications established through steganography. Previous methods generally used neural network models to modify the carrier to hide secret information. However, as long as the original carrier exists, stego traces will inevitably be left, resulting in changes in statistical characteristics and even visual effects. With the emergence of deep learning technology, steganography methods based on deep learning are also constantly developing. A new steganography method has emerged, called carrier-free steganography. Generative steganography using AIGC (artificial intelligence generated content) technology is the most widely used method in carrier-free steganography. The secret information is encoded and input into the generative model as a noise vector to obtain a carrier image carrying the secret information. Without comparison with the original carrier, it is difficult for the analyst to identify the stego traces.

[0003] Existing generative steganography methods include GSN (P.Wei, S.Li, H.Fang, in IEEE / CVF Conference on Computer Vision and Pattern Recognition, CVPR.IEEE, 2022, pp.2293-2302.), S2IRT (Yu, QMJWu, Z.Fu, and Y.Shi, IEEE Trans.DependableSecur.Comput., vol.20, no.5, pp.4118-4134, 2023.), etc. GSN designs a secret block module that uses StyleGAN2 to hide secret data in feature maps during image generation. This approach enables generative steganography methods to achieve higher hiding capacity (8 bits per pixel) and image fidelity. IDEAS decomposes an image into a structure representation and a texture representation. Embedding secret information into the structure representation vector improves the accuracy of secret information extraction. Transform sampling of the texture representation can produce richer generated images. S2IRT is a reversible transformation steganography method from secret information to image based on Glow. The stegographer uses a positional encoding algorithm to encode the secret information into a high-dimensional latent vector, and then maps the latent vector to the stego-image through the Glow model. These generative image steganography methods are very robust, and with the improvement of computing power, the generated images are more realistic and have broad application prospects.

[0004] In the field of steganalysis detection, steganalysis methods are also developing, such as SRNet (M.Boroumand, M.Chen, and J.Fridrich, IEEE Trans.Inform.Forensic Secur., vol.14, no.5, pp.1181-1193, May 2019), SiaStegNet (W.You, H.Zhang, and X.Zhao, IEEE Trans.Inform.Forensic Secur., vol.16, pp.291-306, 2021), etc. However, existing steganalysis detection methods require the carrier image and the stego image to be linked in pairs to train the network, and learn the stego signals in complex textures by comparing the two. If the generated stego images and other ordinary generated images are directly used as training sets, the existing steganalysis detection methods often focus on the different model fingerprints of the two rather than the stego signals. Although a high detection accuracy can be achieved under the current data set, once the data set changes, the trained model will become invalid. This is because the existing steganalysis detection models have not learned the effective classification boundary between generated steganalysis images and ordinary generated images. Summary of the invention

[0005] In view of the above shortcomings of the prior art, in order to make up for the gaps in the prior art in detecting generative steganographic images, the present invention proposes a detection scheme specifically for ordinary generated images and generative steganographic images, so that it is not necessary to train the network by pairing the carrier image and the steganographic image, thereby preventing the use of generated images for covert communication. The mutual information between different image blocks in the generative steganographic image is used as the optimization target of the network, and a feature discrimination loss term is designed to further guide the network optimization. The pre-trained classification model is used to extract image classification features, thereby improving the detection generalization of the network.

[0006] The technical solution for implementing the present invention is as follows:

[0007] A mutual information-guided generative steganalysis detection method uses the mutual information between different image blocks in the generative steganalysis image as the optimization target of the network to establish a mutual information optimization detection model, and adds a feature discrimination loss term to further guide the optimization of the model. The image classification model pre-trained on a large-scale dataset is used to extract classification features and used for the final classification to improve the generalization of the model, and finally the target model is obtained; the method includes the following main steps:

[0008] Step 1: The detected image is processed through two parallel pipelines: one for extracting image features and the other for extracting classification features; when extracting image features, the image is divided into two groups of image blocks of equal size so that two groups of feature vectors can be extracted later; when extracting classification features, the image is scaled to the size required by the classification model to adapt to the weight parameters of the pre-trained model;

[0009] Step 2: The image block obtained in step 1 enters the extraction network E ω , based on the extraction network E ω The twin network architecture is divided into two subnetworks, the two subnetworks share weights, and the two sets of preprocessed image blocks are input into the image feature extraction network E ω Generate two sets of 128-dimensional image features f1, f2;

[0010] Step 3: At the same time as step 2, the scaled image to be detected is input into the classification model pre-trained on a large-scale dataset to obtain the classification feature f CLA ; In order to ensure that information from large-scale data sets is not overwritten, the weight parameters before the fully connected layer in the classification model remain frozen during training;

[0011] Step 4: The two sets of image features f1 and f2 are input into the mutual information estimator T θ Calculate mutual information in

[0012] By mutual information neural estimator T θ Calculate the mutual information I(f1; f2) of two image features f1 and f2:

[0013]

[0014] represents the randomly scrambled f2 vector, the mutual information estimator T θ The network structure consists of two fully connected layers and a ReLU activation function. The calculated mutual information I(f1;f2) is mapped to the (0,1) range using the sigmoid function:

[0015]

[0016] Step 5: At the same time as step 4, the two sets of image features f1 and f2 are input into the feature similarity discriminator respectively. In the evaluation of feature similarity S, the feature similarity discriminator is used The output of and To estimate the divergence of f1 and f2 as a similarity indicator between the two:

[0017]

[0018] From the above formula, we can see that using feature similarity discriminator The divergence estimation is symmetric, and there is no need to consider which feature distribution is used as the reference vector. The structure of the feature similarity discriminator is similar to that of the mutual information estimator, consisting of two fully connected layers, a ReLU activation function, and a sigmoid function.

[0019] Step 6: Fuse the two sets of image features f1 and f2, and calculate the maximum, minimum, average and variance of each dimension of f1 and f2. These four statistical vectors are connected in series for subsequent classification; the final features used for classification include the four statistical vectors of the two sets of feature vectors, the calculated mutual information result I(f1; f2) and feature similarity S, and the classification feature f output by the pre-trained model. CLA , input them into the classification layer FC to obtain the detection result Output of the input image, that is, to identify whether the detected image is a generated stego image. The formula is as follows:

[0020] Output=FC(Fusion(f1,f2),I(f1;f2),S,f CLA )

[0021] Step 7, calculate the loss function and optimize the network through back propagation;

[0022] The mutual information loss term is calculated based on the mutual information I(f1;f2) obtained by the mutual information estimator

[0023]

[0024] Here y represents the true label of the input image {0,1}, where 0 represents the normal generated image and 1 represents the generated steganographic image. Then the feature discrimination loss term is calculated based on the feature similarity S

[0025]

[0026] Here m represents the similarity threshold, which is set to m = 2.5. In addition to the above two loss terms, the final classification result of the model is also used to guide network optimization, and the classification loss term is calculated using cross entropy.

[0027]

[0028] The above three loss terms are weighted using weight parameters α and β to obtain the final loss function used to guide network optimization.

[0029]

[0030] Through the loss function Guide the model training, and stop the training when the set upper limit of training times is reached to obtain the target model for detecting generative steganalysis.

[0031] In the actual processing process, the present invention uses the mutual information between different image blocks in the generated stego image as the optimization target of the network. By focusing on the intrinsic differences between the generated stego image and the non-steganographic image, the recognition ability is effectively enhanced. In addition, the distribution of the stego signal in the generated stego image is analyzed, and the feature discrimination loss term is designed to further guide the network optimization, thereby improving the detection accuracy. The pre-trained classification model is used to extract image classification features to improve the detection generalization of the network.

[0032] By adopting the above means, compared with the prior art, the beneficial effects of the present invention are:

[0033] The method of the present invention does not require the carrier image and the stego image to be linked in pairs to train the network, which makes up for the defect that the prior art cannot detect the carrier-free generative stego, is easy to implement, can effectively improve the detection accuracy of generative stego, and has practical value. The classification boundary of the generative stego image and the ordinary generated image is effectively determined. In addition, the present invention introduces the classification features extracted from the pre-trained model into the final classification stage, which effectively improves the generalization of the model. Experiments show that the present invention can not only effectively detect the generative stego image, but also show reliable generalization ability on different data sets. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is a schematic diagram of the process of the present invention.

[0035] Figure 2 This is a framework diagram of the mutual information-guided detection of generative steganography solution of the present invention.

[0036] Figure 3 This is a graph showing the detection accuracy of the present invention for the GSN, IDEAS and S2IRT steganography methods. DETAILED DESCRIPTION

[0037] The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments.

[0038] Aiming at the detection problem of generative steganography, the present invention uses the mutual information difference between ordinary generated images and generative steganographic images to design the optimization target of the network. First, the detected image needs to be divided into blocks, and the image blocks are processed by two sub-networks to obtain two sets of feature vectors. At the same time, the pre-trained model is used to extract the classification features of the entire detected image. The two sets of feature vectors are not only used for classification, but also need to be input into the mutual information estimator and the feature similarity discriminator to calculate the mutual information and feature similarity respectively. After the two sets of feature vectors are fused, they are connected with the classification features, the calculated mutual information and feature similarity, and then input into the classification layer to obtain the final classification result. During the training process, the loss function is calculated for back propagation to optimize the network.

[0039] like Figure 1 As shown, the specific steps of the present invention are as follows:

[0040] S1: Input the detected image X of any size and enter two preprocessing pipelines for processing: divide the image X into two image blocks of equal size along the x-axis, and the length of the image block is half of the original image. Figure 2 The input image size is 256*256, and each image block size is 128*256 after being divided into image blocks. In the other pipeline, the image is scaled to meet the input size of the pre-trained model. This is to freeze the parameters and still use the pre-trained model to extract classification features.

[0041] S2: Input the two image blocks obtained after preprocessing into the feature extraction network E ω , image feature extraction network E ω Based on the twin network architecture, it is divided into two subnets to facilitate the calculation of mutual information and feature similarity evaluation of features in different image regions. The feature extraction subnet combines the convolutional network and the self-attention module. The convolutional network is conducive to extracting local features of the image, while the self-attention module is conducive to capturing the global features of the image. ω The average pooling layer is used at the end to obtain two sets of 128-dimensional image features f1 and f2;

[0042] S3: At the same time as S2, the scaled image is input into the pre-trained classification model. The network parameters before the fully connected layer in the classification model are frozen to maximize the preservation of the large-scale data set information used for pre-training and improve the generalization of the network. In this embodiment, EfficientNet-B0 is used as the classification model to extract the classification feature f CLA ;

[0043] S4: Input the two sets of image feature vectors f1 and f2 into the mutual information estimator T θMutual information is calculated in . Mutual information measures the degree of mutual dependence between two variables. Specifically, mutual information quantifies the amount of information reduced when one random variable is known. Since the feature vectors f1 and f2 are continuous variables with unknown distribution, the accurate mutual information value cannot be calculated using the mutual information definition formula. In order to realize the mutual information calculation that can be applied to continuous variables with unknown distribution, the mutual information neural estimator method is used to calculate the mutual information of feature vectors f1 and f2. The calculated mutual information not only participates in the final classification, but also serves as the optimization target of the network. The specific calculation method of mutual information is as follows:

[0044]

[0045] represents the randomly scrambled f2 vector. Mutual information estimator T θ The network structure consists of two fully connected layers and a ReLU activation function. The calculated mutual information I(f1;f2) is mapped to the (0,1) range using the sigmoid function:

[0046]

[0047] S5: At the same time as S4, the two sets of feature vectors f1 and f2 are input into the feature similarity discriminator Using feature similarity discriminator The output of and To estimate the divergence of f1 and f2 as the similarity S indicator between the two:

[0048]

[0049] From the above formula, we can see that using feature similarity discriminator To estimate the divergence, it is symmetric and there is no need to consider which feature distribution is used as the reference vector. The structure and mutual information estimator T θ Similarly, it consists of two fully connected layers, a ReLU activation function, and a sigmoid function;

[0050] S6: Fuse the two sets of feature vectors f1 and f2, calculate the maximum, minimum, average and variance of each dimension, and obtain the fused 4*128-dimensional features, which are compared with the classification feature f CLA , the mutual information I(f1;f2) and the feature similarity S are connected and input into the classification layer FC for classification. The classification layer includes a fully connected layer and a softmax activation function. In order to prevent overfitting, the dropout rate is set to 0.5. The calculation process is as follows:

[0051] Output=FC(Fusion(f1,f2),I(f1;f2),S,f CL )

[0052] S7: Calculate the loss function and optimize the network through back propagation. When the label is 1, that is, the detected image is a stego image, we hope that the mutual information is closer to 1, that is, the dependence of different image blocks in the generated stego image is higher; when the label is 0, that is, the detected image is a non-steganographic image, we hope that the mutual information is closer to 0, that is, the dependence of different image blocks in the ordinary generated image is lower and the randomness is higher. This goal is consistent with the optimization goal of the standard binary classification problem, so the mutual information loss term is obtained by using the binary cross entropy calculation method

[0053]

[0054] y represents the true label of the input image. In addition to the mutual information loss term, a feature discrimination loss term is designed to further guide network optimization. When the input image is a stego image, it is hoped that the discriminator will output similar identification results as much as possible, thereby promoting the mutual imitation of the two sets of feature vectors. On the contrary, when the input image is a normal generated image, it is hoped that the discriminator will output a discriminative identification result, thereby increasing the distance between the two sets of feature vectors. The feature similarity discriminator can flexibly calculate the distribution similarity between the two sets of feature vectors and guide the feature extraction network E. ω Extract image feature vectors that are beneficial for classification. Calculate feature discrimination loss based on feature similarity S

[0055]

[0056] Here m represents the similarity threshold, which is set to m = 2.5. In addition to the above two loss terms, the final classification result of the network is also used to guide network optimization, and the classification loss term is calculated using cross entropy.

[0057]

[0058] The above three loss terms are weighted using weight parameters α and β to obtain the final loss function used to guide network optimization.

[0059]

[0060] Through the loss function Guide the model training, and stop the training when the set upper limit of training times is reached to obtain the target model for detecting generative steganalysis.

[0061] The following is a specific experimental example to further illustrate the specific application of this method and examine the effectiveness of the method.

[0062] The encrypted images generated by three different generative steganography techniques, GSN, IDEAS, and S2IRT, were detected. Only one of the steganography techniques was used in the training set, and the three steganography techniques were used in the test to verify the detection accuracy and generalization of the present invention. Each steganography dataset includes 20,000 steganographic images and 20,000 normal generated images. The dataset is divided into training set, validation set, and test set in a ratio of 8:1:1.

[0063] Step 1: First, preprocess the training set images. The input image is divided into two 128*256 image blocks as the input of the feature extraction network. In another preprocessing pipeline, the input image is scaled to 224*224 as the input of the classification model.

[0064] Step 2: Input the two sets of preprocessed image blocks into the image feature extraction network E ω In this paper, two sets of 128-dimensional image feature vectors f1 and f2 are obtained;

[0065] Step 3: At the same time as step 2, the scaled image is input into the classification model to extract the classification feature f CLA In this embodiment, EfficientNet-B0 is used as the classification model to obtain a 1280-dimensional classification feature f CLA ;

[0066] Step 4: Input the feature vectors f1, f2 into the mutual information estimator T θ Calculate the mutual information I(f1;f2);

[0067] Step 5: Input feature vectors f1 and f2 into the feature similarity discriminator Calculate the feature similarity S;

[0068] Step 6: Fuse the feature vectors f1 and f2. The fused features are combined with the classification feature f CLA , the calculated mutual information I(f1; f2) and the feature similarity S are connected and input into the classification layer to obtain the classification result;

[0069] Step 7: Calculate the loss function based on mutual information, feature similarity and classification results After back propagation, the network parameters are optimized. After 200 epochs of training, the training is stopped to obtain the target model for detecting generative steganography. The test set images are input into the model for classification to evaluate the detection effect of the model.

[0070] Depend on Figure 3The experimental results show that the present invention does not rely on pairwise links between carrier images and steganographic images to train the network, can effectively detect generative steganographic images, and has reliable generalization. The designed loss function can effectively determine the classification boundary. When the test set and the training set are from the same source, the method of the present invention can achieve a detection accuracy of more than 95%; when the test set and the training set are from different sources, although the detection accuracy decreases, it still maintains a detection accuracy of more than 60%. The target model trained on the GSN and IDEAS training sets has better generalization, and the average detection accuracy is above 80%.

Claims

1. A mutual information-guided generative steganalysis detection method, which uses the mutual information between different image blocks in the generative steganalysis image as the optimization target of the network to establish a mutual information optimization detection model, and adds a feature discrimination loss term to further guide the optimization of the model. The image classification model pre-trained on a large-scale dataset is used to extract classification features and used for the final classification to improve the generalization of the model, and finally obtain the target model; it includes the following main steps: Step 1: The detected image is processed through two parallel pipelines: one for extracting image features and the other for extracting classification features; when extracting image features, the image is divided into two groups of image blocks of equal size so that two groups of feature vectors can be extracted later; when extracting classification features, the image is scaled to the size required by the classification model to adapt to the weight parameters of the pre-trained model; Step 2: The image block obtained in step 1 enters the extraction network E ω , based on the extraction network E ω The twin network architecture is divided into two subnetworks, the two subnetworks share weights, and the two sets of preprocessed image blocks are input into the image feature extraction network E ω Generate two sets of 128-dimensional image features f1, f2; Step 3: At the same time as step 2, the scaled image to be detected is input into the classification model pre-trained on a large-scale dataset to obtain the classification feature f CLA ; In order to ensure that information from large-scale data sets is not overwritten, the weight parameters before the fully connected layer in the classification model remain frozen during training; Step 4: The two sets of image features f1 and f2 are input into the mutual information estimator T θ Calculate mutual information in By mutual information neural estimator T θ Calculate the mutual information I(f1; f2) of two image features f1 and f2: represents the randomly scrambled f2 vector, the mutual information estimator T θ The network structure consists of two fully connected layers and a ReLU activation function. The calculated mutual information I(f1;f2) is mapped to the (0,1) range using the sigmoid function: Step 5: At the same time as step 4, the two sets of image features f1 and f2 are input into the feature similarity discriminator respectively. In the evaluation of feature similarity S, the feature similarity discriminator is used The output of and To estimate the divergence of f1 and f2 as a similarity indicator between the two: The structure of the feature similarity discriminator is similar to that of the mutual information estimator, consisting of two fully connected layers, a ReLU activation function, and a sigmoid function; Step 6: fuse the two sets of image features f1 and f2, calculate the maximum, minimum, average and variance of each dimension of f1 and f2, and connect these four statistical vectors in series for subsequent classification; the features finally used for classification include the four statistical vectors of the two sets of feature vectors, the calculated mutual information result I(f1; f2) and feature similarity S, and the classification feature f output by the pre-trained model. CLA , input them into the classification layer FC to obtain the detection result Output of the input image, that is, to identify whether the detected image is a generated stego image. The formula is as follows: Output=FC(Fusion(f1,f2),I(f1;f2),S,f CLA ); Step 7, calculate the loss function and optimize the network through back propagation; The mutual information loss term is calculated based on the mutual information I(f1;f2) obtained by the mutual information estimator Here y represents the true label of the input image {0,1}, where 0 represents the normal generated image and 1 represents the generated steganographic image. Then the feature discrimination loss term is calculated based on the feature similarity S. Here m represents the similarity threshold, which is set to m = 2.

5. In addition to the above two loss terms, the final classification result of the model is also used to guide network optimization, and the classification loss term is calculated using cross entropy. The above three loss terms are weighted using weight parameters α and β to obtain the final loss function L used to guide network optimization: Through the loss function Guide the model training, and stop the training when the set upper limit of training times is reached to obtain the target model for detecting generative steganalysis.

Images