Steganography carrier selection method avoiding preprocessing

Abstract

The invention discloses a steganography carrier selection method capable of avoiding preprocessing, which relates to the field of covert communication, and comprises the following steps of: firstly, training a neural network model for carrying out preprocessing distortion judgment on a preprocessed image, then obtaining final distortion of each carrier image in combination with embedded distortion, and sorting and selecting a steganography carrier; the method is suitable for application of a multi-carrier situation, the probability that the preprocessed image is selected out for steganography is reduced, and a steganography system has excellent precision, reliability, robustness and safety.

Description

Technical Field

[0001] The present invention relates to the field of covert communication, and in particular to a method for selecting a steganographic carrier that avoids preprocessing. Background Art

[0002] Image steganography is a form of covert communication that can embed information into images that are transmitted on the Internet in daily life, and the transmission of hidden information cannot be discovered by third parties other than the communication during the transmission process. Image steganography can also be divided into single-carrier steganography and multi-carrier steganography according to the number of carriers used. Multi-carrier steganography can carry more secret information and improve the security of the steganography system.

[0003] Among them, carrier selection is a key step in image steganography, and the carrier selection method directly affects the security of the image steganography system. The most widely used carrier selection method is to jointly calculate image distortion by STC coding and stego distortion function. The improvement of early carrier selection methods is accompanied by the development of stego distortion. Distortion functions such as WOW distortion function, UNIWARD distortion function, and HILL distortion function have been proposed one after another. The distortion function is used to calculate the distortion of each pixel of the image, and then the overall distortion of the image is calculated in combination with STC coding. Finally, the required image is selected in ascending order according to the image distortion. With the development of deep learning, generative adversarial networks and reinforcement learning are also used in stego carrier selection. ASDL-GAN method, UT-GAN method, SPAR-RL method, etc. have been proposed one after another to calculate the overall distortion of the image.

[0004] When there are multiple images to choose from during steganography, we can choose a multi-carrier steganography method for information transmission. However, experiments have shown that if we choose to use pre-processed images (such as mean filtering, median filtering, etc.) for steganography, the security of the steganography system will be greatly compromised. Summary of the invention

[0005] In order to solve the problems of the prior art, the purpose of the present invention is to overcome the shortcomings of the existing technology and provide a method for selecting a steganographic carrier that avoids preprocessing. First, a trained neural network model is used to calculate the preprocessing distortion of the image carrier, and the embedding distortion of the corresponding carrier is calculated. The two distortions are combined to obtain the final distortion, and then several carriers are sorted according to the size of their final distortions, and the steganographic carrier is selected from small to large.

[0006] One of the purposes of the present invention is to provide a technical solution for a training method of a neural network model for preprocessing distortion calculation, which is as follows:

[0007] A training method for a neural network model for preprocessing distortion calculation comprises the following steps:

[0008] S21, determining a training set, wherein the training set includes original images and pre-processed images;

[0009] S22, setting a learning rate of the neural network model to be trained, inputting each image in the training set into the neural network model to be trained, obtaining a model output after being processed by the corresponding neural network model, performing optimization calculation on the model output to obtain a training label of each carrier in the current training round, and then optimizing the parameters of the corresponding neural network model through a loss function back propagation method to obtain a neural network model after the corresponding training round;

[0010] S23. Use the neural network model after the corresponding training rounds in step S22 as the neural network model to be trained, repeat step S22 for several cycles, and obtain a trained neural network model.

[0011] Preferably, when step S22 is completed, after the neural network model completes the corresponding round of training, the test set is input into the neural network model that has completed the corresponding round of training to perform a training accuracy test. When the training accuracy has a relatively optimal value, the trained neural network model is obtained, and the relatively optimal value has any of the following technical features:

[0012] A. Preset the total number of training rounds. After the training of the preset total number of training rounds is completed, the neural network model obtained in each round of training is tested for training accuracy. The training accuracy values ​​obtained in each round are compared, and the highest training accuracy is selected as the relative optimal value. The corresponding number of training rounds is the optimal number of training rounds.

[0013] B. During the training process, the total number of training rounds is not set, and the neural network model obtained in each round of training is tested for training accuracy. When the training accuracy of one round reaches more than 95% and the accuracy of the subsequent four rounds of training does not improve, the training is terminated. At this time, the highest training accuracy is the relative optimal value, and the corresponding number of training rounds is the optimal number of training rounds.

[0014] Preferably, when step S23 is completed, the verification set is input into the trained neural network model for verification testing.

[0015] Preferably, as the number of training rounds increases, the learning rate gradually decreases.

[0016] Preferably, the original image set includes several original images and several images that have undergone basic processing, wherein the basic processing is a processing method in which the grayscale of the processed image remains unchanged; and the preprocessed image set includes several images that have undergone preprocessing, wherein the preprocessing is a processing method in which the grayscale of the processed image changes.

[0017] Preferably, each image in the training set is divided into several training image groups, which are trained in sequence.

[0018] Further preferably, the training graph group is divided into several training groups, which are trained in sequence.

[0019] The second object of the present invention is to provide a technical solution for applying the neural network model trained by the training method of the neural network model for preprocessing distortion calculation to a method for selecting a steganographic carrier that circumvents preprocessing, which is specifically as follows:

[0020] A method for selecting a steganographic carrier to circumvent preprocessing comprises the following steps:

[0021] S11, calculating the preprocessing distortion and embedding distortion of each carrier to be analyzed;

[0022] S12, fusing the preprocessing distortion and the embedding distortion to obtain a final distortion of each carrier;

[0023] S13, after arranging in order according to the final distortion, a carrier sequence with an arrangement rule is obtained, and a steganographic carrier is selected for the carrier sequence in the order of the final distortion value from small to large.

[0024] Preferably, the preprocessing distortion is obtained by inputting each of the carriers to be analyzed into the trained neural network model and performing analytical calculations.

[0025] Preferably, the preprocessing distortion is more than 10 times the embedding distortion.

[0026] Compared with the prior art, the present invention has the following beneficial effects:

[0027] The present invention proposes a training method for a neural network model for preprocessing distortion calculation, wherein an original image set with unchanged grayscale and a preprocessed image set with changed grayscale are input into the neural network model for training, a learning rate is gradually provided during the training process, and the neural network model is subjected to accuracy test and verification test, and it is found that the trained neural network model has excellent performance, a training accuracy of more than 99%, a verification accuracy of more than 99%, and good reliability, and the trained model has high robustness, and for image sets obtained by other preprocessing methods not used for training, the model still has high application verification accuracy (reaching more than 78%, and the best can reach 90.3%) and application verification correctness (reaching more than 70% when selecting the first 250 images, and the best can reach 99.6%, and reaching more than 80% when selecting 750 images, and the best can reach 97.56%).

[0028] The present invention proposes a method for selecting a steganographic carrier that circumvents preprocessing. The method uses a trained neural network model for preprocessing distortion calculation and combines it with embedding distortion to obtain the final distortion of the carrier, and sorts it accordingly to select the steganographic carrier. The security of the steganographic system is further enhanced by increasing the priority of the preprocessing distortion. Compared with the traditional steganographic carrier selection method, the security of the steganographic system is better.

[0029] The present invention trains a neural network model to screen out preprocessed images from carrier images given in a multi-carrier scenario, and combines a traditional embedding distortion algorithm to select multiple images most suitable for steganography for information hiding. The steganographic carrier selection method can greatly reduce the probability of selecting preprocessed images, and the integration of traditional embedding distortion can select images that are more suitable for steganography from a candidate image set, making the carrier selection method safer. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 The overall flow chart of the method for selecting a steganographic carrier to circumvent preprocessing provided by the present invention;

[0031] Figure 2 A flow chart of the selection principle of the steganographic carrier in the steganographic carrier selection method for circumventing preprocessing provided by the present invention;

[0032] Figure 3 It is a schematic diagram of the architecture of the model 1 in the present invention;

[0033] Figure 4 for Figure 3 Schematic diagram of the architecture of each residual layer in ;

[0034] Figure 5 This is a flow chart of training and testing of the neural network model provided by the present invention, in which L 0 The initial labels of the images input to the neural network model are represented by adding subscripts to the corresponding images;

[0035] Figure 6 A schematic diagram of the composition of a training image set used for training a neural network model in the present invention;

[0036] Figure 7 A flowchart for training the neural network model in the present invention;

[0037] Figure 8 A schematic diagram of the composition of a candidate test image set used for testing errors in the present invention;

[0038] Fig. 9A graph showing the comparative test results of the steganographic carrier selection method for circumventing preprocessing provided in the present invention and the traditional method under different embedding rates for steganographic security;

[0039] Fig.10 This is a graph showing the comparative test results of the steganographic security of the steganographic carrier selection method for circumventing preprocessing provided by the present invention and the traditional method under different sample numbers. DETAILED DESCRIPTION

[0040] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0041] For ease of understanding, the nouns or abbreviations mentioned below are first explained:

[0042] BCEloss: The full name of BCEloss is Binary Cross Entropy Loss, binary cross entropy loss

[0043] P E : represents the test error of the steganalyzer, which can be used to measure the security of the steganalysis system, P E The larger the value, the higher the security of the steganographic system. For further understanding, please refer to the literature IEEE Transactions on Information Forensics and Security, 2011, 7(2): 432-444.

[0044] SUNI-random, SUNI-[secure], and SUNI-[joint]: SUNI stands for the use of the algorithm S-UNIWARD to calculate the embedding distortion D E For further understanding, please refer to EURASIP Journal on Information Security, 2014, 2014: 1-13. The meanings of the contents added thereafter are as follows: Random means randomly selecting a stego carrier; [secure] means using the Secure method to select a stego carrier, please refer to IEEE Access, 2019, 7: 57857-57867. For further understanding; [joint] means using the Joint method to select a stego carrier, please refer to IEEE Signal Processing Letters, 2018, 25(10): 1530-1534.

[0045] A method for selecting a steganographic carrier that avoids preprocessing provided by the present invention is described in detail below.

[0046] A method for selecting a steganographic carrier to circumvent preprocessing, such as Figure 1 As shown, the following steps are included:

[0047] S11. Calculate the preprocessing distortion D of each carrier to be analyzed Y and embedding distortion D E ;

[0048] S12: Fuse the preprocessing distortion and the embedding distortion to obtain the final distortion of each carrier, expressed as D = D Y +D E ;

[0049] S13. After arranging in order according to the final distortion, a carrier sequence with an arrangement rule is obtained, so that the steganographic carrier can be selected according to the order of the carrier sequence.

[0050] Furthermore, in step S11, the preprocessing distortion D Y The calculation process is as follows: several carriers to be analyzed are input into the trained neural network model (hereinafter referred to as the final model), and the preprocessing distortion D of each carrier is obtained through the analysis and calculation of the model. Y .

[0051] Furthermore, the final model is used to judge several carriers, obtain the model output p of each carrier, and assign a preprocessing weight M to each carrier, thereby obtaining the preprocessing distortion of each carrier.

[0052] D Y =M×(1-p).

[0053] It should be noted that the model output p is between 0 and 1, 1-p = 1 represents no image distortion, that is, the closer (1-p) is to 1, the lower the preprocessing distortion of the image; in general, the value of traditional embedding distortion is 10 times (1-p). 6 ~10 7 Therefore, the preprocessing distortion is to expand (1-p) by M times, so that the priority of the preprocessing distortion is higher than the priority of the embedding distortion. The preferred M is 10 to the 8th power or more. In this embodiment, M=10 11 , making the priority of preprocessing distortion significantly higher than that of embedding distortion.

[0054] Furthermore, in step S11, the embedded distortion D E The calculation process is as follows: the embedding distortion calculation method is used to calculate several carriers to be analyzed, and the embedding distortion D of each carrier is obtained. E .

[0055] Specifically, in this embodiment, the embedded distortion D E Calculated using the algorithm S-UNIWARD.

[0056] Further, such as Figure 2 As shown, step S13 is specifically, the trained neural network model judges several carriers through the final distortion value, and sorts the several carriers according to the judgment result, and selects the steganographic carriers for the carrier sequence in order, starting from the carrier with the smaller distortion, and the specific number depends on the actual demand.

[0057] Specifically, in this embodiment, the images are arranged from small to large according to the final distortion during sorting, so that the distortion of the carrier located at the front position is small, and the distortion of the carrier located at the back position is large.

[0058] It should be noted that the final model is a trained neural network model obtained after multiple rounds of training of an untrained neural network model (initial model), wherein the neural network model after each round of training is a number of intermediate models.

[0059] Specifically, the neural network model is a binary classification deep learning network (binary classification network for short), which has a multi-layer structure and is composed of the following feature layers:

[0060] Convolutional layer, residual layer, average pooling layer, fully connected layer and sigmoid layer. Each feature layer is directly connected, that is, the data output by the previous layer is directly used as the input data of the next layer. According to the direction of data flow, the order of feature layers is: convolutional layer → residual layer → average pooling layer → fully connected layer → sigmoid layer, until the sigmoid layer outputs the model output p.

[0061] Furthermore, a convolutional layer is added between the residual layer and the average pooling layer.

[0062] Specifically, as shown in Table 1, in this specific implementation, six neural network models with different structures are designed. The following takes Model 1 as an example for a specific introduction. Figure 3 As shown in the figure, the neural network model has a six-layer structure, namely: a convolutional layer, two residual layers (the first residual layer r1 and the second residual layer r2), an average pooling layer, a fully connected layer and a sigmoid layer.

[0063] The following introduces the process of calculation in the carrier input model 1 (initial model, intermediate model or final model) in combination with the structural characteristics of the binary classification network. It should be noted that the carrier in this embodiment is preferably a grayscale image. If the carrier is a non-grayscale image, it needs to be grayscale processed first and then input into the neural network model for calculation.

[0064] The specific process of calculation in the carrier input model 1 is as follows:

[0065] The carrier extracts local pixel features through the convolution layer to obtain data A1, then passes through two convolution layers to obtain data A5, and then passes through the average pooling layer to obtain data A6. Data A6 undergoes data dimension conversion to obtain one-dimensional data input to the fully connected layer to obtain data A7, and finally passes through the sigmoid layer to obtain the final model output p. It should be noted that the model output p can be obtained through the initial model, intermediate model and final model, and the different model outputs of different images are distinguished by using upper and lower subscripts.

[0066] Furthermore, the convolution layer in model 1 includes 64 convolution kernels of size 7×7, a stride of 2, and a padding bit of 3, which is represented as a 7*7 convolution layer; the average pooling layer includes 64 convolution kernels of size 127×127, which is represented as a 127*127 average pooling layer.

[0067] Specifically, Figure 4 As shown, each residual layer includes two residual convolution layers (a first residual convolution layer rc1 and a second residual convolution layer rc2), each residual convolution layer contains 64 convolution kernels of size 3×3, a step size of 1, and a padding bit of 1. The input information passes through the two residual convolution layers rc1 and rc2 in sequence, and then obtains the output information after a batch normalization operation and a Relu layer. In this embodiment, after data A1 passes through the first residual layer r1, data A2 is obtained, and then data A1 and data A2 are added to obtain data A3 as the input information of the residual layer r2, and after passing through the second residual layer r2, data A4 is obtained, and then data A3 and data A4 are added to obtain data A5.

[0068] It should be noted that data A1 to A6 are all 64-channel data, that is, they contain 64 numbers respectively, and data A7 is 1 number. Since they are normalized during the processing, the model output p is a value between 0 and 1.

[0069] Models 2 to 6 differ from model 1 in that the number of residual layers is different, the size of the convolution kernel in the average pooling layer is different, and a 3*3 convolution layer is added between the residual layer and the average pooling layer, as shown in Table 1, which will not be described here.

[0070] Table 1 Neural network model structure

[0071]

[0072] like Figure 5As shown, the training process of the neural network model includes two parts: training and training accuracy test, so that the trained model has the advantage of high accuracy. In order to verify the reliability of the trained model, a verification accuracy test is also added to ensure that the trained model is not only highly accurate but also reliable. Then the trained neural network model is subjected to application verification accuracy test and application verification correctness test to ensure that the training method is feasible and has excellent robustness. Finally, the test error analysis of the trained neural model and the traditional method is carried out together to prove that it has excellent security in terms of steganographic carriers.

[0073] The following describes the training method of the neural network model that trains the initial model into the final model, specifically:

[0074] S21, determine a training image set, which includes original images and pre-processed images, and determine the original label L of each image in the training set 0 , and the training image set is divided into three parts, the first part is a training set for training an untrained neural network model, the second part is a test set for testing the accuracy of the trained neural network model, and the third part is a validation set for verifying the reliability of the trained neural network model, wherein the training set, the test set and the validation set each contain original images and preprocessed images;

[0075] S22, input each image in the training set into the neural network model to be trained, and set the learning rate. After the corresponding neural network model is calculated, the model output is obtained. Then the optimization calculation can be performed to obtain the training label BCEloss for each image i -x, and then optimize the parameters of the corresponding neural network model through the back propagation method of the loss function to obtain the intermediate model model-x after an additional round of training, where i represents the i-th image in the training set and x represents the number of training rounds experienced by the neural network model;

[0076] S23. Use the obtained intermediate model model-x as the neural network model to be trained, repeat step S22, and obtain the intermediate model model-x with an increased number of training rounds, where x represents the number of training rounds experienced by the neural network model.

[0077] It should be noted that there are two ways to end the loop. A relatively simple way is: pre-set a number of loop rounds to obtain a corresponding number of models, and select the neural network model that performs best in the training accuracy test experiment using the test set as the final model model-z, where z is the number of training rounds corresponding to the best training accuracy; the other is to calculate the training accuracy of the intermediate model obtained after each round of training. When the training accuracy on the test set reaches more than 95% and the accuracy of the subsequent 4 rounds of training has not increased again, the training can be ended. At the same time, the best number of training rounds corresponding to the highest training accuracy and the training accuracy corresponding to the best number of training rounds can be obtained. The corresponding model is the final model model-z, and z is also the best number of training rounds. The two methods of judging the end are the same, both of which select the number of rounds with the best training accuracy as the best number of training rounds.

[0078] Furthermore, as the number of training rounds increases, the learning rate gradually decreases, which makes the model more meticulous in the later optimization process and can obtain a better model.

[0079] Specifically, in this embodiment, the relationship between the learning rate and the number of training rounds is: the initial learning rate S1 of the first round of training is set to 0.001, then the learning rate in the xth round of training is The symbol To round down.

[0080] Further, such as Figure 6 As shown, in step S11, the original images in the training image set are combined into the original image set, and the preprocessed images are combined into the preprocessed image set, specifically:

[0081] The original image set is divided into the first original image set and the second original image set, where the first original image set is a set of several original images, and the second original image set is obtained after each image in the first original image set is processed, including three image sets: copy image set, 90° rotated image set and 180° rotated image set, which correspond to the basic processing methods of copy, 90° rotated and 180° rotated, respectively. Therefore, each image in the original image set has not been preprocessed, so its original label is set to Where a represents the serial number of each image in the original image set;

[0082] The preprocessed image set is obtained after each image in the first original image set is preprocessed, including four preprocessing methods and four corresponding image sets, namely: the eroded image set after erosion, the dilated image set after dilation, the sharpened image set after sharpening, and the histogram equalization image set after histogram equalization. Therefore, the original labels of the images in the preprocessed image set are Where b represents the sequence number of each image in the preprocessed image set.

[0083] It should be noted that the images in the first original image set are of uniform size. If they are not of uniform size, the image size needs to be adjusted to the corresponding size. The Resize function in the transform package selected in this embodiment adjusts the image size, and the input size of the binary classification network is set to 512*512 pixels.

[0084] In this embodiment, if Figure 6 As shown, the first original image set contains a total of 5000 images, which come from the BOSSbass ver.1.01 image library. After basic processing and preprocessing, several corresponding image sets are obtained. 80% of the images in the training image set are used as training sets, 10% of the images are used as test sets, and the remaining 10% of the images are used as validation sets. It should be noted that each image set in the training image set is evenly sampled.

[0085] In this embodiment, in step S22, the training label BCEloss i -x uses the binary cross entropy BCEloss function in the loss function torch.nn for calculation, specifically:

[0086]

[0087] in, is the original label of the i-th image, the original label of each image in the original image set Where i represents the 1st, 2nd, ..., or 20,000th image; the original label of each image in the preprocessed image set Here, i represents the 20001st, 20002nd, ..., or 40000th image, is a number between 0 and 1. From the formula, we can find that when The closer The smaller the loss, the further away The greater the loss.

[0088] The following describes the method for determining the optimal number of training rounds in the neural network model training process and the corresponding training accuracy in this specific implementation, as follows:

[0089] In step S22, the images in the training set are grouped to obtain multiple training image groups, and each training image group is trained in turn.

[0090] like Figure 7 As shown, there are a total of 32,000 images in the training set, which are divided into eight training groups with 4,000 images in each group, and trained in sequence;

[0091] The images in the training image group are divided into groups to obtain a number of training groups, and each training group is trained in turn;

[0092] Each training group contains 4,000 images, divided into 125 training groups with 32 images per group.

[0093] Thus, in this embodiment, several training groups in each training group are trained in sequence. After all images in the training group are trained once, the training of the next training group is continued until all training groups have completed one training, which is recorded as one round of training of the training set.

[0094] Furthermore, before the intermediate model model-x obtained after each round of training undergoes a new round of training, a training accuracy test is added. The specific steps are as follows:

[0095] Input each image in the test set into the intermediate model model-x to obtain the model output for each image Among them, x represents the number of training rounds experienced by the intermediate model, c is the serial number of each image in the test set, and the corresponding original label of each image is

[0096] Compare the model output for each image With original label Used to determine the accuracy P of the intermediate model model-x obtained after x rounds of training TEST , the calculation formula is:

[0097]

[0098] Specifically, P TEST Values ​​not greater than 0.5 are considered correct, and values ​​greater than 0.5 are considered incorrect. The correct values ​​are counted and their proportion in the total number of images in the test set is calculated as the training accuracy of the intermediate model model-x.

[0099] It should be noted that the specific number of training rounds can be determined based on the accuracy of the intermediate model model-x obtained after each round of training. When the training accuracy on the test set reaches more than 95% and the accuracy of the subsequent 4 rounds of training does not increase again, the training can be terminated. Among them, the number of rounds with the highest training accuracy and the corresponding accuracy correspond to the optimal number of rounds and training accuracy. The neural network model obtained by the corresponding optimal number of rounds is the final model model-z.

[0100] In the following, in this specific implementation, the obtained final model model-z is subjected to a verification accuracy test to determine the training reliability. The method is similar to the above-mentioned training accuracy test, except that only the selected final model model-z is tested, and the images of the verification set are input into the final model to obtain the model output Correspondingly, the original label of each image is Among them, d is the serial number of each image in the validation set,

[0101] Compare the model output for each image With original label Used to determine the validation accuracy P of the final model z , the calculation formula is:

[0102]

[0103] P z Values ​​not greater than 0.5 are considered correct, and values ​​greater than 0.5 are considered incorrect. The correct ones are counted and their proportion in the total number of images in the test set is calculated as the verification accuracy of the final model.

[0104] Determine whether the verification accuracy of the final model is consistent with the training accuracy tested during the training process. If they are consistent, it means that the neural network model and its training process are reliable.

[0105] For model 1, forty rounds of training are preset, and the best model is obtained in the 36th round, which is selected as the final model model-z. The training accuracy of this model on the test set is 99.1%, and the training accuracy on the validation set is also 99.1%, which has good reliability.

[0106] Specifically, the optimal number of training rounds, training accuracy, and verification accuracy corresponding to different neural network models from Models 1 to 6 are shown in Table 2.

[0107] Table 2 The best number of training rounds, training accuracy and verification accuracy of different neural network models

[0108]

[0109] The following is a brief description of an application test example of the above-mentioned method for selecting a stego carrier to circumvent processing. The last 5,000 images in the BOSSbass ver.1.01 image library are used as an example to introduce the candidate image set, and robustness verification (a set of images containing preprocessing methods not used for training are input into the final model, and the obtained model output is compared with the initial label to judge the accuracy and correctness) and test error analysis (a set of images not used for training are preprocessed and embedded. The distortion is calculated, and then the final distortion is obtained by fusion. After selecting from the smallest to the largest, it is used for test error analysis), specifically:

[0110] First of all, it should be noted that the size of the images in the candidate image set is consistent with the size of the images in the training image set when participating in the neural network model training, and they are grayscale images. If they are not grayscale images, they are first processed into grayscale before being put into the candidate image set;

[0111] Then, the images in the candidate image set are processed accordingly, and the processing method includes at least one processing method other than the preprocessing method of the training process, to obtain a candidate test image set. The images in the candidate test image set have an initial sorting, from the first to the 5000th images.

[0112] Specifically, Figure 8 As shown, the images in the candidate image set are divided into ten parts, three of which are not processed, four are preprocessed, and the remaining three are filtered to obtain the candidate test image set. In this way, the initial labels of the obtained images are: (e is the serial number of the image not to be processed), (f is the serial number of the preprocessed image), (g is the serial number of the filtered image); then, the images in the candidate test image set are input into the final model to obtain the model output corresponding to each image m represents any sequence number among e, f, and g, and the original label of the corresponding image is

[0113] Finally, the robustness verification and test error test of the final model are carried out.

[0114] Robustness verification, including application verification accuracy and application verification correctness.

[0115] Application verification accuracy, specifically:

[0116] Compare the model output for each image With original label Used to determine the accuracy P of the final model model-z appl , the calculation formula is:

[0117]

[0118] Specifically, P appl Values ​​not greater than 0.5 are considered correct, and values ​​greater than 0.5 are considered wrong. The correct ones are counted and their proportion in the total number of images in the candidate image set is calculated as the application verification accuracy of the final model model-z.

[0119] Application verification correctness, specifically:

[0120] According to the model output for each image Sort the values ​​from small to large, and select several values ​​with larger model outputs in order. The images (first 250 or first 750) form the application verification group and compare the model output of the selected images The original label value corresponding to the image is used to determine the application verification accuracy C of the final model model-z appl , the calculation formula is:

[0121]

[0122] Specifically, C. appl Values ​​not greater than 0.5 are considered correct, and values ​​greater than 0.5 are considered wrong. Correct judgments are counted and their proportion in the total number of images in the candidate image set is calculated as the application verification accuracy of the final model model-z.

[0123] Specifically, the final models corresponding to the different neural network models from Models 1 to 6 are tested for application using the alternative image sets, and the corresponding application verification accuracy, and the application verification correctness obtained when selecting the first 250 images or the first 750 images are shown in Table 3.

[0124] Table 3 Robustness verification of different trained neural network models

[0125]

[0126] The test error analysis is to calculate the preprocessing distortion and the embedded distortion, and then fuse them to obtain the final distortion, and then sort them according to the size, and select the image with the smaller final distortion for test error analysis, specifically:

[0127] The preprocessing distortion is calculated as: Where m = 1, 2, ... 5000;

[0128] The embedding distortion of each image in the candidate test image set is calculated when the embedding rate is a certain value, that is,

[0129] Fuse the preprocessed distortion and embedded distortion of each image to obtain the final distortion of each image Where m = 1, 2, ... 5000;

[0130] The final distortions of all images {D1, D2, ..., D n After sorting in ascending order, we get Where f(k j )=1,2……5000, the corresponding image is the image at the f(k j ) position image, f(k j ) represents the sequence number of the corresponding image in the candidate test image set;

[0131] In the image set arranged in ascending order, several images that need to be steganographic are selected from small to large according to the rules.

[0132] In this specific implementation, two kinds of test error analysis are performed on the selected images to be steganographic. One is to calculate the embedding distortion under five embedding rates (0.1, 0.2, 0.3, 0.4 and 0.5 respectively) and obtain the corresponding final distortion. After selecting 500 steganographic images, the selected images are subjected to test error analysis using a steganalyzer. The other is to use a steganalyzer to perform test error analysis on the selected images when the embedding rate is 0.1 and the number of selected steganographic images is the first 250, 500, 750, 1000, or 1250 images.

[0133] At the same time, the same three commonly used methods (SUNI-random, SUNI-[secure] and SUNI-[joint]) were used to select the alternative test image sets for image steganography, and the embedding rates were configured as 0.1, 0.2, 0.3, 0.4 and 0.5 respectively. 500 images were selected according to the rules of the corresponding methods, and the steganalyzer was used to analyze the test errors; and when the embedding rate was 0.1, 250, 500, 750, 1000 and 1250 images were selected according to the rules of the corresponding methods, and the steganalyzer was used to analyze the test errors.

[0134] After comparison, we found that:

[0135] like Fig. 9 As shown in Figure 2, under the same embedding rate, the security of the other three methods gradually decreases with the increase of the embedding rate, while the method of the present invention has a P value of 0.01 when the embedding rate is not greater than 0.5. E It is always above the other three methods, indicating a higher security of the steganographic system.

[0136] Fig.10In order to change the number of images selected according to the rules of different methods when the embedding rate is 0.1, under the method of the present invention, as the number of images increases, P E The decline is the slowest, indicating that when the method proposed in the present invention is used to select images for steganalysis embedding, the security of the steganography system is more affected by the change of the embedding rate than by the change of the number of selected images, and the method proposed in the present invention is more secure when the embedding rate is 0.1.

[0137] In summary, after the alternative test image set is subjected to the analysis of the final distortion of the carrier by the method of the present invention, and the steganographic carrier is selected, it has excellent selection accuracy and security for images that use the same preprocessing method as the preprocessing method selected in the training process of the neural network model, and it also has excellent accuracy and security for images obtained by a method different from the preprocessing method (filtering processing).

[0138] It should be noted that the basic processing described in this specific embodiment is a processing method in which the grayscale of the image remains unchanged after processing, including but not limited to the three methods introduced above. The preprocessing is a processing method in which the grayscale of the image changes after processing, and a total of seven methods are introduced above. Other processing methods are also applicable to the present invention.

[0139] It should be noted that the images in the second original image set can undergo one basic processing or several basic processing. In this specific implementation, three basic processing methods are undergone in order to train the neural network model more accurately and avoid distortion and misjudgment caused by basic operations such as rotating several angles.

[0140] It should be noted that the images in the preprocessed image set may be images that have undergone one or several preprocessing methods. In this specific implementation, four preprocessing methods are used in the training process of the neural network model, and in the subsequent test error analysis process, more preprocessing methods are tested compared to the preprocessing methods involved in the training process. The test results show that the trained neural network system has a relatively complete analysis and calculation capability of preprocessed images, which is not only applicable to images processed by the preprocessing methods in the training process, but also to images processed by other preprocessing methods, and has universal applicability.

[0141] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is limited by the attached embodiments and their equivalents.

Claims

1. A training method for a neural network model for preprocessing distortion calculation, characterized in that: The following steps are involved: S21, determining a training set, wherein the training set includes original images and pre-processed images; S22, setting a learning rate of the neural network model to be trained, inputting each image in the training set into the neural network model to be trained, obtaining a model output after being processed by the corresponding neural network model, performing optimization calculation on the model output to obtain a training label of each carrier in the current training round, and then optimizing the parameters of the corresponding neural network model through a loss function back propagation method to obtain a neural network model after the corresponding training round; S23. Use the neural network model after the corresponding training rounds in step S22 as the neural network model to be trained, repeat step S22 for several cycles, and obtain a trained neural network model.

2. The training method of the neural network model for preprocessing distortion calculation according to claim 1, characterized in that: When step S22 is completed, after the neural network model completes the corresponding round of training, the test set is input into the neural network model that has completed the corresponding round of training to perform a training accuracy test. When the training accuracy has a relatively optimal value, the trained neural network model is obtained, and the relatively optimal value has any of the following technical features: A. Preset the total number of training rounds. After the training of the preset total number of training rounds is completed, the neural network model obtained in each round of training is tested for training accuracy. The training accuracy values ​​obtained in each round are compared, and the highest training accuracy is selected as the relative optimal value. The corresponding number of training rounds is the optimal number of training rounds. B. During the training process, the total number of training rounds is not set, and the neural network model obtained in each round of training is tested for training accuracy. When the training accuracy of one round reaches more than 95% and the accuracy of the subsequent four rounds of training does not improve, the training is terminated. At this time, the highest training accuracy is the relative optimal value, and the corresponding number of training rounds is the optimal number of training rounds.

3. According to the training method of the neural network model for preprocessing distortion calculation according to claim 1, when step S23 is completed, the verification set is input into the trained neural network model for verification testing.

4. The training method of a neural network model for preprocessing distortion calculation according to claim 1, characterized in that: As the number of training rounds increases, the learning rate gradually decreases.

5. According to the training method of the neural network model for preprocessing distortion calculation described in claim 1, the original image set includes several original images and several images that have undergone basic processing, and the basic processing is a processing method in which the grayscale of the processed images remains unchanged; the preprocessed image set is a plurality of preprocessed images, and the preprocessing is a processing method in which the grayscale of the processed images changes.

6. According to the training method of the neural network model for preprocessing distortion calculation according to claim 1, each image in the training set is divided into several training image groups, and the training is performed in sequence.

7. According to the training method of the neural network model for preprocessing distortion calculation according to claim 6, the training graph group is divided into several training groups, and the training is carried out in sequence.

8. A method for selecting a steganographic carrier that circumvents preprocessing, characterized in that: The method for selecting a steganographic carrier to circumvent preprocessing is based on a neural network model trained by the training method for a neural network model for preprocessing distortion calculation according to any one of claims 1 to 7, and comprises the following steps: S11, calculating the preprocessing distortion and embedding distortion of each carrier to be analyzed; S12, fusing the preprocessing distortion and the embedding distortion to obtain a final distortion of each carrier; S13, after arranging in order according to the final distortion, a carrier sequence with an arrangement rule is obtained, and a steganographic carrier is selected for the carrier sequence in the order of the final distortion value from small to large.

9. The method for selecting a steganographic carrier for circumventing preprocessing according to claim 8, characterized in that: The preprocessing distortion is obtained by inputting each of the carriers to be analyzed into the trained neural network model and performing analytical calculations.

10. The method for selecting a steganographic carrier for circumventing preprocessing according to claim 9, characterized in that: The pre-processing distortion is more than 10 times the embedding distortion.

Images