JPEG image confrontation steganography method based on UT-GAN model

Abstract

The invention discloses a JPEG image confrontation steganography method based on a UT-GAN model, and the method comprises the following steps: S1, preprocessing a carrier image C through a UT-GAN network, and generating a confrontation steganography image S; s2, establishing a gradient calculator and a linear mapper, performing gradient adjustment on the confrontation steganography image S and the carrier image C generated in the S1 again, and further generating a confrontation gradient matrix G; s3, dynamically adjusting the adversarial gradient matrix G to obtain a cost matrix P; s4, obtaining K adversarial steganography images L in the cost matrix P; and S5, selecting the optimal confrontation steganography image Z from the K confrontation steganography images L. The method has the beneficial effects that the dependence on a data set is avoided, and the steganography performance is improved.

Description

Technical Field

[0001] The present invention relates to the field of image steganography technology, in particular to adversarial steganography technology and adversarial networks in deep learning, and in particular to a JPEG image adversarial steganography method based on a UT-GAN model. Background Art

[0002] Image steganography aims to hide secret information in digital images in an imperceptible way. Recently, most of the steganographic methods are designed under the distortion minimization framework. Under this framework, the design of embedding cost is a key aspect. Embedding cost refers to the degree of distortion or damage caused by hiding secret information within the embedding unit (such as pixel or DCT coefficient) of the image. Generally, regions with complex image textures exhibit relatively high embedding costs, while regions with simple and flat textures have lower embedding costs. These different embedding costs can significantly affect the security performance of image steganography. Once the embedding cost is defined, the synthetic lattice code (STC) is then used to embed the secret message and minimize the sum of the embedding costs. Inspired by the fast gradient sign method, some adversarial attack based methods try to adjust the original embedding cost according to the gradient obtained by some pre-trained CNN steganalyzer, generally based on deep learning to calculate the adversarial gradient. Note that the aforementioned adversarial attack based methods can be considered as improved strategies because they rely on existing steganographic methods to calculate the initial embedding cost and pre-trained CNN based steganalyzer.

[0003] For example, ASDL-GAN is the first method to introduce the GAN model into image steganography to generate embedding probabilities. However, the steganographic performance of ASDL-GAN is not as good as that of the traditional HILL. UT-GAN improves the generator, embedding simulator and discriminator of ASDL-GAN on the basis of ASDL-GAN, surpassing the performance of traditional steganographic methods; however, the above methods are all data-driven end-to-end, and the defect is that they are highly dependent on the data set. Summary of the invention

[0004] The present invention aims to solve at least one of the technical problems existing in the prior art; to this end, the present invention proposes a JPEG image anti-steganography method based on the UT-GAN model, which is used to solve the technical problems that the prior art is more dependent on the data set and the existing image steganography method has weak anti-steganalysis performance.

[0005] To achieve the above object, the present invention provides a JPEG image anti-steganography method based on the UT-GAN model, comprising the following steps: S1: Preprocess the carrier image C through the UT-GAN network to generate the adversarial steganographic image S; S2: Establish a gradient calculator and a linear mapper to re-adjust the gradients of the adversarial stego-image S and the carrier image C generated in S1, and further generate an adversarial gradient matrix G; S3: Dynamically adjust the adversarial gradient matrix G to obtain the cost matrix P; S4: Obtain K adversarial steganographic images L in the cost matrix P; S5: Select the optimal adversarial stego image Z from the K adversarial stego images L.

[0006] Further: S1 specifically includes the following steps: S1-1: The U-Net-based generator converts the carrier image C into an embedding change probability map; S1-2: Based on the change probability graph and the random matrix N, the modified graph M is calculated using the hyperbolic tangent function; The value range of the random matrix N is between 0 and 1; S1-3: Add the carrier image C and its corresponding modified image M to generate a dense adversarial image S, specifically: S=C+M.

[0007] Further: in said S2, a gradient calculator is established, which specifically comprises the following steps: S2-1: Recover the spatial domain representation of the adversarial steganographic image S and the carrier image C through inverse discrete cosine transform IDCT; S2-2: re-perform non-fitting DCT transformation on the pixels in the spatial domain representation image to obtain DCT coefficients without compression distortion; S2-3: Perform residual filtering on the DCT coefficients, separate the steganographic noise from the natural image content through the combined operation of DCTR operation and NN-DCTR operation, and generate a DCT matrix; S2-4: Phase splitting is used to refine the directionality of the DCT matrix, and the DCT matrix is ​​split into several sub-matrices; S2-5: The statistical submatrix calculates the distribution characteristics of the histogram features, and uses the Gaussian histogram to capture the distribution shift caused by steganography to generate the objective function. The objective function guides the generator of UT-GAN to adjust the steganography strategy and establish a gradient calculator.

[0008] Furthermore: the echelon calculator performs reverse operations on the loss function J of the carrier image C to generate an adversarial gradient matrix G.

[0009] Further: S3 specifically includes the following steps: S3-1: Preprocess the carrier image C through the UT-GAN network to generate the same embedding probability matrix , where each element Indicates the probability of modifying the pixel value at the pixel value position (i, j) by ±1; S3-2: Since the probability is inversely proportional to the cost, the probability can be mapped to the cost through a negative logarithmic transformation, and the embedded probability matrix Map it into a nonlinear increasing cost function and modify the embedding probability direction to generate a dual-channel probability matrix, and then calculate the cost matrix P.

[0010] Further: The specific method of S4 is: Obtain the adversarial steganographic image L from the cost matrix P adjusted in S3 through the STC simulator; Determine the modification direction of each DCT coefficient through the interaction of random noise and cost; Get the modified mapping in the STC simulator; The Double-Tanh function is used as an embedding simulator to obtain all stages of the modified mapping during the training process and construct a step function; The step function, generator and Double-Tanh function are derived, and the cost matrix P is continuously and dynamically adjusted. After K iterations, the optimal solution is approached. In this iterative process, K adversarial steganographic images L are generated.

[0011] Furthermore: the random noise is a random number uniformly distributed between 0 and 1.

[0012] Further: in S5, the optimal adversarial stegographic image Z is defined as the image with the smallest distance to the carrier image C in the steganalysis space; the distance is measured in the NN-DCTR space; the selection process is standardized as follows: ; Among them, d is the coverage-steganography distance calculation, and the feature analysis feature vector of the carrier image C is recorded as , the feature analysis feature vector of the adversarial steganalysis image Z is recorded as ; The set of adversarial steganagrams generated for K adversarial steganagrams L.

[0013] The beneficial effects of the present invention are: (1) A non-data-driven adversarial embedding scheme is proposed; compared with previous adversarial steganography schemes, the adversarial steganography in this application combines feature-based steganography and deep learning-based adversarial steganography, which not only avoids dependence on datasets, but also improves the anti-steganography performance of adversarial steganographic images.

[0014] (2) The present application also proposes a novel gradient calculator, which replaces the deep learning-based steganalyzer (an algorithm for detecting hidden information in digital media) to calculate the adversarial gradient; unlike the traditional steganalyzer, the design of the gradient calculator refers to the DCTR steganalyzer, which acts as an approximate neural network for the steganalyzer feature extractor.

[0015] (3) Considering the trade-off between security and efficiency, in the implementation of the research solution, the UT-GAN adversarial network was first used to generate adversarial steganographic images. On this basis, the cost was continuously modified through the embedded simulator, and finally the optimal adversarial steganographic image was obtained. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of the present invention and the technical solutions in the prior art, the drawings required for use in the embodiments and the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some implementation methods recorded in the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 is a flow chart of the method of the present invention; Figure 2 is a flow chart of the operation of the gradient calculator of the present invention; Figure 3 The steganalysis space image provided by the present invention adopts the adversarial steganalysis network ADV-EMB to select the optimal image; Figure 4 A steganalysis space image provided by the present invention for selecting the optimal image using the method proposed by the present invention; Figure 5 A schematic diagram of the relationship between different steganographic algorithms and the coverage steganographic distance (d) at different adjustable rates (k) provided by the present invention. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical scheme and advantages of the present invention more clearly understood, the present invention is described and illustrated below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. Based on the embodiments provided by the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work belong to the scope of protection of the present invention.

[0019] Obviously, the drawings described below are only some examples or embodiments of the present invention. For ordinary technicians in this field, the present invention can be applied to other similar scenarios based on these drawings without any creative work.

[0020] In addition, it can be understood that although the efforts made in this development process may be complex and lengthy, for ordinary technicians in the field related to the contents disclosed in the present invention, some design, manufacturing or production changes based on the technical contents disclosed in the present invention are just conventional technical means and should not be understood as the contents disclosed in the present invention are insufficient.

[0021] If not otherwise specified, all embodiments and optional embodiments of the present invention can be combined with each other to form a new technical solution.

[0022] See also Figure 1 The method flow chart provided by the present invention has the following steps: S1: Preprocess the carrier image C through the UT-GAN network to generate the adversarial steganographic image S; S2: By establishing a gradient calculator and a linear mapper, the adversarial stego-image S and the carrier image C generated in S1 are re-adjusted in gradient to generate an adversarial gradient matrix G; S3: Dynamically adjust the adversarial gradient matrix G to obtain the cost matrix P; S4: further obtain K adversarial steganographic images L in the cost matrix P; S5: Select the optimal adversarial stego-image Z from the K adversarial stego-images L.

[0023] Specifically: S1-1: The U-Net-based generator converts the carrier image C into an embedding change probability map; S1-2: Based on the change probability graph and the random matrix N, the modified graph M is calculated using the hyperbolic tangent function; The value range of the random matrix N is between 0 and 1; S1-3: Add the carrier image C and its corresponding modified image M to generate a dense adversarial image S, specifically: S=C+M.

[0024] In S2, build the gradient calculator, see Figure 2 , the gradient calculator mainly includes 5 operations, which are as follows: S2-1: Restore the spatial domain representation of the adversarial steganographic image S and the carrier image C through the inverse discrete cosine transform IDCT. This step is similar to converting the DCT coefficient matrix C into the spatial domain matrix W in DCTR. Without considering DC bias and dequantization, the following formula is The discrete cosine transform block function of is: ; in, for The DCT coefficient matrix of the block Elements of for Block space matrix Elements of and All are parameters, and their values ​​are: , =0, ; ≠0, ≠0, ; Since the inverse discrete cosine transform is divided into blocks, each The blocks do not affect other blocks, so it is very suitable to design adversarial gradients; each block in the DCT coefficient matrix The gradient of the block is recorded as , where each element is recorded as ; The gradient of the same spatial matrix W can be recorded as , the elements can be recorded as ; According to the differential chain calculation rule, It can be obtained by the following formula: ; in, Indicates the sensitivity of the loss function to spatial or frequency domain variables. S2-2: Re-transform the pixels in the spatial domain representation image by non-fitting DCT to obtain DCT coefficients without compression distortion; This step is to calculate the non-fitting DCT based on the spatial matrix W, which is equivalent to filtering the residual through 64 DCT kernels. The size of the DCT kernel is ; The kernel corresponding to the position (u, v) in the DCT domain is denoted as , where the elements can be calculated by the following formula: ; In NN-DCTR, this operation can be implemented using the convolution operation in CNN; the convolution kernel is fixed at superior; S2-3: Perform residual filtering on the DCT coefficients, and separate the steganographic noise from the natural image content through the combined operation of DCTR operation and NN-DCTR operation; This step is similar to the corresponding operation in DCTR; In DCTR, this operation shortens the dynamic range of the residual to improve the efficiency of extracting the DCT matrix features contained in the histogram. The operation in DCTR is expressed as follows: ; in, is the rounding function; is the truncation function; is the quantization parameter, which depends on the JPEG quantization factor. The absolute value of the input value in the DCTR quantization operation; In NN-DCTR, the DCTR formula is replaced by the following formula, and T is fixed to 2: ; S2-4: Use phase splitting to refine the directionality of the DCT matrix and enhance feature differentiation; This step DCTR is the same as DCT operation; the DCT block size is , then an unmodified DCT matrix is ​​split into 64 sub-matrices; the unfitted DCT matrix corresponding to the frequency (k, l) is recorded as , the corresponding position of its submatrix (a, b) is recorded as , the following formula is the split function: ; S2-5: Statistical distribution characteristics of the residual after each phase split, Gaussian histogram captures the distribution shift caused by steganography to generate the objective function, the objective function guides the generator of UT-GAN to adjust the steganography strategy to establish a gradient calculator, and further calculate the Gaussian histogram; this step is an approximation of the histogram feature of the submatrix extracted in S2-4; since the operation of calculating the histogram is not differentiable, it cannot be directly applied to a fully differentiable structure; therefore, a differentiable alternative method called the Gaussian histogram layer is adopted; it is a component of the neural network structure, used to optimize the kernel of the semantically supported peer computing information retrieval model PSRM, which uses the accumulation of Gaussian functions to simulate the histogram box, the specific formula is as follows: ; ; ; Among them, g(d) represents the Gaussian histogram, Represents the number of elements in set C, which is used for normalization; is the element of the DCT coefficient matrix; d represents the center position of the Gaussian kernel, that is, the discrete center value of the histogram bin; D Represents the total number of bins of the Gaussian histogram, that is, the discrete or continuous value range covered by the histogram is divided into D intervals; is the Dirac function, which is equal to 1 at c; k represents the horizontal frequency index of the two-dimensional discrete cosine transform (DCT) coefficient; is the parameter that determines the shape of the Gaussian function; Represents L relative to the Gaussian histogram The gradient of a bin in the image; before calculating the histogram, the sub-matrices can be merged to avoid excessive calculations; an unsampled discrete cosine transform DCT can be divided into 64 sub-matrices, and these 64 sub-matrices can be merged into 25 matrices based on symmetry and the most preferred merging strategy. (1 unsampled DCT can be split into 64 sub-matrices, usually referring to an image being divided into 8×8 blocks (64 pixels), each block can be regarded as a sub-matrix and prepared for DCT transformation; directly calculating the Gaussian histogram for each sub-matrix will result in a huge amount of calculation because 64 independent histograms need to be processed. Based on symmetry merging; the merged sub-matrices can share some calculation steps, normalization and smoothing of the histogram, and the 25 here is the optimal value of the merged sub-matrix based on symmetry).

[0025] In S2, the linear mapper is specifically shown in the following formula: ; Among them, w and b are parameters determined by data, Z is the adversarial steganographic image, and the feature analysis feature vector of image Z is recorded as ;because ,so , ; The purpose of generating a linear mapper is to construct the adversarial gradient of the loss function J to obtain the original image; given the original image C and the corresponding stego image S, w, b can be expressed as follows: ; ; in, is the inner product operation.

[0026] The specific method of generating the adversarial gradient matrix G is: Define the loss function: For a neural network, its loss function is recorded as , specifically the steganalyzer The loss function is: S is the adversarial stego image; y is the target category of the adversarial stego image; the established gradient calculator is used to perform reverse calculations, and is: , represents the gradient of the loss function with respect to the pixels of the carrier image C, which is used to optimize the local sensitivity of the steganalytic modification.

[0027] For steganalyzers , the criterion for judging whether image S is an adversarial steganographic image is: ; Among them, Cover is the original image; Stego is the encrypted image.

[0028] In S3, the cost matrix P is dynamically adjusted according to the adversarial gradient matrix G, which specifically includes the following steps: S3-1: S3-1: Preprocess the carrier image C through the UT-GAN network to generate the same embedding probability matrix , where each element Indicates the probability of modifying the pixel value at the pixel value position (i, j) by ±1; S3-2: Since the probability is inversely proportional to the cost, the probability can be mapped to the cost through a negative logarithmic transformation, and the embedded probability Map it into a nonlinear increasing cost function and modify the embedding probability direction to generate a dual-channel probability matrix, and then calculate the cost matrix P. The dual-channel probability matrix is ​​as follows: ; in, The probability of increasing the pixel value by 1, is the probability of pixel value minus 1, Indicates that no modification is made at the pixel position (i, j), that is, the original value is maintained.

[0029] S4 To simulate message embedding, this step attempts to simulate STC, and further generates adversarial steganographic images from the cost adjusted in S3 through the STC simulator; to this end, first generate a random noise ,in for all i and j are independent and identically distributed (iid), and each element is drawn from a uniform distribution on the interval [0,1]; By comparing P and , modified mapping in STC simulator The definition is as follows: ; represents the modification simulated in the interval [-1, +1]; Since the above step function Non-differentiable, using Double-Tanh function as embedding simulator, and modifying the mapping during training All stages of the GAN; it replaces the discrete step function with a differentiable approximation, making the back-propagation process in the GAN generation adversarial network possible; Constructing a step function And the generator and Double-Tanh function are differentiated to simultaneously minimize the steganographic detection probability and visual distortion, and the parameters are updated iteratively through back-propagation, and the resulting cost matrix P is continuously and dynamically adjusted. In this process, new adversarial images will be generated. Through K times of parameter updates and image state iterations, the Pareto optimal solution (that is, the balance point with the lowest detection probability and the smallest distortion) is gradually approached, thereby generating K adversarial steganographic images L.

[0030] The Double-Tanh function is defined as follows: ; The parameter λ controls the accuracy of the simulation, and λ=60 is set. Finally, Double-Tanh is used to complete the message embedding.

[0031] In S5, Figure 3 and Figure 4 As shown, there are respectively a steganalysis space image of the optimal image selected by the adversarial steganography network ADV-EMB provided in an embodiment of the present invention and a steganalysis space image of the optimal image selected in this paper; Select the adversarial steganalysis image that meets the criteria as the optimal output. Usually, the criteria is to select the optimal image that can deceive the opponent and has the smallest adjustment cost. Figure 3 The selection operation in the adversarial steganalysis network ADV-EMB is demonstrated; from a geometric point of view, the steganalyzer is a hyperplane in the steganalysis space that divides the space into two parts corresponding to the cover and the steganography; in the space, the adversarial gradient G acts as a momentum close to C, perpendicular to the hyperplane; Z1, Z2, Z3 are candidates for the optimal stegographic image Z; according to the criterion, Z2 is selected; Z3 is located in the stegographic region (deceiving the adversary) and is close to the hyperplane (the adjustment cost is minimal); the criterion used in ADV-EMB requires a steganalyzer, so it relies on the knowledge of the dataset.

[0032] In contrast, the criterion of the algorithm used in this paper does not depend on the dataset; the criterion is that the best steganalyst image has the smallest distance to the cover image C in the steganalysis space; in the gradient calculator, the weights of the linear mapper are calculated using a single cover-stego pair (C, S); in fact, the linear mapper constructs a hyperplane in the middle of C and S; as Figure 4 As shown, the dotted line that divides the entire plane represents the hyperplane, which is located between C and S; G can be calculated with reference to the hyperplane.

[0033] Z1, Z2, and Z3 are candidates; according to this criterion, Z1 is chosen because it has the smallest distance from C; this criterion stems from the general idea that the smaller the distance between distributions, the higher the probability of the distribution.

[0034] The criteria for selecting the optimal adversarial stegographic image in the present invention are: the image with the smallest distance to the carrier image C in the steganalysis space represents the optimal stegographic image; In the steganalysis space, the distance between two samples can be measured by the norm; the concept of coverage-steganography distance is the distance between two samples reflected by the coverage-steganography operation; the coverage-steganography distance calculation is recorded as d; given an N-dimensional steganalysis feature set f, the coverage-steganography distance between the carrier image C and the adversarial steganalysis image S is calculated as follows: ; After K iterations to generate K adversarial steganographic images L, the generated adversarial steganographic image set is recorded as ; Then the best adversarial steganalysis image Z is selected from the K adversarial steganalysis images L; the optimal steganalysis image Z has the property of having the minimum coverage steganalysis distance to the carrier image C in the steganalysis feature space; this distance is measured in the NN-DCTR space; the selection process can be standardized as follows: ; Where d is the above formula The characteristic analysis feature vector of the carrier image C is recorded as , the feature analysis feature vector of the adversarial steganalysis image Z is recorded as .

[0035] A specific embodiment provided by the present invention: Detection performance analysis: NN-DCTR is a fully differentiable version of DCTR. The detection performance of NN-DCTR was tested and compared with DCTR. The experimental results are shown in Table 1.

[0036] Steganalyzer: is a tool or algorithm used to detect hidden information in images or other media; Steganography: steganography; For safety performance; It can be seen from Table 1 that when the traditional steganography selects the J-UNIWARD steganography algorithm and the UERWARD steganography algorithm, the total error rate of NN-DCTR (such as: the part corresponding to the J-UNIWARD steganography algorithm 48.7+46.1+41.6+38.7) is significantly greater than that of DCTR, and its detection performance is slightly reduced; however, in DCTR, rounding operations and histogram operations are not differentiable. Although the differential of NN-DCTR has errors compared with the original version, resulting in a loss of detection performance; despite the loss, considering that NN-DCTR has the ability to be differentiable in rounding operations and histogram operations, NN-DCTR is still an effective alternative to DCTR.

[0037] Optimal adversarial stego image selection: In SE (the steganography algorithm provided by the present invention), the selection of the optimal adversarial stego image is an important part of the scheme; as introduced in the present invention, the criterion selected by the present invention is the cover-stego distance d; the number of adjustable elements k is adjusted to generate multiple adversarial stego images; the stego image with the smallest d is selected as the optimal image; in this section, multiple adversarial stego images are generated with different adjustable rates k; and the cover-stego (the pair of original image and image after embedding secret information) distance d is visualized; the image marked as 1013 is selected as an example, the payload rate is fixed to 0.4 bpnzac, and there are 9 adjustable rates in each scheme, kÀ{0.1,0.2,…,0.9}.

[0038] like Figure 5 As shown in the figure: the comparison of the results of using the J-UINWAED and UERD steganography algorithms (named J-SE and U-SE respectively) and the steganography algorithm SE proposed in this paper; it can be seen that the coverage-steganography distance changes with the change of the adjustable rate; choosing the rate with the minimum coverage-steganography distance is optimal; different algorithms such as SE have a smaller minimum coverage-steganography distance than U-SE and J-SE, and the coverage-steganography distance under different ratios, SE has an average steganalysis distance smaller than J-SE and U-SE, and according to the smaller the coverage-steganography distance, the more "accurate" the generated adversarial gradient is; it is concluded that the adversarial gradient generated by the adversarial steganography algorithm proposed in this paper is more "accurate".

[0039] Non-adversarial steganalysis test: In this part of the test, the steganalyzer knows the structure of the steganalyzer, but the steganalyzer does not know the situation of the adversarial embedding operation, that is, the steganalyzer is a non-adversarial steganalyzer; this experiment uses DCTR steganalyzer, SRM steganalyzer and GFR steganalyzer as target steganalyzers, and the image set The SE algorithm is a method proposed by the present invention, which uses an embedding simulator to calculate the gradient to modify the embedding cost, thereby generating an adversarial steganographic image dataset. ; In order to compare the transferability of adversarial steganalyzer images, the experiment was also tested under non-adversarial steganalyzer test; The experiment was tested at embedding rates of 0.1 to 0.4; Here, the various items used are introduced as follows: Steganalyzer is a steganalyzer, which includes DCTR steganalyzer, SRM steganalyzer and GFR steganalyzer, and they are all trained by the carrier image C and the traditional steganalyzer image; ASDL-GAN: Automatic Steganalysis Distortion Learning Generative Adversarial Networks; UT-GAN: A steganography embedding framework based on Generative Adversarial Networks (GANs). Its main feature is the combination of U-Net generator and dual TAN function to optimize the embedding cost. SPAR-RL: An automatic image steganographic embedding framework based on deep reinforcement learning; It can be seen that although the security performance of each steganography algorithm in the non-adversarial steganalyzer decreases with the increase of the embedding rate, it can be clearly seen that in the DCTR steganalyzer, SRM steganalyzer and GFR steganalyzer, the SE method of the present application is adopted, and in the embedding rate change of 0.1-0.4, the accuracy corresponding to the embedding rate is stable in the top two of the accuracy corresponding to each embedding rate of all steganography methods. The specific analysis results are shown in Table 2 below:

[0040] Adversarial steganalysis test: In this part of the test, the steganalyzer knows the structure of the steganalyzer, and the steganalyzer knows the situation of the adversarial embedding operation, that is, the steganalyzer is an adversarial steganalyzer; this experiment uses CuNet steganalyzer, SRNet steganalyzer and CovNet steganalyzer as adversarial steganalyzers, which are trained by image sets; the embedding simulator is used to calculate the gradient to modify the embedding cost, thereby generating an adversarial steganalysis image dataset; the experiment was tested at embedding rates of 0.1 to 0.4 respectively; as shown in Table 3 below:

[0041] Steganalyzer is a steganalyzer, which includes CuNet steganalyzer, SRNet steganalyzer and CovNet steganalyzer, and they are all trained by carrier image C and traditional steganalyzer images. Steganography is a steganalysis algorithm. The experiment compares the traditional steganalysis algorithm J-UNIWARD and the GAN-based steganalysis method, as well as the adversarial sample-based steganalysis algorithm SE proposed in this paper.

[0042] It can be seen that although the security performance of each steganography algorithm in combating steganalyzers decreases with the increase of embedding rate, it can be clearly seen that in CuNet steganalyzer, SRNet steganalyzer and CovNet steganalyzer, using the invented method SE, the accuracy corresponding to the embedding rate is stable in the embedding rate change of 0.1-0.4 and is also in the top two among all steganography methods at various embedding rates. It is more stable while maintaining a high accuracy.

[0043] The above is a very detailed description of one or more embodiments of the present invention, but the content is only a specific example of the present invention and cannot be considered to limit the scope of application of the present invention. Any other methods and changes proposed based on the content of the present invention should fall within the scope of patent protection of the present invention.

Claims

1. A JPEG image adversarial steganography method based on the UT-GAN model, characterized in that: The steps include: S1: Preprocess the carrier image C through the UT-GAN network to generate the adversarial steganographic image S; S2: Establish a gradient calculator and a linear mapper to re-adjust the gradients of the adversarial stego-image S and the carrier image C generated in S1, and further generate an adversarial gradient matrix G; S3: Dynamically adjust the adversarial gradient matrix G to obtain the cost matrix P; S4: Obtain K adversarial steganographic images L in the cost matrix P; S5: Select the optimal adversarial stego-image Z from the K adversarial stego-images L.

2. The JPEG image anti-steganography method based on the UT-GAN model according to claim 1, characterized in that: The S1 specifically includes the following steps: S1-1: The U-Net-based generator converts the carrier image C into an embedding change probability map; S1-2: Based on the change probability graph and the random matrix N, the modified graph M is calculated using the hyperbolic tangent function; The value range of the random matrix N is between 0 and 1; S1-3: Add the carrier image C and its corresponding modified image M to generate a dense adversarial image S, specifically: S=C+M.

3. The JPEG image anti-steganography method based on the UT-GAN model according to claim 1, characterized in that: In S2, a gradient calculator is established, which specifically includes the following steps: S2-1: Recover the spatial domain representation of the adversarial steganographic image S and the carrier image C through inverse discrete cosine transform IDCT; S2-2: re-perform non-fitting DCT transformation on the pixels in the spatial domain representation image to obtain DCT coefficients without compression distortion; S2-3: Perform residual filtering on the DCT coefficients, separate the steganographic noise from the natural image content through the combined operation of DCTR operation and NN-DCTR operation, and generate a DCT matrix; S2-4: Phase splitting is used to refine the directionality of the DCT matrix, and the DCT matrix is ​​split into several sub-matrices; S2-5: The statistical submatrix calculates the distribution characteristics of the histogram features, and uses the Gaussian histogram to capture the distribution shift caused by steganography to generate the objective function. The objective function guides the generator of UT-GAN to adjust the steganography strategy and establish a gradient calculator.

4. The JPEG image anti-steganography method based on the UT-GAN model according to claim 1, characterized in that: In S2, The echelon calculator performs reverse operations on the loss function J of the carrier image C to generate the adversarial gradient matrix G.

5. The JPEG image anti-steganography method based on the UT-GAN model according to claim 1, characterized in that: The S3 specifically includes the following steps: S3-1: Preprocess the carrier image C through the UT-GAN network to generate the same embedding probability matrix , where each element Indicates the probability of modifying the pixel value at the pixel value position (i, j) by ±1; S3-2: Since the probability is inversely proportional to the cost, the probability can be mapped to the cost through a negative logarithmic transformation, and the embedded probability matrix Map it into a nonlinear increasing cost function and modify the embedding probability direction to generate a dual-channel probability matrix, and then calculate the cost matrix P.

6. The JPEG image anti-steganography method based on the UT-GAN model according to claim 1, characterized in that: The specific method of S4 is: Obtain the adversarial steganographic image L from the cost matrix P adjusted in S3 through the STC simulator; Determine the modification direction of each DCT coefficient through the interaction of random noise and cost; Get the modified mapping in the STC simulator; The Double-Tanh function is used as an embedding simulator to obtain all stages of the modified mapping during the training process and construct a step function; The step function, generator and Double-Tanh function are derived, and the cost matrix P is continuously and dynamically adjusted. After K iterations, the optimal solution is approached. In this iterative process, K adversarial steganographic images L are generated.

7. The JPEG image anti-steganography method based on the UT-GAN model according to claim 6, characterized in that: The random noise is a random number uniformly distributed between 0 and 1.

8. The JPEG image anti-steganography method based on the UT-GAN model according to claim 3 is characterized in that: In S2-5: Sub-matrices can also be merged, and the merging process is based on the symmetry of all matrices and the merging strategy adopted; Merging strategies include horizontal merging, vertical merging, and block merging.

9. The JPEG image anti-steganography method based on the UT-GAN model according to claim 1, characterized in that: In S5, the optimal adversarial stegographic image Z is defined as the image with the smallest distance to the carrier image C in the steganalysis space; the distance is measured in the NN-DCTR space; the selection process is standardized as follows: ； Among them, d is the coverage-steganography distance calculation, and the feature analysis feature vector of the carrier image C is recorded as , the feature analysis feature vector of the adversarial steganalysis image Z is recorded as ; The set of adversarial steganagrams generated for K adversarial steganagrams L.

Images