DESIGNING STEGANOGRAPHIC DISTORTION USING DIRECTIONAL FILTERS. Vojtěch Holub and Jessica Fridrich

Transcription

1 DESIGNING STEGANOGRAPHIC DISTORTION USING DIRECTIONAL FILTERS Vojtěch Holub an Jessica Fririch Department of ECE, SUNY Binghamton, NY, USA {vholub1, ABSTRACT This paper presents a new approach to efining aitive steganographic istortion in the spatial omain. The change in the output of irectional high-pass filters after changing one pixel is weighte an then aggregate using the reciprocal Höler norm to efine the iniviual pixel costs. In contrast to other aaptive embeing schemes, the aggregation rule is esigne to force the embeing changes to highly texture or noisy regions an to avoi clean eges. Consequently, the new embeing scheme appears markely more resistant to steganalysis using rich moels. The actual embeing algorithm is realize using synrome-trellis coes to minimize the expecte istortion for a given payloa. 1. INTRODUCTION Designing steganographic algorithms for empirical cover sources, such as igital images, is very challenging ue to the funamental lack of accurate moels. The most successful approach toay avois estimating the cover source istribution because this task is infeasible for complex an highly non stationary sources. Instea, the steganography problem is formulate as source coing with fielity constraint [2] the sener embes her message while minimizing an appropriately efine istortion. Practical algorithms that embe near the theoretical payloa istortion boun are available for a very general class of istortion functions [4, 2]. Within this framework, the only task left to the sener is essentially the esign of the istortion function. In an attempt to relate istortion with statistical etectability, the authors of [3] parametrize the istortion function an then searche for such values of the parameters that gave the smallest etectability evaluate as a margin between classes within a selecte feature space (cover moel). However, unless the cover moel is a complete statistical escriptor of the The work on this paper was supporte by Air Force Office of Scientific Research uner the research grant number FA The U.S. Government is authorize to reprouce an istribute reprints for Governmental purposes notwithstaning any copyright notation there on. The views an conclusions containe herein are those of the authors an shoul not be interprete as necessarily representing the official policies, either expresse or implie of AFOSR or the U.S. Government. The authors woul like to thank Jan Koovský for useful iscussions. empirical source [1], such optimize schemes may, paraoxically, en up being more etectable if the Waren esigns the etector outsie of the moel [11], which brings us back to the main an rather ifficult problem moeling the source. All of toay s most secure steganographic schemes for igital images use heuristically efine istortion functions that constrain the embeing changes to those parts of the image that are ifficult to moel (e.g., complex textures or noisy areas). In the JPEG omain, by far the most successful approach is built aroun istortion functions that measure istortion w.r.t. the raw, uncompresse image [9, 15, 16]. A natural way to efine the istortion function in the spatial omain is to assign pixel costs by measuring the impact of changing each pixel in a feature (moel) space using a weighte norm. Making the weights epenent on the pixel s local neighborhoo introuces esirable content aaptivity. An example of this approach is the embeing algorithm HUGO [14], which employs the SPAM feature moel. To the best knowlege of the authors, an base on the recent steganalysis stuy [6], HUGO is currently the most secure algorithm for embeing in the spatial omain even though its secure payloa has been substantially lowere by moern attacks initiate uring the BOSS competition [5] that employ high-imensional rich moels. In this paper, we approach the task of builing istortion functions in the spatial omain using a ifferent strategy. Instea of using a weighte norm in some steganalytic moel to compute the pixel costs, we employ a bank of irectional high-pass filters to obtain the so-calle irectional resiuals, which are relate to the preictability of the pixel in a certain irection. By measuring the impact of embeing on every irectional resiual an by suitably aggregating these impacts, we force the embeing cost to be high where the content is preictable in at least one irection (smooth areas an along eges) an low where the content is unpreictable in every irection (e.g., in texture or noisy areas). The resulting algorithm thus becomes highly aaptive an better resists steganalysis using rich moels. After introucing basic notation in Section 2, we list three steganographic methos with which new schemes will be compare using an empirical measure of security. In Section 3, we escribe the istortion function, incluing the filter banks for computing the irectional resiuals an the

2 aggregation rule. The purpose of the exploratory analysis of Section 4 is to assess the effect of various esign elements on security an select the setting that provies the highest empirical security. In Section 5, we subject the new scheme to steganalysis in the wavelet omain where the embeing costs are compute. The paper is conclue in Section PRELIMINARIES Capital an lower-case bolface symbols stan for matrices an vectors, respectively. The symbols X = (X ij ),Y = (Y ij ) {,...,255} n1 n2 will always be use an 8-bit grayscale cover (an the corresponing stego) image withn 1 n 2 pixels. For matrix X, X T is its transpose, X is X rotate by 18 egrees, an X is the matrix of absolute values Empirical security All experiments are conucte on BOSSbase ver. 1. [5] with 1 images. The steganographic security is evaluate empirically using binary classifiers traine on a given cover source an its stego version embee with a fixe payloa. With the exception of Section 5, we use the Spatial Rich Moel (SRM) [6] consisting of 16 symmetrize submoels with a total imension of 34, 671. All classifiers were implemente using the ensemble [12] with Fisher linear iscriminants as base learners. Security is quantifie using the ensemble s out-of-bag (OOB) error E OOB, which is an unbiase estimate of the testing error average over multiple bootstrap samples of the image source uring training [12] Steganography methos We compare the propose methos with HUGO, the Ege Aaptive (EA) algorithm [13], an Least Significant Bit Matching (LSBM). We use the embeing simulator [5] for HUGO operating at the theoretical payloa istortion boun with efault settings γ = 1, σ = 1, an the switch --T with T = 255 to remove the weakness reporte in [11]. LSBM was simulate at the ternary entropy boun. The coe for the EA algorithm with its custom coing scheme was obtaine from the authors. 3. DISTORTION FUNCTION DESIGN We restrict our esign to aitive istortion in the form: n 1 n 2 D(X,Y) = ρ ij (X,Y ij ) X ij Y ij, (1) i=1 j=1 where ρ ij are the costs of changing pixel X ij to Y ij. The aitivity means that we o not consier the effects of iniviual embeing changes influencing each other. We opte KB K (1) = Sobel K (1) =, K (2) = (K (1) ) T WDFB-H WDFB-D h = Haar wavelet ecomp. low-pass g = Haar wavelet ecomp. high-pass h = Daubechies 8 wavelet ecomp. low-pass g = Daubechies 8 wavelet ecomp. high-pass K (1) = h g T, K (2) = g h T, K (3) = g g T Table 1. Filter banks use in this paper. for this mainly to simplify the esign. Since the embeing algorithm will be force to concentrate the embeing moifications into highly texture/noisy areas, using the Gibbs construction [2] with non-aitive istortion functions may have an aitional beneficial impact on security. The authors contemplate investigating this irection as part of future research. Having efine the pixel costsρ ij, embeing a (pseuo) ranom sequence of bits with minimal expecte istortion (1) is equivalent to source coing with a fielity criterion. A practical algorithm, base on Synrome-Trellis Coes (STCs), that embes near the payloa istortion boun was propose in [4]. It works in the ual omain to better cover the range of small payloas typically neee for steganography. The STC Toolbox, which we also use in this paper to implement all our schemes, can be ownloae from Directional Filters As alreay reporte by its authors, the istortion function of HUGO concentrates the embeing changes primarily in textures an eges. However, the content along an ege can usually be well moele using locally polynomial moels, which ais the etection [7, 6, 8]. Thus, whenever possible the embeing algorithm shoul embe into texture/noisy areas that are not easily moellable in any irection. To this en, we evaluate the smoothness in multiple irections using a filter bankb n = {K (1),...,K (n) } consisting ofnmultiple irectional high-pass filters represente by their kernels normalize so that alll 2 -norms K (k) 2 are the same. Thek-th resiualr (k),k = 1,...,n, is compute asr (k) = K (k) X, where is a convolution mirror-pae so that R (k) has

3 againn 1 n 2 elements. (The mirror-paing prevents introucing embeing artifacts at image bounary.) If the resiual values R (k) ij are large for some ij an for all k, it means that the local content at pixel x ij is not smooth in any irection an thus ifficult to moel. Since we want to etect eges in all irections, it is natural to use establishe ege etectors for the filter banks (see Table 1). The non-irectional KB filter [1] is often use in steganalysis, while the Sobel operator is a common ege etector. Wavelet-base Directional Filter Banks WDFB-H an WDFB-D use the Haar an Daubechies 8-tap wavelets. The computation of the resiual coincies with the first-level wavelet ecomposition with no ecimation. The wavelet banks consist of three filters, K (1),K (2),K (3), using which the LH, HL, an HH irectional resiuals are obtaine. Given the wavelet s 1-D low-pass ecomposition filter h an a highpass ecomposition filter g, the 2-D irectional filters are compute as shown in Table Aggregating embeing suitability The embeing shoul prefer changing large values of irectional resiuals, where the textures an eges are, an preserve the small values, where the content is preictable. One way to achieve this is to weigh the ifference between R (k) an the same resiual after changing only one pixel atij (enoter (k) [ij] ) by the wavelet coefficient itself: ξ (k) ij = R (k) R (k) R (k) [ij] (a) = R (k) K (k). (2) The quantity ξ (k) ij, which we call embeing suitability, is formally a correlation between the absolute value of the cover resiual with the absolute value of the resiual change. Since R (k) R (k) [ij] is the spatially shifte irectional filter K(k), ξ (k) ij can be compute for all pixels at once (equality(a)). Next, we compute the embeing costs ρ ij by aggregating all suitabilities ξ (k) ij, k = 1,...,n. Since we wish to restrict the embeing changes to those pixels with complex content in every irection, the aggregation rule ρ : R n R +, ρ ij = ρ(ξ (1) ij,...,ξ(n) ij ) is require to have the following properties: A1. The larger the values of ξ (k) ij, the smaller the ρ ij shoul be. A2. If there exists k {1,...,n} such that ξ (k) ij =, then ρ ij = +. A simple function that meets both requirements is the reciprocal Höler norm with p < : ρ (p) ij = ( n k=1 ) 1 p ξ (k) ij p. (3) SRM EOOB p Fig. 1. E OOB as a function of the Höler-norm parameter p when embeing at bpp with the WDFB. SRM EOOB.5 Payloa (bpp) HUGO KB Sobel WDFB-H WDFB-D Fig. 2. Evaluating the security of several ifferent filter banks using the OOB estimate of the testing error,e OOB. We restrict the embeing changes to±1, X ij Y ij = 1. Note that ue to the absolute value in (2), both changes result in the same embeing cost, which allows us to use the more powerful multi-layere version of STCs [4] also available in the STC Toolbox (see Section 4.4 for a iscussion of how ifferent coing schemes affect the security). 4. EXPERIMENTS In this section, we first assess how various esign parameters, such as p, the filter bank, an coing, affect security. Then, the most secure setting is ientifie an compare with HUGO, EA, an LSBM Aggregation rule To obtain an insight as to which value of p shoul be use in the aggregation rule (3), in Fig. 1 we plot E OOB (p) for the WDFB when embeing the payloa of bpp (bits per pixel). While for p < the security appears almost constant, for p > the requirement A2 is longer vali the costs at

4 smooth eges ecrease, which lowers the security. A similar epenence of security on p was observe for other filter banks. Thus, for concreteness an simplicity, we fix the value of the parameterp top = Assessing filter banks Fig. 2 shows the OOB error estimate for filter banks liste in Table 1. Among them, the WDFB-D achieves the best steganographic security. We call this embeing algorithm WOW (Wavelet Obtaine Weights). All the other filters achieve comparable security with HUGO, even the WDFB-H with support of size only2 2. Encourage with the success of the Daubechies 8-tap wavelet-base filter bank, we experimente with several other wavelet bases, incluing the Biorthogonal 44 wavelets, only to achieve very similar results in terms of the E OOB. SRM EOOB.5 Payloa (bpp) WOW ternary sim. WOW ternary STC WOW binary sim. WOW binary STC HUGO sim Comparison to prior art Fig. 3 shows the comparison between WOW an three other algorithms using the SRM moel (left) an a moel constructe using epenencies in the wavelet omain (see Section 5 for more etails). The improvement over HUGO is especially apparent for large payloas at bpp, thee OOB of WOW is almost twice as high as that of HUGO. Fig. 4. OOB error estimate of the testing error, E OOB, for WOW implemente using binary an ternary STCs versus simulate optimal embeing. Note the large gain of ternary STCs versus their binary version. Also note that the coing loss is quite small The effect of coing As alreay mentione in Section 3.2, since the costs (3) o not epen on the irection of the embeing change, WOW can use the ternary multi-layere version of STCs. Fig. 4 shows that the gain of using the ternary STCs over their binary version is quite significant. At the same time, the coing loss of STCs w.r.t. optimal embeing operating at the payloa istortion boun is rather small. The last comment above might suggest that HUGO might be improve using ternary embeing instea of binary. However, since HUGO embes only in the irection of smaller istortion an allows interaction among moifications, it is not clear how to implement ternary embeing an what the security impact woul be WOW aaptivity In Fig. 5, we contrast the placement of embeing changes for HUGO an for WOW. The selecte cover image has numerous horizontal an vertical eges an also some texture areas. While HUGO embes with high probability into the pillar eges as well as the horizontal lines above the pillars, WOW embes solely into the texture areas as ictate by the aggregation rule (3)..6 Fig. 5. Embeing probability for payloa bpp using HUGO (bottom left) an WOW (bottom right) for a grayscale cover image (top).

5 SRM EOOB.5 Payloa (bpp) WOW HUGO EA LSBM IaB EOOB WOW HUGO EA LSBM.5 Payloa (bpp) Fig. 3. Comparing statistical etectability of WOW an three state-of-the-art embeing algorithms using the SRM (left) an wavelet-omain epenencies (right). 5. STEGANALYSIS IN WAVELET DOMAIN The most successful steganalysis attacks have always been built in the embeing omain. Although WOW embes in the spatial omain, which is well covere by the SRM, the costs are compute in a transform omain. The goal of this section is to investigate whether WOW can be attacke in the wavelet omain by forming features that capture epenencies among wavelet coefficients. Inspire by how steganalysis features are built in the JPEG omain, we explore the following four logical possibilities graphically shown in Fig. 6: 4-D co-occurrence matrices built from four consecutive wavelet coefficients exploiting epenencies a) intra ban (IaB), b) inter level, c) a mix of intra level an inter level, an ) intra level, inter ban. The IaB features are similar in spirit to the SRM provie the wavelet coefficients are interprete as noise resiuals. Since the IaB features were much more successful in etecting WOW when compare to the other three possibilities b) ), we only provie etaile iscussion for case a). The coefficients were compute using the stanar unecimate iscrete wavelet ecomposition with the Daubechies 8 wavelet (to steganalyze in the omain where WOW computes its costs). Let S (l,s) = {c (l,s) ij }, l {1,2,3}, s {LH,HL,HH}, be the unecimate sth subban in the lth level of the wavelet transform. Assuming that n 1 = 2 k1, n 2 = 2 k2 for some k 1,k 2 Z, the range of subscripts for c (l,s) ij is i = {1,...,2 k1 l+1 } anj = {1,...,2 k2 l+1 }. The steganalytic features are four-imensional co-occurrence matrices forme by groups of four horizontally an vertically ajacent coefficients after truncation an quantization to a ( ) finite ynamic range, c (l,s) ij roun trunc T (c (l,s) ij /q), where q is a quantization step an trunc T (x) = x for x [ T,T], trunc T (x) = T sign(x) otherwise. The horizontal co-occurrence matrix is enote as { C (h,l,s), = ( 1,..., 4 ) { T,...,T} 4, C (h,l,s) = 1,c (l,s) i,j+1 = 2,c (l,s) i,j+2 = 3,c (l,s) i,j+3 = 4 matrixc (v,l,s) (i,j) }, with the vertical c (l,s) ij = efine analogically. We built three co-occurrence matrices for each level l {1,2,3}. In Fig. 6a), enote by a triangle is the cooccurrence C (1,l) C (h,l,lh) + C (v,l,hl). The squares correspon to C (2,l) C (v,l,lh) + C (h,l,hl), while the circles markc (3,l) C (h,l,hh) +C (v,l,hh). In this paper, we use T = 2, which gave each cooccurrence matrix C (i,l) the imensionality of (2T + 1) 4 = 625. Since i {1,2,3} an l {1,2,3}, the total number of co-occurrence matrices is 9, giving the final feature vector a imensionality of = 5,625. A brief stuy on the effect of the quantization step q [,5] on E OOB showe that the best performance was usually obtaine for q 1. Thus, in all our experiments, we setq = 1. Fig. 3 (right) shows the results of steganalysis using the IaB features. WOW still achieves better security than any other teste metho. The overall etection performance of the IaB features is, however, inferior to the SRM (left). 6. CONCLUSION This paper confirms what has been suspecte before restricting the embeing changes to textures while avoiing clean

6 a) b) c) ) Fig. 6. Four types of groups of wavelet coefficients from which 4-D co-occurrence matrices were built to steganalyze WOW. eges greatly improves steganographic security. This high level of aaptivity was achieve through a novel esign of the steganographic istortion function. First, a irectional filter bank is use to etect eges in local neighborhoos of each pixel. Then the changes in the resiuals cause by embeing are weighte an aggregate using a special rule esigne to output a low embeing cost only when the local content is not smooth in any irection. Accoring to our experiments, 2-D wavelet ecomposition filters provie the highest level of steganographic security measure empirically for a given image source (atabase) an classifiers operating in high-imensional feature spaces (rich image moels). The propose algorithm, WOW, outperforms the current state-of-the-art HUGO by a significant margin especially for large payloas. Further potential improvement is possible by employing better irectional filter banks an by using non-aitive istortion to moel interaction of embeing changes. 7. REFERENCES [1] R. Böhme. Improve Statistical Steganalysis Using Moels of Heterogeneous Cover Signals. PhD thesis, Faculty of Comp. Sci., TU Dresen, Germany, 28. [2] T. Filler an J. Fririch. Gibbs construction in steganography. IEEE TIFS, 5(4):75 72, 21. [3] T. Filler an J. Fririch. Design of aaptive steganographic schemes for igital images. In Proc. SPIE, Elec. Img., Meia Watermarking, Sec. an Forensics of Multimeia XIII, volume 788, pages OF 1 14, 211. [4] T. Filler, J. Juas, an J. Fririch. Minimizing aitive istortion in steganography using synrome-trellis coes. IEEE TIFS, 6(3):92 935, September 211. [5] T. Filler, T. Pevný, an P. Bas. BOSS (Break Our Steganography System). July 21. [6] J. Fririch an J. Koovský. Rich moels for steganalysis of igital images. IEEE TIFS, 7(3): , 211. [7] J. Fririch, J. Koovský, M. Goljan, an V. Holub. Steganalysis of content-aaptive steganography in spatial omain. In Information Hiing, 13th Int. Conf., volume 6958 of Springer LNCS, pages , 211. [8] G. Gül an F. Kurugollu. A new methoology in steganalysis : Breaking highly unetactable steganograpy (HUGO). In Information Hiing, 13th Int. Conf., volume 6958 of Springer LNCS, pages 71 84, 211. [9] Y. Kim, Z. Duric, an D. Richars. Moifie matrix encoing technique for minimal istortion steganography. In Information Hiing, 8th Int. Workshop, volume 4437 of Springer LNCS, pages , 26. [1] J. Koovský an J. Fririch. On completeness of feature spaces in blin steganalysis. In Proc. of the 1th ACM MM&Sec Workshop, pages , 28. [11] J. Koovský, J. Fririch, an V. Holub. On angers of overtraining steganography to incomplete cover moel. In Proc. of the 13th ACM MM&Sec Workshop, pages 69 76, 211. [12] J. Koovský, J. Fririch, an V. Holub. Ensemble classifiers for steganalysis of igital meia. IEEE TIFS, 7(2): , 212. [13] W. Luo, F. Huang, an J. Huang. Ege aaptive image steganography base on LSB matching revisite. IEEE TIFS, 5(2):21 214, June 21. [14] T. Pevný, T. Filler, an P. Bas. Using high-imensional image moels to perform highly unetectable steganography. In Information Hiing, 12th Int. Conf., volume 6387 of Springer LNCS, pages , 21. [15] V. Sachnev, H. J. Kim, an R. Zhang. Less etectable JPEG steganography metho base on heuristic optimization an BCH synrome coing. In Proc. of the 11th ACM MM&Sec Workshop, pages , 29. [16] C. Wang an J. Ni. An efficient JPEG steganographic scheme base on the block entropy of DCT coefficents. In Proc. of IEEE ICASSP, Kyoto, Japan, 212.