目的 图像信息隐藏包括图像隐写术和图像水印技术两个分支。隐写术是一种将秘密信息隐藏在载体中的技术，目的是为了实现隐秘通信，其主要评价指标是抵御隐写分析的能力。水印技术与隐写术原理类似，但其是通过把水印信息嵌入到载体中以达到保护知识产权的作用，追求的是防止水印被破坏而尽可能地提高水印信息的鲁棒性。研究者们试图利用生成对抗网络（generative adversarial networks，GANs）进行自动化的隐写算法以及鲁棒水印算法的设计，但所设计的算法在信息提取准确率、嵌入容量和隐写安全性或水印鲁棒性、水印图像质量等方面存在不足。方法 本文提出了基于生成对抗网络的新型端到端隐写模型（image information hiding-GAN，IIH-GAN）和鲁棒盲水印模型（image robust blind watermark-GAN，IRBW-GAN），分别用于图像隐写术和图像鲁棒盲水印。网络模型中使用了更有效的编码器和解码器结构SE-ResNet（squeeze and excitation ResNet），该模块根据通道之间的相互依赖性来自适应地重新校准通道方式的特征响应。结果 实验结果表明隐写模型IIH-GAN相对其他方法在性能方面具有较大改善，当已知训练好的隐写分析模型的内部参数时，将对抗样本加入到IIH-GAN的训练过程，最终可以使隐写分析模型的检测准确率从97.43%降低至49.29%。该隐写模型还可以在256×256像素的图像上做到高达1 bit/像素（bits-per-pixel）的相对嵌入容量；IRBW-GAN水印模型在提升水印嵌入容量的同时显著提升了水印图像质量以及水印提取正确率，在JEPG压缩的攻击下较对比方法提取准确率提高了约20%。结论 本文所提IIH-GAN和IRBW-GAN模型在图像隐写和图像水印领域分别实现了领先于对比模型的性能。

Objective Steganography is a technique that hides secret information in multimedia without arousing suspicion from the steganalyzer. In a typical case, the steganography system consists of three parts:Alice, Bob, and Eve. The sender Alice hides the secret message in the carrier image(cover), turns it into another image(stego) that does not change its appearance perception, and then sends the stego to the receiver Bob through a public channel. Then, Bob can recover the secret messages from the stego. Eve acts as the steganalyzer to monitor their communications and determine whether secret information is hidden in the stego. In general, image information hiding includes two branches, namely, image steganography and image watermarking. Steganography hides secret information in a carrier and achieves the purpose of secret communication via the transmission of stego images, and the main evaluation metric is security against steganalysis. The principle of watermarking technology is similar to that of steganography, the difference is that its purpose is to use the watermark information embedded in the carrier to protect intellectual property rights, and the metric of watermarking emphasizes robustness against various watermarking attack. Traditional steganography and watermarking algorithms depend on the artificial designed complex feature, which requires the designer's domain knowledge and accumulated experience. Recent work has shown that deep neural networks are highly sensitive to minute perturbations of input images, giving rise to adversarial examples. This property is usually considered a weakness of learned models but can be exploited to enhance the capability of information hiding. Researchers have tried to use generative adversarial networks (GANs) to design steganographic algorithms and robust watermarking algorithms automatically. However, due to the unreasonable design of the neural network structure and other reasons as well as the lacking consideration of several practical problems, state-of-the-art GAN-based information hiding methods have several weaknesses.1) In real-world applications, the pixel value of the decoded image should be a float, but the networks proposed by existing methods set it to an integer. 2) Image steganography based on GANs has insufficient anti-steganalysis ability. 3) Watermarking technology based on deep learning has limited consideration of the types of attacking noises.4) The design of differential noise layer is unreasonable. Thus, the existing GAN-based steganography or watermarking algorithms have deficiencies in information extraction accuracy, embedding capacity, steganography security or watermark robustness, and watermark image quality. Method The paper proposes a new end-to-end steganographic model driven by GANs called image information hiding-GAN (IIH-GAN)) and robust blind watermarking model named image robust blind watermark-GAN (IRBW-GAN) for image steganography and robust blind watermarking, respectively. SE-ResNet, a more efficient encoder and decoder structure, is included in the network model, which can optimize the interdependence between network channels and enhance the global feature automatic selection, leading to a more accurate, high-quality information embedding and extraction. The proposed IIH-GAN uses a discriminator to cotrain with the encoder-decoder; thus, it maintains the distribution of the carrier image during adversarial training unchanged and enhances the security in resisting steganalysis. To solve the problem of decoding real images in real-world scenarios, IIH-GAN adds a round layer between the encoder and the decoder. IIH-GAN adds the adversarial examples to the GAN-based steganographic model to remedy the shortcomings of GAN-based steganography in resisting the powerful state-of-the-art deep learning-based steganalysis algorithms. In the watermark model, IRBW-GAN adds a differentiable noise layer between the encoder and the decoder that resists noise attacks, considering various noise attack types and high-intensity noise attacks. For non differentiable JPEG compression noise, a new type of differentiable network layer is proposed for simulation. The datasets used include celebA, BOSSBase, and common object in context(COCO). The existing advanced GAN-based steganography methods, such as Volkhonskiy, Hayes, Hu, and HiDDeN, are used for comparison experiments under the same evaluation metrics of image quality, capacity, decoding accuracy, and steganography security. The watermarking methods for comparison experiments include HiDDeN, ReDMark, and Liu. The watermark image quality and watermark extraction accuracy under various noises are compared. Noise types include Identity, Dropout, Cropout, Gaussian blur, JPEG Compression, Crop, Resize, Mean filtering, and Salt and pepper. Result Experimental results show that the designed models have remarkable improvements in performance compared with state-of-the-art methods. When the detailed parameters of the trained steganalysis model are known, the adversarial examples are added to the proposed IIH-GAN. This method can reduce the detection accuracy of existing powerful deep learning-based steganalysis, YeNet, from 97.43% to 48.69%, which means the proposed IIH-GAN greatly improves the steganography security. The proposed watermarking model IRBW-GAN can achieve a relative embedding capacity as high as 1 bpp (bits-per-pixel) on a 256×256 pixels image. Compared with other models, the peak signal-to-noise ratio and structural similarity of IRBW-GAN are greatly improved, which means that the image generated by IRBW-GAN has a higher image quality. Compared with the state-of-the-art deep learning-based watermarking methods, when resisting various types and high-intensity noise attacks, IRBW-GAN model considerably improves the watermarked image quality and watermark extraction accuracy while increasing the watermark embedding capacity. The extraction accuracy is increased by approximately 20% compared with other methods under the attack of JEPG compression. The proposed simulated JPEG compression network layer is closer to the real JPEG compression, which can achieve a better robustness against image compression. Conclusion The proposed IIH-GAN and IRBW-GAN achieve superior performance over state-of-the-art models in the fields of image steganography and watermarking, respectively.