浏览全部资源
扫码关注微信
纸质出版日期： 2021-09-16 ，
录用日期： 2020-11-24
移动端阅览
郑钢, 胡东辉, 戈辉, 郑淑丽. 生成对抗网络驱动的图像隐写与水印模型[J]. 中国图象图形学报, 2021,26(10):2485-2502.
Gang Zheng, Donghui Hu, Hui Ge, Shuli Zheng. End-to-end image steganography and watermarking driven by generative adversarial networks[J]. Journal of Image and Graphics, 2021,26(10):2485-2502.
目的
2
图像信息隐藏包括图像隐写术和图像水印技术两个分支。隐写术是一种将秘密信息隐藏在载体中的技术，目的是为了实现隐秘通信，其主要评价指标是抵御隐写分析的能力。水印技术与隐写术原理类似，但其是通过把水印信息嵌入到载体中以达到保护知识产权的作用，追求的是防止水印被破坏而尽可能地提高水印信息的鲁棒性。研究者们试图利用生成对抗网络（generative adversarial networks，GANs）进行自动化的隐写算法以及鲁棒水印算法的设计，但所设计的算法在信息提取准确率、嵌入容量和隐写安全性或水印鲁棒性、水印图像质量等方面存在不足。
方法
2
本文提出了基于生成对抗网络的新型端到端隐写模型（image information hiding-GAN，IIH-GAN）和鲁棒盲水印模型（image robust blind watermark-GAN，IRBW-GAN），分别用于图像隐写术和图像鲁棒盲水印。网络模型中使用了更有效的编码器和解码器结构SE-ResNet（squeeze and excitation ResNet），该模块根据通道之间的相互依赖性来自适应地重新校准通道方式的特征响应。
结果
2
实验结果表明隐写模型IIH-GAN相对其他方法在性能方面具有较大改善，当已知训练好的隐写分析模型的内部参数时，将对抗样本加入到IIH-GAN的训练过程，最终可以使隐写分析模型的检测准确率从97.43%降低至49.29%。该隐写模型还可以在256×256像素的图像上做到高达1 bit/像素（bits-per-pixel）的相对嵌入容量；IRBW-GAN水印模型在提升水印嵌入容量的同时显著提升了水印图像质量以及水印提取正确率，在JEPG压缩的攻击下较对比方法提取准确率提高了约20%。
结论
2
本文所提IIH-GAN和IRBW-GAN模型在图像隐写和图像水印领域分别实现了领先于对比模型的性能。
Objective
2
Steganography is a technique that hides secret information in multimedia without arousing suspicion from the steganalyzer. In a typical case
the steganography system consists of three parts: Alice
Bob
and Eve. The sender Alice hides the secret message in the carrier image(cover)
turns it into another image(stego) that does not change its appearance perception
and then sends the stego to the receiver Bob through a public channel. Then
Bob can recover the secret messages from the stego. Eve acts as the steganalyzer to monitor their communications and determine whether secret information is hidden in the stego. In general
image information hiding includes two branches
namely
image steganography and image watermarking. Steganography hides secret information in a carrier and achieves the purpose of secret communication via the transmission of stego images
and the main evaluation metric is security against steganalysis. The principle of watermarking technology is similar to that of steganography
the difference is that its purpose is to use the watermark information embedded in the carrier to protect intellectual property rights
and the metric of watermarking emphasizes robustness against various watermarking attack. Traditional steganography and watermarking algorithms depend on the artificial designed complex feature
which requires the designer's domain knowledge and accumulated experience. Recent work has shown that deep neural networks are highly sensitive to minute perturbations of input images
giving rise to adversarial examples. This property is usually considered a weakness of learned models but can be exploited to enhance the capability of information hiding. Researchers have tried to use generative adversarial networks (GANs) to design steganographic algorithms and robust watermarking algorithms automatically. However
due to the unreasonable design of the neural network structure and other reasons as well as the lacking consideration of several practical problems
state-of-the-art GAN-based information hiding methods have several weaknesses.1) In real-world applications
the pixel value of the decoded image should be a float
but the networks proposed by existing methods set it to an integer. 2) Image steganography based on GANs has insufficient anti-steganalysis ability. 3) Watermarking technology based on deep learning has limited consideration of the types of attacking noises.4) The design of differential noise layer is unreasonable. Thus
the existing GAN-based steganography or watermarking algorithms have deficiencies in information extraction accuracy
embedding capacity
steganography security or watermark robustness
and watermark image quality.
Method
2
The paper proposes a new end-to-end steganographic model driven by GANs called image information hiding-GAN (IIH-GAN)) and robust blind watermarking model named image robust blind watermark-GAN (IRBW-GAN) for image steganography and robust blind watermarking
respectively. SE-ResNet
a more efficient encoder and decoder structure
is included in the network model
which can optimize the interdependence between network channels and enhance the global feature automatic selection
leading to a more accurate
high-quality information embedding and extraction. The proposed IIH-GAN uses a discriminator to cotrain with the encoder-decoder; thus
it maintains the distribution of the carrier image during adversarial training unchanged and enhances the security in resisting steganalysis. To solve the problem of decoding real images in real-world scenarios
IIH-GAN adds a round layer between the encoder and the decoder. IIH-GAN adds the adversarial examples to the GAN-based steganographic model to remedy the shortcomings of GAN-based steganography in resisting the powerful state-of-the-art deep learning-based steganalysis algorithms. In the watermark model
IRBW-GAN adds a differentiable noise layer between the encoder and the decoder that resists noise attacks
considering various noise attack types and high-intensity noise attacks. For non differentiable JPEG compression noise
a new type of differentiable network layer is proposed for simulation. The datasets used include celebA
BOSSBase
and common object in context(COCO). The existing advanced GAN-based steganography methods
such as Volkhonskiy
Hayes
Hu
and HiDDeN
are used for comparison experiments under the same evaluation metrics of image quality
capacity
decoding accuracy
and steganography security. The watermarking methods for comparison experiments include HiDDeN
ReDMark
and Liu. The watermark image quality and watermark extraction accuracy under various noises are compared. Noise types include Identity
Dropout
Cropout
Gaussian blur
JPEG Compression
Crop
Resize
Mean filtering
and Salt and pepper.
Result
2
Experimental results show that the designed models have remarkable improvements in performance compared with state-of-the-art methods. When the detailed parameters of the trained steganalysis model are known
the adversarial examples are added to the proposed IIH-GAN. This method can reduce the detection accuracy of existing powerful deep learning-based steganalysis
YeNet
from 97.43% to 48.69%
which means the proposed IIH-GAN greatly improves the steganography security. The proposed watermarking model IRBW-GAN can achieve a relative embedding capacity as high as 1 bpp (bits-per-pixel) on a 256×256 pixels image. Compared with other models
the peak signal-to-noise ratio and structural similarity of IRBW-GAN are greatly improved
which means that the image generated by IRBW-GAN has a higher image quality. Compared with the state-of-the-art deep learning-based watermarking methods
when resisting various types and high-intensity noise attacks
IRBW-GAN model considerably improves the watermarked image quality and watermark extraction accuracy while increasing the watermark embedding capacity. The extraction accuracy is increased by approximately 20% compared with other methods under the attack of JEPG compression. The proposed simulated JPEG compression network layer is closer to the real JPEG compression
which can achieve a better robustness against image compression.
Conclusion
2
The proposed IIH-GAN and IRBW-GAN achieve superior performance over state-of-the-art models in the fields of image steganography and watermarking
respectively.
图像信息隐藏图像隐写术生成对抗网络(GANs)对抗样本鲁棒盲水印
image information hidingimage steganographygenerative adversarial networks(GANs)adversarial examplesrobust blind watermarking
Ahmadi M, Norouzi A, Karimi N, Samavi S and Emami A. 2020. ReDMark: framework for residual diffusion watermarking based on deep networks.Expert Systems with Applications, 146: #113157[DOI:10.1016/j.eswa.2019.113157]
Bao P and Ma X H. 2005. Image adaptive watermarking using wavelet domain singular value decomposition. IEEE Transactions on Circuits and Systems for Video Technology, 15(1): 96-102[DOI:10.1109/TCSVT.2004.836745]
Bas P, Filler T and PevnýT. 2011. "Break Our Steganographic System": The Ins and Outs of Organizing BOSS//Information Hiding. Berlin: Springer: 59-70[DOI: 10.1007/978-3-642-24178-9_5http://dx.doi.org/10.1007/978-3-642-24178-9_5]
Boroumand M, Chen M and Fridrich J. 2018. Deep residual network for steganalysis of digital images. IEEE Transactions on Information Forensics and Security, 14(5): 1181-1193[DOI:10.1109/TIFS.2018.2871749]
Etemad E, Samavi S, Soroushmehr S M R, Karimi N, Etemad M, Shirani S and Najarian K. 2018. Robust image watermarking scheme using bit-plane of hadamard coefficients. Multimedia Tools and Applications, 77(2): 2033-2055[DOI:10.1007/s11042-016-4278-1]
Fridrich J and Kodovsky J. 2012. Rich models for steganalysis of digital images. IEEE Transactions on Information Forensics and Security, 7(3): 868-882[DOI:10.1109/TIFS.2012.2190402].
Goodfellow I J, Pouget-Abadie J, Mirza M, Xu B, Warde-Farley D, Ozair S, Courville A and Bengio Y. 2014. Generative adversarial nets//Proceedings of the 27th International Conference on Neural Information Processing Systems. Montreal, Canada: ACM: 2672-2680
Gulrajani I, Ahmed F, Arjovsky M, Dumoulin V and Courville A C. 2017. Improved training of Wasserstein GANs//Proceedings of the 31st International Conference on Neural Information Processing Systems (NIPS'17). NY, USA: Curran Associates Inc: 5769-5779
Hayes J and Danezis G. 2017. Generating steganographic images via adversarial training//Proceedings of the 31st International Conference on Neural Information Processing Systems (NIPS'17). NY, USA: Curran Associates Inc: 1951-1960
He K M, Zhang X Y, Ren S Q and Sun J. 2016. Deep residual learning for image recognition//Proceedings of 2016 IEEE Conference on Computer Vision and Pattern Recognition. Las Vegas, USA: IEEE: 770-778[DOI: 10.1109/CVPR.2016.90http://dx.doi.org/10.1109/CVPR.2016.90]
Holub V and Fridrich J. 2012. Designing steganographic distortion using directional filters//Proceedings of 2012 IEEE International workshop on information forensics and security (WIFS). Costa Adeje, Spain: IEEE: 234-239[DOI: 10.1109/WIFS.2012.6412655http://dx.doi.org/10.1109/WIFS.2012.6412655]
Holub V, Fridrich J and Denemark T. 2014. Universal distortion function for steganography in an arbitrary domain. EURASIP Journal on Information Security, 2014(1): #1[DOI:10.1186/1687-417X-2014-1]
Hu D H, Wang L, Jiang W J, Zheng S L and Li B. 2018a. A novel image steganography method via deep convolutional generative adversarial networks. IEEE Access, 6: 38303-38314[DOI:10.1109/ACCESS.2018.2852771]
Hu J, Shen L and Sun G. 2018b. Squeeze-and-excitation networks//Proceedings of 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Salt Lake City, USA: IEEE: 7132-7141[DOI: 10.1109/CVPR.2018.00745http://dx.doi.org/10.1109/CVPR.2018.00745]
Karybali I G and Berberidis K. 2006. Efficient spatial image watermarking via new perceptual masking and blind detection schemes. IEEE Transactions on Information Forensics and Security, 1(2): 256-274[DOI:10.1109/TIFS.2006.873652]
Kandi H, Mishra D and Gorthi R K S S. 2017. Exploring the learning capabilities of convolutional neural networks for robust image watermarking. Computers&Security, 65: 247-268[DOI:10.1016/j.cose.2016.11.016]
Lin T Y, Maire M, Belongie S, Hays J, Perona P, Ramanan D, Dollár P and Zitnick C L. 2014. Microsoft COCO: common objects in context//Proceedings of the 13th European Conference on Computer Vision. Zurich, Switzerland: Springer: 740-755[DOI: 10.1007/978-3-319-10602-1_48http://dx.doi.org/10.1007/978-3-319-10602-1_48]
Liu Y, Guo M X, Zhang J, Zhu Y S and Xie X D. 2019. A novel two-stage separable deep learning framework for practical blind watermarking//Proceedings of the 27th ACM International Conference on Multimedia. Nice, France: ACM: 1509-1517[DOI: 10.1145/3343031.3351025http://dx.doi.org/10.1145/3343031.3351025]
Liu Z W, Luo P, Wang X G and Tang X O. 2015. Deep learning face attributes in the wild//Proceedings of 2015 IEEE International Conference on Computer Vision. Santiago, Chile: IEEE: 3730-3738[DOI: 10.1109/ICCV.2015.425http://dx.doi.org/10.1109/ICCV.2015.425]
Mun S M, Nam S H, Jang H U, Kim D and Lee H K. 2017. A robust blind watermarking using convolutional neural network[EB/OL]. [2020-07-21].https://arxiv.org/pdf/1704.03248.pdfhttps://arxiv.org/pdf/1704.03248.pdf
Nasir I, Weng Y and Jiang J M. 2007. A new robust watermarking scheme for color image in spatial domain//Proceedings of the 3rd International IEEE Conference on Signal-Image Technologies and Internet-Based System. Shanghai, China: IEEE: 942-947[DOI: 10.1109/SITIS.2007.67http://dx.doi.org/10.1109/SITIS.2007.67]
Ouyang J, Coatrieux G, Chen B J and Shu H Z. 2015. Color image watermarking based on quaternion Fourier transform and improved uniform log-polar mapping. Computers and Electrical Engineering, 46: 419-432[DOI:10.1016/j.compeleceng.2015.03.004]
Parah S A, Sheikh J A, Loan N A and Bhat G M. 2016. Robust and blind watermarking technique in DCT domain using inter-block coefficient differencing. Digital Signal Processing, 53: 11-24[DOI:10.1016/j.dsp.2016.02.005]
Pevny T, Bas P and Fridrich J. 2010a. Steganalysis by subtractive pixel adjacency matrix. IEEE Transactions on Information Forensics and Security, 5(2): 215-224[DOI:10.1109/TIFS.2010.2045842]
Pevny T, Filler T and Bas P. 2010b. Using high-dimensional image models to perform highly undetectable steganography//Proceedings of the 12th International Conference on Information Hiding. Calgary, Canada: Springer: 161-177[DOI: 10.1007/978-3-642-16435-4_13http://dx.doi.org/10.1007/978-3-642-16435-4_13]
Tan S Q and Li B. 2014. Stacked convolutional auto-encoders for steganalysis of digital images//Proceedings of 2014 Asia-Pacific Signal and Information Processing Association Annual Summit and Conference (APSIPA). Siem Reap, Cambodia: IEEE: 1-4[DOI: 10.1109/APSIPA.2014.7041565http://dx.doi.org/10.1109/APSIPA.2014.7041565]
Volkhonskiy D, Nazarov I, Borisenko B and Burnaev E. 2017. Steganographic generative adversarial networks[EB/OL]. [2020-07-21].http://arxiv.org/pdf/1703.05502.pdfhttp://arxiv.org/pdf/1703.05502.pdf
Xiao C W, Li B, Zhu J Y, He W, Liu M Y and Song D. 2018. Generating adversarial examples with adversarial networks//Proceedings of the 27th International Joint Conference on Artificial Intelligence. Stockholm, Sweden: IJCAI: 3905-3911
Xu G S, Wu H Z and Shi Y Q. 2016. Structural design of convolutional neural networks for steganalysis. IEEE Signal Processing Letters, 23(5): 708-712[DOI:10.1109/LSP.2016.2548421]
Ye J, Ni J Q and Yi Y. 2017. Deep learning hierarchical representations for image steganalysis. IEEE Transactions on Information Forensics and Security, 12(11): 2545-2557[DOI:10.1109/TIFS.2017.2710946]
Zhu J R, Kaplan R, Johnson J and Li F F. 2018. HiDDeN: hiding data with deep networks//Proceedings of the 15th European Conference on Computer Vision (ECCV). Munich, Germany: Springer: 657-672[DOI: 10.1007/978-3-030-01267-0_40http://dx.doi.org/10.1007/978-3-030-01267-0_40]
相关作者
相关机构
京公网安备11010802024621