Image Steganography based on Style Transfer

To better obtain the content feature $F$ used for secret information mapping, we used a set of high-pass filters (a total of 32 filters, each with a size of 5×5 and three channels), including the high-pass filter of SRM [20] and its rotating counterparts. The high-pass filter with learnable parameters is used to sample the high-frequency signal from the image. The texture features and spatial position information in the image are extracted as a whole and then passed through a 4-conv layer network and activated by the Leaky ReLU function and the output is the content feature $F$. In this paper, rather than directly concatenate the secret information with the content image that might not fully exploit the semantic information represented by the latent space, as well as corrupting the original features of the input image. Inspired by image enhancement, we propose a new secret information embedding scheme. As shown in Fig. 2, the combined features:

where $M$ is the secret information matrix, $F$ is the image feature map, $M^{{}^{\prime}}\in R^{H\times W\times C}$ is the processed feature by dot product operation. $H$ and $W$ represent the height and width of the matrix, $C$ is the number of channels. ”$\odot$” represents the dot product operation of the corresponding position elements of the matrix. The secret information matrix is multiplied by the image feature map, which is feature selection. Therefore, the actual embedded secret information is closely related to the texture. Due to the above reasons, when the secret information vector is mapped to the matrix space, it will be forced to learn to arrange the secret information into the matrix according to the image texture characteristics.

Information hiding module is designed on the basis of the style transfer model [18]. The model mainly includes encoder $E$, decoder $G$ and discriminator $D$. As shown in Fig. 3, the encoder network consists of 5 convolutional layers: 1$\times$conv-stride-1 and 4$\times$conv-stride-2. The decoder network contains 9 residual blocks [21], 4 up-sampling blocks and 1$\times$conv-stride-1. The discriminator is a fully convolutional network with 7$\times$conv-stride-2 layers.

The style of the generated stego image is controlled by $D$. Therefore, the style loss function is also the discriminator loss function to distinguish the output stylized image $G(E(x_{i}))$ from the real style sample $s_{i}\in I^{{}^{\prime}}$ , $x_{i}\in I$ is a content image. The style loss function of our model is given by

We map the secret information into a feature map and hide the secret while generating the stylized image. The full objective function of our model is

$E$ and $G$ are trained on the content image set and the style image set to generate stylized stego images. $\lambda$ controls the relative importance of style loss.

When recovering secret information from the received stego image, a positive number represents $1$ and a negative number represents $0$. The secret loss function is used to measure the difference between the output of the extractor network and the original secret information and is given by

where $m$ is the secret information, $\widehat{m}$ is the extracted secret information by the extractor network, $\delta$ is the upper threshold of the error accuracy of the secret information. We use a set of high-pass filter in the first layer of the extractor to better obtain image features with secret information and improve the secret information recovery capability of the extractor network. In the extractor of our model, we also added a channel attention mechanism [22] so that the extractor can pay attention to image features with rich textures because the secret information is embedded in this area. We first extract the feature map $I_{f_{c}}$ from the stego image. Then the $I_{f_{c}}$ will be fed into the attention model and the model is formulated as

where $c$ represents the number of feature channels, $\delta$ is the ReLU [23] function, $\phi$ is the pooling layer. $W_{1}\in R^{\frac{c}{r}\times c}$, $W_{2}\in R^{c\times\frac{c}{r}}$ the hyperparameter $r$ is reduced to a coefficient. Finally, multiply the learned activation value $s_{c}$ by the original feature $I_{f_{c}}$ to obtain a feature map with different channel attention,

Channel attention mechanism make the extractor focus on regions with rich texture and improve the extraction of secret information.

Here we evaluate the accuracy of secret information recovery. To improve the recovery rate of secret information, we optimized the filters for extracting the texture features of the stego image and added a channel attention mechanism to the extractor. To verify whether the above two modules are useful for message extraction, we designed three ablation experiments at a message embedding size of 1000 bits. The experimental results are shown in Table 1. As we can see that with the optimized filters and channel attention can improve the recovery accuracy of secret information.

Then we compare the accuracy with STNet [14], which is also a steganography network based on style transfer, at different embedding size. The experimental results are shown in Table 2. We can see that the message recovery performance of these two methods is comparable, although our method is slightly weaker, but in practice we can also achieve $100\%$ after using the error correction code. In addition, STNet is limited to a blunt combination of images and styles, and the quality of the generated images is weaker than our method as shown below.

In Fig.4, we show the stylized stego image generated by our model and STNet. Stego images generated by our steganography model are like oil paintings created by artists, which are highly artistic. In order to quantitatively evaluate the quality of the stylized stego images generated by our model and STNet model, we evaluate these images through SSIM. The results are displayed in Table 3. In all three art styles, the SSIM evaluation index of images generated by our model is comparable to that of STNet. In addition,STNet can only be trained to combine style images and content images and cannot learn the general features of one class of style images.In contrast, the image generated by our method is more like an artistic oil painting, and our method is more artistic.

Unlike the security pursued by traditional steganography, the goal is to make stego and cover indistinguishable. Our model aims to make the generated stylized steganographic images indistinguishable from the normal stylized images. Moreover, our model generates subtly different images for different training under the same message embedding, making the steganalysis network more difficult to train. Fig. 5 shows the stylized stego images generated by the same model in different iterations. The images from (a) to (e) have slight color differences in the same style. This is consistent with a realistic scenario, as the images created are not the same each time, even for the same work created by the same artist. From a security point of view, generating similar but different steganographic images from the same model can further resist the training of steganalysis networks.

Our model embeds secret information during the stylization of content images, and current steganalysis cannot determine whether the modified part of the generated images come from style transfer or information embedding. And it is meaningless for steganalyzer to distinguish between the generated image and the content image, because the generated stego image is based on the stylized image. In our security experiment design, after receiving the generated image, the steganalyzer needs to determine whether the stylized image contains secret information. Therefore the cover image is a stylized image without secret information, stego image is a stylized image with secret information. We use SRNet [10], the typical steganalysis network, to evaluate the security of our model. The experimental data settings are: the artistic style of the generated image is Cézanne, the style image generated by the style transfer model [18] is cover, and the style stego image generated by our model is stego.

To evaluate the security of our stylized stego images, we distinguish three possible kinds of steganalyzers: 1) An Ignorant Steganalyzer who has obtained our model, but does not know which iterative model and only has one iterative model. Therefore, we set the training dataset as the cover and stego image pairs generated by corresponding models saved in a certain iteration, the testing dataset as the image pair generated by corresponding models saved in another iteration; 2) A Knowledgeable Steganalyzer who knows different iterative models, but the number of iterations of the generated stego is not known; and 3) An Omniscient Steganalyzer who knows iterations of generated stego. The experiment results are shown in Table 4. Under the embedding size of 1000 bits, for the ignorant steganalyzer, the detection accuracy of ours is 0.55, $20\%$ less than STNet, which is equivalent to blind guessing. The knowledgeable steganalyzer achieves a detection accuracy of 0.60 and omniscient steganalyzer achieves a detection accuracy of 0.71, $27\%$ and $22\%$ less than STNet, respectively. These results show that our security is stronger than STNet in different situations and difficult to be detected by ignorant steganalyzer in practical applications.