using high-dimensional image models to perform highly...

Using High-Dimensional Image Models to Perform

Highly Undetectable Steganography

Tomá² Pevný1, Tomá² Filler2, Patrick Bas3

1CTU, Prague, Czech Republic2 SUNY, Binghamton, USA

3Lagis, Lille, France

29th June 2010

T. Pevný, T. Filler, P. Bas | HuGO � Highly Undetectable steGO 1/20

Outline

1 Motivation

2 Minimizing the distortion function

3 Designing the distortion function

4 Experimental veri�cation

5 Conclusion

T. Pevný, T. Filler, P. Bas | HuGO � Highly Undetectable steGO 2/20

Outline

1 Motivation

2 Minimizing the distortion function

3 Designing the distortion function

4 Experimental veri�cation

5 Conclusion

T. Pevný, T. Filler, P. Bas | HuGO � Highly Undetectable steGO 3/20

Steganography

Practical steganography for digital media

modi�es the cover objects to convey the message.

makes changes as undetectable as possible.

Distortion function

any function D : X ×X → [0,∞].

correlates with detectability.

is minimized during embedding.

T. Pevný, T. Filler, P. Bas | HuGO � Highly Undetectable steGO 4/20

Additive distortion function

D(x ,y) =n

∑i=1

ρi |xi − yi |

|xi − yi | ≤ 1,

ρi cost of changing one pixel (embedding impact)

Aditivity implies that embedding changes do not interact.

T. Pevný, T. Filler, P. Bas | HuGO � Highly Undetectable steGO 5/20

Separational principle

Theorema

If we want to communicate m bits in n elements (pixels), than the

minimal expected distortion is

Dmin(m,n,ρ) =n

∑i=1

piρi ,

where pi is the probability of changing the ith pixel,

pi =e−λρi

1+ e−λρi

.

The parameter λ is obtained by solving ∑ni=1H(pi ) = m.

aJ. Fridrich and T. Filler, Practical Methods for Minimizing Embedding Impact in

Steganography, 2007

T. Pevný, T. Filler, P. Bas | HuGO � Highly Undetectable steGO 6/20

Corollary of the theorem

Corrolary

Design of the steganographic algorithm boils down to

the design of an additive distortion function D, orthe setting embedding costs ρi .

Allows to compare additive distortion functions.

Practical algorithms approaching the distortion bound existsa.

aT. Filler, J. Fridrich, and J. Judas, Minimizing embedding impact in steganography

using Trellis-Coded Quantization, 2010

T. Pevný, T. Filler, P. Bas | HuGO � Highly Undetectable steGO 7/20

Outline

1 Motivation

2 Minimizing the distortion function

3 Designing the distortion function

4 Experimental veri�cation

5 Conclusion

T. Pevný, T. Filler, P. Bas | HuGO � Highly Undetectable steGO 8/20

Designing the distortion function

Distortion function

D(x,y) = ‖f (x)− f (y)‖=d

∑j=1

wj |fj(x)− fj(y)|

d � number of features

Additive approximation

D ′(x,y) =n

∑i=1

D(x,yix)|xi − yi |

n � number of pixels

T. Pevný, T. Filler, P. Bas | HuGO � Highly Undetectable steGO 9/20

Model Correction

+1

-1

+1

-1

+1

-1

+1

-1

no change change pixel

Compensates the suboptimality caused by approximating D(x ,y) byD ′(x ,y).

T. Pevný, T. Filler, P. Bas | HuGO � Highly Undetectable steGO 10/20

Outline

1 Motivation

2 Minimizing the distortion function

3 Designing the distortion function

4 Experimental veri�cation

5 Conclusion

T. Pevný, T. Filler, P. Bas | HuGO � Highly Undetectable steGO 11/20

Features of the model

d3

d2

d1

Distortion function

D(x,y) =T

∑d1,d2,d3=−T

wd1,d2,d3

∣∣fd1,d2,d3(x)− fd1,d2,d3(y)∣∣f →d1,d2,d3 � # of di�erences (d1,d2,d3) between neighboring pixels

T. Pevný, T. Filler, P. Bas | HuGO � Highly Undetectable steGO 12/20

Setting the weights

−60

6

−60

6

0

5 · 10−2

0.1

d2d1

Mean of CX,→d1d2

feature

00

0

0.5

1

d2d1

w(d1, d2) =[√

d21 + d2

2 + σ]−γ

T. Pevný, T. Filler, P. Bas | HuGO � Highly Undetectable steGO 13/20

Outline

1 Motivation

2 Minimizing the distortion function

3 Designing the distortion function

4 Experimental veri�cation

5 Conclusion

T. Pevný, T. Filler, P. Bas | HuGO � Highly Undetectable steGO 14/20

Detectability by Spam

0 0.2 0.4 0.6 0.8 10

0.2

0.4

0.1

0.3

0.5

noModelCorrect.

withModelCorrect.

HuGO

ternary LSB match.

simulatedSTC h = 10

Relative payload (bpp)

Err

or

PE

�xed size 512×512

images

PE = min1

2

(PFp +PFn

)SVMs with Gaussian

kernel.

T. Pevný, T. Filler, P. Bas | HuGO � Highly Undetectable steGO 15/20

Detectability by feature sets

0 0.2 0.4 0.6 0.8 10

0.2

0.4

0.1

0.3

0.5 WAMSPAM 1st

SPAM 2nd

CDF

ternary LSB matching

HuGO

Relative payload (bpp)

Err

or

PE

T. Pevný, T. Filler, P. Bas | HuGO � Highly Undetectable steGO 16/20

HuGO, where did you hide the message?

Fig: 0.25 bits per pixel Fig: 0.50 bits per pixel

T. Pevný, T. Filler, P. Bas | HuGO � Highly Undetectable steGO 17/20

Outline

1 Motivation

2 Minimizing the distortion function

3 Designing the distortion function

4 Experimental veri�cation

5 Conclusion

T. Pevný, T. Filler, P. Bas | HuGO � Highly Undetectable steGO 18/20

Conclusion

We presented a methodology to design a steganographic

algorithm by applying state of the art principles:

separate distortion function from codinguse of high-dimensional model (107 features).

The practical realization, HuGO allows the embedder to hide

7× longer message than LSB matching at the same level of

security.

T. Pevný, T. Filler, P. Bas | HuGO � Highly Undetectable steGO 19/20

Do you want be the BOSS?

B O S SBreak Our Steganographic SystemBreak Our Steganographic System

Steganalytic challenge is coming up in June 2010!

1000 images, 500 with a hidden message

Guess which ones!

http://boss.gipsa-lab.grenoble-inp.fr

T. Pevný, T. Filler, P. Bas | HuGO � Highly Undetectable steGO 20/20