# Deep Steganalysis: End-to-End Learning with Supervisory Information beyond Class Labels

###### Abstract

Recently, deep learning has shown its power in steganalysis. However, the proposed deep models have been often learned from pre-calculated noise residuals with fixed high-pass filters rather than from raw images. In this paper, we propose a new end-to-end learning framework that can learn steganalytic features directly from pixels. In the meantime, the high-pass filters are also automatically learned. Besides class labels, we make use of additional pixel level supervision of cover-stego image pair to jointly and iteratively train the proposed network which consists of a residual calculation network and a steganalysis network. The experimental results prove the effectiveness of the proposed architecture.

## 1 Introduction

Steganography is the technique of concealing communication by means of cover medium transmission. It is a hot topic of information security and has drawn more and more attention in recent years. On the contrary, steganalysis aims at detecting the very existence of secret message in covers such as digital images. It is a very challenging task because the stego signal is usually very weak while greatly impacted by the variations of cover contents. Generally, it can be seen as a binary classification problem that distinguishes stegos from covers. For a long time, detection is conducted with two separate steps: feature extraction and classification. It would be worth to note that, though classifier is automatically optimized, the crucial feature extraction is based entirely on heuristics. To detect the advanced steganographic schemes [1, 2, 3], various handcrafted high-dimensional features such as rich feature representations [4, 5, 6, 7, 8, 9, 10, 11] have been proposed, even though the image is hard to modeled.

In recent years, based on the concept of learning features automatically, deep learning has made significant achievements in various areas like computer vision. The use of deep learning challenges traditional handcrafted feature based approaches. This has aroused the interest of researchers in the steganalysis field in seeking the way to apply deep learning for steganalysis. In our very first paper [12], using deep convolutional neural networks (CNN) with high-pass filtering layer, we achieve comparable performance with that of the SRM[6] with ensemble classifiers [11]. Inspired by this paper, different architectures are proposed. In [13], Pibre et al. present a CNN architecture for steganalysis with fewer convolutional layers, and without the pooling operation. But such architecture is designed specially for steganalysis in the scenario where the embedding happened roughly in the same locations over images caused by a fixed embedding key. This is a similar situation for the architecture proposed in [14]. More recently, Xu et al. also propose a deep learning approach for steganalysis with a more compact CNN model [15] and some ensemble strategies [16] that have led to performance improvement. Furthermore, we pre-train a CNN model with high payload stego images and fine-tune it with lower payload ones [17]. The effectiveness of this transfer learning strategy has been proven. Another effective transfer learning strategy incorporating the prior knowledge from traditional steganalysis tasks to regularize a CNN model has been proposed in [18].

So far, deep learning shows its power in steganalysis. However, most of the proposed models are learned from pre-calculated noise residuals rather than raw images. In fact, CNNs are originally designed to learn patterns for understanding visual content of the image in computer vision problems, while in steganalysis, the signal of interest is hidden within the noise component. In order to deal with this problem, recent methods firstly filter the image with a handcrafted high-pass kernel to enhance the stego signal, and then use CNN to learn features from computed residuals. The limitation is that handcrafted kernels could be suboptimal when facing sophisticated data embedding methods and image sources. In this paper, we propose a new CNN architecture that can learn the residuals and the steganalytic features from images simultaneously. Actually, it is hard to learn such residuals with only label information. We make use of cover-stego image pairs as additional supervisory information to train the proposed network jointly and iteratively. The experimental results prove the effectiveness of the proposed method.

## 2 The Proposed Method

The core idea behind deep learning is that comprehensive feature representations can be efficiently learned with the deep architectures which are composed of stacked layers of trainable non-linear operations. However, because of the diversity of image content, it is hard to learn effective feature representations directly from images for steganalysis. Recent proposed approaches have to fix the kernel of first layer as the HPF (high-pass filter) like the kernel in [6]. It is so-called pre-processing layer. In other words, only label information is not enough to learn powerful feature representations for steganalysis. In this section, we present a novel framework based on deep learning with more supervisory information beyond class labels.

### 2.1 Overall Architecture

As we said above, because of the power of deep networks and large-scale training data, deep learning always gets much better performance than traditional learning methods. However, for steganalysis, it is hard to say that since image content instead of stego signals dominates the optimization process. To tackle this problem, In [12], we propose a feasible approach by employing the HPF kernel as defined in Eq. (1) at the first layer of the proposed network. We fix the parameters without learning at this layer.

(1) |

The role of the first layer of fixed HPF is to suppress the image content while amplifying the stego signals, which can make the deep networks learn powerful feature representations for steganalysis. Thereafter, different networks have been proposed [17, 18, 15, 16] but with the same fixed HPF layer.

Can we learn this HPF automatically or, in other words, can we learn steganalytic features directly from an image itself? Since stego signal is quite weak and its existence is easy to be concealed by the variety of image contents, we found that it is hard to directly learn HPF with only label supervision (cover or stego). But we have more than that. Cover and stego image pair as the supervisory information at the pixel level is also used. Firstly, we reconstruct the cover images using this pixel level supervisory information. The idea of image reconstruction is similar to cover estimation in traditional steganalysis. But differently, we make this step trainable. Secondly, by subtracting reconstructed image contents from input images, noise residuals are obtained. It is worth noting that the learned filters in the image reconstruction step are low-pass, but the whole two-step module can be recognized as high pass filtering.

Generally, steganalysis is the binary classification problem that optimizes over a loss function. In our proposed approach, we formulate the loss function as a combination of two terms: the classification term and the image reconstruction term. The classification term is a global constraint that makes the prediction accurate, and the reconstruction term reconstructs the input image at the pixel level, as seen in Eq. (2).

(2) |

where specifies a relative importance of the reconstruction term against the classification term . The goal of the reconstruction term is to ensure that the noise residuals can be automatically learned from the input image.

The overall architecture is shown in Fig. 1. It has two sub-networks: the residual network and the steganalysis network. The residual network is placed at the very beginning to transform original images to its reconstructions, then to get noise residuals. The residuals are calculated as the differences between the input image and its reconstructions straightforwardly. Then, we feed the residuals into the steganalysis network. In the following, we present the details of the two sub-networks and their corresponding loss functions.

### 2.2 The Residual Network

Image reconstruction is the key part of the residual network. A straightforward way to learn the reconstruction model is to train a regression network to make the response of an input image approximate the groundtruth which should be the corresponding cover image of . As we all know, the loss criterion plays an important role in learning process. For the residual network, we define its reconstruction loss as

(3) |

in which, supposing has a total of elements,

(4) |

is a robust loss that is less sensitive to outliers than the loss, when . Meanwhile, when is quite close to zero, loss is used to dampen oscillation. It should be noted that the input images are normalized. is the corresponding cover image of the th input image , and is the reconstructed image. is the number of training samples.

We design a one convolutional layer network to approximate because more layers means more information loss, which is fatal for stego signal that we try best to preserve. The residual noise is calculated as the difference between the input image and its reconstruction straightforwardly. Fig. 2 shows the architecture of residual network. It has two learnable kernels with sizes of and respectively. As we know, parameter initialization is very important for training the networks. These two kernels are initialized with the weights as following.

We train the network in a supervised way with the corresponding covers guiding the training process. It should be noted that the reconstruction loss is the average of losses corresponding to the two outputs. The outputs are the reconstructed images, respectively

Then by taking the differences between the input and the outputs, we get two residuals which are finally fed into the steganalysis network that will be introduced in Section 2.3

### 2.3 The Steganalysis Network

For the stegnalsysis network, it learns feature representation automatically and optimally. The objective is to minimize the classification loss function defined in Eq. (5).

(5) |

where is the predicted probability distribution over different possible outcomes (cover or stego), and , similar to the loss function used in logistic regression, is the negative log-likelihood of the correct class,

(6) |

where is the input residuals and is the corresponding label. In the proposed architecture, we use the Xu’s[15] network as the steganlysis network to approximate . The models proposed by us in [12] and by Xu et al. in [15] are basically the same except the additional abs layer and batch normalization layers which make Xu’s Net have less parameters and consequently less probability of over-fitting.

### 2.4 End-to-End Learning

Since the reconstructed image can be learnt optimally, assembled with the steganalysis network, the proposed steganalytic CNN model can directly learn from raw images.

We iteratively update the parameters of the proposed architecture by minimizing the joint loss (7) through stochastic gradient descent (SGD). is set to in our implementation. During the optimization, the parameters of the residual network are updated using the gradients both from the residual network itself and the steganalysis network.

(7) |

Both the corresponding cover image and class label are used as the supervisory information to guide the learning process.

## 3 Experiments

### 3.1 Dataset

The dataset we used is BOSSbase v1.01 [19] which contains 10000 images acquired by seven digital cameras in raw format and subsequently processed to the size of . To evaluate the performance of our proposed CNN models, four state-of-the-art spatial domain content-adaptive steganographic algorithms, S-UNIWARD [3], HILL-CMD [20], WOW[2], and MiPOD[21] with embedding rate of 0.4 bpp are considered. They were implemented with unfixed random embedding keys.

### 3.2 Parameter Configuration

The stochastic gradient descent (SGD) algorithm was used to train the proposed CNN in experiments. The learning rate was initialized to 0.001 and scheduled to lower it by a multiplier of 0.3 for five times when the error plateaus lasts for some amount of time (50 epochs). The momentum was set to 0.9. The minibatch size was 32 (16 cover/stego pairs) because of the limitation of GPU memory. All the weights in convolutional layers are initialized from a zero-mean Gaussian distribution with standard deviation of 0.01. Bias learning was disabled in the convolutional layers. The weights in the last fully connected (FC) layer were initialized using “Xavie” initialization and the bias were initialized with . The weight decay was not enabled except that for the FC layer it was fixed to 0.0005.

### 3.3 Results

We compared the performance of proposed CNN model with the state-of-the-art CNN model proposed by Xu et al. [15]. They are both implemented with Torch under the same parameter configuration. Since we mainly focus on the possibility of learning deep steganalytic model from a raw image, no ensemble strategy was adopt for both models. In the experiments, 8000 training pairs (cover/stego) were randomly selected from the dataset. The remains were used as testing pairs which were never touched in the whole training phase. In the training phase, we randomly generated a split from the 8000 training pairs by evenly breaking the 8000 training pairs into five non-overlapping folds, and used the first four folds for training and the rest one fold for validation. The models were trained on 6400 pairs and validated on 1600 pairs. The validation pairs were used to decide when to lower the learning rate or stop the training process. To evaluate the performance, in the testing stage, the 2000 testing pairs went through the well-trained models. Table 1 shows the detection error rates. We can find that our proposed model has better performance on detecting MiPOD, WOW and HILL-CMD, and also is comparable to Xu’s model when detecting S-UNIWARD. This proves the effectiveness of our proposed model. That is to say we can directly learn effective steganalytic features from images themselves without using the fixed HPF layer.

S-UNIWARD | HILL-CMD | WOW | MiPOD | |
---|---|---|---|---|

Xu’s | 20.68% | 30.83% | 19.53% | 24.78% |

Proposed | 20.78% | 29.35% | 17.78% | 22.43% |

### 3.4 Visualization

Fig. 3 shows the normalized learned high-pass filters and their visualization for HILL-CMD and S-UNIWARD algorithms. We can find that the learned HPF filters have similar shapes to the traditionally used and filters, but have more weights on surrounding pixels which makes the stego-noise more exposed to the corresponding residuals. This can be verified in Fig. 4 especially in the so-called hard-to-predicate texture regions. Fig. 4 shows the feature maps after ’abs layer’ in steganalysis network [15]. We can find that our proposed residual network makes the steganalysis network capture more details on texture region, which is very important for detecting adaptive steganography algorithms.

## 4 Conclusion

In this paper, we proposed to learn effective steganalytic feature representations directly from images themselves. We made use of both label information and cover-stego pair information to train the proposed network by minimizing the joint loss (7). Results proved that the high-pass filters can be optimally learned. The proposed model captured more details on texture region, which boosts the detection performance especially for MiPOD, WOW and HILL-CMD. In our future work, we will put more effort on learning more types of high-pass filters to improve the performance. How to incorporate the knowledge of the selection-channel into deep models is also an interesting topic.

## References

- [1] Tomáš Pevnỳ, Tomáš Filler, and Patrick Bas. Using high-dimensional image models to perform highly undetectable steganography. In Information hiding, pages 161–177. Springer, 2010.
- [2] Vojtéch Holub and Jessica Fridrich. Designing steganographic distortion using directional filters. In The IEEE International Workshop on Information Forensics and Security (WIFS), pages 234–239, 2012.
- [3] Vojtěch Holub and Jessica Fridrich. Digital image steganography using universal distortion. In Proceedings of the first ACM workshop on Information hiding and multimedia security, pages 59–68. ACM, 2013.
- [4] Gokhan Gul and Fatih Kurugollu. A new methodology in steganalysis: breaking highly undetectable steganograpy (hugo). In Information Hiding, pages 71–84. Springer, 2011.
- [5] Jessica Fridrich, Jan Kodovskỳ, Vojtěch Holub, and Miroslav Goljan. Steganalysis of content-adaptive steganography in spatial domain. In Information Hiding, pages 102–117. Springer, 2011.
- [6] Jessica Fridrich and Jan Kodovsky. Rich models for steganalysis of digital images. IEEE Transactions on Information Forensics and Security, 7(3):868–882, 2012.
- [7] Yun Q Shi, Patchara Sutthiwan, and Licong Chen. Textural features for steganalysis. In Information Hiding, pages 63–77. Springer, 2013.
- [8] Vojtech Holub and Jessica Fridrich. Random projections of residuals for digital image steganalysis. IEEE Transactions on Information Forensics and Security, 8(12):1996–2006, 2013.
- [9] Weixuan Tang, Haodong Li, Weiqi Luo, and Jiwu Huang. Adaptive steganalysis against wow embedding algorithm. In Proceedings of the 2nd ACM workshop on Information hiding and multimedia security, pages 91–96, 2014.
- [10] Tomas Denemark, Vahid Sedighi, Vojtech Holub, Rémi Cogranne, and Jessica Fridrich. Selection-channel-aware rich model for steganalysis of digital images. In 2015 National Conference on Parallel Computing Technologies (PARCOMPTECH), pages 48–53, 2015.
- [11] Jan Kodovsky, Jessica Fridrich, and Vojtech Holub. Ensemble classifiers for steganalysis of digital media. IEEE Transactions on Information Forensics and Security, 7:432–444, 2012.
- [12] Yinlong Qian, Jing Dong, Wei Wang, and Tieniu Tan. Deep learning for steganalysis via convolutional neural networks. In IS&T/SPIE Electronic Imaging, pages 94090J–94090J, 2015.
- [13] Lionel Pibre, Jérôme Pasquet, Dino Ienco, and Marc Chaumont. Deep learning is a good steganalysis tool when embedding key is reused for different images, even if there is a cover source-mismatch. In EI: Electronic Imaging, 2016.
- [14] Jean-François Couchot, Raphaël Couturier, Christophe Guyeux, and Michel Salomon. Steganalysis via a convolutional neural network using large convolution filters. CoRR, abs/1605.07946, 2016.
- [15] Guanshuo Xu, Han-Zhou Wu, and Yun-Qing Shi. Structural design of convolutional neural networks for steganalysis. IEEE Signal Processing Letters, 23(5):708–712, 2016.
- [16] Guanshuo Xu, Han-Zhou Wu, and Yun-Qing Shi. Ensemble of cnns for steganalysis: An empirical study. In Proceedings of the 4th ACM Workshop Inf. Hiding and Multimedia Security (IH&MMSec), pages 103–107, June 2016.
- [17] Y. Qian, J. Dong, W. Wang, and T. Tan. Learning and transferring representations for image steganalysis using convolutional neural network. In Proceedings of 2016 IEEE International Conference on Image Processing (ICIP), pages 2752–2756, Sept 2016.
- [18] Yinlong Qian, Jing Dong, Wei Wang, and Tieniu Tan. Learning representations for steganalysis from regularized cnn model with auxiliary tasks. In Proceedings of the 2015 International Conference on Communications, Signal Processing, and Systems, pages 629–637, 2016.
- [19] Patrick Bas, Tomáš Filler, and Tomáš Pevnỳ. ”break our steganographic system”: The ins and outs of organizing boss. In Information Hiding, pages 59–70. Springer, 2011.
- [20] Bin Li, Ming Wang, Xiaolong Li, Shunquan Tan, and Jiwu Huang. A strategy of clustering modification directions in spatial image steganography. IEEE Transactions on Information Forensics and Security, 10(9):1905–1917, 2015.
- [21] Vahid Sedighi, Rémi Cogranne, and Jessica Fridrich. Content-adaptive steganography by minimizing statistical detectability. IEEE Transactions on Information Forensics and Security, 11(2):221–234, 2016.