Imperceptible Image Steganography Using Symmetry-Adapted Deep Learning Techniques

Abstract

Digital image steganography is the process of embedding information within a cover image in a secure, imperceptible, and recoverable way. This research extends a symmetry-adapted deep-learning approach to identify hidden patterns of images using two-dimensional convolutional neural networks (CNN). The proposed method (SteGuz) uses three CNNs to implement the different phases of the steganography process on digital image covers. SteGuz introduced a gain function, based on several image similarity metrics, to maximize the imperceptibility of the hiding process. Using 10 different pairs of cover-secret images, the performance of the proposed method was measured in terms of standard metrics such as peak signal to noise ratio (PSNR) and structured similarity index measurement (SSIM). The results showed that the proposed methodology outperformed the original method in terms of both imperceptibility and recoverability. In addition, when compared with some existing methods, SteGuz proved the outstanding performance of achieving a very high PSNR value while maintaining high accuracy of the extracted image.

1. Introduction

Steganography is the process of hiding a message by placing it within another, innocuous medium. The literal meaning of the word, derived from the Greek language, means “covered writing” [1]. The creator of the word, Trithemius, used the Greek words “steganos” and “graphia”, which mean “covered” and “writing”, respectively. One notable example of steganography is found in a story by Greek historian Herodotus. In this story, a Milesian tyrant ordered a slave be sent to the city of Miletus with a secret message tattooed onto his scalp. The slave allowed for time to pass such that his hair grew back, fully obscuring the tattoo. Once he arrived at Miletus, his head was shaved to reveal the tattooed message to the city advisor, Aristagoras. Upon discovery of the message, Aristagoras started a revolution against the Persian king [2]. In this scenario, the slave was the carrier of the message, the tattooed scalp was the hidden information, the tyrant was the sender, and Aristagoras was the receiver.

More recently, many methods exist for embedding hidden information inside digital mediums such as images, audio files, hypertext transport protocol (HTTP) headers, and even plain text files [3]. Nearly any type of digital data, like text and audio files, can be embedded into a cover digital medium. This research focuses on the process of embedding a digital image within another. In fact, digital images provide an excellent medium for information hiding due to several reasons. The first reason is their popularity due to the ease of capture, storage, and exchange. Secondly, images contain many different characteristics, such as bit depth, colors, edges, corners, dimensions, and metadata [4] offering a multiplicity of redundant data that can be manipulated to embed information. Furthermore, the visual integrity of an image is resistant to slight changes in pixel values that may be imperceptible to the human eye. This reduces the likelihood that someone would be able to discern the presence of hidden information.

The Least Significant Bit Substitution (LSB) steganographic method is one of the classical approaches for image steganography. It modifies the least significant bits of the cover pixels to embed the bits of a hidden message. In the case of colored images, the three 8-bit wide color channels (Red, Green, and Blue) provide plenty of space for embedding information [5]. The LSB ++ method [6] is a variation of the LSB algorithm that combines encryption with hiding to increase the level of security against steganalysis. The method uses a key to lock the frequency difference of any two adjacent image bins to maintain sensitive pixels in the cover image, hence reducing the distortion introduced by the embedding process. In [7], the authors proposed another LSB substitution method using pixel value differencing (PVD) and exploiting modification directions (EMD).

Another category of image steganographic methods embed the information in the transform domain of an image. A transform is a mathematical function that is used to alter the structure of the data into waves, such as sine and cosine waves. One example uses used hierarchical trees coding and digital Fourier transform [8] to hide data in images. The Fourier transform (FT) is a transform function that is used to decompose a function into waves of different amplitudes and frequencies [9]. The Discrete Cosine transform (DCT) [10] and The Discrete Wavelet Transform (DWT) [11] are other transform functions that are typically utilized for image steganography. In fact, WLT decomposes a function into a series of wavelets that are wave-like oscillations which are localized in time [12]. Some methods may combine more than one transform function to enhance the hiding process. One novel image steganography methodology used the Finite Ridgelet Transform (FRT), Discrete Wavelet Transform (DWT), and Arnold Scrambling to provide high imperceptibility and hiding capacity [13]. Another technique relied on DWT in conjunction with all phase discrete cosine biorthogonal transform (APDCBT) and singular value decomposition (SVD) [14]. APDCBT is a transform that improves upon the discrete cosine transform (DCT) by offering greater performance in high-frequency and low-frequency aggregation.

With the increased interest in deep learning applications, research efforts were directed to find effective ways to train symmetry-adapted neural networks to identify hidden patterns of image data and deal with the dynamic nature of steganography. The authors in [15] used three Convolutional Neural Networks (CNNs) that were trained together to perform the hiding and the extraction process. Using a similar network structure, the technique proposed in [16] combined the Image Elliptic Curve Cryptography (ECC) and the Discrete Cosine Transform (DCT) as part of the pre-processing network to normalize the secret image and extract its important features. Deep convolutional generative adversarial networks (DCGANs) have also been used in the field of steganography, as seen in [17]. The generative model of the GAS is used to create steganographic images that look like samples from the dataset, while the discriminatory model is used to detect if the steganographic image contains a hidden message [18].

In this research, we introduce an extension of the work introduced in [15] in which three CNNs are built to embed a full-size image into a cover image. In the original work the retrieval of the secret image was approximate yet recognizable. However, in this research three modifications are presented: (1) Removing the normalization and denormalization steps to eliminate the reliance of training on the ImageNet dataset. (2) The noise layer was removed allowing for LSB hiding and hence a higher imperceptibility. (3) The loss function used to update the network weights was replaced with a “gain function”.

The rest of the paper is organized as follows: Section 2 provides a quick overview on the principles of CNN. Section 3 describes the details of the steganographic method (called SteGuz) including the network structure, the training process, as well as the model hyperparameters. Experimental results are discussed in Section 4 and the performance of the proposed method is compared with some existing techniques in Section 5. Finally, Section 6 concludes the research.

2. Convolutional Neural Networks

Deep learning is an approach to artificial intelligence that uses neural networks to achieve a task or goal [19]. Neural networks are loosely modeled after the human brain in the sense that a neural network consists of many interconnected nodes (also known as perceptrons) that communicate with each other. To this end, they are aptly named ‘neural networks.’ The implementation and architecture of neural networks can vary greatly, but the foundation is largely the same. Neural networks are comprised of several layers, with the first layer being the input layer and the last layer being the output layer [20]. In between the input layer and output layer are the hidden layers where the number of hidden layers will vary depending on the application and domain. Each perceptron in the network has one or more weighted inputs that are used in conjunction with an activation function to produce an output variable [21].

Convolutional networks are special types of neural networks designed to work well with two-dimensional data, such as images and media [22]. As shown in Figure 1, a CNN is structured into several convolutional layers that process an image or other two-dimensional input to discover important information such as edges and corners [23]. The distinction between important and unimportant information is decided by the activation function. That information is provided to the pooling layer, where the spatial size of the convolution is reduced while summarizing and maintaining the important details about the convolution. This, in turn, reduces the computational power needed to process the data because there is less information to process. This is achieved by one or more of several types of pooling functions, such as average and max pooling.

When the network is initialized and the weights of the perceptrons are randomized, the gradient descent method [24] or other optimization algorithms are used to update the weights and bias of the perceptron after every step is taken in the training process. As the network continues to update its weights and biases and reach the minimum of the loss function, diminishing results will be returned from the training process [25]. One method of accelerating the training process involves feeding the input data of a network in batches, as opposed to individual samples. The batch size of a network refers to the number of samples passed into the neural network at a time. For this research, the batch size refers to the number of pairs of cover and hidden images processed by the network for each step of the training process.

3. The SteGuz Approach

The goal of the proposed steganographic method is to embed a colored image into another one with the same size. The resultant stego-image should be visually indistinguishable from the original cover. To achieve this, a CNN system is built using the same structure proposed in [15]. Three individual networks: preparatory, hiding, and reveal network, are trained together as one cohesive unit.

3.1. The Network Architecture

As shown in Figure 2, the preparatory network preprocesses the secret image before the embedding takes place. The preparatory network consists of five two-dimensional convolution layers, with each convolution layer having fifty filters each of 3 × 3, 4 × 4, and 5 × 5 patches. Each patch has a kernel size of five and has a ReLU activation function. The output of the preparatory network is a secret tensor with the dimensions of 224 × 224 × 150. By convolving the secret image with the operations in the preparatory network, the dimensionality of the secret image is expanded, thereby allowing the hiding network to select the most important features for the hiding process. As illustrated in Figure 3, the secret tensor is fed into the hiding network along with the cover image to produce the stego-image, which is then sent to the reveal network that reproduces the secret image. Both the hiding network and reveal network have the same structure as the preparatory network. Before the images are provided to the network, they are first rescaled to 224 × 224 pixels. Each image is full-color, with each color channel occupying eight bits per pixel.

It is worth noting that in [15] a noise layer was added to avoid embedding the secret data inside the LSB of the cover image’s pixels. Although this step increases the robustness against steganalysis, it also increases the distortion level in the stego-images. Therefore, in this research, we chose to remove this layer to further improve the imperceptibility of the hiding results. Furthermore, in their original implementation [15], the input images are normalized using the mean and standard deviation values that were calculated from the images in ImageNet dataset. Those hard-coded values are also used by the denormalization process that takes place after the stego-image is generated. In this research, however, we decided to eliminate those steps to decouple the network structure from the training dataset.

3.2. The Gain Function

The learning process of the method proposed in [15] uses a loss function that is presented in (1) where $c$ represents the cover image, $c^{\prime }$ represents the stego-image, $s$ represents the secret image, and $s^{\prime }$ represents the recovered image. The $\Vert c+c^{\prime }\Vert$ part of the loss function represents the error between the cover and steganographic image and is applied to the preparatory and hiding networks. On the other hand, the $\beta \Vert s-s^{\prime }\Vert$ part of the loss function represents the error between the hidden and extracted image and is applied to all three networks. The parameter $\beta$ represents the prescriptive weight given to the extraction error which directly affects the accuracy of the retrieved image.

$$L\left(c, c^{\prime }, s, s^{\prime }\right)=\Vert c-c^{\prime }\Vert +\beta \Vert s-s^{\prime }\Vert$$

(1)

The loss function defined in (1) is based on the pixel level error of two images which ignores the strong correlations between the pixels that carry important information about the structure of the images. The Structured Similarity Index Measure (SSIM), on the other hand, has been efficiently used to measure the image quality as perceived by the human visual system [10]. In the pursuit of a better visual imperceptibility, the learning goal of our network was altered to focus on maximizing image quality instead of minimizing losses. Therefore, we decided to define a “gain function” as a combination of two image quality measures to consider both the image structure and the similarity of image content. The gain function is expressed as follows:

$$G\left(c, c^{\prime }, s, s^{\prime }\right)=PSNR\left(c,c^{\prime }\right)+PSNR\left(s,s^{\prime }\right)+SSIM\left(c,c^{\prime }\right)+SSIM\left(s,s^{\prime }\right)$$

(2)

The Peak-to-Signal Ratio (PSNR) is computed as the difference between two images and is calculated in (3) which is expressed in terms of the Mean-Square-Error (MSE) as given in Equation (4). Notice that M represents the maximum pixel value, m and $n$ represent the dimensions of the images, $I\left(i,j\right)$ represents the original image pixel values at $\left(i,j\right)$, and $I^{\prime }\left(i,j\right)$ represents the corresponding pixel in the modified image.

$$MSE=\frac{{{\displaystyle \sum }}_{i=1}^m{{\displaystyle \sum }}_{j=1}^n{\left(I\left(i,j\right)-I^{\prime }\left(i,j\right)\right)}^2}{m\ast n}$$

(3)

$$PSNR=10(lo{g}_{10}(\frac{M^2}{MSE}))$$

(4)

On the other hand, the Structured Similarity Index Measure (SSIM) [16] can be measured using Equation (5), where ${\mu }_I$ represents the mean of the original image I while ${\mu }_{I^{\prime }}$ represents the mean of modified image (I′), ${\sigma }_{I{I}^{\prime }}^2$ represents the covariance of I and I′, ${\sigma }_I^2$ represents the mean variance of I, ${\sigma }_{I^{\prime }}^2$ represents the mean variance of I′, and $c_1$ and $c_2$ represent two variables to stabilize division, in the event that the denominator is weak [26]. The value of SSIM ranges between 0 and 1, where a higher value reflects a greater similarity between the two images I and I′.

$$SSIM\left(I,I^{\prime }\right)=\frac{\left(2{\mu }_I{\mu }_{I^{\prime }}+c_1\right)\left(2{\sigma }_{I{I}^{\prime }}+c_2\right)}{\left({\mu }_I^2+{\mu }_{I^{\prime }}^2+c_1\right)\left({\sigma }_I^2+{\sigma }_{I^{\prime }}^2+c_2\right)}$$

(5)

Obviously, the higher the PSNR and SSIM coefficients, the better is the image quality. Furthermore, to optimize the gain/loss function, Adam optimizer was used to train the three networks. The Adam optimizer works well with networks that have large input requirements and has been shown to work well with CNNs [27]. Therefore, the Adam optimizer was used to maximize the gain function described in Equation (2).

3.3. The Model Hyperparameters

The network used in this research was built on an unofficial Python implementation [28] of the method in [15]. The code was revised using the first major version of the Python TensorFlow library. Additional libraries were used in this experiment to include scikit-image for gathering the image metrics [29] and Matplotlib for displaying the images inside the Jupyter Notebook [30]. The hyperparameters were adjusted from the original network as well. The batch size was increased from 8 to 16. The motivation for increasing the batch size was to produce more variation in image details during the training process. The three networks were trained together for ten epochs. However, since the steps taken per epoch were directly correlated to the batch sizes, the original network’s number of steps per epoch was 1784. Since the batch size was doubled in the proposed network, the number of steps per epoch was reduced to 891. The learning rate was slightly increased from 0.0001 to 0.0002. The motivation for increasing the learning rate by a small amount was to speed up the training process, but not so much that the network converges on the wrong solution. In addition, the momentum was decreased from 0.75 to 0.25 to reduce the speed of the training process. In fact, we have noticed that a large momentum value contributed to the “ghosting” effect in the resulting images where the hidden image is slightly visible in the resultant stego-image.

3.4. The Training Dataset

To train and test both the original network and the enhanced network, the Linnaeus 5 [31] and Imagenette [32] datasets were used. Linnaeus 5 is a dataset that contains 6000 square images of five different types of objects. The images in the Linnaeus 5 dataset are saved in a JPG format, with each image having a height and width of 128 pixels. The Imagenette, on the other hand, is derived from the original ImageNet dataset and consists of 9468 images of ten different types of objects. The images provided by the Imagenette dataset were also saved in JPG format but varied widely in height and width.

When the images are supplied to the preparatory and hiding networks, they are first resized to 224 pixels square with the goal of hiding one full-size color image inside another color image of equal size. To enhance the diversity of data during the training process, a randomly selected pair of cover and secret images are used to produce a steganographic image. The generated steganographic image is then used by the reveal network to extract the hidden image and update the network weights. It is important to highlight that the hiding neural network efficiently scattered the secret information throughout the bits of the stego-image which has been simultaneously trained with the reveal network to extract the hidden image.

4. Results

4.1. The Experimental Setup

In our experiments, Google Colaboratory, also referred to as Colab, was used as the code editor and execution environment for training and testing the network. Colab works by hosting the interpretation and execution of Jupyter notebooks on their cloud service, where the Jupyter notebooks are Python-based computational documents. To accelerate the training process, the Pro version of Colab was used, which enabled the use of an Nvidia Tesla T4 or Nvidia Tesla P100 GPU within a high-RAM runtime environment. The space occupied by our model parameters is 34.6 MB.

To showcase the performance of the implemented approach, we choose to use a wide variety of images exhibiting different color and structural details.

Table 1. The images used in experiments.

Cover Images		Secret Images
Baboon	Berries	Graffiti	Karaoke
Chainsaws	Church	Lena	Lotus
Dog	Fish	Parachute	Parrot
French Horn	Garbage Truck	Pens	Peppers
Gas Pump	Golf Balls	Stained Glass	Thistle

shows the 20 images used as covers and secret images throughout the experiments. The images were collected from various sources. Baboon and Lena, for example, are popular choices in the field of image processing. Other images, such as the Karaoke and French Horn, are samples from the datasets used for training the network. There are also a few original images, such as Graffiti and Lotus. For all test cases, the secret image has the same size as the cover image.

4.2. Objective Performance Measures

Although the visual inspection of the resultant images can be used as a basis for evaluating the efficacy of a given steganography technique, it is still a subjective measure that may differ from one person to the other. Hence, a set of standardized metrics are used here to quantitatively measure and compare the performance of the proposed method with several existing methods. The used metrics covers three aspects: The embedding capacity, the hiding effectiveness, and retrieval similarity.

The hiding capacity of an image steganographic technique is usually measured in terms of the bit per pixel (bpp) value. Obviously, a greater bpp means that the technique can hide more information inside the pixels of the cover image. The following equation can be used to compute the bpp where E represents the maximum embedding capacity of the given technique (in bits) and H and W represent the height and width of the cover image (in pixels), respectively [33]:

$$Hiding capacity=\frac{E}{H\ast W}$$

(6)

Throughout the experiments, the Peak-to-Signal Ratio (PSNR) is used to measure the distortion introduced to the resultant stego-image in comparison to the original one. PSNR is computed as the difference between the cover and steganographic images (refer to Equations (3) and (4)) and is measured in decibels (dB). Of course, the higher PSNR value the less the distortion between the two input images which reflects the imperceptibility of the steganographic method. In addition, we choose to measure the accuracy of the extraction process using the Structured Similarity Index Measure (SSIM). Using Equation (5), the value of SSIM ranges between 0 and 1, where a higher value reflects a greater similarity between the secret image and the retrieved one and hence a higher extraction accuracy.

4.3. Experiemental Results

The following set of experiments focus on evaluating the performance of the SteGuz approach in terms of both invisibility and accuracy of extraction. PSNR between the cover and the stego-image is used as a measure of the invisibility and SSIM is used to measure the similarity between the secret image and the retrieved one.

Table 2. The hiding/extraction results of StegGuz vs. the deep Steganography method.

Experiment	SteGuz		Deep Steganography [15]
Graffiti in Baboon	PSNR: 42.85748	SSIM: 0.88449	PSNR: 27.96642	SSIM: 0.87001
Karaoke in Berries	PSNR: 44.33152	SSIM: 0.93213	PSNR: 25.62975	SSIM: 0.85424
Lena in Chainsaws	PSNR: 42.4834	SSIM: 0.91373	PSNR: 29.35	SSIM: 0.91303
Lotus in Church	PSNR: 44.17786	SSIM: 0.90252	PSNR: 29.59204	SSIM: 0.86413
Parachute in Dog	PSNR: 44.72544	SSIM: 0.91306	PSNR: 25.7312	SSIM: 0.93006
Parrot in Fish	PSNR: 44.487	SSIM: 0.92739	PSNR: 25.77007	SSIM: 0.92166
Pens in French Horn	PSNR: 42.45224	SSIM: 0.83423	PSNR: 27.37058	SSIM: 0.77593
Peppers in Garbage Truck	PSNR: 43.06884	SSIM: 0.89151	PSNR: 27.89983	SSIM: 0.89549
Stained Glass in Gas Pump	PSNR: 41.65722	SSIM: 0.81930	PSNR: 25.3442	SSIM: 0.83418
Thistle in Golf Balls	PSNR: 40.16172	SSIM: 0.92120	PSNR: 25.99714	SSIM: 0.87267

shows the PSNR and SSIM values for the 10 test image pairs. In addition, the table shown the same metrics evaluated on the results of the original method in [15].

The results in Table 2 shows that the changes proposed in the network structure implemented in SteGuz has a strong impact not only on imperceptibility but also on recoverability. When compared side-by-side, the stego-images generated by SteGuz were visually indistinguishable, while the steganographic images generated by the original network clearly exposed details of the hidden image. A close examination reveals that some details of the secret image, such as edges and corners, are visually perceptible in the stego-image produced by the original method. In most of the test cases, the PSNR values were significantly improved in SteGuz when compared to the results from the original method. The average value of PSNR for SteGuz were 43.04027 dB. On the other hand, the experiments on the original method resulted in the average of 28.69137 dB for PSNR, based on an example figure provided by the author of the original implementation. When trained on the Imagenette and Linnaeus 5 datasets, the averages of PSNR computed for the original method slightly dropped to 27.69137 dB. The reason behind this is the normalization step that is hard-coded based on the parameters collected from the ImageNet dataset.

The recoverability of the proposed network was improved as well in SteGuz when compared with the original network. Comparing the extracted images from the original and proposed networks revealed that the original method’s extraction process lost some of the sharpness and minute details of the image. Additionally, extracted images contained a distorted, wave-like pattern. In Table 2, the sample extracted image generated by the original method resulted in an average of 0.84422 for the SSIM values. The proposed StegGuz approach improved slightly on the similarity between the hidden and extracted image with a SSIM value of 0.87402. Visually, the extraction process of the proposed network succeeded in maintaining the sharpness and the fine details of the recovered image. However, the contrast of the extracted images was noticeably reduced, and the extracted images were slightly grainy.

In conclusion, the results of the experiments strongly support that the changes introduced by the proposed methodology greatly improved the quality of the imperceptibility of the hiding process without sacrificing much in terms the quality of the extracted image. In fact, this trade-off reflects the choice we made when setting the hyperparameters of the networks which highly valued the security of the transmission process over the precise extraction of the hidden information.

5. Discussion

To further discuss the performance of the proposed method, we compare it with several existing methods. Comparison of their performance is carried out from two aspects: objective quantitative metrics (PSNR and SSIM) and the hiding capacity. In the case of image covers, the hiding capacity is measured in bit-per-pixel (bpp) which reflects the maximum message size that might be embedded into an image.

Table 3. A performance comparison with some existing techniques.

Method	Approach	Cover/Secret Images	Image Dataset	Cover vs. Stego-Image PSNR (db)	Secret vs. Retrieved Image Similarity	Hiding Capacity (bpp)
LSB	Spatial		N/A	35.28	1	12
TDHN [36]	CNN		NWPU-RESISC45	40.3	0.98	24
FCDNet [34]	FC-DenseNet		ImageNet	40.196	0.984	23.96
SteganoCNN [37]	CNN		ImageNet	21.614	0.855	48
Deep Stego [15]	CNN		ImageNet	28.69	0.73	24
SteGuz	CNN		Linnaeus 5/Imagenette	44.33	0.93	24

shows the methods as named by their authors in their respective publications. The table also shows the images used in their experiments and, whenever possible, the dataset where those images were collected. An exception is the LSB method which is a classical image steganographic approach. The results given here are based on the authors’ implementation of the algorithm. Four bits per each pixel color are utilized for hiding a secret image. If the image doesn’t undergo any compression or noise addition, the extracted image should be identical to the originally embedded one. This means 100% similarity or SSIM of 1.

The results show that SteGuz offers the highest imperceptibility among all the listed methods while maintaining a high accuracy in retrieving the hidden secret image. Except for the LSB method, all methods retrieve an approximation of the secret image. The highest SSIM value between the secret and the extracted images was achieved by FCDNet [34] and yet is less than our method. Furthermore, SteGuz outperformed all other methods in terms of the hiding capacity except for SteganoCNN which offers double the capacity achieved by our method. To achieve this, however, SteganoCNN sacrifices the hiding imperceptibility which is obviously the lowest among the listed methods.

There are several ways in which this work can be improved. The Python code for the proposed network was written using the first version of TensorFlow. Created by Google Brain, TensorFlow 1.0 was released by in 2017 and its successive major revision, TensorFlow 2.0, was released in 2019 [35]. Converting the existing code to TensorFlow 2.0 will benefit from the changes made to the library and improve the accuracy of the results. To reduce the risk of overfitting, one can try different activation functions or use a larger dataset with a greater variety of images for training the network. Another avenue for future work would be testing the proposed methodology using standard steganalysis techniques to quantify the possibility of detecting the presence of a hidden message.

6. Conclusions

In this research, the fields of digital image steganography and convolutional neural networks were explored to develop an enhanced version of the method in [15]. The original method is considered the state-of-art deep-learning-based image steganography. The proposed method (named SteGuz) used the same network structure which consists of three networks that are trained as one unit. However, significant changes have been made to improve the imperceptibility of the hiding process. The main contributions are: (1) the removal of the image normalization/denormalization steps, (2) careful tuning of the network hyperparameters, (3) removing the noise layer, and (4) replacing the loss function with a gain function that prioritizes the similarity of the cover and hidden images over the reduction of the error between the input and generated images. Experimental results showed that the proposed method succeeded in providing higher impressibility as well as better retrieval accuracy than the original one. When compared with several existing methods, SteGuz outperformed their imperceptibility results without sacrificing the accuracy of the extracted image.