We describe a novel general strategy for building steganography detectors for digital images. The process starts with assembling a rich model of the noise component as a union of many diverse submodels formed by joint distributions of neighboring samples from quantized image noise residuals obtained using linear and nonlinear high-pass filters. In contrast to previous approaches, we make the model assembly a part of the training process driven by samples drawn from the corresponding cover- and stego-sources. Ensemble classifiers are used to assemble the model as well as the final steganalyzer due to their low computational complexity and ability to efficiently work with high-dimensional feature spaces and large training sets. We demonstrate the proposed framework on three steganographic algorithms designed to hide messages in images represented in the spatial domain: HUGO, edge-adaptive algorithm by Luo , and optimally coded ternary ±1 embedding. For each algorithm, we apply a simple submodel-selection technique to increase the detection accuracy per model dimensionality and show how the detection saturates with increasing complexity of the rich model. By observing the differences between how different submodels engage in detection, an interesting interplay between the embedding and detection is revealed. Steganalysis built around rich image models combined with ensemble classifiers is a promising direction towards automatizing steganalysis for a wide spectrum of steganographic schemes.

/pdf/rich-models-for-steganalysis-of-digital-images-4osa224324.pdf

Rich Models for Steganalysis of Digital Images

The rapid progress in synthetic image generation and manipulation has now come to a point where it raises significant concerns for the implications towards society. At best, this leads to a loss of trust in digital content, but could potentially cause further harm by spreading false information or fake news. This paper examines the realism of state-of-the-art image manipulations, and how difficult it is to detect them, either automatically or by humans. To standardize the evaluation of detection methods, we propose an automated benchmark for facial manipulation detection. In particular, the benchmark is based on Deep-Fakes, Face2Face, FaceSwap and NeuralTextures as prominent representatives for facial manipulations at random compression level and size. The benchmark is publicly available and contains a hidden test set as well as a database of over 1.8 million manipulated images. This dataset is over an order of magnitude larger than comparable, publicly available, forgery datasets. Based on this data, we performed a thorough analysis of data-driven forgery detectors. We show that the use of additional domain-specific knowledge improves forgery detection to unprecedented accuracy, even in the presence of strong compression, and clearly outperforms human observers.

/pdf/faceforensics-learning-to-detect-manipulated-facial-images-535z96cczo.pdf

FaceForensics++: Learning to Detect Manipulated Facial Images

Currently, the most successful approach to steganography in empirical objects, such as digital media, is to embed the payload while minimizing a suitably defined distortion function. The design of the distortion is essentially the only task left to the steganographer since efficient practical codes exist that embed near the payload-distortion bound. The practitioner’s goal is to design the distortion to obtain a scheme with a high empirical statistical detectability. In this paper, we propose a universal distortion design called universal wavelet relative distortion (UNIWARD) that can be applied for embedding in an arbitrary domain. The embedding distortion is computed as a sum of relative changes of coefficients in a directional filter bank decomposition of the cover image. The directionality forces the embedding changes to such parts of the cover object that are difficult to model in multiple directions, such as textures or noisy regions, while avoiding smooth regions or clean edges. We demonstrate experimentally using rich models as well as targeted attacks that steganographic methods built using UNIWARD match or outperform the current state of the art in the spatial domain, JPEG domain, and side-informed JPEG domain.

/pdf/universal-distortion-function-for-steganography-in-an-3uayce1tdz.pdf

Universal distortion function for steganography in an arbitrary domain

The rapid progress in synthetic image generation and manipulation has now come to a point where it raises significant concerns for the implications towards society. At best, this leads to a loss of trust in digital content, but could potentially cause further harm by spreading false information or fake news. This paper examines the realism of state-of-the-art image manipulations, and how difficult it is to detect them, either automatically or by humans. To standardize the evaluation of detection methods, we propose an automated benchmark for facial manipulation detection. In particular, the benchmark is based on DeepFakes, Face2Face, FaceSwap and NeuralTextures as prominent representatives for facial manipulations at random compression level and size. The benchmark is publicly available and contains a hidden test set as well as a database of over 1.8 million manipulated images. This dataset is over an order of magnitude larger than comparable, publicly available, forgery datasets. Based on this data, we performed a thorough analysis of data-driven forgery detectors. We show that the use of additional domainspecific knowledge improves forgery detection to unprecedented accuracy, even in the presence of strong compression, and clearly outperforms human observers.

This paper presents a new approach to defining additive steganographic distortion in the spatial domain The change in the output of directional high-pass filters after changing one pixel is weighted and then aggregated using the reciprocal Holder norm to define the individual pixel costs In contrast to other adaptive embedding schemes, the aggregation rule is designed to force the embedding changes to highly textured or noisy regions and to avoid clean edges Consequently, the new embedding scheme appears markedly more resistant to steganalysis using rich models The actual embedding algorithm is realized using syndrome-trellis codes to minimize the expected distortion for a given payload

/pdf/designing-steganographic-distortion-using-directional-547n80etfg.pdf

Designing steganographic distortion using directional filters

Today, the most accurate steganalysis methods for digital media are built as supervised classifiers on feature vectors extracted from the media. The tool of choice for the machine learning seems to be the support vector machine (SVM). In this paper, we propose an alternative and well-known machine learning tool-ensemble classifiers implemented as random forests-and argue that they are ideally suited for steganalysis. Ensemble classifiers scale much more favorably w.r.t. the number of training examples and the feature dimensionality with performance comparable to the much more complex SVMs. The significantly lower training complexity opens up the possibility for the steganalyst to work with rich (high-dimensional) cover models and train on larger training sets-two key elements that appear necessary to reliably detect modern steganographic algorithms. Ensemble classification is portrayed here as a powerful developer tool that allows fast construction of steganography detectors with markedly improved detection accuracy across a wide range of embedding methods. The power of the proposed framework is demonstrated on three steganographic methods that hide messages in JPEG images.

/pdf/ensemble-classifiers-for-steganalysis-of-digital-media-14urqbpk2p.pdf

Ensemble Classifiers for Steganalysis of Digital Media

Currently, the most successful approach to steganography in empirical objects, such as digital media, is to cast the embedding problem as source coding with a fidelity constraint. The sender specifies the costs of changing each cover element and then embeds a given payload by minimizing the total embedding cost. Since efficient practical codes exist that embed near the rate-distortion bound, the remaining task left to the steganographer is the fidelity measure - the choice of the costs. In the past, the costs were obtained either in an ad hoc manner or determined from the effects of embedding in a chosen feature space. In this paper, we adopt a different strategy in which the cover is modeled as a sequence of independent but not necessarily identically distributed quantized Gaussians and the embedding change probabilities are derived to minimize the total KL divergence within the chosen model for a given embedding operation and payload. Despite the simplicity of the adopted model, the resulting stegosystem exhibits security that is comparable to current state-of-the-art methods methods across a wide range of payloads.

/pdf/multivariate-gaussian-model-for-designing-additive-301hbtqtr7.pdf

Multivariate gaussian model for designing additive distortion for steganography

A modern direction in steganography calls for embedding while minimizing a distortion function defined in a sufficiently complex model space. In this paper we show that, quite surprisingly, even a high-dimensional cover model does not automatically guarantee immunity to simple attacks. Moreover, the security can be compromised if the distortion is optimized to an incomplete cover model. We demonstrate these pitfalls with two recently proposed steganographic schemes and support our arguments experimentally. Finally, we discuss how the corresponding models might be modified to eliminate the security flaws.

/pdf/on-dangers-of-overtraining-steganography-to-incomplete-cover-5fkatsij62.pdf

On dangers of overtraining steganography to incomplete cover model

Quantitative steganalysis strives to estimate the change rate defined as the relative number of embedding changes introduced by steganography. In this paper, we propose two new classes of quantitative steganalysis methods for the steganographic algorithm Jsteg. The first class obtains the change-rate estimate using a maximum likelihood estimator equipped with a precover model. While this approach provides better accuracy than existing structural attacks, it becomes computationally intractable with increasing complexity of the cover model. The second class of methods computes the change-rate estimate by minimizing an objective function constructed from a heuristically formed zero message hypothesis. The advantage of this heuristic approach is a low implementation complexity and modular architecture that allows flexible incorporation of higher order statistics of discrete cosine transform coefficients. The proposed methods are experimentally compared with current state-of-the-art methods.

/pdf/quantitative-structural-steganalysis-of-jsteg-2dnbb6ow7t.pdf

Jan Kodovsky

Papers

Rich Models for Steganalysis of Digital Images

Ensemble Classifiers for Steganalysis of Digital Media

Multivariate gaussian model for designing additive distortion for steganography

On dangers of overtraining steganography to incomplete cover model

Quantitative Structural Steganalysis of Jsteg