Image steganography is a technique to hide secret message into cover images via modifying some image components in an imperceptible manner. On the contrary, image steganalysis aims to detect the existence of secret message hidden by image steganography. During the past decade, many effective steganography methods have been proposed with the development of the steganalytic techniques.
Image steganography can be divided into two categories, that is, spatial steganography and JPEG steganography. In modern research, both of them are usually designed under the framework of distortion minimization , in which the design of embedding cost is the key issue. Typically, the embedding cost tries to measure the statistical detectability of each embedding unit (i.e. pixel or DCT coefficient). The smaller the embedding cost, the more likely the corresponding unit will be modified during the subsequent operation of Syndrome-Trellis Codes (STCs) . Up to now, there are many effective cost have been proposed in spatial domain. Most of them such as HUGO , WOW , S-UNIWARD , HILL  and MIPOD  adopt an additive cost, meaning that they assume the embedding impact for each unit is independent. Some methods such as CMD , Synch  and DeJoin  improve the existing additive cost via sequentially embedding message and updating the cost to synchronize the modification direction. These methods usually achieve better security performance since the mutual impacts of adjacent embedding units are taken into consideration. For JPEG steganography, the additive cost-based methods include UED , J-UNIWARD , UERD , BET , and the non-additive one includes BBC , which aims to preserve the spatial continuity at block boundaries. To enhance security, some other steganography methods aim to adjust existing costs via highlighting the details in an image [5, 6] or reassigning lower costs to controversial units [37, 36]. Recently, some deep learning techniques such as Generative Adversarial Network (GAN)  and adversarial example  have been applied in steganography. For instance, ASDL-GAN  and UT-GAN [32, 33] can learn costs that are directly related to the undetectability against the steganalyzer. ADV-EMB  and method 
adjust the costs according to the gradients back-propagated from the target Convolutional Neural Network (CNN)-based steganalyzer.
Note that above steganography methods mainly focus on designing embedding costs, and usually employ the STCs to minimize the total costs in subsequent data hiding. However, most existing embedding costs seem empirical, which would not be effective to measure the statistical detectability of embedding units. In addition, minimizing the total costs using STCs would not always produce high security stegos. Unlike existing works, we propose a novel framework to enhance the security of current steganography methods both in spatial and JPEG domains via stego post-processing, which aims to reduce the residual distance between cover and modified stego. We firstly formulate the stego post-processing as a non-linear integer programming problem, and solve it using a heuristic search method - Hill Climbing. To achieve good security performance, the adaptive filters for obtaining image residuals and the distance measure are carefully designed. In addition, four acceleration strategies according to the characteristics of post-modification are considered to speed up our algorithm. Experimental results show that the proposed method can significantly enhance the security performance of the existing steganography methods, especially when the payloads and/or quality factors are large. Note that this paper is an extension of our previous work . Compared to the work , the main differences of this paper are as follows. 1) Instead of using a fixed filter in  to obtain image residuals, in this paper, we design multiple adaptive filters which can better suppress image content while preserve the artifacts left by steganography; 2) The proposed method significantly accelerates the post-processing via restricting the position of modified units, the direction and amplitude of modification, and adopting a fast method for convolution. 3) More extensive experimental results and analysis are given in this paper. For instance, we include both conventional and deep learning steganalytic models for security evaluation. We provide more analysis on statistical characteristics of post-modification and the processing time. In addition, both spatial and JPEG steganography methods and more image datasets are inlcued in this paper. 4) The extensive experimental results show that the proposed method can achieve higher security than the work .
Ii Robustness Analysis of STCs
Most current steganographic methods are constructed under the framework of distortion minimization. After the embedding costs are carefully designed, some coding methods are then used to embed secret message into cover image in order to minimize the total cost. In practical applications, STCs is widely used in modern steganography methods both in spatial and JPEG domains. Since the extraction of hidden message after using the proposed method is related to STCs, we will give a brief overview of STCs and its robustness against post-modification in the following.
Ii-a Review of Syndrome-Trellis Codes
STC is one of the popular coding methods which is able to embed secret message into the cover image efficiently while approaching the optimal coding performance. It can be used to solve binary or non-binary embedding problem under the steganography framework of distortion minimization. For binary problem, the message embedding and extraction for spatial steganography 111Similar results can be obtained for JPEG steganography. can be formulated as follows:
where is the function for message embedding. is the function for message extraction. is a cover image. is a stego image. is a secret message. is a parity function such as . is a parity-check matrix of a binary linear code . is the coset corresponding to syndrome . STCs constructs the parity-check matrix by placing a small submatrix along the main diagonal. The height of the submatrix is a parameter that can be used to balance the algorithm performance and speed. Using parity-check matrix constructed in this way, equation (1) can be solved optimally by Viterbi algorithm with linear time and space complexity w.r.t. , which is the dimension of .
For the q-ary (q 2) embedding problem, STCs solves it efficiently via multi-layered construction. It decomposes the q-ary problem into a sequence of similar binary problem and then applies the above solution for binary problem. The q-ary problem can be solved optimally if each binary problem is solve optimally. For more details of STCs, please refer the paper .
Ii-B Analysis of Robustness of STCs
From equation (2), the value of extracted message is determined by and . In a covert communication, since is fixed for a cover image, the message extraction completely relies on . Therefore, if there exists a modification matrix such that , we can extract exactly the same secret message from and , which shows the robustness of STCs against the modification in this case. Generally, image steganography embeds message into lower bits of the cover image for not introducing visually perceptible artifacts. Therefore, the parity function of q-ary STCs returns the to LSBs of the input image, where . Based on this characteristic, q-ary STCs’ robustness against post-modification can be formulated as follows:
where and are matrices of the same size , denotes the element of the modification matrix
Taking a stego image obtained by ternary STCs (i.e. ) for example, in this case, . , . Therefore, we conclude that adding a multiple of 4 to any elements of the stego image will not confuse the message extraction at all.
Iii Proposed Framework and Method
In this section, we first describe the framework of stego post-processing, and then present some implementation details, including the selection of some important parameters and four strategies to speed up processing. Finally, we will give the full description of the proposed algorithm under this framework.
Iii-a Framework of Stego Post-processing
As shown in Fig. 1, the current steganography firstly designs costs for all embedding units of a cover image, and then uses STCs to embed secret message into cover to get the resulting stego. Quite different from the existing works, the proposed framework aims to enhance the steganography security via reducing image residual distance between cover and stego using stego post-processing. Since most current steganography methods, such as HILL  and UERD , employ ternary STCs for data embedding, the ternary case (i.e. ) is considered in our experiments. Please note that it is easy to extend our method for different .
Iii-A1 Main Idea of Stego Post-processing
It is well known that the steganography will introduce detectable artifacts into image residuals, and thus most effective steganalyzers based on hand-crafted features (e.g. SRM , GFR ) and deep learning (e.g. Xu-Net , Ye-Net , and J-Xu-Net ) are mainly based on analyzing image residuals in spatial domain. As illustrated in Fig. 2
, these steganalytic methods usually contain 3 components, that is, high-pass filters to obtain image residuals, feature extraction operator of image residuals and a classifier based on the features. Since the steganography signal is rather weak compared to image content, good high-pass filters can effectively suppress image content and improve the signal-to-noise ratio (note that for steganalysis, noise here is image content), which is very helpful for steganalysis. From this point of view, if the image residual distance between cover and modified stego image is smaller, the security performance is expected to be better. Therefore, the main idea of the proposed framework is to reduce such distance via stego post-processing. Combined with the robustness analysis on STCs in sectionII-B, the proposed stego post-processing can be formulated as the following optimization problem:
where 222For spatial steganography, and denote pixel values of the corresponding images. For JPEG steganography, they denote the DCT coefficients. The image residual is obtained and analyzed in spatial domain both for spatial and JPEG steganography. denotes the image residual of image in spatial domain, denotes the distance between two image residuals and ; is a cover image, is a stego image obtained with an existing steganography method, is a modified version of with our post stego-processing; is an integer matrix; denotes the available range of embedding units of . Taking spatial steganography for instance, every unit in should be an integer in the range of .
Note that the proposed framework tries to modify a resulting stego obtained with an existing steganography method under the framework of distortion minimization, thus any modification on will inevitably increase the total distortion. However, we expect that the steganography security would become better since the residual distance between cover and the resulting stego is reduced after stego post-processing.
Iii-A2 Implementation of the Framework
Since the modifications are limited on integers, and the distance function is usually non-linear, the optimization problem described in the previous section is a non-linear integer programming, which is very hard to find the optimal solution. In our experiments, we employ a greedy algorithm, i.e., Hill Climbing, to find an approximate solution. Specifically, from an initial stego , we sequentially process the embedding units one by one to iteratively reduce its residual distance to cover until all embedding units are dealt with.
Fig. 3 illustrates how the proposed method updates a target embedding unit within a stego image. Let denote cover, denote the candidate stego which is initialized as the stego with an existing steganography method, denote the temporary variable for the modified version of after changing a target unit according to the rule described in section II (i.e. ). By doing so, we can assure that the secret messages extracted from and are exactly the same after modification. To determine whether the modified stego is better than the candidate one , we firstly apply function on cover image and two stego images , , and get the corresponding image residuals , and separately. And then we calculate the distance between the residual of cover and the two image residuals and separately according to a certain function, denoted as and . Finally, we will update the candidate stego as the temporary if , otherwise we keep unchanged.
We repeat the above operations for all embedding units, and the whole pseudo-code of the proposed framework is illustrated in Algothrim 1. The inputs of the algorithm are cover and the corresponding stego using an existing steganography method. The algorithm first initializes the candidate stego as , and then updates using three loops. In the first loop (i.e. line 6 - 22), it traverses all the embedding units row by row. In the second loop (i.e. line 7 - 21), it considers the direction of post-modification to an embedding unit (positive or negative ). In the third loop (i.e. line 8 - 20), it considers different amplitudes of post-modification to an embedding units (e.g. ). After the three loops, the algorithm finally outputs a modified stego , which usually has smaller residual distance compared with the input stego .
The residual function in Algorithm 1 is the key issue that would significantly affect the security performance of the proposed framework. In the following, we will discuss the design of adaptive filter.
As described in section III-A1, most modern steganalytic features are mainly derived from image residuals. Thus, the selection of high-pass filters is very important for steganalysis. Until now, there are many available filters in existing works, such as various filters in SRM  and GFR . Note that these filters are fixed for all images. Inspired from , we employ an adaptive way to learn high-pass filters for each image. Specifically, we first compute the convolution of the image with a prediction filter whose center element is 0, which amounts to predicting target pixels via their surrounding pixels; and then we determine the elements in the prediction filter by minimizing the mean square error between the predicted pixels and actual ones via lease squares; finally, we set the center of prediction filter as -1 to obtain the final filter, which calculate the residual between the predicted and actual values. Different from work  which learns a filter of size () with symmetry constraint, we first learn a base filter of size without symmetry constraint for any given image and its transposed version. Thus, the resulting basic filter (denoted as ) is a predictor of horizontal direction while its transposed version is a predictor of vertical direction. And then we get the outer product of and , denoted as , which can calculate the residual based on the prediction of both horizontal and vertical directions. In our method, we can obtain different residual functions via the combination of the elements in set with different size . Based on our experiments, we finally select the filters of size 7 for spatial steganography while filters of size 3 for JPEG steganography. More experimental results on the hyper-parameter selection are shown in section IV-A.
In Algorithm 1 (line 12-13), the distance function is used to measure the residual distance between cover and stego. Different distances will lead to different post-modification, and thus affect security performance. We have tested several typical distance measures, including Manhattan, Euclidean, Chebychev and Hamming, and found that the Manhattan distance usually performs well on various steganography methods in both spatial and JPEG domains. Thus, we employ the Manhattan distance in all following experiments.
Iii-B Acceleration Strategies
Several issues would significantly affect the processing time of the proposed Algorithm 1. First of all, there are three nested loops. The first loop will traverse all embedding units of the input stego . Taking an image of size for example, there are totally 262144 () units to be dealt with. For each unit, two directions (i.e. positive or negative in the second loop) and different amplitudes (i.e. 4, 8, , in the third loop) of the modification need to be considered. If we can reduce the iteration number of these loops, the algorithm speed will be improved. Furthermore, the filtering operation to get image residuals in the innermost loop is time-consuming. As a result, a fast method for filtering is needed. In the following sections, we will describe four acceleration strategies separately.
Iii-B1 Restriction on Position of Post-Modification
To reduce the number of embedding units to be dealt with in the first loop, we conduct the following experiment. Let be the set of all embedding units of the output image , be the set of units have been modified by steganography while be the complement of , be the set of units have been modified by our post-processing while be the complement of . The four following statistics are considered.
Table I and Table II show the average results on 10,000 images from BOSSBase  for various steganography methods both in spatial and JPEG domains. From Tables I and II , we obtain two following observations.
: The steganography modification rate is relatively lower. In this experiment, less than 11% for spatial steganography for payload 0.4 bpp, and less than 4% for JPEG steganography for payload 0.4 bpnz.
: For those embedding units modified by the stego post-processing (i.e. ), more of them are located at the small set of . Taking S-UNIWARD for instance, over 65% of post-modification are located at the set of , which occupies only 7.39% of all units.
Based on above observations, we consider dealing with those embedding units that have been previously modified with the steganography (i.e. ) while skipping most unchanged units.
|75||1.36 (68.18)||1.26 (52.26)||1.28 (50.22)|
|98.64 (31.82)||98.74 (47.74)||98.72 (49.78)|
|95||3.65 (65.30)||3.47 (54.67)||3.45 (53.70)|
|96.35 (34.70)||96.53 (45.33)||96.55 (46.30)|
Iii-B2 Restriction on Direction of Post-Modification
In the previous section, we limited the post-modification to be performed on those embedding units which have been modified with steganography. To speed up the second loop, we will analyze the relationship between the directions (i.e. or ) of post-modification and steganography modification. We divide into two subsets according to its modification direction, denoted as and ; Similarly, we divide into two subsets according to its modification direction, denoted as and . Two following statistics are considered.
Table III and Table IV show the average results on 10,000 images from BOSSBase  in different cases. From the two tables, we observe that the direction of post-modification is usually contrary to that of steganography modification. On average, is over 98% and over 86% for spatial and JPEG steganography separately. In our method, therefore, we will limit the direction of post-modification. This property is reasonable since the detectable artifacts left by steganography usually become more obvious when the direction of post-modification is the same as that of steganography modification.
Iii-B3 Restriction on Amplitude of Post-Modification
In section II-B, we showed that adding a multiple of 4 to any embedding unit of the stego image would not confuse the message extraction. However, most existing literatures have shown that the security performance of steganography usually becomes poorer when the steganography modification becomes relatively larger. To enhance steganography security, we expect that most amplitudes of the post-modification are the smallest ones, i.e. 4, for the ternary STCs. To investigate this, we divide into two subsets according to whether the post-modification amplitude is equal to or larger than 4, denoted as and separately. The two following statistics are considered in this experiment.
Table V and Table VI show the average results on 10,000 images from BOSSBase  in different cases. From the two tables, we observe that almost all amplitudes of the post-modification are 4. On average, is 100% and over 98% for spatial and JPEG steganography separately, which fits our expectations very well. Therefore, we limit the amplitude for the post-modification to 4 in our method.
Iii-B4 Efficient Convolution
In the three previous subsections, we try to reduce the loop count of the three loops in Algorithm 1 separately. In this section, we will speed up the key operation - i.e. the function to obtain image residual in the innermost loop (i.e. line 11) in Algorithm 1.
In section III-A3, we determine to employ several adaptive convolution filters with a smaller size (i.e. or , which is significantly smaller than the image size and , i.e. in our experiments) to update image residual of temporary stego . Please note that the convolution is linear and it just affects a small region of embedding units that around the filter center. Thus, there is no need to perform the convolution on the whole temporary stego to obtain its residual, since just an element within is different from the candidate stego (refer line 9-10 in Algorithm 1). An equivalent and efficient method is employed in our method. When the image residual of is available (i.e. ), the image residual of can be calculated based on the following formula:
where is a matrix of the same size , and its elements are all 0 except that the element at position is 1.
Due to the characteristic of matrix , it is very fast to get the via modifying a small region corresponding to the position within , that is, a region of size for spatial steganography or a region of size 333Note that here: 1). The Inverse Discrete CosineTransform (IDCT) in JPEG decompression is linear. 2) Modifying a DCT coefficient in JPEG will affect an image block in spatial domain. for JPEG steganography. By doing so, we can obtain over 500 times acceleration both in spatial and JPEG steganography based on our experiments.
Iii-C The Proposed Method
The pseudo-code for the proposed stego post-processing is illustrated in Algorithm 2. According to the first three acceleration strategies, we observe that only one loop (i.e. line 6-20 in Algorithm 2) is remaining here compared to Algorithm 1, and most embedding units in this loops will be skipped (i.e. line 10-12 in Algorithm 2). According to the analysis in Section III-B - 4), the execution time is unbearable without using the fast method for obtaining temporary image residual . Thus the fast method is employed in both Algorithm 1 and Algorithm 2. For a fair comparison, both algorithms are implemented with Matlab and on the same server with CPU Intel Xeon Gold 6130. The processing time and the security performance of two algorithms would be evaluated in the following.
Iii-C1 Comparison on Processing Time
In this experiment, we will compare the processing time of the algorithm before and after using the first three acceleration strategies. Four spatial steganography methods and three JPEG steganograpy methods are considered 444Please refer to Section IV for more details about the experimental settings.. The comparative results are shown in Table VII and Table VIII. From the two tables, we observe that the processing time of the proposed method (i.e. Algorithm 2) is significantly shorter than the original one (i.e. Algorithm 1). On average, we gain over 12 and 9 times speed improvement for the spatial and JPEG steganography separately.
Iii-C2 Comparison on Security Performance
In this experiment, we will compare the security performances of Algorithm 1 and Algorithm 2. The experimental results are shown in Table IX and Table X. From the two tables, we observe that both algorithms can enhance the steganography security in all cases. Although we have significantly simplified the Algorithm 1 for acceleration, the performance of Algorithm 2 would not drop. On the contrary, it is able to outperform Algorithm 1 slightly on average.
Iv Experimental Results and Discussions
In our experiments, we collect 10,000 gray-scale images of size from BOSSBase , and randomly divide them into two non-overlapping and equal parts, one for training and the other for testing. Like most existing literatures, we use the optimal simulator for data embedding. Four typical spatial steganography methods (i.e. S-UNIWARD , MIPOD , HILL  and CMD-HILL ) and three typical JPEG steganography methods (i.e. J-UNIWARD , UERD  and BET-HILL ) are considered. The spatial steganalytic detectors include two conventional feature sets (i.e. SRM , maxSRM ) and a CNN-based one (i.e. Xu-Net ). Similarly, the JPEG steganalytic detectors also include two conventional ones (i.e. GFR , SCA-GFR  ) and a CNN-based one (i.e. J-Xu-Net ). The ensemble classifier  is used for conventional steganalytic features.
Iv-a Hyper-Parameter Selection
The residual function is the key issue in the proposed algorithm that will significantly affect the security performance. We employ several adaptive filters to get image residuals. In this section, we try to select proper hyper-parameter about the adaptive filters, including the adaptive filter set and the size of basic filter .
Iv-A1 Adaptive Filter Set
As described in section III-A3, we first learn a basic filter for each image, and then produce two filters via transpose and outer product, and then we obtain three adaptive filters, that is, , and . For simplification, three combinations of above filters are evaluated, that is, , and . In addition, the filter size of is fixed as 3 in this experiment, and the steganalytic features SRM and GFR are used for security evaluation for the spatial (0.4 bpp) and JPEG steganography (0.4 bpnz) separately. The detection accuracies evaluated on test set are shown in Table XI and Table XII. From Table XI, we observe that the three filter sets can improve the security performance of the four spatial steganography methods except using the filter on CMD-HILL. On average, the set achieves the best performance, and it gains an average improvement of 0.97% compared to the baseline steganpgraphy. From Table XII, we observe and can improve the security performance while will significantly drop the performance. On average, the filter set performs the best and it achieves an improvement of around 1.90% for both quality factors. The above results show that different adaptive filter sets have a great influence on security performance. The filter sets and usually perform the best in spatial and JPEG domain separately.
Iv-A2 Size of Basic Filter
In previous section, we fixed the size of basic filter as 3, and selected the proper filter set for spatial and JPEG steganography separately. In this section, we first fixed the selected filter set, and evaluate their performances with different sizes of the basic filter , including . The detection accuracies are shown in Table XIII and Table XIV. From the two tables, we observe that the four filter sizes can improve the performance of various steganography methods in both spatial and JPEG domains. In spatial domain, the average performance becomes the best when the size of is 7 instead of 3, which will further gain an improvement of 1.10%. In JPEG domain, the proper size of is still 3 based on our experiments.
We should note that the hyper-parameter determined previously is just a suboptimal solution. Due to time constraint, we probably find a better solution via brute force method according to several important issues, such as the combinations of adaptive filters with different sizes, the specific steganography with a given payload, and the steganalytic models under investigation and so on. For simplicity, we just apply the filter setwith filter size for spatial steganography, and the filter set with filter size for JPEG steganography for all embedding payloads and steganalytic models in the following section.
Iv-B Steganography Security Evaluation
In this section, we will evaluate the security performance on different steganography methods for different payloads ranging from 0.1 bpp/bpnz to 0.5 bpp/bpnz. Three different steganalyzers in spatial domain, including SRM , maxSRM , and Xu-Net , and three steganalyzers in JPEG domain, including GFR , SCA-GFR , and J-Xu-Net , are used for security evaluation. The average detection accuracies on test set are shown in Table XV and Table XVI. From the two tables, we obtain the three following observations:
Almost in all cases, the proposed method can effectively improve the steganography security both in spatial and JPEG domains. The improvement usually increases with increasing embedding payload.
In spatial domain, we can achieve greater improvements on MIPOD and HILL compared to S-UNIWARD and CMD-HILL. Taking the payload of 0.5 bpp for instance, we obtain about 3% improvement on both MIPOD and HILL, while less than 2% for two other steganography methods under two hand-crafted steganalytic feature sets, i.e. SRM and maxSRM. Furthermore, the proposed method seems more effective to the CNN-based steganalyzer (i.e. Xu-Net). For instance, we can obtain about 5% improvement for MIPOD and HILL for the payload of 0.5 bpp, which is a significant improvement on current steganography methods.
Fig. 4: The violin plots of the relative post-modification rates for HILL and BET-HILL
In JPEG domain, the proposed method can gain more improvement on UERD and BET-HILL compared to J-UNIWARD. Taking the payload 0.5 bpnz and for instance, it obtain an improvement of about 3% for both UERD and BET-HILL under the steganalytic feature GFR, while only 1.65% for J-UNIWARD. In addition, the proposed method seems less effective to CNN-based steganalyzer (i.e. J-Xu-Net) compared to the hand-crafted feature sets. In some cases, the security will drop slightly (less than 0.15%) after using the proposed method.
Iv-C Analysis on Post-Modification
In this section, we will analyze some statistical characteristics on the post-modification with our method, including the relative modification rate and its relation to the density of steganography modification.
Iv-C1 Relative Post-Modification Rates
We first defined the relative post-modification rate to cover (denoted as , i.e. steganography modification rate) and the relative post-modification rate to steganography modification (denoted as ) are as follows:
where denote the set of embedding units in cover, stego, and the modified version with the proposed method separately. Note that since we limit the stego post-modification on those units that have been modified with the corresponding steganography; since the number of embedding units is the same for the three images. Table XVII and Table XVIII show the average results evaluated on 10,000 images from BossBase. From the two tables, we observe that will increase with increasing (and embedding payloads), and is usually less than 6% and 9% for spatial and JPEG steganography separately.
We further define the relative post-modification rate to stego (denoted as ) as follows:
Taking HILL for example, the average value of is around ‱) when the embedding payload is 0.5 bpp. Fig. 4 shows the violin plots of for HILL and BET-HILL in different cases. From the two figures, we observe that the median number of usually increases with increasing payload. Even when the payload is as high as 0.5 bpp / 0.5 bpnz, the median number of is less than 80‱ / 40‱, which means that we can achieve great improvement (refer to Table XV and Table XVI) via modifying a tiny fraction of embedding units for any given stego images .
Iv-C2 vs. Density of Steganography Modification
From Fig. 4, we also observe that for a given payload, the values of will change a lot for different images. Taking HILL for 0.1 bpp for instance, the minimum of is close to 0, while the maximum become close to 30, meaning the range of is over 20 in this case. Furthermore, the range will increase with increasing payload or quality factor. In this section, we will analyze the factor which affects the values of .
Fig. 5 shows the steganography modifications and the post-modifications of two typical images using HILL for payload 0.1 bpp. From Fig. 5, we observe that for the first image, the steganography modifications seem uniformly dispersed throughout the whole image, while it is highly concentrated on a small part for the second one. After performing our method, the numbers of the post-modification are 1 and 523 separately. Thus we expect that there should be a positive correlation between the relative post-modification rate and the density of steganography modification. To verify this, we define the density of steganography modification in the following way. We first compare the difference between cover and stego , and divide the difference (i.e. ) into overlapping small blocks. And then we just consider those blocks which contain steganography modification, denoted as as . For each block , we calculate the proportion of steganography modification , where denotes the number of steganography modification in block , . Finally, we define the density of steganography modification for the stego image as follows.
Based on above definition, the densities of two images in Fig.5 are 0.05 and 0.27 respectively. We further calculate and the density of steganography modification for 10,000 images in BOSSBase, and show the scatter plot for HILL (0.1 bpp) and BET-HILL (0.1 bpnz, QF=75) in Fig 6. For display purpose, we remove some outlying data (less than 0.15% with larger values) in this figure. From Fig. 6, it is obvious that increases with increasing density. In this case, the corresponding Pearson correlation coefficients are 0.95 and 0.70 respectively, meaning the linear relationships between the and the density of steganography modification are relatively strong, which fits our expectation very well. Similar results can be found for other steganography methods and/or payloads.
Iv-D Evaluation on Processing Time
In this section, we will evaluate the processing time of the proposed method. To achieve convincing results, we report the average results on 100 images randomly selected from BOSSBase. For comparison, we also provide the processing time of the corresponding steganography method. The average results are shown in Table XIX and Table XX. From the two tables, we have two following observations:
For a given steganography method, the processing time usually increases with increasing payload since more steganography modification should be dealt with. Taking HILL for instance, the time processing is 0.18s for 0.1 bpp, while it becomes 0.34s for 0.5 bpp.
For the same reason, for a given JPEG steganography method and a payload, the processing time usually increases with increasing quality factor. Taking BET-HILL for 0.5 bpnz for instance, the processing time is 0.50s for QF=75, while it increases to 0.56s for QF=95.
Overall, the processing time of the proposed method is very short (less than 0.60s per image in all cases), which is comparable to or even much shorter than that of the current steganography method.
Iv-E Security Evaluation on Other Image Databases
In this section, we will evaluate the security performance of the proposed method on two other databases including 10,000 gray-scale images of size from BOWS2  and 40,000 gray-scale images of size from SZUBase. The experimental settings about the partition of image dataset and hyper-parameters are the same as previous ones used for the BOSSBase. For simplification, three embedding payloads, including 0.1 bpp/bpnz, 0.3 bpp/bpnz, 0.5 bpp/bpnz are considered in this experiment. For comparison, the detection accuracy improvements on the three image databases (i.e. BOSSBase, BOWS2 and SZUBase) are shown in Table XXI and Table XXII. From the two tables, we obtain two following observations:
Almost in all cases, the proposed method can effectively enhance the steganography security for the three image databases. In a few cases, the security performance will drop slightly (less than 0.17%) compared to the corresponding baseline steganography.
Compared to the results on BOSSBase, we can even make greater improvements on BOWS2 and SZUBase in many cases, especially for steganography methods in spatial domain. In several cases, we can achieve over 4% improvements, which is a significant improvement on the current good steganography.
The above results show that the proposed method can be effectively extended to other image databases.
Iv-F Comparison with Our Previous Method
In this section, we will compare the steganography security and the processing time with our previous work .
Iv-F1 Comparison on Security Performance
For simplification, we evaluate spatial steganography methods for payload 0.4 bpp using SRM, and JPEG steganography methods for payload 0.4 bpnz with QF 95 using GFR both on BOSSBase. The experimental results are shown in Table XXIII and Table XXIV separately. From the two tables, we observe that in spatial domain, both methods can enhance steganography security. On average, the previous method and the proposed method achieve an improvement of about 1% and 2% separately. In JPEG domain, our previous method  does not work, while the proposed method still achieves an average improvement of about 2%.
Iv-F2 Comparison on Processing Time
The average processing time evaluated on 100 randomly selected images from BOSSBase are shown in Table XXV and Table XXVI separately. From the two tables, we observe that the proposed method is significantly faster than the previous method. On average, the proposed method are able to achieve about 7 times acceleration in spatial domain, and about 5 times acceleration in JPEG domain.
The above results show that the proposed method is much more effective and faster than the previous one  555Please note that the fast method for updating image residual in section III-B4 is also employed in our previous work for comparison. .
In this paper, we propose a novel method to enhance the steganography security via stego post-processing. The main contributions of this paper are as follows.
To our best knowledge, this is the first work (including our previous conference work ) to enhance steganography security via stego post-processing. The extensive experimental results show that we can easily achieve better steganography security via modifying a tiny part of embedding units within given stegos.
The proposed method is universal, because it can be effectively applied in those steganography methods using STCs for data hiding, including most modern image steganography methods both in spatial and JPEG domains.
Via analyzing some characteristics about the post-modification, such as the location, the direction and the amplitude of post-modification (see section III-B), we significantly speed up the proposed method while preserving satisfactory results.
In our experiments, we try to reduce the Manhattan distance between cover residual and stego resudial via post-modification. Other steganalytic measures, such as the co-occurrence matrices of image residual in SRM and some deep learning based features will be considered in our future work. In addition, we will combine the technique of adversarial example to further improve the steganography security.
-  (2011) ”Break our steganographic system”: the ins and outs of organizing boss. In Springer International Workshop on Information Hiding, pp. 59–70. Cited by: §III-B1, §III-B2, §III-B3, §IV.
-  (2007) BOWS2. Note: http://bows2.ec-lille.fr Cited by: §IV-E.
-  (2019) Exploiting adversarial embeddings for better steganography. In ACM Workshop on Information Hiding and Multimedia Security, pp. 216–221. Cited by: §I.
-  (2019) Enhancing steganography via stego post-processing by reducing image residual difference. In ACM Workshop on Information Hiding and Multimedia Security, pp. 63–68. Cited by: §I, §IV-F1, §IV-F2, §IV-F, TABLE XXIII, TABLE XXIV, TABLE XXV, TABLE XXVI, 1st item.
-  (2016) Defining cost functions for adaptive steganography at the microscale. In IEEE International Workshop on Information Forensics and Security, pp. 1–6. Cited by: §I.
-  (2018) Defining cost functions for adaptive JPEG steganography at the microscale. IEEE Transactions on Information Forensics and Security 14 (4), pp. 1052–1066. Cited by: §I.
-  (2016) Steganalysis features for content-adaptive JPEG steganography. IEEE Transactions on Information Forensics and Security 11 (8), pp. 1736–1746. Cited by: §IV-B, §IV.
-  (2015) Improving steganographic security by synchronizing the selection channel. In ACM Workshop on Information Hiding and Multimedia Security, pp. 5–14. Cited by: §I.
-  (2014) Selection-channel-aware rich model for steganalysis of digital images. In IEEE International Workshop on Information Forensics and Security, pp. 48–53. Cited by: §IV-B, §IV.
-  (2011) Minimizing additive distortion in steganography using syndrome-trellis codes. IEEE Transactions on Information Forensics and Security 6 (3), pp. 920–935. Cited by: §I, §II-A.
-  (2007) Practical methods for minimizing embedding impact in steganography. In Security, Steganography, and Watermarking of Multimedia Contents IX, Vol. 6505, pp. 650502. Cited by: §I.
-  (2012) Rich models for steganalysis of digital images. IEEE Transactions on Information Forensics and Security 7 (3), pp. 868–882. Cited by: §III-A1, §III-A3, §IV-B, §IV.
-  (2014) Generative adversarial nets. In Advances in neural information processing systems, pp. 2672–2680. Cited by: §I.
-  (2014) Uniform embedding for efficient JPEG steganography. IEEE transactions on Information Forensics and Security 9 (5), pp. 814–825. Cited by: §I.
-  (2015) Using statistical image model for JPEG steganography: uniform embedding revisited. IEEE Transactions on Information Forensics and Security 10 (12), pp. 2669–2680. Cited by: §I, §III-A, §IV.
-  (2014) Universal distortion function for steganography in an arbitrary domain. Springer EURASIP Journal on Information Security 2014 (1), pp. 1. Cited by: §I, §IV.
-  (2012) Designing steganographic distortion using directional filters. In IEEE International Workshop on Information Forensics and Security, pp. 234–239. Cited by: §I.
-  (2018) Efficient JPEG steganography using domain transformation of embedding entropy. IEEE Signal Processing Letters 25 (6), pp. 773–777. Cited by: §I, §IV.
-  (2008) Revisiting weighted stego-image steganalysis. In Security, Forensics, Steganography, and Watermarking of Multimedia Contents X, Vol. 6819, pp. 681905. Cited by: §III-A3.
-  (2012) Ensemble classifiers for steganalysis of digital media. IEEE Transactions on Information Forensics and Security 7 (2), pp. 432–444. Cited by: §IV.
-  (2014) A new cost function for spatial image steganography. In IEEE International Conference on Image Processing, pp. 4206–4210. Cited by: §I, §III-A, §IV.
-  (2015) A strategy of clustering modification directions in spatial image steganography. IEEE Transactions on Information Forensics and Security 10 (9), pp. 1905–1917. Cited by: §I, §IV.
-  (2018) Defining joint distortion for JPEG steganography. In ACM Workshop on Information Hiding and Multimedia Security, pp. 5–16. Cited by: §I.
-  (2010) Using high-dimensional image models to perform highly undetectable steganography. In Springer International Workshop on Information Hiding, pp. 161–177. Cited by: §I.
-  (2016) Content-adaptive steganography by minimizing statistical detectability. IEEE Transactions on Information Forensics and Security 11 (2), pp. 221–234. Cited by: §I, §IV.
-  (2015) Steganalysis of adaptive JPEG steganography using 2d gabor filters. In ACM Workshop on Information Hiding and Multimedia Security, pp. 15–23. Cited by: §III-A1, §III-A3, §IV-B, §IV.
-  (2013) Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199. Cited by: §I.
-  (2019) CNN-based adversarial embedding for image steganography. IEEE Transactions on Information Forensics and Security 14 (8), pp. 2074–2087. Cited by: §I.
-  (2017) Automatic steganographic distortion learning using a generative adversarial network. IEEE Signal Processing Letters 24 (10), pp. 1547–1551. Cited by: §I.
-  (2016) Structural design of convolutional neural networks for steganalysis. IEEE Signal Processing Letters 23 (5), pp. 708–712. Cited by: §III-A1, §IV-B, §IV.
-  (2017) Deep convolutional neural network to detect j-uniward. In ACM Workshop on Information Hiding and Multimedia Security, pp. 67–73. Cited by: §III-A1, §IV-B, §IV.
-  (2019, To be appeared) An embedding cost learning framework using gan. IEEE Transactions on Information Forensics and Security. Cited by: §I.
-  (2019) Towards automatic embedding cost learning for JPEG steganography. In ACM Workshop on Information Hiding and Multimedia Security, pp. 37–46. Cited by: §I.
-  (2017) Deep learning hierarchical representations for image steganalysis. IEEE Transactions on Information Forensics and Security 12 (11), pp. 2545–2557. Cited by: §III-A1.
-  (2017) Decomposing joint distortion for adaptive steganography. IEEE Transactions on Circuits and Systems for Video Technology 27 (10), pp. 2274–2280. Cited by: §I.
-  (2018) Controversial ’pixel’ prior rule for JPEG adaptive steganography. IET Image Processing 13 (1), pp. 24–33. Cited by: §I.
-  (2017) A new rule for cost reassignment in adaptive steganography. IEEE Transactions on Information Forensics and Security 12 (11), pp. 2654–2667. Cited by: §I.