# From Covert Hiding to Visual Editing: Robust Generative Video Steganography

###### Abstract

Traditional video steganography methods are based on modifying the covert
space for embedding, whereas we propose an innovative approach that embeds
secret message within semantic feature for steganography during the video
editing process. Although existing traditional video steganography methods
display a certain level of security and embedding capacity, they lack adequate
robustness against common distortions in online social networks (OSNs). In
this paper, we introduce an end-to-end robust generative video steganography
network (RoGVS), which achieves visual editing by modifying semantic feature
of videos to embed secret message. We employ face-swapping scenario to
showcase the visual editing effects. We first design a secret message
embedding module to adaptively hide secret message into the semantic feature
of videos. Extensive experiments display that the proposed RoGVS method
applied to facial video datasets demonstrate its superiority over existing
video and image steganography techniques in terms of both robustness and
capacity.

Index Terms—  Generative video steganography, Robust steganography, Semantic
modification

##  1 Introduction

Steganography is the science and technology of embedding secret message into
natural digital carriers, such as image, video, text, etc. Generally, the
natural digital carriers are called “cover” and the digital media with secret
message are called “stego”. Conventional image steganography methods [49, 12,
31] primarily modify high-frequency components to embed secret message. They
commonly utilize methodologies such as pixel value manipulation or integrating
secret message into the cover image before inputting it into an encoder for
steganographic purposes.

Fig. 1: Methodology of RoGVS. We modulate semantic feature with secret message
to edit videos, such as the identity feature in facial videos. Our RoGVS can
generate high-quality stego videos even in the presence of various
distortions.

In the past few years, as the rise of short video software applications like
TikTok, YouTube, Snapchat, etc., video has become a suitable carrier for
steganography. Traditional video steganographic methods, utilizing direct
pixel value manipulation [32], coding mapping [34], or adaptive distortion
function [36], exploit video data redundancy for information hiding.
Nevertheless, while successful in security and embedding capacity, these
methods on modifying covert space can be erased by common post-processing
operations easily. So they are vulnerable to mitigate diverse distortions that
may occur in lossy channel transmission.

Fig. 2: The Framework of the Proposed RoGVS. $\bm{E}_{m}$ is secret message
encoder. $\bm{E}_{id}$ is identity feature extractor. $\bm{E}_{\phi}$ is video
feature extractor. $\bm{D}_{\varphi}$ represents a video decoder.
$\bm{E}_{ext}$ represents secret message extractor.

Visual editing on videos can be seen as the process of modifying the semantic
information of objects within them. Instead of hiding secret message in covert
space, we embed secret message within semantic feature of videos for visual
edition. The advanced semantic feature is less susceptible to distortions,
making this method inherently robust. In order to improve the robustness of
video steganography, we propose an end-to-end robust generative video
steganography network (RoGVS), which consists of four modules, containing
information encoding module, secret message embedding model, attacking layer,
and secret message extraction module. For evaluation, we use face-swapping
technology as an example to show the effectiveness of our method, while it can
be easily extended to other applications. Comprehensive experiments have
showcased that our method surpasses state-of-the-art techniques, attaining
commendable robustness and generalization capabilities.

The main contributions of our work are as follows: 1) We are the first to
explore a novel generative video steganography method, which modifies semantic
feature to embed secret message during visual editing instead of modify the
covert space. This framework exhibits strong extensibility, serving as a new
topic for the future development of the steganography field. 2) The proposed
method is robust against common distortions in social network platform and the
secret message can be extracted with high accuracy. 3) Our method achieves
better security for anti-steganalysis than other state-of-the-art methods,
which can effectively evade the detection of steganalysis system.

##  2 Related Work

Image Steganography. Conventional image steganography methods primarily modify
high-frequency components to embed secret message. The LSB substitution method
[80] operates under the assumption that human eyes cannot perceive changes in
the least significant bit of pixel values. HiDDeN [12] introduces an end-to-
end trainable framework through an encoder-decoder architecture. SteganoGAN
[31] employs dense encoders to enhance payload capacity. Wei et al [16]
propose an advanced generative steganography network that can generate
realistic stego images without using cover images. However, alterations in
high-frequency components can be obliterated by common post-processing
operations, such as JPEG compression or Gaussian Blur.

Video Steganography. Early video steganography usually modifies RGB or YUV
color spaces for embedding secret message. Dong et al [33] observed that
altering intra-frame modes in HEVC significantly affected video coding
efficiency, while modifications to multilevel recursive coding units had
minimal distortion impact. PWRN [35] employs a super-resolution CNN, the Wide
Residual-Net filter (PWRN), to replace HEVC’s loop filter. Recently, He et al
[36] devised an adaptive distortion function using enhanced Rate Distortion
Optimization (RDO) and Syndrome-Trellis Code (STC) to minimize embedding
distortion. However, these methods are struggle to handle various distortions
that may arise in lossy channel transmission.

Visual Editing. Visual editing can encompass color correction on a single
image, deletion, addition, or alteration of objects within the image, or even
merging two photos to create an entirely new scene. In videos, visual editing
might involve adding effects to specific frames, removing elements from the
video to alter the scene, replacing one person’s face with another [26], also
called face-swapping.

##  3 Proposed Approach

Our method aims to embed secret message $\bm{M}$ using semantic feature
extracted from reference image $\bm{I}_{R}$ into cover video $\bm{V}_{C}$,
generating stego video $\bm{V}_{C}^{{}^{\prime}}$. As illustrated in Fig. 2,
our approach comprises four modules: Information Encoding Module, Secret
Message Embedding Module, Attacking Layer, Secret Message Extraction Module.

###  3.1 Information Encoding Module

The information encoding module consists of three parts: The first is identity
extractor $\left(\bm{E}_{id}\right)$ which utilizes a facial recognition
network to extract identity feature tailored for the reference image
$\left(\bm{I}_{R}\right)$. The second is video feature extractor
$\left(\bm{E}_{\phi}\right)$. It acquires the latent representation of cover
video $\bm{V}_{C}$ with $v$ frames, employing an encoder [26] for video
feature extraction. The third is secret message encoder
$\left(\bm{E}_{m}\right)$ which is a one-layer dense Multi-layer Perceptron
(MLP). The above three parts are formulated as follows:

$\bm{F}_{id}=\bm{E}_{id}(\bm{I}_{R})$ (1)
$\bm{F}^{i}_{C}=\bm{E}_{\phi}(\bm{I}_{C}^{i})$ (2)
$\bm{F}_{m}=\bm{W_{m}M}+\bm{b}_{m},$ (3)

where $\bm{I}^{i}_{C}$ is the $i$-th frame of the cover video.
$\bm{F}^{i}_{C}$ represents the latent feature representation of $i$-th frame.
$\bm{F}_{id}$ is the identity feature of the reference image. $\bm{M}$ is the
secret message. $\bm{W_{m}}$ and $\bm{b}_{m}$ represents the learnable weights
and biases.

###  3.2 Secret Message Embedding and Extraction Module

This module aims to embed the secret message during face swapping. The key
problem is how to implement face swapping under the guidance of secret
message. To our understanding, the latent features of the cover video
encompass both identity and attribute feature. Face swapping essentially
involves replacing the cover video’s identity with that of the reference
image. Consequently, we embed the secret message into the identity feature of
the reference image, formulated as follows:

$\bm{F}^{\prime}_{id}=\bm{F}_{id}+\lambda\cdot\bm{F}_{m},$ (4)

where $\lambda$ is a hyper-parameter adjusting the influence of secret message
on identity feature.

Due to strong coupling between identity and attribute features, direct
extraction of attribute feature from the latent representation
$\bm{F}_{c}^{i}$ by $\bm{E}_{\phi}$ is unfeasible. To ensure better attribute
preservation, we design a Secret-ID block, consisting of the modified version
of the residual block and AdaIN to inject $\bm{F}_{id}^{i}$ into
$\bm{F}_{C}^{i}$. The Secret-ID block is formulated as follows:

$\bm{AdaIN}(\bm{F}^{i}_{C},\bm{F}^{\prime}_{id})=\sigma_{\bm{F}^{\prime}_{id}}\frac{\bm{F}^{i}_{C}-\mu(\bm{F}^{i}_{C})}{\sigma(\bm{F}^{i}_{C})}+\mu_{\bm{F}^{\prime}_{id}},$
(5)

where $\mu({\bm{F}^{i}_{C}})$ and $\sigma({\bm{F}^{i}_{C}})$ represent the
channel-wise mean and standard deviation of the input feature
$\bm{F}^{i}_{C}$, respectively. Meanwhile, $\sigma_{\bm{F}^{\prime}_{id}}$ and
$\mu_{\bm{F}^{\prime}_{id}}$ correspond to two variables derived from the
secret-identity feature $\bm{F}^{\prime}_{id}$.

After N Secret-ID blocks, the identity feature in $\bm{F}_{C}^{i}$ is replaced
by $\bm{F}^{\prime}_{id}$ and then we get $\bm{F}^{i}_{S}$. Subsequently, we
use an video Decoder $\bm{D}_{\phi}$ to recover the $i$-th frame
$\bm{I}_{S}^{i}$ of the stego video from $\bm{F}^{i}_{S}$. The Decoder
contains four upsample blocks, a ReflectionPad layer and a convolutional
layer. Each upsample block consists of a upsample layer, a convolutional layer
and a BatchNorm layer. The process to get $\bm{I}^{i}_{S}$ can be expressed as
$\bm{I}^{i}_{S}=\bm{D}_{\phi}(\bm{F}^{i}_{S})$.

We design an extraction module to retrieve secret message $\bm{M}^{\prime}$
from the stego videos, featuring seven convolutional layers using ReLU
activation. Ultimately, a sigmoid activation function and binarization are
applied to extract the embedded secret message. This module’s formulation is
as $\bm{M}^{\prime}=\bm{E}_{ext}\left(\bm{V}_{S}\right)$.

###  3.3 Attacking Layer

To bolster the robustness of our method for face-swapping videos in real-world
scenarios, we design a attacking layer. This module simulates prevalent
distortions encountered across social network platforms.

JPEG Compression. JPEG compression involves a non-differentiable quantization
step due to rounding. To mitigate this, we apply Shin et al.’s method [53] to
approximate the near-zero quantization step using function Eq. (6):

$\displaystyle\bm{q(x)}=\left\\{\begin{array}[]{ll}\bm{x^{3}},&\bm{|x|<0.5}\\\
\bm{x},&\bm{|x|\geq 0.5}\end{array}\right.,$ (6)

where $x$ denotes pixels of the input image. We uniformly sample the JPEG
quality from within the range of [50, 100].

Color Distortions. We consider two general color distortions: brightness and
contrast. We perform a linear transformation on the pixels of each channel as
the formula Eq. (7):

$\bm{p(x)}=a\times\bm{f(x)}+c,$ (7)

where $\bm{p(x)}$ and $\bm{f(x)}$ refers to the distorted and the original
image. The parameters $\bm{a}$ and $\bm{c}$ regulate contrast and brightness,
respectively.

Color Saturation. We perform random linear interpolation between RGB and gray
images equivalent to simulate the distortion.

Additive Noise. We use Gaussian noise to simulate any other distortions that
are not considered in the attacking layer. We employ a Gaussian noise model
(sampling the standard deviation $\delta\sim U[0,0.2])$ to simulate imaging
noise.

###  3.4 Loss Function

The proposed method ensures both high stego video quality and precise
extraction of secret message. We achieve this by training the modules using
the following losses.

Identity Loss. The identity loss minimizes the variance between the identity
features ($\bm{F}_{id}$) of the reference image and the $i$-th frame
($\hat{\bm{F}}_{id}^{i}$) in the stego video, reducing alterations caused by
secret message. Cosine similarity is used to measure this loss by the formula
Eq (8).

$\mathcal{L}_{\emph{id}}=1-\frac{\bm{F}_{id}\times\hat{\bm{F}}_{id}^{i}}{||\bm{F}_{id}||_{2}||\hat{\bm{F}}_{id}^{i}||_{2}}.$
(8)

Table 1: Comparison Results on Extraction Accuracy. “-” means “Without
Distortion”. ($\cdot$) represents Bits Per Frame (BPF). Under different
distortion scenarios, our method demonstrates superior performance in
comparison.

Method | - | PNG | Resize (0.5) | Bit Error | Brightness | Contrast | H.264 ABR | H.264 CRF | Motion Blur | Rain | Saturate | Shot Noise
---|---|---|---|---|---|---|---|---|---|---|---|---
HiDDeN [12] | 0.9633 | 0.8342 | 0.6516 | 0.7543 | 0.7939 | 0.7813 | 0.7901 | 0.7813 | 0.7635 | 0.7624 | 0.7927 | 0.6310
LSB [80] | 1.0000 | 0.4988 | 0.4932 | 0.4533 | 0.4685 | 0.4985 | 0.4921 | 0.4932 | 0.4935 | 0.5085 | 0.4885 | 0.5012
PWRN [35] | 1.0000 | 0.8473 | 0.6392 | 0.8082 | 0.7959 | 0.4470 | 0.7430 | 0.7907 | 0.6004 | 0.7255 | 0.7743 | 0.8291
Ours (9) | 0.9737 | 0.9650 | 0.8510 | 0.9393 | 0.9409 | 0.8959 | 0.8792 | 0.9566 | 0.9414 | 0.9374 | 0.9521 | 0.9059
Ours (18) | 0.9942 | 0.9665 | 0.9486 | 0.9565 | 0.9605 | 0.9544 | 0.9634 | 0.9642 | 0.9587 | 0.9623 | 0.9612 | 0.9588

Attribute Loss. We use the weak feature matching loss [26] to constrain
attribute difference before and after embedding secret message. The loss
function is defined as follows:

$\mathcal{L}_{att}=\sum_{j=h}^{H}\frac{1}{N_{j}}||D_{j}(\bm{I}^{i}_{S})-D_{j}(\bm{I}^{i}_{C})||_{1},$
(9)

where $\bm{D}_{j}$ refers to the feature extractor of Discriminator D for the
j-th layer, $N_{j}$ is the number of elements in the j-th layer, and $H$ is
the total number of layers. Additionally, $h$ represents the starting layer
for computing the weak feature matching loss.

Adversarial Loss. To enhance performance, we use multi-scale Discriminator
with gradient penalty. We adopt the Hinge version of adversarial loss defined
as follows:

$\mathcal{L}_{adv}=\bm{E}_{x}[-log\bm{D}(x)]+\bm{E}_{z}[log(1-\bm{D}(z)],$
(10)

where $\bm{D}$ denotes the Discriminator, $x$ and $z$ in our method is
respectively $\bm{I}_{R}$ and $\bm{I}_{S}^{i}$

Secret Loss. To address this, we use the Binary Cross-Entropy loss (BCE) as
defined in Eq. (11).

$\mathcal{L}_{\emph{sec}}=\mathcal{L}_{\emph{bce}}(\bm{M},\bm{M^{{}^{\prime}}}).$
(11)

Total loss. The total loss is defined as follows:

$\mathcal{L}=\alpha_{1}\mathcal{L}_{\emph{id}}+\alpha_{2}\mathcal{L}_{\emph{att}}+\alpha_{3}\mathcal{L}_{\emph{sec}}+\mathcal{L}_{\emph{adv}}+\alpha_{4}\mathcal{L}_{\emph{GP}}.$
(12)

##  4 Experiments

###  4.1 Experimental Setups

Datasets. We use Vggface2 [61] for training and FFHQ [15] for validation. We
crop and resize facial areas to a fixed 224 $\times$ 224 resolution for input
images. To analyze quality and performance, we randomly select 100 videos from
DeepFake MNIST+ [65] to evaluate the performance.

Implementation Details. We train the model to encode a binary message of
length $m$ = 9 or 18 bits in a frame. During training, we employ Adam
optimizer with a learning rate of $4\times 10^{-4}$ and a batch size of 4. We
set $\alpha_{1}=10$, $\alpha_{2}=10$, $\alpha_{3}=15$, and
$\alpha_{4}=10^{-5}$. The networks train for 1 million steps, integrating the
Attacking Layer after the initial 800k steps for stability. We use an NVIDIA
GeForce RTX 3090 GPU for our experiments.

Fig. 3: Qualitative Analysis of Stego Videos. Original represents frames
within the cover videos. Fig. 4: Exampled Generated Stego Video Frames. Left:
Vggface2. Right: FFHQ.

Evaluation Metrics. We employ Bits Per Frame (BPF), quantifying the bits
number of secret message per frame in the stego video. To assess robustness,
we evaluate secret message extraction accuracy under various scenarios. For
security assessment, we use three steganalysis methods [62, 63, 64] to
demonstrate our method’s anti-detection capability.

Baselines. To ensure fair comparison in our experiments, we align HiDDeN and
LSB to this capacity. Detailed methods of HiDDeN and LSB are available in the
supplementary materials. Additionally, due to its PU-based design, PWRN has a
limited capacity of 15 BPF when resizing input images to $224\times 224$.

###  4.2 Performance Analysis

We compare the performance of our RoGVS with image-level steganography
including HiDDeN [12] and LSB [80] and video-level steganography including
PWRN [35].

Video Quality Assessment. Fig 4 shows qualitative results on the integrity of
generated video frames. We perform tests within and across datasets, each
containing 16 test samples. The generated faces effectively change individual
identities while retaining attributes like expressions and poses. More
findings are available in the supplementary materials. Fig 3 illustrates the
visual effects of certain intermittent frames within the stego videos.

Comparisons on Extraction Accuracy & Robustness. We conduct extensive
experiments with multiple types of distortions. Detailed distortion
implementations are provided in the supplement.

Table 2: Ablation Study on Different Embedding Positions of Secret Message.
Evaluation metric: Accuracy.

Method | PNG | Resize (0.5) | H.264 CRF | Motion Blur | Shot Noise
---|---|---|---|---|---
(a) | 0.965 | 0.918 | 0.951 | 0.941 | 0.924
(b) | 0.875 | 0.722 | 0.858 | 0.848 | 0.820
(c) | 0.939 | 0.856 | 0.894 | 0.861 | 0.893
RoGVS | 0.967 | 0.949 | 0.963 | 0.959 | 0.959

Table 3: Ablation Study for $\lambda$ on Extraction Accuracy.

| $\lambda=1.00$ | $\lambda=0.1$ | $\lambda=0.01$ | $\lambda=0.005$
---|---|---|---|---
Accuracy | 0.8414 | 0.5885 | 0.8607 | 0.5160

The quantitative comparison results in terms of accuracy are reported in Table
1. The results show that our method can successfully extract secret message
with high accuracy even after severe distortions. LSB [80] struggles even with
PNG (quantization) and HiDDeN [12], though trained with a distortion module,
can not generalize well to video-level distortions. PWRN [35] demonstrates
robustness across numerous distortions, yet its performance remains
constrained under operations such as motion blur or contrast adjustment. The
proposed RoGVS method shows superior robustness to these distortions while
maintaining high extraction accuracy. Security Analysis. We use three video
steganalysis tools to evaluate the security of our method. The detection
performance of these three steganalysis schemes is presented in Table 4. Table
4 demonstrates that our method exhibits slightly superior security compared to
the three counterparts.

Table 4: Quantitative Security Analysis. Evaluation metric: AUC. Closer to 0.5
indicates higher performance.

Detection method | HiDDeN | LSB | PWRN | ours
---|---|---|---|---
Zhai et al. [62] | 0.5312 | 0.5423 | 0.5456 | 0.5245
Li et al. [63] | 0.5416 | 0.5467 | 0.5411 | 0.5178
Sheng et al. [64] | 0.5309 | 0.5189 | 0.5167 | 0.5146

###  4.3 Ablation Study

Embedding Position of Secret Message. In our generation network with 9 Secret-
ID blocks, we explore different positions for embedding the secret message. We
divide the secret message into two 9-bit segments and allocate their
positions. In detail, Setting (a): 1st-4th blocks and 5th-9th blocks. Setting
(b): 1st-2nd blocks and 3rd-4th blocks. Setting (c): 5th-6th blocks and
7th-8th blocks. They are in comparison of the standard setting of RoGVS:
1st-3rd blocks and 4th-6th blocks.

Table 2 displays the performance for these four setups. Both Settings b and c
show a considerable decrease compared to Settings a and d, suggesting that
adding more Secret-ID blocks improves performance. Notably, Setting c
outperforms Setting b, indicating the higher influence of subsequent blocks on
the generated image.

Ablation on Attacking Layer, $\lambda$ & Discriminator. Fig 5 shows even
without the module, our method demonstrates considerable robustness,
surpassing the three comparative methods. The addition of attacking layer
improves accuracy by an average of 6%.

Fig. 5: Ablation Results on Attacking Layer. The horizontal axis represents
distortion types, corresponding to the order listed in Table 1.

Table 3 presents the impact of $\lambda$ on the extraction accuracy. More
ablation results on $\lambda$ and the discriminator are displayed in the
supplement.

##  5 Conclusions

We propose a robust generative video steganography method based on visual
editing, which modifies semantic feature to embed secret message. We use face-
swapping scenario as an example to show the effectiveness of our RoGVS. The
results showcase that our method can generate high-quality visually edited
stego videos. What’s more, RoGVS outperforms existing video and image
steganography methods in robustness and capacity.

## References

  * [1] Authors,  “The frobnicatable foo filter,” ACM MM 2013 submission ID 324. Supplied as additional material acmmm13.pdf.
  * [2] Authors,  “Frobnication tutorial,” 2012,  Supplied as additional material tr.pdf.
  * [3] J. W. Cooley and J. W. Tukey,  “An algorithm for the machine computation of complex Fourier series,”  Math. Comp., vol. 19, pp. 297–301, Apr. 1965.
  * [4] S. Haykin,  “Adaptive filter theory,”  Information and System Science. Prentice Hall, 4th edition, 2002.
  * [5] Dennis R. Morgan,  “Dos and don’ts of technical writing,”  IEEE Potentials, vol. 24, no. 3, pp. 22–25, Aug. 2005.
  * [6] Vojtěch Holub and Jessica Fridrich,  “Designing steganographic distortion using directional filters,”  in 2012 IEEE International workshop on information forensics and security (WIFS). IEEE, 2012, pp. 234–239.
  * [7] Vojtěch Holub, Jessica Fridrich, and Tomáš Denemark,  “Universal distortion function for steganography in an arbitrary domain,”  EURASIP Journal on Information Security, vol. 2014, pp. 1–13, 2014.
  * [8] Bin Li, Ming Wang, Jiwu Huang, and Xiaolong Li,  “A new cost function for spatial image steganography,”  in 2014 IEEE International conference on image processing (ICIP). IEEE, 2014, pp. 4206–4210.
  * [9] Mahdi Ahmadi, Alireza Norouzi, Nader Karimi, Shadrokh Samavi, and Ali Emami,  “Redmark: Framework for residual diffusion watermarking based on deep networks,”  Expert Systems with Applications, vol. 146, pp. 113157, 2020.
  * [10] Junpeng Jing, Xin Deng, Mai Xu, Jianyi Wang, and Zhenyu Guan,  “Hinet: deep image hiding by invertible network,”  in Proceedings of the IEEE/CVF international conference on computer vision, 2021, pp. 4733–4742.
  * [11] Shao-Ping Lu, Rong Wang, Tao Zhong, and Paul L Rosin,  “Large-capacity image steganography based on invertible neural networks,”  in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2021, pp. 10816–10825.
  * [12] Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei,  “Hidden: Hiding data with deep networks,”  in Proceedings of the European conference on computer vision (ECCV), 2018, pp. 657–672.
  * [13] Andrew Brock, Jeff Donahue, and Karen Simonyan,  “Large scale gan training for high fidelity natural image synthesis,”  arXiv preprint arXiv:1809.11096, 2018.
  * [14] Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen,  “Progressive growing of gans for improved quality, stability, and variation,”  arXiv preprint arXiv:1710.10196, 2017.
  * [15] Tero Karras, Samuli Laine, and Timo Aila,  “A style-based generator architecture for generative adversarial networks,”  in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2019, pp. 4401–4410.
  * [16] Ping Wei, Sheng Li, Xinpeng Zhang, Ge Luo, Zhenxing Qian, and Qing Zhou,  “Generative steganography network,”  in Proceedings of the 30th ACM International Conference on Multimedia, 2022, pp. 1621–1629.
  * [17] Han Zhang, Ian Goodfellow, Dimitris Metaxas, and Augustus Odena,  “Self-attention generative adversarial networks,”  in International conference on machine learning. PMLR, 2019, pp. 7354–7363.
  * [18] Donghui Hu, Liang Wang, Wenjie Jiang, Shuli Zheng, and Bin Li,  “A novel image steganography method via deep convolutional generative adversarial networks,”  IEEE access, vol. 6, pp. 38303–38314, 2018.
  * [19] Zhuo Zhang, Guangyuan Fu, Rongrong Ni, Jia Liu, and Xiaoyuan Yang,  “A generative method for steganography by cover synthesis with auxiliary semantics,”  Tsinghua Science and Technology, vol. 25, no. 4, pp. 516–527, 2020.
  * [20] Zhuo Zhang, Jia Liu, Yan Ke, Yu Lei, Jun Li, Minqing Zhang, and Xiaoyuan Yang,  “Generative steganography by sampling,”  IEEE access, vol. 7, pp. 118586–118597, 2019.
  * [21] Zhian Liu, Maomao Li, Yong Zhang, Cairong Wang, Qi Zhang, Jue Wang, and Yongwei Nie,  “Fine-grained face swapping via regional gan inversion,”  in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 8578–8587.
  * [22] Yi-Ting Cheng, Virginia Tzeng, Yu Liang, Chuan-Chang Wang, Bing-Yu Chen, Yung-Yu Chuang, and Ming Ouhyoung,  “3d-model-based face replacement in video,”  in SIGGRAPH’09: Posters, pp. 1–1. 2009.
  * [23] Justus Thies, Michael Zollhofer, Marc Stamminger, Christian Theobalt, and Matthias Nießner,  “Face2face: Real-time face capture and reenactment of rgb videos,”  in Proceedings of the IEEE conference on computer vision and pattern recognition, 2016, pp. 2387–2395.
  * [24] Yuval Nirkin, Yosi Keller, and Tal Hassner,  “Fsgan: Subject agnostic face swapping and reenactment,”  in Proceedings of the IEEE/CVF international conference on computer vision, 2019, pp. 7184–7193.
  * [25] Lingzhi Li, Jianmin Bao, Hao Yang, Dong Chen, and Fang Wen,  “Faceshifter: Towards high fidelity and occlusion aware face swapping,”  arXiv preprint arXiv:1912.13457, 2019.
  * [26] Renwang Chen, Xuanhong Chen, Bingbing Ni, and Yanhao Ge,  “Simswap: An efficient framework for high fidelity face swapping,”  in Proceedings of the 28th ACM International Conference on Multimedia, 2020, pp. 2003–2011.
  * [27] Zhili Zhou, Xiaohua Dong, Ruohan Meng, Meimin Wang, Hongyang Yan, Keping Yu, and Kim-Kwang Raymond Choo,  “Generative steganography via auto-generation of semantic object contours,”  IEEE Transactions on Information Forensics and Security, 2023.
  * [28] Zichi Wang, Guorui Feng, Hanzhou Wu, and Xinpeng Zhang,  “Data hiding during image processing using capsule networks,”  Neurocomputing, vol. 537, pp. 49–60, 2023.
  * [29] Shilpa Gupta, Geeta Gujral, and Neha Aggarwal,  “Enhanced least significant bit algorithm for image steganography,”  IJCEM International Journal of Computational Engineering & Management, vol. 15, no. 4, pp. 40–42, 2012.
  * [30] Amritpal Singh and Harpal Singh,  “An improved lsb based image steganography technique for rgb images,”  in 2015 IEEE International Conference on electrical, computer and communication technologies (ICECCT). IEEE, 2015, pp. 1–4.
  * [31] Kevin Alex Zhang, Alfredo Cuesta-Infante, Lei Xu, and Kalyan Veeramachaneni,  “Steganogan: High capacity image steganography with gans,”  arXiv preprint arXiv:1901.03892, 2019.
  * [32] Ozdemir Cetin and A Turan Ozcerit,  “A new steganography algorithm based on color histograms for data embedding into raw video streams,”  computers & security, vol. 28, no. 7, pp. 670–682, 2009.
  * [33] Yi Dong, Tanfeng Sun, and Xinghao Jiang,  “A high capacity hevc steganographic algorithm using intra prediction modes in multi-sized prediction blocks,”  in Digital Forensics and Watermarking: 17th International Workshop, IWDW 2018, Jeju Island, Korea, October 22-24, 2018, Proceedings 17. Springer, 2019, pp. 233–247.
  * [34] Jindou Liu, Zhaohong Li, Xinghao Jiang, and Zhenzhen Zhang,  “A high-performance cnn-applied hevc steganography based on diamond-coded pu partition modes,”  IEEE Transactions on Multimedia, vol. 24, pp. 2084–2097, 2021.
  * [35] Zhonghao Li, Xinghao Jiang, Yi Dong, Laijin Meng, and Tanfeng Sun,  “An anti-steganalysis hevc video steganography with high performance based on cnn and pu partition modes,”  IEEE Transactions on Dependable and Secure Computing, vol. 20, no. 1, pp. 606–619, 2022.
  * [36] Songhan He, Dawen Xu, Lin Yang, and Weipeng Liang,  “Adaptive hevc video steganography with high performance based on attention-net and pu partition modes,”  IEEE Transactions on Multimedia, 2023.
  * [37] Jiankang Deng, Jia Guo, Niannan Xue, and Stefanos Zafeiriou,  “Arcface: Additive angular margin loss for deep face recognition,”  in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2019, pp. 4690–4699.
  * [38] Max Jaderberg, Karen Simonyan, Andrew Zisserman, et al.,  “Spatial transformer networks,”  Advances in neural information processing systems, vol. 28, 2015.
  * [39] Nuur Alifah Roslan, Nur Izura Udzir, Ramlan Mahmod, and Adnan Gutub,  “Systematic literature review and analysis for arabic text steganography method practically,”  Egyptian Informatics Journal, 2022.
  * [40] Nadia A Karim, Suhad A Ali, and Majid Jabbar Jawad,  “A coverless image steganography based on robust image wavelet hashing,”  TELKOMNIKA (Telecommunication Computing Electronics and Control), vol. 20, no. 6, pp. 1317–1325, 2022.
  * [41] Sheng Li, Zichi Wang, Xiudong Zhang, and Xinpeng Zhang,  “Robust image steganography against general downsampling operations with lossless secret recovery,”  IEEE Transactions on Dependable and Secure Computing, 2023.
  * [42] Mahmoud M Mahmoud and Huwaida T Elshoush,  “Enhancing lsb using binary message size encoding for high capacity, transparent and secure audio steganography–an innovative approach,”  IEEE Access, vol. 10, pp. 29954–29971, 2022.
  * [43] Omer Farooq Ahmed Adeeb and Seyed Jahanshah Kabudian,  “Arabic text steganography based on deep learning methods,”  IEEE Access, vol. 10, pp. 94403–94416, 2022.
  * [44] M Hassan Shirali-Shahreza and Mohammad Shirali-Shahreza,  “Text steganography in chat,”  in 2007 3rd IEEE/IFIP International Conference in Central Asia on Internet. IEEE, 2007, pp. 1–5.
  * [45] B Delina,  “Information hiding: A new approach in text steganography,”  in Proceedings of the International Conference on Applied Computer and Applied Computational Science, World Scientific and Engineering Academy and Society (WSEAS 2008), 2008, pp. 689–695.
  * [46] Fatiha Djebbar, Beghdad Ayad, Habib Hamam, and Karim Abed-Meraim,  “A view on latest audio steganography techniques,”  in 2011 International Conference on Innovations in Information Technology. IEEE, 2011, pp. 409–414.
  * [47] Kaliappan Gopalan,  “Audio steganography using bit modification,”  in 2003 International Conference on Multimedia and Expo. ICME’03. Proceedings (Cat. No. 03TH8698). IEEE, 2003, vol. 1, pp. I–629.
  * [48] Fatiha Djebbar, Beghdad Ayad, Karim Abed Meraim, and Habib Hamam,  “Comparative study of digital audio steganography techniques,”  EURASIP Journal on Audio, Speech, and Music Processing, vol. 2012, no. 1, pp. 1–16, 2012.
  * [49] Zhengxin You, Qichao Ying, Sheng Li, Zhenxing Qian, and Xinpeng Zhang,  “Image generation network for covert transmission in online social network,”  in Proceedings of the 30th ACM International Conference on Multimedia, 2022, pp. 2834–2842.
  * [50] Ting-Chun Wang, Ming-Yu Liu, Jun-Yan Zhu, Andrew Tao, Jan Kautz, and Bryan Catanzaro,  “High-resolution image synthesis and semantic manipulation with conditional gans,”  in Proceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 8798–8807.
  * [51] Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok,  “Synthesizing robust adversarial examples,”  in International conference on machine learning. PMLR, 2018, pp. 284–293.
  * [52] Danying Hu, Daniel DeTone, and Tomasz Malisiewicz,  “Deep charuco: Dark charuco marker pose estimation,”  in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2019, pp. 8436–8444.
  * [53] Richard Shin and Dawn Song,  “Jpeg-resistant adversarial images,”  in NIPS 2017 Workshop on Machine Learning and Computer Security, 2017, vol. 1, p. 8.
  * [54] Matthew Tancik, Ben Mildenhall, and Ren Ng,  “Stegastamp: Invisible hyperlinks in physical photographs,”  in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020, pp. 2117–2126.
  * [55] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun,  “Deep residual learning for image recognition,”  in Proceedings of the IEEE conference on computer vision and pattern recognition, 2016, pp. 770–778.
  * [56] Xun Huang and Serge Belongie,  “Arbitrary style transfer in real-time with adaptive instance normalization,”  in Proceedings of the IEEE international conference on computer vision, 2017, pp. 1501–1510.
  * [57] Ming-Yu Liu, Xun Huang, Arun Mallya, Tero Karras, Timo Aila, Jaakko Lehtinen, and Jan Kautz,  “Few-shot unsupervised image-to-image translation,”  in Proceedings of the IEEE/CVF international conference on computer vision, 2019, pp. 10551–10560.
  * [58] Taesung Park, Ming-Yu Liu, Ting-Chun Wang, and Jun-Yan Zhu,  “Semantic image synthesis with spatially-adaptive normalization,”  in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2019, pp. 2337–2346.
  * [59] Jonas Adler and Sebastian Lunz,  “Banach wasserstein gan,”  Advances in neural information processing systems, vol. 31, 2018.
  * [60] Ishaan Gulrajani, Faruk Ahmed, Martin Arjovsky, Vincent Dumoulin, and Aaron C Courville,  “Improved training of wasserstein gans,”  Advances in neural information processing systems, vol. 30, 2017.
  * [61] Qiong Cao, Li Shen, Weidi Xie, Omkar M Parkhi, and Andrew Zisserman,  “Vggface2: A dataset for recognising faces across pose and age,”  in 2018 13th IEEE international conference on automatic face & gesture recognition (FG 2018). IEEE, 2018, pp. 67–74.
  * [62] Liming Zhai, Lina Wang, and Yanzhen Ren,  “Universal detection of video steganography in multiple domains based on the consistency of motion vectors,”  IEEE transactions on information forensics and security, vol. 15, pp. 1762–1777, 2019.
  * [63] Zhonghao Li, Laijing Meng, Shutong Xu, Zhaohong Li, Yunqing Shi, and Yuanchang Liang,  “A hevc video steganalysis algorithm based on pu partition modes.,”  Computers, Materials & Continua, vol. 59, no. 2, 2019.
  * [64] Q Sheng, RD Wang, ML Huang, Q Li, and D Xu,  “A prediction mode steganalysis detection algorithm for hevc,”  J Optoelectron-laser, vol. 28, no. 4, pp. 433–440, 2017.
  * [65] Jiajun Huang, Xueyu Wang, Bo Du, Pei Du, and Chang Xu,  “Deepfake mnist+: a deepfake facial animation dataset,”  in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2021, pp. 1973–1982.
  * [66] Xiyao Liu, Ziping Ma, Junxing Ma, Jian Zhang, Gerald Schaefer, and Hui Fang,  “Image disentanglement autoencoder for steganography without embedding,”  in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2022, pp. 2303–2312.
  * [67] Robert Engelmore and Anthony Morgan, Eds.,  Blackboard Systems,  Addison-Wesley, Reading, Mass., 1986.
  * [68] William J. Clancey,  “Communication, Simulation, and Intelligent Agents: Implications of Personal Intelligent Machines for Medical Education,”  in Proceedings of the Eighth International Joint Conference on Artificial Intelligence (IJCAI-83), Menlo Park, Calif, 1983, pp. 556–560, IJCAI Organization.
  * [69] William J. Clancey,  “Classification Problem Solving,”  in Proceedings of the Fourth National Conference on Artificial Intelligence, Menlo Park, Calif., 1984, pp. 45–54, AAAI Press.
  * [70] Arthur L. Robinson,  “New ways to make microcircuits smaller,”  Science, vol. 208, no. 4447, pp. 1019–1022, 1980.
  * [71] Arthur L. Robinson,  “New Ways to Make Microcircuits Smaller—Duplicate Entry,”  Science, vol. 208, pp. 1019–1026, 1980.
  * [72] Diane Warner Hasling, William J. Clancey, and Glenn Rennels,  “Strategic explanations for a diagnostic consultation system,”  International Journal of Man-Machine Studies, vol. 20, no. 1, pp. 3–19, 1984.
  * [73] Diane Warner Hasling, William J. Clancey, Glenn R. Rennels, and Thomas Test,  “Strategic Explanations in Consultation—Duplicate,”  The International Journal of Man-Machine Studies, vol. 20, no. 1, pp. 3–19, 1983.
  * [74] James Rice,  “Poligon: A System for Parallel Problem Solving,”  Technical Report KSL-86-19, Dept. of Computer Science, Stanford Univ., 1986.
  * [75] William J. Clancey,  Transfer of Rule-Based Expertise through a Tutorial Dialogue,  Ph.D. diss., Dept. of Computer Science, Stanford Univ., Stanford, Calif., 1979.
  * [76] William J. Clancey,  “The Engineering of Qualitative Models,”  Forthcoming, 2021.
  * [77] Mathieu Bouville,  “Crime and punishment in scientific research,” 2008.
  * [78] NASA,  “Pluto: The ’other’ red planet,” https://www.nasa.gov/nh/pluto-the-other-red-planet, 2015,  Accessed: 2018-12-06.
  * [79] Andreas Rossler, Davide Cozzolino, Luisa Verdoliva, Christian Riess, Justus Thies, and Matthias Nießner,  “Faceforensics++: Learning to detect manipulated facial images,”  in Proceedings of the IEEE/CVF international conference on computer vision, 2019, pp. 1–11.
  * [80] Chi-Kwong Chan and Lee-Ming Cheng,  “Hiding data in images by simple lsb substitution,”  Pattern recognition, vol. 37, no. 3, pp. 469–474, 2004.
  * [81] Yu Wang, Yun Cao, Xianfeng Zhao, Zhoujun Xu, and Meineng Zhu,  “Maintaining rate-distortion optimization for ipm-based video steganography by constructing isolated channels in hevc,”  in Proceedings of the 6th ACM workshop on information hiding and multimedia security, 2018, pp. 97–107.
  * [82] Haiwei Wu, Jiantao Zhou, Jinyu Tian, and Jun Liu,  “Robust image forgery detection over online social network shared images,”  in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022, pp. 13440–13449.
  * [83] Shichao Dong, Jin Wang, Renhe Ji, and et al.,  “Implicit identity leakage: The stumbling block to improving deepfake detection generalization,”  in CVPR, 2023.
  * [84] Wenliang Zhao, Yongming Rao, Weikang Shi, and et al.,  “Diffswap: High-fidelity and controllable face swapping via 3d-aware masked diffusion,”  in CVPR, 2023.
  * [85] Zhendong Wang, Jianmin Bao, and et al.,  “Altfreezing for more general video face forgery detection,”  in CVPR, 2023.