Securing Fixed Neural Network Steganography
Image steganography is the art of concealing secret information in images in
a way that is imperceptible to unauthorized parties. Recent advances show that
is possible to use a fixed neural network (FNN) for secret embedding and
extraction. Such fixed neural network steganography (FNNS) achieves high
steganographic performance without training the networks, which could be more
useful in real-world applications. However, the existing FNNS schemes are
vulnerable in the sense that anyone can extract the secret from the
stego-image. To deal with this issue, we propose a key-based FNNS scheme to
improve the security of the FNNS, where we generate key-controlled
perturbations from the FNN for data embedding. As such, only the receiver who
possesses the key is able to correctly extract the secret from the stego-image
using the FNN. In order to improve the visual quality and undetectability of
the stego-image, we further propose an adaptive perturbation optimization
strategy by taking the perturbation cost into account. Experimental results
show that our proposed scheme is capable of preventing unauthorized secret
extraction from the stego-images. Furthermore, our scheme is able to generate
stego-images with higher visual quality than the state-of-the-art FNNS scheme,
especially when the FNN is a neural network for ordinary learning tasks.
Zicong Luo, Sheng Li, Guobiao Li, Zhenxing Qian, Xinpeng Zhang
# Securing Fixed Neural Network Steganography

###### Abstract.

Image steganography is the art of concealing secret information in images in a way that is imperceptible to unauthorized parties. Recent advances show that is possible to use a fixed neural network (FNN) for secret embedding and extraction. Such fixed neural network steganography (FNNS) achieves high steganographic performance without training the networks, which could be more useful in real-world applications. However, the existing FNNS schemes are vulnerable in the sense that anyone can extract the secret from the stepo-image. To deal with this issue, we propose a key-based FNNS scheme to improve the security of the FNNS, where we generate key-controlled perturbations from the FNN for data embedding. As such, only the receiver who possesses the key is able to correctly extract the secret from the stego-image using the FNN. In order to improve the visual quality and undetectability of the stego-image, we further propose an adaptive perturbation optimization strategy by taking the perturbation cost into account. Experimental results show that our proposed scheme is capable of preventing unauthorized secret extraction from the stego-images. Furthermore, our scheme is able to generate stego-images with higher visual quality than the state-of-the-art FNNS scheme, especially when the FNN is a neural network for ordinary learning tasks.

Steganography, Fixed neural network, Key-controlled perturbation +
Footnote †: journal: Information systems — Multimedia information systems

+
Footnote †: journal: Information systems — Multimedia information systems

+
Footnote †: journal: Information systems — Multimedia information systems

+
Footnote †: journal: Information systems — Multimedia information systems — Multimedia information systems

+
Footnote †: journal: Information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia information systems — Multimedia systems — information systems — Multimedia information systems — Multimedia systems — Multimedia systems — information systems — Multimedia systems — information systems — Multimedia systems — information systems — Multimedia systems — information systems — Multimedia systems — information systems — Multimedia systems — information systems — Multimedia systems — information systems — Multimedia systems — information systems — Multimedia systems — information systems — Multimedia systems — information systems — Multimedia systems — information systems — Multimedia systems — information systems — Multimedia systems — information systems — Multimedia systems — information systems — Multimedia systems — information systems — Multimedia systems — information systems — Multimedia systems — information systems — Multimedia systems — information systems — Multimedia systems — information systems — Multimedia systems — information systems — Multimedia systems — information systems — Multimedia systems — information systems — Multimedia systems — information systems — Multimedia systems — information systems — Multimedia systems — information systems — information systems — Multimedia systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems systems — information systems — information systems — information systems — information systems — information systems systems — information systems — information systems — information systems — information systems — information systems systems — information systems — information systems — systems systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems systems — information systems — information systems — information systems — information systems — information systems systems — information systems — information systems — information systems systems — information systems — information systems — information systems systems — information systems — information systems — information systems — information systems systems — information systems — information systems — information systems — information systems systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems systems — information systems — information systems — information systems — information systems — information systems — information systems — information systems systems — information systems — information systems — information systems systems — information systems — information systems — information systems systems — information systems systems — information systems — information systems systems — information systems systems — information systems — information systems systems — information systems systems — information systems systems — information systems — information systems systems — information systems — information systems systems — information systems systems — information systems systems — information systems systems — information systems systems — information systems systems — information systems systems — information systems systems — information systems — information systems systems — information systems systems — information systems systems systems — information systems systems — information systems systems — information systems systems — information systems systems — information systems systems — information systems systems — information systems systems — information systems — information systems systems — information systems systems — information systems systems — information systems systems — information systems systems — information systems systems — information systems systems — information systems — information systems systems — information systems systems — information systems systems — information systems systems — information systems systems — information systems systems — information systems systems — information systems systems — information systems systems — information systems systems systems — information systems systems — information systems systems systems — information systems systems — information systems systems systems — information systems systems systems — information systems systems — information systems systems — information systems systems systems — information systems systems — information systems systems — information systems systems systems — information systems systems — information systems systems — information systems systems systems — information systems systems systems — information systems systems — information systems systems — information systems systems — information systems systems — information systems systems — information systems systems — information systems systems systems — information systems systems — information systems systems systems — information systems systems — information systems systems — information systems systems — information systems systems systems — information systems systems — information systems systems — information systems systems systems — information systems systems systems — information systems systems — information systems systems — information systems systems — information systems systems systems — information systems systems — information systems systems systems — information systems systems — information systems systems systems — information systems systems systems — information systems systems — information systems systems — information systems systems — information systems systems systems — information systems systems — information systems systems — information systems systems — information systems systems — information systems systems systems systems — information systems systems — information systems systems — information systems systems — information systems systems systems — information systems systems — information systems systems — information systems systems — information systems systems — information systems systems systems — information systems systems — information systems systems — information systems systems — information systems systems systems — information systems — systems systems systems — information systems systems systems — information systems systems — information systems systems — information systems systems — systems systems systems — information systems systems — information systems — systems systems systems — information systems — systems systems systems — information systems systems — information systems — systems — information systems systems — information systems systems — systems systems — information systems — systems systems systems — information systems — systems — information systems — systems systems — information systems — systems — systems — systems — information systems — systems — systems — systems — systems — systems — systems — systems — information systems — systems — systems — systems — systems — systems — systems — systems — systems — systems — systems — systems — systems — systems — systems — systems — systems — systems — systems — systems — — systems — systems — — systems — systems — — systems — — systems — — — systems — — systems — — systems — — — systems — — systems — — — systems — — — systems — — — systems — — systems — — — — systems — — — systems — — — — systems — — — — — — — systems — — — — — — — — — — — — — systems — — — — — — — — — — — — — systems — — — — — — — — — — — — systems — — — — — — — — — — systems — — — — — — — — — — — systems — — — — — — — — — — — systems — — — — — — — — — — systems — — — — — — — — — — — systems — — — — — — — — — — systems — — — — — — — — — — systems — — — — — — — — systems — — — — — — — — — systems — — — — — — — — systems — — — — — — — — — systems — — — — — — — — systems — — — — — — — systems — — — — — — systems — — — — — — — — systems — — — — — — systems — — — — — — systems — — — — — — systems — — — — — — — systems — — — — — systems — — — — — systems — — — — — — systems — — — — — systems — — — — systems — — — — — systems — — — — — systems — — — — systems — — — — systems — — — — systems — — — — — systems — — — — systems — — — — systems — — — systems — — — — systems — — — — systems — — — — systems — — — — systems — — — — systems — — — systems — — — systems — — — — systems — — — — systems — — — — systems — — — — systems — — — — systems — — — — systems — — — systems — — — — systems — — — systems — — — — systems — — — — systems — — — — systems — — — systems — — — — systems — — — — systems — — — — systems — — — — — systems — — — — — systems — — — systems — — — — systems — — — — — systems — — — — systems — — — — — systems — — — — systems — — — — — systems — — — — systems — — — — — systems — — — — systems — — — — — systems — — — systems — — — systems — — — — — systems — — — systems — — — — — systems — — — — — systems — — — — — systems — — — — systems — — — — systems — — — — systems — — — — systems — — — — — systems — — — systems — — — — — systems — — — — systems — — — — — systems — — — — — systems — — — — — systems — — — — systems — — — — — — systems — — — — — — systems — — — — — systems — — — — — — systems — — — — — — systems — — — — — — systems — — — — — — systems — — — — — — systems — — — — — — systems — — — — — — — — systems — — — — — — — — — systems — — — — — — — — systems — — — — — — — systems — — — — — — — — — systems — — — — — — — — — — — systems — — — — — — — — — systems — — — — — — — — — — systems — — — — — — — — — — — — — systems — — — — — — — — — — — — — — — — — — systems — — — — — — — — — — — — — — — — — systems — — — — — — — — — — — — — — — — — — — — — — — — — — — — systems —
he can easily extract the secret from the stego-image. To address this issue, an intuitive approach is to encrypt the secret before data embedding. The problem is that the DNN-based steganographic schemes could not guarantee lossless data extraction due to the uncertainty of the neural networks. A single bit of extraction error of the cipher text would cause a failure in decryption.

In this paper, we propose a key-based FNNS to improve the security of the existing FNNS schemes. Instead of directly encrypting the secret, we propose to use a key to control the generation of the adversarial perturbations for data embedding using a FNN. Once the stego-image is generated, only the receiver who possesses the correct key is able to perform correct secret decoding, as shown in Fig.1. To improve the visual quality and undetectability of the stego-images, we propose to estimate the perturbation cost and incorporate it into the design of the loss function to adaptively learn the perturbation from the FNN for data embedding. In particular, pixels with high perturbation costs will be assigned with low perturbation strength. Experimental results demonstrate the advantage of our scheme for preventing unauthorized data extraction. Furthermore, our scheme offers higher visual quality and undetectability than the state-of-the-art FNNS scheme, especially when using FNNs which work on ordinary learning tasks.

The main contributions of this paper are summarized as follows.

1. We are the first to look into the vulnerability of the existing FNNS schemes and propose a key-based FNNS to prevent unauthorized secret extraction from the stego-image.
2. We propose a key-based perturbation generation strategy by encrypting the stego-image before feeding it into the FNN for secret decoding.
3. We propose to estimate the perturbation cost of each image pixel, which is incorporated into the loss function to generate adaptive perturbation for data embedding. This is shown to be able to significantly improve the visual quality and undetectability of the stego-images.

## 2. Related Works

### Traditional image steganography

Traditional image steganography designs hand-crafted schemes to modify the cover image for data embedding, which can be divided into two categories including spatial domain-based steganography (Sutskever et al., 2016; Krizhevsky et al., 2015; Krizhevsky et al., 2016; Krizhevsky et al., 2017) and transform domain-based steganography(Krizhevsky et al., 2016; Krizhevsky et al., 2017; Krizhevsky et al., 2017; Krizhevsky et al., 2017; Krizhevsky et al., 2017). The former directly alters the pixel values in the spatial domain, while the latter changes the coefficients of the cover image in the transform domain to accommodate the secret.

To improve the undetectability of the stego-images, researchers propose adaptive image steganography which can be applied to perform data embedding in the spatial or transformed domain(Krizhevsky et al., 2016; Krizhevsky et al., 2017; Krizhevsky et al., 2017; Krizhevsky et al., 2017). The most popular framework for adaptive steganography is the syndrome-trellis codes (STCs) steganographic framework (Krizhevsky et al., 2016), which is able to achieve minimum distortion caused by data embedding. To effectively estimate the distortion, Pevny _et al._(Pevny et al., 2016) propose HUGO to measure the distortion for spatial domain-based steganography. Li _et al._(Li et al., 2017) introduce HILL which exploits both the high-pass filter and low-pass filter to focus more on the texture area for data embedding. Kin-Cleaves _et al._(Kin-Cleaves et al., 2016) propose Dual-Syrndrome Trellis Codes (Dual-STCs) to improve the robustness of steganography. On top of this, Guan _et al._(Guan et al., 2016) propose a novel coding scheme that extends Dual-STCs to a double-layered embedding scheme which leverages the channel knowledge for data embedding. The

Figure 1. The application scenario of our proposed method. Alice (sender) and Bob (receiver) download a FNN from a DNN model repository. Alice uses this FNN to generate a stego-image with a key and sent it to Bob through a public communication channel. Bob can extract the secret from the stego-image using the FNN with the corresponding key. Eve (attacker) may eavesdrop on the channel to intercept the stego-image. However, he is not able to extract the secret without knowing the key.
capacity of these schemes is usually limited to ensure high undetectability.

### DNN-based image steganography

DNN-based image steganography trains a secret encoder for embedding secret into a cover image and a secret decoder for data extraction from a stego-image, which is shown to be promising to improve the performance of steganography.

Zhu _et al.[(38)]_ pioneer the research for DNN-based image steganography, where an end-to-end autoencoder is proposed for data embedding. This is further improved by SteganGAN [(37)] which is able to achieve a payload of up to 6 bits per pixel (BPP). Tancik _et al.[(27)]_ incorporate the image printing and recapturing process in the encoder-decoder to enhance the performance of the secret decoder, which is robust against the attacks caused due to printing and recapturing. Baluja[(3)] proposes a DNN which is able to hide a color image into another color image. Wei _et al.[(32)]_ utilize generative adversarial networks (GANs)[(9)] to directly generate stego-images from secrets without using a cover image. Recently, researchers attempt to conduct data embedding using invertible networks [(11; 15; 22; 34)], which treat the data embedding and extraction as a pair of inverse problems to achieve a high data embedding capacity.

These schemes require training the steganographic networks on a large dataset. To avoid training, a few studies have been explored for Fixed Neural Network Steganography (FNNS) which does not require any training for data embedding and extraction. This is achieved by adding adversarial perturbations into a cover image to generate a stego-image which is able to produce some specific outputs corresponding to the secret. Ghamizi _et al.[(8)]_ produce the stego-images by encoding the secret into image labels to generate the perturbation, the capacity of which is rather limited. Kishore _et al.[(17)]_ propose to generate perturbations according to a message loss to produce the stego-image, which significantly improves the data embedding capacity compared with the work in [(8)].

Despite the advantage, the existing FNNS schemes are weak in securing the secret embedded in the stego-image. The attackers can extract the secret from the stego-images using the FNN or a surrogate network. On the other hand, it is yet unanswered on how we could generate a piece of perturbation that is able to minimize the distortion caused by data embedding. To address these two issues, we propose in this paper to generate key controlled and adaptive adversarial perturbations for FNNS. The former makes sure that the secret can only be extracted from the stego-image using a correct key, while the latter adaptively changes the perturbation strength for different pixels to improve the visual quality and undetectability of the stego-image.

## 3. Problem Formulation

Given a FNN \(\mathcal{F}\), a cover image \(\mathcal{X}_{cover}\), a secret \(\mathcal{M}\) and different keys \(\mathcal{K}\) and \(\mathcal{K}_{err}\), our goal is to generate a stego-image by

\[\mathcal{X}_{stego}=\mathcal{X}_{cover}+\Delta(\mathcal{F},\mathcal{X}_{cover },\mathcal{K},\mathcal{M},\Phi),\]

where \(\Phi\) is an image encryption operation, \(\Delta\) refers to our key controlled and adaptive perturbation generation scheme. Tab. 1 summarizes the notations used in this paper.

The stego-image should have the least distortion compared with the cover image, which has to satisfy the following properties.

Property 1 ().: _We should be able to extract the secret from the stego-image using the FNN and the correct key, i.e.,_

\[\mathcal{F}(\Phi(\mathcal{X}_{stego},\mathcal{K}))=\mathcal{M}. \tag{1}\]

Property 2 ().: _We should not be able to extract the secret from the stego-image by only using the FNN, i.e.,_

\[\mathcal{F}(\mathcal{X}_{stego})\neq\mathcal{M}. \tag{2}\]

Property 3 ().: _We should not be able to extract the secret from the stego-image by using the FNN and a wrong key, i.e.,_

\[\mathcal{F}(\Phi(\mathcal{X}_{stego},\mathcal{K}_{err}))\neq\mathcal{M}. \tag{3}\]

## 4. The Proposed Method

The overall structure of our proposed method is illustrated in Fig.2. Given an RGB cover image \(\mathcal{X}_{cover}\in[0,1]^{C\times H\times W}\), where \(C\), \(H\), and \(W\) refer to the channel, height, and width of the image, respectively. We propose to generate key controlled and adaptive perturbations using \(\mathcal{F}\) based on \(\mathcal{K}\) and \(\mathcal{M}\in\{0,1\}^{D\times H\times W}\) with \(D\) being the number of bits per pixel to be hidden. We propose to encrypt the stego-image using \(\mathcal{K}\) before optimizing the perturbations. And we design three different types of decoding loss terms to satisfy the three requirements listed in the previous section. To achieve the minimum data embedding distortion, we propose an adaptive image distortion loss by taking the perturbation cost for each pixel (in \(\mathcal{X}_{cover}\)) into consideration. The adaptive image distortion loss and the three types of decoding losses are combined to generate \(\mathcal{X}_{stego}\) by adaptively adding the perturbations into \(\mathcal{X}_{cover}\).

### Stego-image Encryption

We adopt a simple and straightforward way to encrypt the stego-image by adding each element in the stego-image with a random number. The encrypted version of the stego-image is computed by

\[\mathcal{X}_{stego}^{\mathcal{K}}=\Phi(\mathcal{X}_{stego},\mathcal{K})= \mathcal{X}_{stego}\oplus Rand(\mathcal{K}), \tag{4}\]

where \(\oplus\) is the element-wise addition, and \(Rand\) is a function to generate a random matrix with elements ranging [-1,1] using \(\mathcal{K}\)

\begin{table}
\begin{tabular}{c|l} \hline Notation & Description \\ \hline \(\mathcal{X}_{cover}\) & the cover image \\ \hline \(\mathcal{X}_{stego}\) & the stego-image \\ \hline \(\mathcal{F}\) & the FNN \\ \hline \(\mathcal{M}\) & the secret message \\ \hline \(\Phi\) & the process of image encryption \\ \hline \(\delta\) & the perturbation added to the cover image \\ \hline \(\mathcal{K}\) & the correct key \\ \hline \(\mathcal{K}_{err}\) & the wrong key \\ \hline \(\mathcal{W}\) & the perturbation cost matrix \\ \hline \end{tabular}
\end{table}
Table 1. Notation.
Note that the dimension of the random matrix should be the same as that of the stego-image.

### Perturbation Cost Estimation

To enhance the visual quality and undetectability of the stego-images, we adopt a similar distortion function which has been used in the existing adaptive image steganographic schemes to estimate a perturbation cost for each pixel in \(\mathcal{X}_{coorer}\). The distortion function we use here is motivated by HILL(HILL, 2017), which employs a high-pass filter \(F_{h}\) and two low-pass filters \(F_{l}^{1},F_{l}^{2}\) to measure the distortion caused by data embedding. The distortion function is formulated below

\[\mathcal{W}=\frac{1}{|\mathcal{X}_{coorer}\otimes F_{h}|\otimes F_{l}^{1}} \otimes F_{l}^{2}, \tag{5}\]

where \(F_{l}^{1}\) and \(F_{l}^{2}\) are average filters with the size of \(3\times 3\) and \(15\times 15\), \(\bigotimes\) refers to the convolution operation, and \(F_{h}\) is designed as

\[F_{h}=\begin{bmatrix}-1&2&-1\\ 2&-4&2\\ -1&2&-1\end{bmatrix}. \tag{6}\]

To make the perturbation cost suitable for optimizing the adaptive perturbations, \(\mathcal{W}\) is further truncated and processed by

\[\mathcal{W}=\begin{cases}T&\text{if}\ \mathcal{W}>t\\ \mathcal{W}&\text{otherwise}\end{cases}. \tag{7}\]

The perturbation cost \(\mathcal{W}\) measures the cost of perturbing each pixel in the cover image. Pixels with high perturbation costs are not suitable to be changed for data embedding, which refers to pixels' smooth areas. During the optimization, the perturbation strength should be low on such pixels. On the contrary, we can carry out perturbations with high strength for pixels with low perturbation costs.

### Loss Functions

We design four loss functions including adaptive image distortion loss, Type-I decoding loss, Type-II decoding loss, and Type-III decoding loss. The adaptive image distortion loss aims to preserve the quality of the stego-image according to the perturbation cost. The three decoding losses are used to guarantee the generation of key control perturbations.

**Adaptive image distortion loss.** The adaptive image distortion loss is formulated by

\[\mathcal{L}_{d}(\mathcal{X}_{coorer},\mathcal{X}_{stego},\mathcal{W})=\sqrt{ \mathcal{W}\cdot(\mathcal{X}_{coorer}-\mathcal{X}_{stego})^{2}}, \tag{8}\]

where \(\cdot\) denotes the element-wise product operation. This is a weighted L2 distance between the cover image and the stego-image. By using such a loss, we shall be able to learn an adaptive perturbation during optimization, which focuses more on the pixels with low perturbation costs.

**Type-I decoding loss** We design a Type-I decoding loss below to satisfy Property 1 mentioned in Section 3.

\[\mathcal{L}_{I}(\mathcal{X}_{stego},\mathcal{K},\mathcal{M})=L_{BCE}(\mathcal{ F}(\Phi(\mathcal{X}_{stego},\mathcal{K})),\mathcal{M}), \tag{9}\]

where \(L_{BCE}\) a binary cross-entropy. This loss makes sure that, when the correct key is used to encrypt the stego-images, we are able to recover the secret by feeding the encrypted version of the stego-image into the FNN.

**Type-II decoding loss.** We design a Type-II decoding loss below to satisfy Property 2 mentioned in Section 3.

\[\mathcal{L}_{II}(\mathcal{X}_{stego},\mathcal{M})=L_{BCE}(\mathcal{F}( \Phi(\mathcal{X}_{stego},\mathcal{K}_{err})),\mathcal{M}). \tag{10}\]

This loss is used to prevent the attacker from using the wrong key for message decoding. To well simulate the scenario in which the

Figure 2. An overview of the proposed key-based FNNS.
user uses several randomly guessed keys for message decoding, we generate a wrong key set \(\mathcal{K}_{err}\) containing \(N\) distinct keys which are different from \(\mathcal{K}\). We accumulate the Type-III decoding loss for each wrong key by

\[\mathcal{L}_{III}(\mathcal{X}_{stego},\mathcal{K}_{err},\mathcal{M})=\sum_{n=1}^ {N}L_{BCE}(\mathcal{F}(\Phi(X_{stego},K_{err}^{n})),\mathcal{M}), \tag{12}\]

where \(K_{err}^{n}\) denotes the \(n^{th}\) key in \(\mathcal{K}_{err}\).

**Total Loss.** The overall loss function is a weighted sum among the aforementioned losses, which is given by

\[\mathcal{L}_{Total}=\lambda_{d}\mathcal{L}_{d}+\lambda_{I}\mathcal{L}_{I}- \lambda_{II}\mathcal{L}_{II}-\lambda_{III}\mathcal{L}_{III}, \tag{13}\]

where \(\lambda_{d}\), \(\lambda_{I}\), \(\lambda_{II}\) and \(\lambda_{III}\) are the weights for balancing different loss terms.

### Optimization strategy

Our goal is to optimize the following problem:

\[min \mathcal{L}_{Total}, \tag{14}\] \[s.t. 0\leq\mathcal{X}_{stego}\leq 1.\]

Researchers have proposed a lot of optimization approaches to solve this problem by generating adversarial perturbations. Note that we have to quantize the stego-images for real-world applications. The quantization will reduce the visual quality of the stego-image. It would also make the output of the FNN cross the decision boundary, which causes a reduction in message decoding accuracy. We propose a two-stage optimization strategy to alleviate the negative impact of quantization on steganographic performance. In the first stage, we carry out the optimization by only using the adaptive image distortion loss and Type-I decoding loss. In the second stage, we conduct the optimization of the total loss. As such, the output of the network would repeatedly cross the decision boundary during the optimization process to achieve stable performance.

The details of the optimization process are given in Algorithm 1, where we use L-BFGS(Bordes and Riedler, 2017) as the main optimization approach. For each iteration, we quantize each element in each of the RGB channels of the stego-image into 255 levels to learn perturbations that are effective on quantized RGB images.

```
Input:\(\mathcal{F}\); \(\mathcal{X}_{coor}\); \(\mathcal{W}\); \(\mathcal{M}\); \(\mathcal{K}\); \(\mathcal{K}_{err}\) Output:\(\mathcal{X}_{stego}\)
1 Parameters:\(\alpha\): learning rate; \(E\): number of iterations; \(st_{1}\): the number of steps for the first stage ; \(st_{2}\): the number of steps for the second stage; \(\lambda_{d},\lambda_{I},\lambda_{II},\lambda_{III}\);
2 Freezeze \(\mathcal{F}\); \(\triangleright\) Freeze the decoder network parameters \(\mathcal{X}_{stego}\leftarrow\mathcal{X}_{coor}\); \(\triangleright\) Initialize for\(i=1\) to \(E\)do
3\(\mathcal{L}_{Total}^{1}\leftarrow\lambda_{d}\mathcal{L}_{d}+\lambda_{I} \mathcal{L}_{I}\)
4\(\delta\leftarrow\) L-BFGS(\(\mathcal{L}_{Total}^{1},\alpha,st_{1}\)); \(\triangleright\) Takes \(st_{1}\) steps to optimize \(\mathcal{L}_{Total}^{2}\)
5\(\mathcal{L}_{Total}^{2}\leftarrow\lambda_{d}\mathcal{L}_{d}+\lambda_{I} \mathcal{L}_{I}-\lambda_{II}\mathcal{L}_{II}-\lambda_{III}\mathcal{L}_{III}\)
6\(\delta\leftarrow\) L-BFGS(\(\mathcal{L}_{Total}^{2},\alpha,st_{2}\)); \(\triangleright\) Takes \(st_{2}\) steps to optimize \(\mathcal{L}_{Total}^{2}\)
7\(\mathcal{X}_{stego}\gets clip_{1}^{0}(\mathcal{X}_{coor}+\delta)\); \(\triangleright\) Clip the image to [0,1]
8\(\mathcal{X}_{stego}\gets quantize(\mathcal{X}_{stego})\); \(\triangleright\) Quantization
9
10 end for return \(\mathcal{X}_{stego}\)
```

**Algorithm 1**Key-based FNNS

## 5. Experiments

### Setup

**Datasets and DNN models.** To evaluate the effectiveness of our proposed method, we conduct experiments on three different datasets, namely MS-COCO(Shi et al., 2017), Div2k(Dai et al., 2018), and CelebA(Miyi et al., 2018). To prepare the data for our experiments, we follow different procedures for different datasets. For Div2k, which is a high-quality dataset consisting of diverse images, we use the entire validation set as our cover images. For MS-COCO and CelebA, which are large-scale datasets for natural scenes and human faces, we randomly use 100 images as our cover images. For all the datasets, we resize the images to a fixed resolution of \(256\times 256\) to ensure consistency and efficiency. To generate the secret and the key, we use a random function to assign each bit with equal probability. Specifically, we generate each bit from a Bernoulli distribution with a parameter of 0.5, meaning that each bit has a 50% chance of being 0 or 1. As such, the secret and the key are uniformly distributed and independent. We use a SteganoGAN(Shi et al., 2017) model pre-trained on the corresponding dataset as the FNN. The SteganoGAN is a popular tool for image steganography which is designed using generative adversarial networks.

**Parameters and Evaluation Metrics.** We set the learning rate \(\alpha\) as 0.10, the number of iterations \(E\) as 100, and the number of the two-stage L-BFGS optimizations as 15 for both \(st_{1}\) and \(st_{2}\). The parameters for balancing different loss terms are set as \(\lambda_{d}=40\), \(\lambda_{I}=5\), \(\lambda_{II}=0.05\) and \(\lambda_{III}=0.05\), respectively. The number of wrong keys is set as \(N=3\) in the wrong key set \(\mathcal{K}_{err}\). The \(t\) and \(T\) for computing the perturbation cost are set as 0.5 and 3, respectively. We use three widely used metrics to evaluate the performance of our method, including bit error rate (BER), peak signal-to-noise ratio (PSNR), and structural similarity index (SSIM). The BER measures the accuracy of the secret extraction, while the PSNR and SSIM measure the visual quality of stego-images.

### Comparisons

We conduct quantitative comparisons between our proposed method and the state-of-the-art FNNS scheme proposed in (Kang et al., 2017) (termed as the FNNS for short). We follow the default settings according to the source code of FNNS for implementation, where we use a pre-trained SteganoGAN model (Shi et al., 2017) as the FNN. Tab.2 reports the performance among different schemes in terms of BER, PSNR, and SSIM, where we use the same key for secret embedding and extraction using our proposed method. Compared with the FNNS, our scheme achieves similar BER which is close to zero when the payload is less than 3BPP. Our method outperforms the FNNS in terms of PSNR and SSIM in almost all cases. In Div2k, the PSNR and SSIM of our proposed method are significantly higher than the FNNS with 6dB and 0.2 increment in PSNR and SSIM, respectively. This indicates the effectiveness of our adaptive perturbation
learning strategy by incorporating the perturbation cost during the optimization. We also observe that both our proposed method and the FNNS perform better than the pre-trained SteganoGAN, which indicates the advantage of the FNNS-based schemes.

Tab.3 further gives the performance of our proposed scheme when the attackers do not know the correct keys. We can see that the BER is around 30% (50% for random guess) for the no key and wrong key cases at different payloads and datasets. This is to say, the attackers are not able to correctly extract the secret from our stego-images if they only know the FNN.

Fig. 3 illustrates some stego-images generated using our proposed method and the FNNS. It can be seen that our stego-images are visually similar to the corresponding cover images. Compared with the FNNS, our method is able to adaptively adjust the perturbation strength according to the image content, where more perturbations are learnt for texture areas. This further demonstrates the advantage of our proposed scheme over the FNNS in terms of visual quality.

### Performance on non-steganographic DNN Models

In this section, we evaluate the performance of our proposed method on DNN models which perform ordinary learning tasks. Concretely, we download two non-steganographic DNN models from a public model repository, including DnCNN(Wang et al., 2017) and FFDNet(Wang et al., 2018), which are pre-trained for image denoising. We use these two image-denoising DNN models as the FNNs for image steganography. Tab.4 gives the comparison between our proposed method and the FNNS on these two DNN models. It can be seen that our scheme performs significantly better than the FNNS in terms of PSNR and SSIM. For both DNN models, the PSNR and SSIM of our stego-images are significantly higher than those generated using FNNS, with over 15dB improvement in PSNR and over 0.6 increment in SSIM. While the BER of our proposed method is still acceptable. Therefore, our proposed method would be more useful for real-world applications when the sender and receiver do not possess any steganographic DNN models.

### Undetectability

One of the important criteria for measuring the steganographic performance is the undetectability of the stego-images against steganalysis tools, which are used to detect the existence of hidden secrets in an image. We follow the suggestion given in (Krizhevsky et al., 2014) to evaluate the undetectability, where StegExpose (Bengio et al., 2017) is adopted as the steganalysis tool. To measure the undetectability of our method, we randomly select 1000 cover images from the MS-COCO dataset and generate 1000 stego-images using FNNS and our proposed method at a payload of 1 BPP. Fig.4 plots the ROC curves for different schemes. It can be seen that the undetectability of our proposed method is better than that of the FNNS.

### Ablation Study

In this section, we conduct ablation studies to analyze the effects of different components in our method. In all the ablation studies, we use the CelebA dataset for evaluation and conduct a data embedding at a payload of 1BPP to generate the stego-images, where the Type-I decoding loss is always used.

**Effectiveness of perturbation cost.** In order to evaluate the effectiveness of perturbation cost, we replace the adaptive image distortion loss with the standard L2 loss in our proposed scheme

\begin{table}
\begin{tabular}{c|c|c c c c|c c c|c c c c} \hline \hline \multirow{2}{*}{Datasets} & \multirow{2}{*}{Methods} & \multicolumn{4}{c|}{BER(\%)\(\downarrow\)} & \multicolumn{4}{c|}{PSNR(dB)\(\uparrow\)} & \multicolumn{4}{c}{SSIM\(\uparrow\)} \\ \cline{3-13}  & & 1BPP & 2BPP & 3BPP & 4BPP & 1BPP & 2BPP & 3BPP & 4BPP & 1BPP & 2BPP & 3BPP & 4BPP \\ \hline \multirow{3}{*}{COCOCO} & SteganoGAN & 3.40 & 6.29 & 11.13 & 15.70 & 25.32 & 24.27 & 25.01 & 24.94 & 0.84 & 0.82 & 0.82 & 0.82 \\  & FNNS & 0.03 & 0.01 & **0.01** & 14.56 & 37.58 & 36.04 & 26.31 & **34.75** & 0.91 & 0.93 & 0.71 & **0.91** \\  & Ours & **2E-04** & **0.01** & 0.10 & **14.43** & **40.46** & **36.62** & **29.43** & 33.65 & **0.98** & **0.95** & **0.84** & 0.89 \\ \hline \multirow{3}{*}{Div2k} & SteganoGAN & 5.12 & 8.31 & 13.74 & 22.85 & 21.33 & 21.06 & 21.42 & 21.84 & 0.76 & 0.76 & 0.77 & 0.78 \\  & FNNS & **0.00** & **5E-04** & **0.07** & **2.21** & 25.96 & 21.41 & 18.68 & 18.68 & 0.79 & 0.60 & 0.38 & 0.38 \\  & Ours & 0.01 & 0.08 & 1.87 & 8.77 & **33.92** & **27.60** & **25.77** & **25.79** & **0.96** & **0.88** & **0.79** & **0.77** \\ \hline \multirow{3}{*}{CelebA} & SteganoGAN & 3.94 & 7.36 & 8.84 & 10.00 & 25.98 & 25.53 & 25.70 & 25.08 & 0.85 & 0.86 & 0.85 & 0.82 \\  & FNNS & **2E-06** & **5E-05** & **4E-04** & **2.40** & 34.43 & 34.48 & 30.98 & 30.79 & 0.83 & 0.87 & 0.80 & 0.75 \\ \cline{1-1}  & Ours & 3E-04 & 2E-03 & 0.02 & 2.75 & **39.48** & **36.43** & **33.22** & **33.86** & **0.95** & **0.92** & **0.87** & **0.86** \\ \hline \hline \end{tabular}
\end{table}
Table 2. Performance comparisons among different methods on different datasets. \(\uparrow\) indicates better, and vice versa. We mark the best-performing values in bold.

\begin{table}
\begin{tabular}{c|c c c c|c c c} \hline \hline \multirow{2}{*}{Datasets} & \multicolumn{4}{c|}{BER without key(\%)\(\uparrow\)} & \multicolumn{4}{c}{BER with wrong key(\%)\(\uparrow\)} \\ \cline{2-9}  & 1BPP & 2BPP & 3BPP & 4BPP & 1BPP & 2BPP & 3BPP & 4BPP \\ \hline COCO & 29.77 & 24.81 & 13.64 & 28.98 & 34.32 & 30.51 & 18.86 & 32.62 \\ Div2k & 22.26 & 21.11 & 13.72 & 22.31 & 25.54 & 24.95 & 17.73 & 25.19 \\ CelebA & 30.65 & 31.61 & 29.53 & 27.98 & 33.76 & 35.19 & 33.64 & 31.97 \\ \hline \hline \end{tabular}
\end{table}
Table 3. The BER of the secret extracted using our method on different datasets without using a key or using wrong keys at different payloads.
and re-evaluate the performance. The results are shown in the second row in Tab.5, where we report various metrics including the PSNR, SSIM, and the BER using different keys. Compared with the numbers shown in the last row in Tab.5, we can observe that using the perturbation cost improves the performance of BER, PSNR, and SSIM. Because it allows us to focus more on the low-cost regions corresponding to the texture areas for data embedding.

**Effectiveness of Type-II decoding loss.** To examine the effectiveness of the Type-II decoding loss, we take out this loss and rerun the experiments, the results of which are given in the third row in Tab.5. Compared with the results given in the last row in Tab.5, we can see the use of Type-II decoding loss would be able to make it more difficult for the attacker to decode the secret without using a correct key.

**Effectiveness of Type-III decoding loss.** For the same token, we remove the Type-III decoding loss and rerun the experiments to conduct ablation studies for Type-III decoding loss. The corresponding results are reported in the fourth row in Tab.5. We see that using Type-III decoding loss substantially increases the BER for the cases where no key or wrong key is used for decoding. Compared with the results in the last row in Tab.5, using the Type-III decoding loss increase the BER of 8.29% and 6.75% for the no key and wrong key cases, respectively.

Figure 4. The ROC curves plotted for different schemes against the StegExpose.

Figure 3. Illustration of stego-images generated using our method and the FNNS at different payload settings on different datasets. The first column shows the cover image, the second to the ninth column shows the stego-images generated using our method and the FNNS from a payload of 1BPP to 4BPP. For each cover image, we present the stego-images in the first row and the corresponding residuals (i.e., the absolute difference between the cover and stego-images) in the second row. We magnify the residuals by 10 times to highlight the altered regions. The cover images (from top to bottom) used in this figure are randomly selected from MS-COCO[20], Div2k[1], and CelebA[21], respectively.
**Effectiveness of two-stage update.** Next, we conduct evaluations to see whether our two-stage update strategy is helpful. To do so, we use a single one-stage update by optimizing only the total loss using the L-BFGS optimizer. The results are shown in the fifth row in Tab.5. We find that our two-stage updating strategy indeed improves the steganographic performance because it helps us to escape local minima caused by quantization. Particularly, the BER is improved from 0.04% to 3E-04% by using our two-stage update strategy.

**Effectiveness of iterative quantization.** To generate a stego-image that is suitable to be transmitted in public communication channels, we have to quantize the image after the optimization. A simple way is to quantize the image when the optimization is done. In our proposed method, we quantize the images in each iteration instead of performing the quantization in the final iteration. We believe such a strategy would be able to learn perturbations that are more appropriate for the quantized images. For justification, we conduct two additional experiments here, where we conduct one-stage updates and two-stage updates and only perform the image quantization after the optimization, respectively. Tab.6 reports the results of these experiments. By comparing the results in Tab.6 with the last two rows in Tab.5, we can clearly observe that the optimal performance is achieved only when both iterative quantization and two-stage updates are applied.

In addition, as shown in the first row of Tab.5, the performance of our method degrades significantly when none of the proposed components are incorporated. We also observe that the combination of all components leads to a substantial improvement over the use of any single component. This indicates that our components are complementary for performance boosting.

## 6. Conclusion

In this paper, a key-based FNNS is proposed to improve the security of the existing FNNS schemes. Unlike the existing FNNS schemes, we use a key to control the generation of the adversarial perturbations for data embedding, which is performed by encrypting the input images of the FNN. Given a stego-image, only the receiver who possesses the correct key can extract the secret using the FNN. We further propose an adaptive perturbation generation scheme by taking the perturbation cost into account during the optimization. This is shown to be effective in improving the visual quality and undetectability of the stego-images. We use a pre-trained steganographic network and two image-denoising DNN models as the FNNs to evaluate the performance of our key-based FNNS. The results indicate the advantage of our proposed scheme over the state-of-the-art FNNS in terms of preventing unauthorized secret extraction as well as the steganographic performance.

###### Acknowledgements.

 This work is supported by National Natural Science Foundation of China under Grant 62072114, U20A20178, U20B2051, U1936214 and U22B2047.

\begin{table}
\begin{tabular}{c|c c c c c} \hline \hline  & BER(\%)\(\downarrow\) & BER without & BER with & PSNR(dB)\(\uparrow\) & SSIM\(\uparrow\) \\ \hline One-stage Update & 0.32 & 33.58 & 36.34 & 38.19 & 0.95 \\ \hline Two-stage Update & 0.65 & 35.56 & 38.13 & 37.97 & 0.95 \\ \hline \end{tabular}
\end{table}
Table 6. The effectiveness of iterative quantization.

\begin{table}
\begin{tabular}{c|c|c c|c c|c c|c c|c c|c c} \hline \hline \multirow{2}{*}{Models} & \multirow{2}{*}{Methods} & \multicolumn{3}{c|}{BER(\%)\(\downarrow\)} & \multicolumn{3}{c|}{BER without key(\%)\(\uparrow\)} & \multicolumn{3}{c|}{BER with wrong key(\%)\(\uparrow\)} & \multicolumn{3}{c}{PSNR(dB)\(\uparrow\)} & \multicolumn{3}{c}{SSIM\(\uparrow\)} \\ \cline{3-14}  & & 1BPP & 2BPP & 3BPP & 1BPP & 2BPP & 3BPP & 1BPP & 2BPP & 3BPP & 1BPP & 2BPP & 3BPP & 1BPP & 2BPP & 3BPP \\ \hline \multirow{2}{*}{DnCNN} & FNNS & **0.04** & **0.02** & **0.08** & / & / & / & / & / & 13.64 & 10.38 & 11.76 & 0.12 & 0.07 & 0.07 \\  & Ours & 3.03 & 3.41 & 4.00 & 20.45 & 21.80 & 21.46 & 20.97 & 21.38 & 21.23 & **31.81** & **30.39** & **29.19** & **0.80** & **0.75** & **0.70** \\ \hline \multirow{2}{*}{FFDNet} & FNNS & 7.17 & 9.92 & 14.69 & / & / & / & / & / & 12.03 & 12.31 & 12.26 & 0.08 & 0.08 & 0.08 \\  & Ours & **5.62** & **5.76** & **5.77** & 21.28 & 22.40 & 21.82 & 21.72 & 22.14 & 21.95 & **31.88** & **30.50** & **29.34** & **0.80** & **0.76** & **0.71** \\ \hline \end{tabular}
\end{table}
Table 4. Performance comparisons on the CelebA dataset using two non-steganographic DNN models, downloaded from a public model repository, as FNNs for steganography.

\begin{table}
\begin{tabular}{c c c c|c c c c} \hline \hline Perturbation & Type-II & Type-III & Two-stage & BER(\%)\(\downarrow\) & BER without & BER with & PSNR(dB)\(\uparrow\) & SSIM\(\uparrow\) \\ Cost & Loss & Loss & Update & & key(\%)\(\uparrow\) & wrong key(\%)\(\uparrow\) & PSNR(dB)\(\uparrow\) & SSIM\(\uparrow\) \\ \hline ✗ & ✗ & ✗ & ✗ & ✗ & 0.04 & 8.08 & 16.09 & 38.24 & 0.94 \\ ✗ & ✓ & ✓ & ✓ & 2E-03 & **30.91** & 33.67 & 38.58 & 0.94 \\ ✓ & ✗ & ✓ & ✓ & 4E-03 & 29.60 & 33.09 & 38.44 & 0.95 \\ ✓ & ✓ & ✗ & ✓ & 7E-03 & 22.35 & 27.01 & 39.16 & 0.95 \\ ✓ & ✓ & ✓ & ✗ & 0.04 & 25.38 & 28.74 & 37.11 & 0.93 \\ ✓ & ✓ & ✓ & ✓ & **3E-04** & 30.64 & **33.76** & **39.48** & **0.95** \\ \hline \end{tabular}
\end{table}
Table 5. Effectiveness of different components in our method.