Neural Cover Selection for Image Steganography

We appreciate the reviewer's recognition of our contributions. Our work advances steganographic cover optimization by using DDIM to adjust the cover image, reducing extraction errors and improving stego image quality. Unlike previous methods, our approach offers stronger interpretability. We show the encoder prefers low-variance pixels for message encoding, verified by the waterfilling algorithm for Gaussian channels.

We address the two weaknesses as follows.

1. Clarification on fixed vs. trainable components: The DDIM and LISO models are pre-trained and remain fixed throughout the process. The latent vector $x_T$ generated by the DDIM's forward pass is the only component optimized by minimizing the extraction loss $||m-\hat{m}||$ (lines 141-142). This method is both practical and efficient, as it avoids the need for costly fine-tuning of DDIM. We will clarify this point in the revised manuscript.

2. Additional experiments using SRNet: We conducted experiments using SRNet, and the results are presented in Table 1 of the supplementary material. Our observations indicate that the images generated by our framework effectively resist steganalysis by SRNet. This is evidenced by the significant drop in detection rate when transitioning from scenario 1 to scenario 2. As a reminder, in scenario 2, we exploit the differentiability of the steganalyzer (SRNet) and incorporate an additional loss term to account for steganalysis . We will ensure this information is clearly presented in the manuscript.

Below, we provide a detailed, line-by-line response to each of the questions.

1. Security and robustness terminology: Indeed; it makes more sense to use "security" for resistance to steganalysis and "robustness" for resistance to channel perturbations. We will update the terminology in the manuscript accordingly.

2. Steganalysis settings: Regarding the settings of the steganalysis experiments, we adhered to the default values specified in the LISO paper. We will add detailed information about the number of samples used for training and testing in the revised manuscript.

3. Latent optimization description: Thank you for your suggestion, we will make this process clearer in the text. The DDIM is pre-trained and fixed during the entire process, as is the LISO model. The latent vector $x_T$ ​ produced by the DDIM’s forward pass is the only entity being optimized by minimizing the extraction loss $||m-\hat{m}||$ (lines 141-142). This approach is practical and efficient, as it avoids the costly fine-tuning of the DDIM.

4. Reconsidering terminology, replacing “Cover Selection”: Thanks for the suggestion. We are considering several options such as "cover reconstruction," "cover fine-tuning," or "cover re-generation" to better describe our process.

5. Clarification on detection and error rates in steganalysis: Thank you for your feedback. We define the detection rate as detection rate=N_true/N_test. We will include this definition in the revised manuscript. Our use of this definition follows the steganographic framework presented in LISO [1]. We will also clarify its connection to the "error rate" as you described, noting that the closer the error rate is to 50%, the better the performance in resisting steganalysis. We will ensure these definitions and their implications are clearly explained.

   [1] Xiangyu Chen, Varsha Kishore, and Kilian Q Weinberger. “Learning iterative neural optimizers for image steganography.” In International Conference on Learning Representations, 2023.

Thank you for engaging in our discussion. We genuinely appreciate your constructive feedback.

We appreciate the reviewer's recognition of our work, including (a) identifying limitations of existing cover selection methods, (b) integrating pretrained generative models with steganographic encoder-decoder pairs, and (c) demonstrating that our neural encoder hides messages within low variance pixels, similar to the water-filling algorithm. Our approach yields lower error rates and enhanced image quality, confirmed by visual metrics, and increases low variance pixels, further improving message concealment.

We would like to provide pointers to the experiments and key results in the manuscript and appendix that we strongly believe address the main weaknesses and limitations identified in the review.

1. Experiments with high-quality images: We agree that this is an important aspect and would like to emphasize that we conducted extensive experiments using high-quality images from the CelebA-HQ dataset at 1024x1024 resolution and Animal Faces-HQ (AFHQ) dataset at 512x512 resolution. The qualitative results can be found in Fig. 10 of the appendix, with additional results shown in Fig. 1 and Fig. 2 of the supplementary material. These figures illustrate the high quality of the CelebA-HQ and AFHQ images. The effectiveness of our framework is further validated by the metrics presented in Table 2 of the main text, including Error Rate, BRISQUE, PSNR, and SSIM. These results indicate that we achieve similar improvements compared to the baselines for both high-quality and low-quality images.

2. Enhancing image quality without compromising the algorithm's security performance: We would like to clarify that the algorithm's security performance is not compromised. As shown in Table 4 of the manuscript, XuNet's detection rate using the AFHQ dataset (high-quality 512x512 images) remains similar, if not lower, before and after applying our framework, indicating that our approach maintains security performance. Additionally, the high quality of our AFHQ images is validated in Table 2, measured by metrics such as BRISQUE, SSIM, and PSNR.

Perhaps these setups were not clear, and we will clarify them in the revised manuscript. We kindly ask the reviewer to consider these results in their review.

We provide answers to the questions and suggestions below.

1. JPEG layer description: Thanks for the suggestion. We agree that a brief description of the JPEG layer in Section 5.2 will enhance the clarity of our paper. We will include this in the revised manuscript.

2. Fig. 11 third row third column fuzziness: The subgraph in the third row and third column does appear fuzzier than the others. This issue is an outlier and has not been observed in CelebA-HQ, AFHQ, or other ImageNet classes. It arises due to the LISO framework, on which our method is built. LISO is the state-of-the-art steganographic encoder-decoder, which is why we chose to build our method on it. However, training LISO on ImageNet is challenging because of the vast number of classes. To address this, we fine-tuned LISO using additional owl images obtained through data augmentation techniques such as rotation and flipping, and achieved a slightly better-quality image, as shown in Fig. 3 of the supplementary material.

   We would also like to emphasize that the main focus of this work is to design a cover selection algorithm, not the steganographic encoder and decoder. While we have made improvements to the owl image, further investigation into enhancing LISO’s performance on ImageNet would be necessary for even better results, which was beyond the scope of the main paper.

3. Advantage of BigGAN network and DDIM network (Kim et al. 2022): BigGAN and the diffusion model from Kim et al. (2022) are among the state-of-the-art generative models, known for their high-quality image generation capabilities. Both models are open-sourced, making them accessible for replication. Additionally, the papers introducing these models are highly cited, indicating their significant impact and validation within the research community. We would also like to note that our approach is applicable to other generative models as well.

4. Clarification on the role of weight initialization in Fig. 2: As described in Section 3.1 of the manuscript, our process consists of two steps. In step 1, the initial cover image goes through the forward diffusion process to get the latent $x_T$. This serves as the initialization for the next step. In step 2, we optimize the already initialized elements of $x_T$ such that when it goes through the backward diffusion process, the output image minimizes the message reconstruction loss. In other words, we treat $x_T$ as a learnable weight matrix initialized from step 1, and its weights are updated via step 2 using gradient descent. We hope this addresses your question, and we will add more details to this section to make it clearer.

5. Reference pointer (Evsutin et al. 2018): We have carefully checked our references, and the article by Evsutin et al. (2018) is included (lines 350-352). If there are any specific concerns or if you need further clarification, please let us know.

We express our gratitude to the reviewer for their valuable feedback, and we will address each point in detail.

Weaknesses:

• Image alteration: We acknowledge the concern regarding the alteration of the original image content due to the optimization of latent variables. However, it is important to highlight that such modifications are not only common but also well-founded in the literature.

  a) Established practice in research: Our approach of altering the cover image is in line with established practices in the field of cover selection. For example, studies such as [1] and [2] analyzed different cover images and selected the most suitable ones to improve the robustness and accuracy of message extraction. These works provide concrete evidence and justification for the alteration of cover images, demonstrating that such modifications are beneficial for enhancing performance in steganographic applications.

  [1] Farzin Yaghmaee and Mansour Jamzad. Estimating watermarking capacity in gray scale images based on image complexity. EURASIP Journal on Advances in Signal Processing, 2010:1–9, 2010.

  [2] Zichi Wang and Xinpeng Zhang. Secure cover selection for steganography. IEEE Access, 7:57857– 57867, 2019.

  b) Preservation of image semantics: While our algorithm alters the cover image to minimize decoding error, it does not change its meaning or semantics. In semantic communications, these modifications are acceptable as the focus is on accurately transmitting essential information, not preserving the exact original image content.

• Unnatural visual characteristics (Fig. 10), potentially leading to easy detection: We want to clarify that the algorithm's detection accuracy remains intact. Table 4 of the manuscript demonstrates that XuNet's detection rate with the AFHQ dataset stays consistent or even decreases after applying our framework, showing that our method does not compromise security performance.

• Loss term for steganalysis: Our paper addresses the inclusion of an additional loss term for steganalysis, as outlined in Section 5.3 (lines 304-306). We incorporate the steganalyzer’s logit output into the loss function. Our results in Table 4 show that, when embedding 4 bits per pixel, detection accuracy drops from 97.35% to 8.6% after incorporating the loss, indicating improved resistance to steganalysis. We will clarify this further in the main text.

• Unexpected decline in detection rate: Indeed, it is puzzling that detection decreases despite the increased payload. This effect is not related to our introduced method but is inherent to the LISO framework on which our method is based. As shown in Table 5 of the LISO manuscript [1], they also observe this unexpected behavior where the detection rates do not increase consistently with higher payloads. This phenomenon is not fully understood.

  We chose to use LISO because it is a state-of-the-art steganographic framework. However, we recognize that this reliance on LISO also means inheriting some of its unexplained behaviors. Future work could explore approaches combining LISO with other frameworks or develop novel techniques to address detection rate inconsistencies with different payloads. We will highlight this in our paper and acknowledge the need for further research to understand and improve the framework.

  [1] Xiangyu Chen, Varsha Kishore, and Kilian Q Weinberger. “Learning iterative neural optimizers for image steganography.” In International Conference on Learning Representations, 2023.

Questions:

• Comparisons to other schemes: While related, the mentioned frameworks are designed for different settings than those we used. The approaches in [1, 2] involve networks that learn algorithms robust to image perturbations between the encoder and decoder, whereas our settings assume no such perturbations. In [3], the focus is on hiding secret images within cover images, unlike our method, which hides secret binary messages. Lastly, [4] deals with coverless steganography, mapping secret messages to latent vectors for a generative adversarial network, which then generates random cover images. In contrast, our settings involve embedding secret messages into given cover images using a dedicated encoder.

• Additional qualitative results: We have included additional qualitative results comparing the original and encoded images in Fig. 1 of the supplementary material.

• Effect on optimized images:

  1. Relationship with Image Complexity Metrics: We would like to refer the reviewer to Fig. 12 of Appendix G, where we conducted extensive simulations to answer this important question. In our experiments on the AFHQ dataset, we analyzed the relationship between the decoding error and various image complexity metrics: entropy, edge density, compression ratio, and color diversity. Our results show a negative correlation between the decoding error and the first three metrics, and a positive correlation with color diversity. We conjecture that optimizing for decoding error is affecting these image complexity metrics. While these findings are encouraging, more research is needed to fully understand the effects of optimization on the original images.

  2. Increase in Low-Variance Pixels: As discussed in Section 4.3 of the main text, the optimization process increases the number of low-variance pixels in the images from 81.6% to 92.4%. This is related to our discussion about the algorithm hiding data in low-variance spots. When the number of low-variance pixels increases, the encoder has more flexibility and options for data hiding, resulting in better performance.

  We will include more details of this discussion in the manuscript to highlight the need for further investigation.

• Clarification, encoding in low-variance pixels: We would like to refer the reviewer to part (3) of the global response. We hope this description addresses the question.

We thank the reviewer for the response.

We would like to clarify three key points:

1. The primary focus of our work is on developing a cover selection algorithm rather than a complete steganographic encoding-decoding framework. Our method is versatile and can be integrated with various steganographic frameworks, including RoSteALS and StegaStamp. The assumption of no perturbation aligns with the steganographic frameworks described in [1,2,3]. Among those 3, we specifically selected the LISO framework [3] due to its status as the state-of-the-art. This line of work operates without assuming any perturbations, which is why perturbation results are not presented in our work.

   [1] Kevin Alex Zhang, Alfredo Cuesta-Infante, Lei Xu, and Kalyan Veeramachaneni. “Steganogan: High capacity image steganography with gans.” arXiv preprint arXiv:1901.03892, 2019.

   [2] Varsha Kishore, Xiangyu Chen, Yan Wang, Boyi Li, and Kilian Q Weinberger. “Fixed neural network steganography: Train the images, not the network.” In International Conference on Learning Representations, 2021.

   [3] Xiangyu Chen, Varsha Kishore, and Kilian Q Weinberger. “Learning iterative neural optimizers for image steganography.” In International Conference on Learning Representations, 2023.

2. Although we do not provide perturbation results, we present results related to JPEG distortion (Section 5.2), which is highly relevant to real-world applications and offers a meaningful representation of our method’s effectiveness.

3. Regarding the request to “provide comparative results with several methods such as RoSteALS or StegaStamp”, we are uncertain about the exact nature of the comparative results the reviewer is seeking. As mentioned earlier, our focus is on designing a cover selection algorithm for a given steganographic encoder-decoder pair. If RoSteALS outperforms StegaStamp, then our cover selection framework applied to RoSteALS would also outperform its application to StegaStamp. If the reviewer is suggesting a comparison of our framework when applied to LISO versus RoSteALS or StegaStamp, it would not be a fair comparison, as LISO is trained under different conditions than the other methods.