[Paper Review] Adversarial Embedding: A robust and elusive Steganography and Watermarking technique

Salah Ghamizi, Maxime Cordy+2 more|arXiv (Cornell University)|Nov 14, 2019

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper introduces Adversarial Embedding, a novel steganography and watermarking technique that leverages targeted adversarial attacks on deep neural networks to invisibly embed secret messages in images. By using non-transferable, imperceptible perturbations, the method achieves high embedding density (up to 10 bits per pixel), resists steganalysis, and maintains message integrity under image tampering, with less than 13% recovery rate by adversaries lacking model access.

ABSTRACT

We propose adversarial embedding, a new steganography and watermarking technique that embeds secret information within images. The key idea of our method is to use deep neural networks for image classification and adversarial attacks to embed secret information within images. Thus, we use the attacks to embed an encoding of the message within images and the related deep neural network outputs to extract it. The key properties of adversarial attacks (invisible perturbations, nontransferability, resilience to tampering) offer guarantees regarding the confidentiality and the integrity of the hidden messages. We empirically evaluate adversarial embedding using more than 100 models and 1,000 messages. Our results confirm that our embedding passes unnoticed by both humans and steganalysis methods, while at the same time impedes illicit retrieval of the message (less than 13% recovery rate when the interceptor has some knowledge about our model), and is resilient to soft and (to some extent) aggressive image tampering (up to 100% recovery rate under jpeg compression). We further develop our method by proposing a new type of adversarial attack which improves the embedding density (amount of hidden information) of our method to up to 10 bits per pixel.

Motivation & Objective

• Address the limitations of existing steganography and watermarking techniques that fail to balance high data capacity, undetectability, and resilience to tampering.
• Leverage the inherent properties of adversarial attacks—such as imperceptibility, non-transferability, and robustness—to create a new class of secure embedding methods.
• Develop a new adversarial attack, Sorted Targeted Adversarial Attack (SATA), to maximize embedding density while maintaining high success rates for message retrieval.
• Demonstrate that the proposed method outperforms prior deep learning-based steganography in terms of embedding capacity, security, and robustness to common image manipulations.

Proposed method

• Use a pre-trained deep neural network (DNN) with multiple output classes as the embedding and extraction mechanism, mapping class outputs to binary message bits.
• Apply a non-transferable targeted adversarial attack (SATA) to generate stego-images by perturbing cover images such that the DNN classifies them into specific target classes corresponding to the encoded message.
• Design SATA to enable multi-class embedding by sorting target classes and using a weighted loss function controlled by hyperparameter γ to balance class-specific perturbations.
• Ensure imperceptibility by constraining perturbations within a small L2 norm (ε = 0.5) and using iterative PGD-style optimization with random restarts.
• Enable black-box compatibility by relying only on model logits and gradients, allowing integration with any existing DNN and adversarial attack framework.
• Use a grid search over γ and ε to optimize the success rate of embedding across multiple images, ensuring reliable message recovery.

Experimental results

Research questions

• RQ1 Can adversarial attacks be repurposed to create a steganography and watermarking system that is both highly undetectable and resilient to image tampering?
• RQ2 To what extent can the embedding density be increased by modifying the adversarial attack to support multi-class encoding?
• RQ3 How effective is the proposed method against steganalysis and unauthorized retrieval when the attacker has partial knowledge of the model?
• RQ4 How does the method perform under common image processing operations such as JPEG compression, color depth reduction, and resizing?
• RQ5 What is the trade-off between embedding capacity (number of classes per image) and success rate of message recovery?

Key findings

• The proposed Adversarial Embedding technique achieves an embedding density of up to 10 bits per pixel using a 10,000-class ImageNet-style classifier, surpassing existing steganography methods.
• With a 100-class classifier, the method reaches an embedding density of 0.2 BPP, comparable to state-of-the-art steganography techniques.
• Under JPEG compression, the method maintains a 100% message recovery rate, demonstrating strong resilience to aggressive image tampering.
• When an attacker lacks access to the shared model, the message recovery rate drops below 13%, confirming strong confidentiality due to non-transferability.
• The SATA attack successfully embeds up to seven classes per image with a success rate of 0.8% across 1,000 test images, indicating high reliability for practical deployment.
• The method shows robustness to color depth reduction, achieving up to 88% recovery rate under 8-bit color depth, indicating resilience to common image processing.