[Paper Review] CycleGAN, a Master of Steganography

Casey Chu, Andrey Zhmoginov+1 more|arXiv (Cornell University)|Dec 8, 2017

Advanced Steganography and Watermarking TechniquesComputer Science10 references153 citations

TL;DR

The paper reveals that CycleGAN hides source-image information in its generated outputs via high-frequency, low-amplitude signals, making it vulnerable to adversarial attacks and suggesting modifications to training to improve robustness.

ABSTRACT

CycleGAN (Zhu et al. 2017) is one recent successful approach to learn a transformation between two image distributions. In a series of experiments, we demonstrate an intriguing property of the model: CycleGAN learns to "hide" information about a source image into the images it generates in a nearly imperceptible, high-frequency signal. This trick ensures that the generator can recover the original sample and thus satisfy the cyclic consistency requirement, while the generated image remains realistic. We connect this phenomenon with adversarial attacks by viewing CycleGAN's training procedure as training a generator of adversarial examples and demonstrate that the cyclic consistency loss causes CycleGAN to be especially vulnerable to adversarial attacks.

Motivation & Objective

• Investigate how CycleGAN encodes information from the source image into generated outputs.
• Demonstrate that the encoding is high-frequency and robust to low-frequency content.
• Show that the cyclic consistency loss enables adversarial attacks via crafted inputs.
• Discuss implications for loss design and potential defenses to reduce vulnerability.
• Explore connections between CycleGAN behavior and adversarial attack frameworks.

Proposed method

• Train CycleGAN on unpaired image domains X and Y (e.g., aerial photographs and maps).
• Analyze how GFx reconstructs x from Fx, identifying hidden high-frequency signals.
• Quantify sensitivity to input noise by defining V = E[ ||G(Fx+z) − GFx||_1 ].
• Experiment with noise amplitude ε and spatial correlation σ to observe V’s behavior.
• Demonstrate adversarial-map construction by optimizing y* to minimize ||Gy* − x*|| and rotate this into a CycleGAN training perspective.

Experimental results

Research questions

• RQ1 Does CycleGAN encode source-image information in the generated outputs, and if so, in what form?
• RQ2 How does the hidden information respond to noise and perturbations, and is it localized or spread out?
• RQ3 Can the cyclic consistency loss be interpreted as enabling adversarial attacks on the generator G?
• RQ4 What defenses might mitigate the vulnerability without destroying the CycleGAN objectives?
• RQ5 What implications does this have for loss design in composite neural networks (e.g., GANs and perceptual losses)?

Key findings

• The generated map Fx contains high-frequency, low-amplitude signals encoding information about the source aerial image x.
• Vattains nearly its maximum when ε ≥ 3/256 ≈ 0.01, indicating imperceptible input noise can cause large changes in reconstruction.
• Encoding is robust to low-frequency content; high-frequency components carry the information.
• Perturbations added via F can produce nonlocal changes in G’s output, yet the system can still reconstruct targeted elements when masked appropriately.
• An adversarial-map y* can be found by gradient descent to cause Gy* to reproduce any desired x*, showing a vulnerability to adversarial manipulation.
• The cyclic consistency loss appears to function like an ongoing adversarial attack on G, suggesting that training may foster increased susceptibility to such attacks.