[Paper Review] HiDDeN: Hiding Data With Deep Networks

Jiren Zhu, Russell Kaplan+2 more|arXiv (Cornell University)|Jul 26, 2018

Digital Media Forensic Detection24 references4 citations

TL;DR

HiDDeN is an end-to-end trainable deep learning framework for image steganography and robust watermarking that uses a joint encoder-decoder network with an adversarial discriminator to embed messages imperceptibly into images. It achieves high robustness to common image distortions—including JPEG compression, blurring, dropout, and cropping—by training with differentiable approximations of non-differentiable transformations, outperforming prior deep learning methods and matching or exceeding commercial watermarking tools like Digimarc in key scenarios.

ABSTRACT

Recent work has shown that deep neural networks are highly sensitive to tiny perturbations of input images, giving rise to adversarial examples. Though this property is usually considered a weakness of learned models, we explore whether it can be beneficial. We find that neural networks can learn to use invisible perturbations to encode a rich amount of useful information. In fact, one can exploit this capability for the task of data hiding. We jointly train encoder and decoder networks, where given an input message and cover image, the encoder produces a visually indistinguishable encoded image, from which the decoder can recover the original message. We show that these encodings are competitive with existing data hiding algorithms, and further that they can be made robust to noise: our models learn to reconstruct hidden information in an encoded image despite the presence of Gaussian blurring, pixel-wise dropout, cropping, and JPEG compression. Even though JPEG is non-differentiable, we show that a robust model can be trained using differentiable approximations. Finally, we demonstrate that adversarial training improves the visual quality of encoded images.

Motivation & Objective

• To develop an end-to-end trainable deep learning framework for data hiding that supports both steganography and robust watermarking.
• To improve the imperceptibility and robustness of hidden data by leveraging adversarial training and differentiable approximations of non-differentiable image transformations.
• To enable flexible trade-offs between capacity, secrecy, and robustness by modifying training-time noise layers.
• To demonstrate that neural networks can learn to embed information in a way that survives real-world image distortions, even when the distortion is non-differentiable.
• To show that end-to-end training with adversarial loss improves visual quality and makes the encoded images harder to detect by steganalyzers.

Proposed method

• A convolutional encoder network takes a cover image and a binary message as input and outputs a visually indistinguishable encoded image.
• A decoder network takes the encoded image and reconstructs the original message, minimizing reconstruction error.
• An adversarial network is trained to distinguish between real cover images and encoded images, providing a loss that improves the imperceptibility of the hidden data.
• Noise layers simulating real-world distortions (e.g., Gaussian blur, pixel dropout, cropping, JPEG) are inserted between encoder and decoder during training to improve robustness.
• For non-differentiable JPEG compression, a differentiable approximation (JPEG-Mask) is used during training to enable backpropagation.
• The overall training objective minimizes three components: (1) L2 distance between cover and encoded images, (2) cross-entropy loss between input and decoded messages, and (3) adversarial loss from the discriminator.

Experimental results

Research questions

• RQ1 Can end-to-end deep learning be used to create a unified framework for both steganography and robust watermarking?
• RQ2 Can a deep learning model learn to embed data in a way that remains robust to common image distortions, including non-differentiable ones like JPEG compression?
• RQ3 Does adversarial training improve the visual quality and detectability resistance of encoded images?
• RQ4 Can a single model trained on multiple distortion types generalize well across different distortions without specialized retraining?
• RQ5 How does the performance of HiDDeN compare to state-of-the-art commercial watermarking systems like Digimarc under realistic distortion conditions?

Key findings

• HiDDeN achieves 94% bit accuracy under pixel-wise dropout (p=0.1), outperforming models trained without noise and approaching the performance of specialized models.
• The model trained with a differentiable approximation of JPEG achieves 85% bit accuracy under actual JPEG compression, significantly outperforming a non-robust model that drops to 50% (chance level).
• The Combined model, trained on all distortion types, achieves 94% accuracy under Cropout and 97% under specialized Crop, demonstrating strong generalization without sacrificing performance.
• Against Dropout (p=0.1), the specialized HiDDeN model achieves ≥95% bit accuracy, while Digimarc fails completely, indicating superior robustness in this scenario.
• For cropping and high-intensity spatial noise, HiDDeN’s specialized and combined models achieve ≥95% bit accuracy, comparable to or exceeding Digimarc’s success rate.
• The model trained with no noise performs poorly under real distortions, confirming that robustness must be explicitly trained for, not assumed from clean transmission.