[Paper Review] Hiding Images in Deep Probabilistic Models

Haoyu Chen, Linqi Song+3 more|arXiv (Cornell University)|Oct 5, 2022

Digital Media Forensic Detection4 citations

TL;DR

This paper proposes a novel framework for hiding images within deep probabilistic models by embedding secret images into the learned patch distribution of a cover image using a SinGAN. Unlike autoencoder-based methods, it avoids transmitting a decoding network, enabling secure, high-capacity, and flexible steganography with key-dependent extraction and robustness against steganalysis.

ABSTRACT

Data hiding with deep neural networks (DNNs) has experienced impressive successes in recent years. A prevailing scheme is to train an autoencoder, consisting of an encoding network to embed (or transform) secret messages in (or into) a carrier, and a decoding network to extract the hidden messages. This scheme may suffer from several limitations regarding practicability, security, and embedding capacity. In this work, we describe a different computational framework to hide images in deep probabilistic models. Specifically, we use a DNN to model the probability density of cover images, and hide a secret image in one particular location of the learned distribution. As an instantiation, we adopt a SinGAN, a pyramid of generative adversarial networks (GANs), to learn the patch distribution of one cover image. We hide the secret image by fitting a deterministic mapping from a fixed set of noise maps (generated by an embedding key) to the secret image during patch distribution learning. The stego SinGAN, behaving as the original SinGAN, is publicly communicated; only the receiver with the embedding key is able to extract the secret image. We demonstrate the feasibility of our SinGAN approach in terms of extraction accuracy and model security. Moreover, we show the flexibility of the proposed method in terms of hiding multiple images for different receivers and obfuscating the secret image.

Motivation & Objective

• Address the limitations of autoencoder-based data hiding, including large decoding networks, vulnerability to steganalysis, and inflexible multi-receiver support.
• Develop a new computational framework that embeds secret images not in the data domain but within the probability distribution learned by a deep generative model.
• Achieve secure and accurate image hiding by leveraging the internal structure of a SinGAN during patch distribution learning, with extraction only possible via a shared embedding key.
• Enable flexible steganography for multiple receivers and support image obfuscation through pixel shuffling without compromising model security.

Proposed method

• Use a SinGAN, a pyramid of GANs, to learn the patch-level probability distribution of a single cover image.
• During SinGAN training, fit a deterministic mapping from a fixed set of noise maps (generated by an embedding key) to the secret image, embedding it into the model’s internal distribution.
• The stego SinGAN behaves identically to the original SinGAN in generating cover-like samples, ensuring model security and invisibility to steganalysis tools.
• Extract the secret image via a single forward pass using the same embedding key, eliminating the need for a separate decoding network.
• Support multiple secret images by training the SinGAN to map multiple key-dependent noise maps to different secret images simultaneously.
• Integrate pixel shuffling (obfuscation) of the secret image, with the shuffling key shared alongside the embedding key, to further strengthen security.

Experimental results

Research questions

• RQ1 Can secret images be embedded within the probability distribution of a deep generative model without altering the model’s observable behavior?
• RQ2 Can the proposed method achieve high extraction accuracy while remaining undetectable by existing steganalysis tools?
• RQ3 Is it feasible to embed multiple secret images for different receivers using a single shared model and keying mechanism?
• RQ4 How does pixel shuffling of the secret image affect the difficulty of steganalysis and the perceptual quality of extracted images?
• RQ5 What is the statistical relationship between the original cover distribution and the stego distribution, and how does it constrain embedding capacity?

Key findings

• The proposed method achieves improved extraction accuracy over autoencoder-based approaches, with visual quality of extracted secret images closely matching the originals.
• The stego SinGAN maintains the same generative behavior as the original SinGAN, passing multiple security tests and remaining undetected by steganalysis tools like StegExpose.
• Hiding multiple secret images (up to four) results in only a graceful degradation of extraction accuracy across all metrics, demonstrating scalability and flexibility.
• Pixel shuffling of the secret image significantly increases the difficulty of steganalysis, with the main content still clearly visible in extracted images despite noise.
• The method enables key-dependent extraction without transmitting a decoding network, enhancing practicality and security.
• Empirical results show that the statistical distance between the original and stego distributions remains small, supporting the feasibility of the probabilistic hiding framework.