Content-adaptive pentary steganography using the multivariate generalized Gaussian cover model

The vast majority of steganographic schemes for digital images stored in the raster format limit the amplitude of embedding changes to the smallest possible value. In this paper, we investigate the possibility to further improve the empirical security by allowing the embedding changes in highly textured areas to have a larger amplitude and thus embedding there a larger payload. Our approach is entirely model driven in the sense that the probabilities with which the cover pixels should be changed by a certain amount are derived from the cover model to minimize the power of an optimal statistical test. The embedding consists of two steps. First, the sender estimates the cover model parameters, the pixel variances, when modeling the pixels as a sequence of independent but not identically distributed generalized Gaussian random variables. Then, the embedding change probabilities for changing each pixel by 1 or 2, which can be transformed to costs for practical embedding using syndrome-trellis codes, are computed by solving a pair of non-linear algebraic equations. Using rich models and selection-channel-aware features, we compare the security of our scheme based on the generalized Gaussian model with pentary versions of two popular embedding algorithms: HILL and S-UNIWARD. 1. MOTIVATION Currently, the most successful approach to designing adaptive steganography is based on minimizing a distortion between the cover and the corresponding stego object. A popular form of the distortion is obtained by first assigning a cost of changing each cover element (e.g., pixel or DCT coefficient) and then computing the total distortion as a sum of costs of all modified pixels. When larger costs are assigned to pixels where the detection is expected to be easier (smooth segments, such as blue sky), the embedding changes concentrate in textured and/or noisy regions where the modifications will be harder to detect by an adversary. Coding methods, such as the syndrome-trellis codes,9 can be used to realize such steganographic schemes in practice in a near-optimal fashion w.r.t. the theoretical rate–distortion bound. The fundamental assumption made here is that the distortion should be related to statistical detectability. However, most distortion functions are assembled in an ad hoc or empirical manner, often assigning the pixel costs by quantifying the impact of making an embedding change on outputs of one or more high-pass filters (noise residuals).15, 16, 21, 22 Recently, a qualitatively different and entirely model-driven approach has been proposed in Refs [5, 12]. It starts with imposing a model on the cover object and estimating the model parameters, the local pixel variances at each pixel. Then, the costs (the probabilities of modifying each pixel or change rates) are computed analytically from the estimated model in order to minimize the Kullback–Leibler divergence between the cover and stego distributions12 or, equivalently, the power of an optimal statistical test.5 By assuming that pixels form a sequence of independent but not necessarily identically distributed random variables, it becomes tractable to compute the optimal embedding change probabilities (costs) using the method of Lagrange multipliers. In this paper, we use the same framework with two innovative elements. First, we explore the possibility to further improve the empirical security by using a more general cover model. While in the prior work5, 12 the multivariate Gaussian distribution was used to model pixels, here we employ the Multivariate Generalized Gaussian (MVGG) model. Since the generalized Gaussian can have thicker tails, it makes sense to allow embedding changes with amplitude larger than 1 to embed a larger payload in pixels from textured areas. Pentary embedding has already been studied and shown beneficial in the past.8 Our study shows that within our modeldriven framework when measuring the security empirically using classifiers trained on examples of cover and stego images, pentary embedding schemes indeed improve security. This gain becomes larger for larger payloads. Surprisingly, despite the fact that the shape parameter of the generalized Gaussian model affects the properties of the selection channel in a major manner, we see little effect on empirical security. This suggests that the way current empirical detectors equipped with rich media features incorporate the knowledge of the selection channel is suboptimal. In the next section, we introduce the cover model, the embedding operation, and derive the stego source model. In Section 3, we formulate steganalysis as a hypothesis testing problem and derive the asymptotic statistical distribution of the optimal detector in the fine-quantization and small-payload limit for a large number of pixels. In Section 3, we show that the optimal change rates controlling the embedding changes by ±1 and ±2 must satisfy a set of two non-linear equations that need to be solved for each pixel together with the global payload constraint (for the payload-limited sender). The cover parameter estimation routine is described in Section 5. The proposed MVGG embedding scheme is tested in Section 6, where we report the detection results with the Spatial Rich Model (SRM)11 and its selection-channel-aware version called maxSRMd27 on a standard image database. We investigate the effect of the shape parameter in the MVGG model on detection and compare the schemes to existing state-of-the-art embedding schemes. The paper is summarized in Section 7. 2. COVER AND STEGO IMAGE MODELS In this section, we introduce the model we use to describe images represented in the spatial domain. We also define the embedding operation and derive the distribution of pixels in the stego image. 2.1 Cover model The light intensity values registered by an imaging sensor are corrupted by the shot noise, dark current, readout, and electronic noise. The superposition of these noise sources can be well modeled using a Gaussian distribution.13, 14 For simplicity and tractability, we will ignore the effects of the subsequent processing, such as demosaicking and filtering, that make the noise in spatially adjacent pixels dependent. Formally, we will consider the pixels in a digital image to be a sequence of N independent realizations (z1, . . . , zN ) of quantized Gaussian random variables (Z1, . . . , ZN ), Zn ∼ N (μn, ω2 n). When estimating the pixel mean using denosing, the difference xn = μn − μ̂n will inevitably contain also the modeling error besides the Gausian acquisition noise. The modeling error will be especially significant in textured regions of the image and may exhibit thick tails (non-Gaussianity). We include the modeling error into the noise component and adopt a Generalized Gaussian (GG) model for x = (x1, . . . , xN ), which we consider as N independent realizations of quantized zero-mean generalized Gaussian random variables (X1, . . . , XN ) distributed according to Xn ∼ f(x; bn, ν) = ν 2bnΓ(1/ν) exp ( − ∣∣∣∣ x bn ∣∣∣∣ν) , (1) where ν is the shape parameter and b is the width parameter directly related to the variance, σ2 n, via the relationship σ2 n = bnΓ(3/ν)/Γ(1/ν). Notice that, for simplicity, we assume that the shape parameter of the GG is constant across the image and only the variances vary. When estimating the cover model, only the variances will be estimated at every pixel as explained in Section 5. We will experiment with several values for the shape parameter ν to see which value provides the best empirical security. As already mentioned, we assume that the above distributions are quantized with a quantizer with centroids k4, k ∈ Z. For simplicity and without loss on generality, in this paper we set 4 = 1. Assuming the fine quantization limit, 4 σn for all n, the probability mass function (pmf) of the nth pixel is given by P0 = (p0(k;σn, ν))k∈Z p0(k;σn, ν) = P(xn = k) ∝ ν 2bnΓ(1/ν) exp ( −|k| ν