Improving Selection-Channel-Aware Steganalysis Features

Currently, the best detectors of content-adaptive steganography are built as classifiers trained on examples of cover and stego images represented with rich media models (features) formed by histograms (or co-occurrences) of quantized noise residuals. Recently, it has been shown that adaptive steganography can be more accurately detected by incorporating content adaptivity within the features by accumulating the embedding change probabilities (change rates) in the histograms. However, because each noise residual depends on an entire pixel neighborhood, one should accumulate the embedding impact on the residual rather than the pixel to which the residual is formally attributed. Following this observation, in this paper we propose the expected value of the residual L1 distortion as the quantity that should be accumulated in the selectionchannel-aware version of rich models to improve the detection accuracy. This claim is substantiated experimentally on four modern content-adaptive steganographic algorithms that embed in the spatial domain. Motivation Modern content-adaptive steganography dates back to 2010 when HUGO (Highly Undetectable steGO) was introduced [22]. It incorporated syndrome-trellis codes [6] as the most innovative element that is currently used in all modern steganographic schemes operating in any domain. Such advanced coding techniques gave the steganographer control over where the embedding changes are to be executed by specifying the costs of modifying each pixel. The costs, together with the payload size, determine the probability with which a given pixel is to be modified during embedding. These probabilities, also called change rates, are recognized as the so-called selection channel. Since the costs of virtually all content-adaptive embedding techniques are not very sensitive to the embedding changes themselves [25], they are also available to the steganalyst. For simpler embedding paradigms, such as the Least Significant Bit (LSB) replacement combined with naive adaptive embedding, researchers have shown how a publicly known selection channel can be used to improve the WS detector [23]. Modern adaptive steganographic schemes for digital images [13, 19, 26, 16, 24], however, do not use LSB replacement or naive adaptive embedding, and their detection requires detectors built with machine learning. The prevailing trend is to represent images using rich media models, such as the Spatial Rich Model (SRM) [7], Projection Rich Model (PSRM) [14], and their numerous variants designed for the spatial domain [2], JPEG domain [17, 12, 15, 27], and for color images [8, 9]. Such rich models are concatenations of histograms (for projection type rich models [14] and phase-aware models [15, 12, 27]) or co-occurrences of quantized noise residuals obtained with a variety of linear and non-linear pixel predictors. In [28], the authors proposed to compute the co-occurrences in the SRM only from a fraction of pixels with the highest embedding change probability. Even though this decreased the amount of data available for steganalysis, the authors showed that the embedding algorithm WOW could be detected with a markedly better accuracy. A generalization of this approach was later proposed that utilized the statistics of all pixels by accumulating the maximum of the four pixel change rates in the co-occurrences of four neighboring residuals. This version of the SRM called maxSRM [5] improved the detection of all content-adaptive algorithms to a varying degree. The idea was, however, not extensible to spatial-domain rich features for detection of JPEG steganography [15, 12, 27] or to projection type features because the residuals depend on numerous pixels and one can no longer associate a pixel (or a DCT coefficient) change rate with a given residual sample. This paper resolves this issue by replacing the change rate with the expected value of the residual distortion as the quantity that should be accumulated in the histograms (for JPEG phase-aware features and projection type features) and in co-occurrences (for SRM). This extension is relatively straightforward for linear residuals since the relationship tying the embedding domain and the residual domain is linear. If the embedding changes are executed independently,1 one can easily compute the expected value of the embedding distortion in the residual domain analytically. A major complication, however, occurs for non-linear residuals due to the necessity to compute marginals of high-dimensional probability mass functions. This is why the emphasis of this paper is on rich representations formed from linear residuals. An extension of the idea presented in this paper to phase-aware JPEG features appears in [3]. In the next section, we include a brief overview of the SRM, PSRM, and maxSRM to prepare the ground for the third section, where we describe the quantity that 1This is true for all current steganographic schemes with the notable exception of steganography that synchronizes the selection channel [4, 20]. will be accumulated in the histograms (PSRM) and cooccurrences of quantized noise residuals (SRM) in the selection-channel-aware version of such features. Since the PSRM is extremely computationally demanding, we only work with a subset of its features that come from linear (’spam’ type) residuals of dimension 1,980. In the fourth section, we show that making this relatively compact feature space properly aware of the selection channel achieves state-of-the-art performance with the ensemble classifier. The paper is concluded in the fifth section, where we summarize the contribution and outline how the proposed idea can be executed for phase-aware JPEG features. Preliminaries: SRM, PSRM, and maxSRM In this section, we review the basics of the SRM, its projection version, the PSRM, and the selection-channelaware maxSRM. This is done in order to make the paper self-contained and easier to read. The symbols X,Y∈ {0, . . . ,255}n1×n2 will be used exclusively for two-dimensional arrays of pixel values in an n1×n2 grayscale cover and stego image, respectively. Elements of a matrix will be denoted with the corresponding lower case letter. The pair of subscripts i, j will always be used to index elements in an n1×n2 matrix. The cardinality of a finite set S will be denoted |S|. SRM Both the SRM and the PSRM extract the same set of noise residuals from the image under investigation. They differ in how they represent their statistical properties. The SRM uses four dimensional co-occurrences while the PSRM uses histograms of residual projections. A noise residual is an estimate of the image noise component obtained by subtracting from each pixel its estimate (expectation) obtained using a pixel predictor from the pixel’s immediate neighborhood. Both rich models use 45 different pixel predictors of two different types – linear and non-linear. Each linear predictor is a shift-invariant finite-impulse response filter described by a kernel matrix K(pred). The noise residual Z = (zkl) is a matrix of the same dimension as X: Z = K(pred) ?X−X , K?X. (1) In (1), the symbol ′?′ denotes the convolution with X mirror-padded so that K?X has the same dimension as X. This corresponds to the ’conv2’ Matlab command with the parameter ’same’. An example of a simple linear residual is zij = xi,j+1− xij , which is the difference between a pair of horizontally neighboring pixels. In this case, the residual kernel is K = ( −1 1 ), which means that the predictor estimates the pixel value as its horizontally adjacent pixel. This predictor is used in submodel ’spam14h’ in the SRM. All non-linear predictors in the SRM are obtained by taking the minimum or maximum of up to five residuals obtained using linear predictors. For example, one can predict pixel xij from its horizontal or vertical neighbors, obtaining thus one horizontal and one vertical residual Z(h) = (z ij ), Z (v) = (z ij ): z (h) ij = xi,j+1−xij , (2) z (v) ij = xi+1,j −xij . (3) Using these two residuals, one can compute two nonlinear ’minmax’ residuals as: z (min) ij = min{z (h) ij ,z (v) ij }, (4) z (max) ij = max{z (h) ij ,z (v) ij }. (5) The next step in forming the SRM involves quantizing Z with a quantizer Q−T,T with centroids Q−T,T = {−Tq,(−T +1)q, . . . ,T q}, where T > 0 is an integer threshold and q > 0 is a quantization step: rij ,Q−T,T (zij), ∀i, j. (6) The next step in forming the SRM feature vector involves computing a co-occurrence matrix of fourth order, C(SRM) ∈ Q−T,T , from four (horizontally and vertically) neighboring values of the quantized residual rij (6) from the entire image:2 c (SRM) d0d1d2d3 = n1,n2−3 ∑ i,j=1 [ri,j+k = dk,∀k = 0, . . . ,3], (7)