Publications

2023

1. EI

   Cost polarization by dequantizing for JPEG steganography

   In Proceedings IS&T, Electronic Imaging, Media Watermarking, Security, and Forensics 2023

   Abs PDF

   In this article, we study a recently proposed method for improving empirical security of steganography in JPEG images in which the sender starts with an additive embedding scheme with symmetrical costs of ±1 changes and then decreases the cost of one of these changes based on an image obtained by applying a deblocking (JPEG dequantization) algorithm to the cover JPEG. This approach provides rather significant gains in security at negligible embedding complexity overhead for a wide range of quality factors and across various embedding schemes. Challenging the original explanation of the inventors of this idea, which is based on interpreting the dequantized image as an estimate of the precover (uncompressed) image, we provide alternative arguments. The key observation and the main reason why this approach works is how the polarizations of individual DCT coefficients work together. By using a MiPOD model of content complexity of the uncompressed cover image, we show that the cost polarization technique decreases the chances of “bad” combinations of embedding changes that would likely be introduced by the original scheme with symmetric costs. This statement is quantified by computing the likelihood of the stego image w.r.t. the multivariate Gaussian precover distribution in DCT domain. Furthermore, it is shown that the cost polarization decreases spatial discontinuities between blocks (blockiness) in the stego image and enforces desirable correlations of embedding changes across blocks. To further prove the point, it is shown that in a source that adheres to the precover model, a simple Wiener filter can serve equally well as a deep-learning based deblocker.

2022

1. thesis

   DEEP LEARNING FOR IMAGE STEGANOGRAPHY AND STEGANALYSIS. CHALLENGES, ADVANCES, AND OPPORTUNITIES

   Yousfi, Y.

   2022

   Abs PDF

   Deep learning has proven incredibly successful in a plethora of fields. In computer vision, deep neural networks are now the state-of-the-art for a variety of tasks. At the first glance, steganography and steganalysis appear to be very much different tasks than classical computer vision tasks, yet deep learning, especially convolutional neural networks, popularized by the computer vision field, have outperformed all classical feature-based approaches for detecting steganography. Intuitively, steganographic embedding changes are weak, noise-like signals executed primarily in complex content, such as textures and edges. Since computer vision classifies and categorizes content, it is also suitable for detecting the presence of noise-like stego signals modulated by content. In this dissertation, we focus on refactoring steganography detectors with more modern and general components, qualitatively understanding their strengths and failure cases, and using them algorithmically to improve steganography. First, we show that many custom ingredients long believed to be necessary for successfully training a deep neural network for steganography detection can be omitted in favor of more general-purpose convolutional architectures with very few domain-specific changes. Next, we focus on understanding what makes deep neural networks superior to their classical feature-based predecessors. Lastly, we use these powerful steganography detectors as a feedback loop in novel batch steganography algorithms, which allocate more payload in images where state-of-the-art detectors fail to detect steganography.

2. IH

   Detector-Informed Batch Steganography and Pooled Steganalysis

   Yousfi, Y., Dworetzky, E., and Fridrich, J.

   In The 10th ACM Workshop on Information Hiding and Multimedia Security 2022

   Abs PDF

   Abstract We study the problem of batch steganography when the senders use feedback from a steganography detector. This brings an additional level of complexity to the table due to the highly non-linear and non-Gaussian response of modern steganalysis detectors as well as the necessity to study the impact of the inevitable mismatch between senders’ and Warden’s detectors. Two payload spreaders are considered based on the oracle generating possible cover images. Three different pooling strategies are devised and studied for a more comprehensive assessment of security. Substantial security gains are observed with respect to previous art – the detector-agnostic image-merging sender. Close attention is paid to the impact of the information available to the Warden on security.

2021

1. WIFS21

   Data Augmentation for JPEG Steganalysis

   Itzhaki, T., Yousfi, Y., and Fridrich, J.

   In IEEE International Workshop on Information Forensics and Security 2021

   Abs PDF Slides

   Deep Convolutional Neural Networks (CNNs) have performed remarkably well in JPEG steganalysis. However, they heavily rely on large datasets to avoid overfitting. Data augmentation is a popular technique to inflate the datasets available without collecting new images. For JPEG steganalysis, the augmentations predominantly used by researchers are limited to rotations and flips (D4 augmentations). This is due to the fact that the stego signal is erased by most augmentations used in computer vision. In this paper, we systematically survey a large number of other augmentation techniques and asses their benefit in JPEG steganalysis.

2. WIFS21

   CNN Steganalyzers Leverage Local Embedding Artifacts

   Yousfi, Y., Butora, J., and Fridrich, J.

   In IEEE International Workshop on Information Forensics and Security 2021

   Abs PDF Slides

   While convolutional neural networks have firmly established themselves as the superior steganography detectors, little human-interpretable feedback to the steganographer as to how the network reaches its decision has so far been obtained from trained models. The folklore has it that, unlike rich models, which rely on global statistics, CNNs can leverage spatially localized signals. In this paper, we adapt existing attribution tools, such as Integrated Gradients and Last Activation Maps, to show that CNNs can indeed find overwhelming evidence for steganography from a few highly localized embedding artifacts. We look at the nature of these artifacts via case studies of both modern content-adaptive and older steganographic algorithms. The main culprit is linked to “content creating changes” when the magnitude of a DCT coefficient is increased (Jsteg, –F5), which can be especially detectable for high frequency DCT modes that were originally zeros (J-MiPOD). In contrast, J-UNIWARD introduces the smallest number of locally detectable embedding artifacts among all tested algorithms.

3. IH

   How to Pretrain for Stegnalysis

   Butora, J., Yousfi, Y., and Fridrich, J.

   In The 9th ACM Workshop on Information Hiding and Multimedia Security 2021

   Abs PDF

   In this paper, we investigate the effect of pretraining CNNs on ImageNet on their performance when refined for steganalysis of digital images. In many cases, it seems that just ’seeing’ a large number of images helps with the convergence of the network during the refinement no matter what the pretraining task is. To achieve the best performance, the pretraining task should be related to steganalysis, even if it is done on a completely mismatched cover and stego datasets. Furthermore, the pretraining does not need to be carried out for very long and can be done with limited computational resources. An additional advantage of the pretraining is that it is done on color images and can later be applied for steganalysis of color and grayscale images while still having on-par or better performance than detectors trained specifically for a given source. The refining process is also much faster than training the network from scratch. The most surprising part of the paper is that networks pretrained on JPEG images are a good starting point for spatial domain steganalysis as well.

4. IH

   Improving EfficientNet for JPEG Steganalysis

   Yousfi, Y., Butora, J., Fridrich, J., and Fuji-Tsang, C.

   In The 9th ACM Workshop on Information Hiding and Multimedia Security 2021

   Abs PDF

   In this paper, we study the EfficientNet family pre-trained on ImageNet when used for steganalysis using transfer learning. We show that certain “surgical modifications” aimed at maintaining the input resolution in EfficientNet architectures significantly boost their performance in JPEG steganalysis, establishing thus new benchmarks. The modified models are evaluated by their detection accuracy, the number of parameters, the memory consumption, and the total floating point operations (FLOPs) on the ALASKA II dataset. We also show that, surprisingly, EfficientNets in their “vanilla form” do not perform as well as the SRNet in BOSSbase+BOWS2. This is because, unlike ALASKA II images, BOSSbase+BOWS2 contains aggressively subsampled images with more complex content. The surgical modifications in EfficientNet remedy this underperformance as well.

2020

1. WIFS20

   ImageNet Pre-trained CNNs for JPEG Steganalysis

   Yousfi, Y., Butora, J., Khvedchenya, E., and Fridrich, J.

   In IEEE International Workshop on Information Forensics and Security 2020

   Abs PDF Code Video

   In this paper, we investigate pre-trained computervision deep architectures, such as the EfficientNet, MixNet, and ResNet for steganalysis. These models pre-trained on ImageNet can be rather quickly refined for JPEG steganalysis while offering significantly better performance than CNNs designed purposely for steganalysis, such as the SRNet, trained from scratch. We show how different architectures compare on the ALASKA II dataset. We demonstrate that avoiding pooling/stride in the first layers enables better performance, as noticed by other top competitors, which aligns with the design choices of many CNNs designed for steganalysis. We also show how pre-trained computer-vision deep architectures perform on the ALASKA I dataset.

2. SPL

   An Intriguing Struggle of CNNs in JPEG Steganalysis and the OneHot Solution

   Yousfi, Y., and Fridrich, J.

   IEEE Signal Processing Letters 2020

   Abs PDF Code

   Deep convolutional neural networks (CNNs) have become the tool of choice for steganalysis because they outperform older feature-based detectors by a large margin. However, recent work points at cases where feature-based detectors perform better than CNNs due to their failure to compute simple statistics of DCT coefficients. We introduce a shallow “OneHot” CNN, which encodes DCT coefficients using clipped one-hot encoding into a binary volumetric representation of the DCT plane fed to a convolutional block designed to learn relevant intra-block and inter-block relationships using vanilla and dilated convolutions. Methodology for plugging the “OneHot” network into conventional steganalysis CNNs is also introduced for an end-to-end learnable detector with improved performance

3. EI

   JPEG steganalysis detectors scalable with respect to compression quality

   Yousfi, Y., and Fridrich, J.

   In Proceedings IS&T, Electronic Imaging, Media Watermarking, Security, and Forensics 2020

   Abs PDF

   Practical steganalysis inevitably involves the necessity to deal with a diverse cover source. In the JPEG domain, one key element of the diversification is the JPEG quality factor, or, more generally, the JPEG quantization table used for compression. This paper investigates experimentally the scalability of various steganalysis detectors w.r.t. JPEG quality. In particular, we report that CNN detectors as well as older feature-based detectors have the capacity to contain the complexity of multiple JPEG quality factors within a single model when the quality factors are properly grouped based on their quantization tables. Detectors trained on multiple JPEG qualities show no loss of detection accuracy when compared with dedicated detectors trained for a specific JPEG quality factor. We also demonstrate that CNNs (but not so much feature-based classifiers) trained on multiple qualities can generalize to unseen custom quantization tables compared to detectors trained for specific JPEG qualities. Their ability to generalize to very different quantization tables, however, remains a challenging task. A semi-metric comparing quantization tables is introduced and used to interpret our results.

4. IH

   Turning Cost-Based Steganography into Model-Based

   Butora, J., Yousfi, Y., and Fridrich, J.

   In The 8th ACM Workshop on Information Hiding and Multimedia Security 2020

   Abs PDF

   Most modern steganographic schemes embed secrets by minimizing the total expected cost of modifications. However, costs are usually computed using heuristics and cannot be directly linked to statistical detectability. Moreover, as previously shown by Ker at al., cost-based schemes fundamentally minimize the wrong quantity that makes them more vulnerable to knowledgeable adversary aware of the embedding change rates. In this paper, we research the possibility to convert cost-based schemes to model-based ones by postulating that there exists payload size for which the change rates derived from costs coincide with change rates derived from some (not necessarily known) model. This allows us to find the steganographic Fisher information for each pixel (DCT coefficient), and embed other payload sizes by minimizing deflection. This rather simple measure indeed brings sometimes quite significant improvements in security especially with respect to steganalysis aware of the selection channel. Steganographic algorithms in both spatial and JPEG domains are studied with feature-based classifiers as well as CNNs.

5. asilomar

   Successive Information Bottleneck and applications in Deep Learning

   Yousfi, Y., and Akyol, E.

   In Asilomar Conference on Signals, Systems and Computers 2020

   Abs PDF

   Information Bottleneck (IB) method studies the trade-off between compression and prediction: extracting relevant information from the input variable X while preserving relevant information about another random variable Y, the resulting representation is another random variable Z. Motivated by the deep neural networks implementations, this paper studies a novel variation of the N-layer IB problem where the layers are assumed to be encoded in a successive fashion. We propose a method for performing an N-Layer IB in a greedy fashion and analyze numerical results obtained over a set of synthetic experiments.

2019

1. IH

   Breaking ALASKA: Color Separation for Steganalysis in JPEG Domain

   Yousfi, Y., Butora, J., Giboulot, Q., and Fridrich, J.

   In The 7th ACM Workshop on Information Hiding and Multimedia Security 2019

   Abs PDF

   This paper describes the architecture and training of detectors developed for the ALASKA steganalysis challenge. For each quality factor in the range 60–98, several multi-class tile detectors implemented as SRNets were trained on various combinations of three input channels: luminance and two chrominance channels. To accept images of arbitrary size, the detector for each quality factor was a multi-class multi-layered perceptron trained on features extracted by the tile detectors. For quality 99 and 100, a new “reverse JPEG compatibility attack” was developed and also implemented using the SRNet via the tile detector. Throughout the paper, we explain various improvements we discovered during the course of the competition and discuss the challenges we encountered and trade offs that had to be adopted in order to build a detector capable of detecting steganographic content in a stego source of great diversity.