Adversarial steganography based on sparse cover enhancement

Abstract CNN (Convolutional Neural Network) steganalyzers achieve enormous improvements in detecting stego images. However, they are easily deceived by adversarial steganography, which combines adversarial attack and steganography. Currently, there are two kinds of adversarial steganography, function separation and cover enhancement. ADV-EMB (ADVersarial EMBedding) is a typical function separation method. It forces the steganographic modifications along side the gradient directions of the target CNN steganalyzer on partial image elements. It results in relatively low deceiving success rate against the target model. ADS (ADversarial Steganography) is the first adversarial steganography, which is based on cover enhancement. It introduces much distortions, so it can be easily detected by non-target steganalyzers. To overcome such defects of the previous works, in this paper, we propose a novel cover enhancement method, denoted as SPS-ENH (SParSe ENHancement). Through sparse ± 1 adversarial perturbations, we effectively compress the distortions caused in cover enhancement. In addition, a re-trying scheme is introduced to further reduce the distortion scale. Extensive experiments show that the proposed method outperforms the previous works in the average classification error rates under non-target steganalyzers and deceiving success rates against target CNN models. When combining with the min–max strategy, the proposed method converges in less iterations and provides higher security level than ADV-EMB.