GIFDL: Generated Image Fluctuation Distortion Learning for Enhancing Steganographic Security

TL;DR

The paper tackles the vulnerability of modification-based steganography to deep-learning steganalysis by redefining distortion through learned fluctuations in generated images. It introduces GIFDL, a GAN-based framework that uses two discriminators assigned to cover-stego and fluctuation-stego tasks, and trains on fluctuation images produced by small CFG-scale variations in a fixed text-to-image model. A U-Net generator yields a modification map, which is embedded via a differentiable simulator and then refined with a specialized loss that balances adversarial and entropy goals. Results show GIFDL achieves superior resistance to multiple steganalyzers across payloads and datasets, with notable generalization to real-world diffusion datasets and compatibility with volatility-cost integration, reflecting a practical advance in secure steganography with black-box generative covers.

Abstract

Minimum distortion steganography is currently the mainstream method for modification-based steganography. A key issue in this method is how to define steganographic distortion. With the rapid development of deep learning technology, the definition of distortion has evolved from manual design to deep learning design. Concurrently, rapid advancements in image generation have made generated images viable as cover media. However, existing distortion design methods based on machine learning do not fully leverage the advantages of generated cover media, resulting in suboptimal security performance. To address this issue, we propose GIFDL (Generated Image Fluctuation Distortion Learning), a steganographic distortion learning method based on the fluctuations in generated images. Inspired by the idea of natural steganography, we take a series of highly similar fluctuation images as the input to the steganographic distortion generator and introduce a new GAN training strategy to disguise stego images as fluctuation images. Experimental results demonstrate that GIFDL, compared with state-of-the-art GAN-based distortion learning methods, exhibits superior resistance to steganalysis, increasing the detection error rates by an average of 3.30% across three steganalyzers.

Figures (8)

• Figure 1: Comparison of existing GAN-based steganography methods with the proposed method.
• Figure 2: (a) Users can access the black-box Stable Diffusion at https://stabledifffusion.com/webui to use Stable Diffusion. (b) Images generated with CFG = 7.5000. (c) Images generated with CFG = 7.5001, where the Classifier-Free Guidance (CFG) scale is an input parameter in Stable Diffusion that controls how closely a prompt should be followed.
• Figure 3: (a) Cover image, (b) average pixel difference between the 10 fluctuation images and the cover image, (c) pixel difference between the stego image and the cover image, where the stego image is generated by GMAN. For clearer observation, the brightness of (b) and (c) is multiplied by 50.
• Figure 4: The overall framework of the proposed GIFDL consists of three components: the Generative Model, the Generator, and the Discriminator. In the Generative Model, we use a T2I model to generate cover image $C$ and corresponding fluctuation images $F_i, i = 1, 2, \ldots$ From this series of fluctuation images, a random fluctuation image $F_{ran}$ is selected to participate in the subsequent training of the generator and discriminator. In the Generator, we employ a U-Net architecture to generate the modification probability map $P$. Using a simulation embedder, we obtain the modification map $M$, which is further used to produce the stego image $S$. In the Discriminator, Discriminator #1 is used to distinguish between the cover image $C$ and the stego image $S$, while Discriminator #2 distinguishes between the fluctuation image $F_{ran}$ and the stego image $S$. It is important to note that $F_{ran}$ is randomly selected in each training epoch and is not fixed.
• Figure 5: (a) Image generated with CFG = 7.5000. (b) Image generated with CFG = 7.4980. There are significant differences between (a) and (b).