Synchronization Detection and Recovery of
Steganographic Messages with Adversarial Learning
Haichao Shi1,2 and Xiao-Yu Zhang1
1

2

Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China
School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China

Abstract. As a means for secret communication, steganography aims at concealing a message within a medium such that the presence of the hidden message can
hardly be detected. In computer vision tasks, adversarial training has become a
competitive learning method to generate images. However, the generative tasks
are confronted with great challenge on synthesizing images. This paper studies
the mechanism of applying adversarial learning for discriminative tasks to learn
the steganographic algorithm. We show that through unsupervised adversarial
training, the adversarial model can produce robust steganographic solutions,
which act like an encryption. Through supervised adversarial training, we can
also train a robust steganalyzer, which is utilized to discriminate whether an image contains secret information. Our model is composed of three modules, i.e. a
generator, a discriminator and a steganalyzer. All the three members are trained
simultaneously. To formulate the algorithm, we use a game to represent the communication between the three parties. In this game, the generator and discriminator attempt to communicate with each other with secret messages hidden in an
image. While the steganalyzer attempts to analyze whether there is a transmission
of confidential information. Experimental results demonstrate the effectiveness
of the proposed method on steganography tasks.
Keywords: Steganography, Steganalysis, Adversarial learning.

1

Introduction

Steganography has become a heated research topic in information security, which is
widely used in various applications. It is used to conceal secret information (i.e. a message, an image or a sound) within a medium such that both the secret message as well
as its content will remain invisible. Therefore, the ultimate goal is to conceal a payload
into a cover object without affecting the sharpness of the cover object. With the emergence of all sorts of media, steganography, especially image-based steganography, has
drawn worldwide attention. The design of robust steganographic algorithms which are
used in secret communications is of vital importance.
Steganographic algorithms are designed to hide the secret information within a cover
message such that the cover message appears unaltered to an external adversary. Recent
researchers have made great efforts to design steganographic algorithms to minimize

2
the perturbations within the cover object when embedded into the secret message. Obviously, concealing both the content of the carrier as well as the presence of a secret
message is of vital importance for privacy sensitive communication. The steganography
aims to hide the presence of a secret message, while the steganalysis algorithms are
utilized to find out and recover the secret information of the carrier object. Similar with
adversarial training, the steganalysis serves as the adversarial to steganography.
For the game design of the steganographic techniques, we leverage the ideas from
the adversarial learning. Adversarial learning is based on game theory, and is combined
with unsupervised way to jointly train the model. In our previous work [19], we proposed a novel strategy of secure steganograpy based on generative adversarial networks
to generate suitable and secure covers for steganography, which was not considered the
decoding process. This paper is different from that, we not only encode the secret messages into the images, but decode it utilizing the network. Then we utilize a steganalysis
network to detect the presence of hidden messages. Through unsupervised training, the
generator plays the role of a sender, which is utilized to generate steganographic images
as real as possible. As the discriminator plays the role of a receiver, it not only differentiates real images and generated images, but also extracts the secret messages. And
the steganalysis network, as a listener of the whole process, incorporates supervised
learning with adversarial training to compete against state-of-the-art steganalysis methods.
In summary, this paper makes the following contributions:
(1) We incorporate the generative adversarial network into steganography, which
proves to be a good way of encryption.
(2) We integrate the unsupervised learning method and supervised learning method
to train the generator and steganalyzer respectively, and received robust steganographic
techniques in unsupervised manner.
(3) We also utilize the discriminative network to extract the secret information. Experiments are conducted on widely used datasets, which demonstrate the advantages of
the proposed method.
The rest of the paper is structured as follows. In Section 2, we discuss the related
work of steganography, adversarial networks. In Section 3, we elaborate the proposed
method. In Section 4, experiments are conducted to demonstrate the effectiveness of
the proposed method. In Section 5, we draw conclusions.

2

Related work

2.1

Steganography

The image-based steganography algorithm can be split into two categories. The one is
based on the spatial domain, the other is based on the DCT domain. In our work, we
focus on the spatial domain steganography. The state-of-the-art steganographic
schemes concentrate on embedding secret information within a medium while minimizing the perturbations within that medium. On the contrary, steganalysis is to figure
out whether there is secret information or not in the medium.

3
Least Significant Bit (LSB) [12] is one of the most popular embedding methods in
spatial domain steganography. If LSB is adopted as the steganography method, the statistical features of the image are destroyed. And it is easy to detect by the steganalyzer.
For convenience and simple implementation, the LSB algorithm hides the secret to the
least significant bits in the given image’s channel of each pixel. Mostly, the modification of the LSB algorithm is called ±1-embedding. It randomly adds or subtracts 1 from
the channel pixel, so the last bits would match the ones needed.
Besides the LSB algorithm, some sophisticated steganographic schemes choose to
use a distortion function which is used for selecting the embedding localization of the
image. This type of steganography is called the content-adaptive steganography. The
minimization of the distortion function between the cover image 𝐶 and the steganographic image 𝑆 is usually required. These algorithms are the most popular and the
most secure image steganography in spatial domain, such as HUGO (Highly Undetectable steGO) [4], WOW (Wavelet Obtained Weights) [2], S-UNIWARD (spatial universal wavelet relative distortion) [3], etc.
𝑑 𝐶, 𝑆 = 𝑓 𝐶, 𝑆 ∗ |𝐶 − 𝑆|

(1)

where 𝑓 𝐶, 𝑆 is the cost of modifying a pixel, which is variable in different steganographic algorithms.
HUGO is a steganographic scheme that defines a distortion function domain by assigning costs to pixels based on the effect of embedding some information within a
pixel. It uses a weighted norm function to represent the feature space. WOW is another
content-adaptive steganographic method that embeds information into a cover image
according to textural complexity of regions. In WOW shows that the more complex the
image region is, the more pixel values will be modified in this region. S-UNIWARD
introduces a universal distortion function that is independent of the embedded domain.
Despite the diverse implementation details, the ultimate goals are identical, i.e. they are
all devoted to minimize this distortion function, to embed the information into the noise
area or complex texture, and to avoid the smooth image coverage area.
2.2

Adversarial Learning

In recent years, GANs have been successfully applied to image generation tasks. The
method that generative adversarial networks generate images can be classified in two
manners in general. The first is mainly exploring image synthesis tasks in an unconditioned manner that generates synthetic images without any supervised learning
schemes. Goodfellow et al. [7] propose a theoretical framework of GANs and utilize
GANs to generate images without any supervised information. However, the early
GANs has somewhat noisy and blurry results and sometimes the gradient will be vanished when training the networks. Later, Radford et al. [15] propose a deep convolutional generative adversarial networks (DCGANs) for unsupervised representation. To
solve the situation of gradient vanishing, WGAN [14] is proposed using the Wasserstein distance instead of the Jensen-Shannon divergence, to make the data set distribution compared with the learning distribution from G.

4
Another direction of image synthesis with GANs is to synthesize images by conditioning on supervised information, such as text or class labels. The Conditional GAN
[16] is one of the works that develop a conditional version of GANs by additionally
feeding class labels into both generator and discriminator of GANs. Info-GAN [17]
introduces a new concept, which divides the input noise z into two parts, one is the
continuous noise signal that cannot be explained, and the other is called C. Where C
represents a potential attribute that can be interpreted as a facial expression, such as the
color of eyes, whether with glasses or not, etc. in the facial tasks. Recently, Reed et al.
[18] utilize GANs for image synthesis using given text descriptions, enabling translation from character level to pixel level.
Adversarial learning has been applied to steganographic and cryptographic problems. In Abadi’s [1] work, they apply two neural networks to adversarial game to encrypt a secret message. In which game the discriminator can be deceived. In this paper,
we are devoted to training a model that can learn a steganographic technique by itself
making full use of the discriminator.

3

Adversarial Steganography

This section discusses our proposed adversarial steganographic scheme, we present the
experiments supporting our claims after laying the theoretical groundwork.
3.1

Network Architecture

Generator. The generator receives the cover images and secret messages. Before learning the distribution of the images, the secret messages are first embedded into the cover
image. The generated steganographic images are then input into the generator. As is
shown in Fig.1, we use a fully connected layer, which can cover anywhere of the image
not merely a fixed region. Then four fractionally-strided convolution layers, and finally
a Hyperbolic tangent function layer. The architecture is shown as follows:

Fig. 1. The architecture of the generator

Discriminator. The discriminator is mainly responsible for extracting the secret messages. Besides, it can also help to optimize the visual quality of the generated images.

5
We use four convolutional layers, and then a fully connected layer. In detail, we additionally add a decoding function at the end of the network to extract the secret messages.
Which acts as an interface, accepting the steganographic images as input. The decoding
function analyzes the modification of pixels in images, and recovers the message. As is
shown as follows:

Fig. 2. The architecture of the discriminator

Steganalyzer. The steganalyzer’s inputs are both covers and steganographic images.
The steganalyzer’s architecture is similar to the discriminator, as is illustrated in Fig. 3.
With distinct, we first use a predefined high-pass filter to make a filtering operation,
which is mainly for steganalysis. And then four convolutional layers. Finally, we use a
classification layer, which includes several fully connected layers.

Fig. 3. The architecture of the steganalyzer

3.2

Optimization Objective

Our training scheme includes three parties: generator, discriminator and steganalyzer.
In this game, the generator conveys a secret medium to the discriminator, which the
steganalyzer attempts to eavesdrop the conveying process and find out whether there
are some special information containing in the process. Generally speaking, the generator generates a steganographic image within the cover image embedded with a secret
message. Then generator passes it to the next network which we called discriminator,
concentrating on decoding and recovering the message. The steganalyzer figures out a

6
confidence probability of how much likely the image is hidden with a secret message
when given an image.
For the whole process of information conveying is transparent to the discriminator,
so the decoding can be easily achieved. In the game of the three parties, the generator
is trained to learn to produce a steganographic image such that the discriminator can
decode and recover the secret message, and such that the steganalyzer can output a
better probability whether it is a cover or a steganographic image.

Fig. 4. The whole architecture of the training game. 𝑀 and 𝑀′ represents the secret message and
extracted message from the steganographic image respectively, 𝐶 represents the cover image,
and 𝑆𝐶 represents the steganographic image. 𝑝 is the probability of classifying the co-

vers and steganographic images. 𝑝′ is the probability of classifying the real images and
generated images.

The whole architecture can be depicted in Fig.4, the generator receives a cover image, 𝐶, and a secret message, 𝑀. Combined with the above two inputs, it outputs a steganographic image, 𝑆- , which is simultaneously given to the discriminator and steganalyzer. Once receiving the steganographic image, the discriminator decodes it and
attempts to recover the message. For the game is under generative adversarial networks,
the discriminator can also improve the visual quality of the generated images. In addition to the steganographic images, the cover images are also input into the steganalyzer,
whose output is a probability to classify the steganographic images and covers.
We let 𝜔/ , 𝜔0 , 𝜔1 denote the parameters of generator, discriminator and steganalyzer respectively. We utilize 𝐺(𝜔/ , 𝑀, 𝐶) represents generator’s output given an
image 𝐶 and secret message 𝑀 , 𝐷(𝜔0 , 𝑆- ) for discriminator’s output on steganographic images 𝑆- , and 𝑆(𝜔1 , 𝐶, 𝑆- ) for steganalyzer’s output on covers and steganographic images. Then we use 𝐿/ , 𝐿0 , 𝐿1 represent the loss of three networks respectively. And we can calculate as follows:
𝐷 𝜔0 , 𝑆- = 𝐷(𝜔0 , 𝐺(𝜔/ , 𝑀, 𝐶))

(2)

𝑆 𝜔1 , 𝐶, 𝑆- = 𝑆(𝜔1 , 𝐶, 𝐺(𝜔/ , 𝑀, 𝐶))

(3)

7
where the 𝐷 𝜔0 , 𝑆- is output of the discriminator, 𝑆 𝜔1 , 𝐶, 𝑆- is the output of the
steganalyzer.
For the generator’s loss, we correspond it with the other two networks. And we add
constraints to normalize the loss.
𝐿/ 𝜔/ , 𝑀, 𝐶 = 𝜆/ ∙ 𝑑 𝐶, 𝑆- + 𝜆0 ∙ 𝐿0 (𝜔0 , 𝑆- ) + 𝜆1 ∙ 𝐿1 (𝜔1 , 𝐶, 𝑆- )

(4)

where 𝑑 𝐶, 𝑆- is the Euclidean distance between the covers and the steganographic
images. And 𝜆/ , 𝜆0 , 𝜆1 are the calculation loss weights of the generator, discriminator
and steganalyzer respectively. These variables are varying from [0,1].
Also, we set discriminator’s loss to be the norm form. Here, we use the ℓ@ norm.
𝐿0 𝜔/ , 𝜔0 , 𝑀, 𝐶 = 𝑀, 𝐷 𝜔0 , 𝑆-

@

= ||𝑀, 𝐷(𝜔0 , 𝐺(𝜔/ , 𝑀, 𝐶))||@ = ||𝑀, 𝑀′||@ (5)

where the form ||𝑀, 𝑀′||@ is the distance between 𝑀 and 𝑀′.
And we set steganalyzer’s loss to be binary cross-entropy of logistic regression.
𝐿1 𝜔/ , 𝜔1 , 𝐶, 𝑆- = −

A
B

F 𝑦 ln 𝑆

𝜔1 , 𝐶, 𝑆- + (1 − 𝑦) ln(1 − 𝑆 𝜔1 , 𝐶, 𝑆- )

(6)

where 𝑦 = 1 if 𝑥 = 𝐶, which means classifying the images as covers, 𝑦 = 0 if 𝑥 = 𝑆- ,
which means the steganographic images are identified.
We apply adversarial learning techniques to discriminative tasks to learn the steganographic algorithm. Under unsupervised adversarial training, the model can produce steganographic techniques, which act like an encryption.

4

Experiments

As a proof of concept, we conducted our experiments on two image datasets: celebrity
faces in the wild (CelebA) [8] consisting of 202,599 images and BossBase, which is a
dataset of 10000 grayscale images of various scenes. Our datasets are formed of 64 ×
64 pixel images. For the choice of 𝑀, we concatenate a random paragraph message to
generalize our model to random message, with each sample of each dataset. And we
consider different kinds of embedding rates, which vary from 0.1bpp (bits per pixel) to
0.4bpp. Generally, most steganographic algorithms can successfully hide secret message approximately at 0.4bpp. All experiments were performed in TensorFlow[9], on a
workstation with a Titan X GPU.
4.1

CelebA dataset

For the CelebA dataset, which contains 202,599 images of celebrity faces from 10,177
unique identities. We train the model using RMSProp optimization algorithm with the
learning rate of 2×10JK . At each batch we train either the generator, discriminator, or
steganalyzer alternatively.
From the results, we can see that there is no noticeable image quality decrease between 0.1bpp and 0.4bpp. As is shown in Fig. 5. And we also calculate the PSNR (Peak
Signal to Noise Ratio) to evaluate the steganographic effect.

8

Fig. 5. The above are the covers and steganographic images of CelebA dataset. (a) represents the
covers, (b) represents the steganographic images with the embedding rates of 0.1bpp, (c) represents the steganographic images with the embedding rates of 0.4bpp. The bottom is the contrast
of PSNR of embedding rates at 0.1bpp and 0.4bpp.

4.2

BossBase dataset

In addition to the experiments on the CelebA dataset, we also trained our model on the
BossBase dataset, which is a standard steganography dataset. For the images from this
dataset do not come from a single distribution, so the dataset can perform worse than
the experiments on the CelebA dataset.

9

Fig. 6. Similarly, the above are the covers and steganographic images of BossBase dataset. (a)
represents the covers, (b) represents the steganographic images with the embedding rates of
0.1bpp, (c) represents the steganographic images with the embedding rates of 0.4bpp. The bottom
is also the contrast of PSNR of embedding rates at 0.1bpp and 0.4bpp.

We can conclude from the two groups of experiments that for the datasets with distinct
distribution, different embedding rates can influence the similarity between the original
images and the embedded images.
4.3

Comparison with related work

We train in such a way that the steganalyzer can detect the covers and steganographic
images with low rates. Thus, on the basis of this experiment, we additionally conduct
another experiment compared with the state-of-the-art steganographic algorithms.
Which also shows competitive results.
For both datasets, we compare our scheme against steganographic algorithms HUGO
and S-UNIWARD. As is shown in Table 1, our steganalyzer performs competitively.
By training steganalyzer in a supervised fashion, the experiments show that it has the
capacity to become a strong steganalyzer, competing against established techniques like
GNCNN, and so is a good choice for the steganalyzer. Furthermore, for both the CelebA

10
and BossBase datasets, we use 10,000 samples and split them in half, creating a training
set and a test set. And we then trained the generator on the training set. Following this,
we then created an additional 5,000 steganographic images utilizing each steganography algorithm. Thus, we can make the cover set and steganographic images set consist
of 5,000 images respectively.
Table 1. Accuracy of distinguishing between cover and steganographic images for the GNCNN
and Steganalyzer at an embedding rate of 0.4bpp.

Steganographic
Algorithm
HUGO
S-UNIWARD
Generator

CelebA
Steganalyzer
GNCNN
0.93
0.91
0.94

Steganalyzer
0.91
0.89
0.92

BossBase
Steganalyzer
GNCNN
0.72
0.75
0.83

Steganalyzer
0.68
0.71
0.82

As demonstrated in the experiments, the steganalyzer performs competitively against
the GNCNN [10], and the generator also performs well against other steganographic
techniques. The experimental data shows that on the one hand, the generated images
are good at visual quality. On the other hand, the generated images are harder to detect,
which shows the security of the generated images as covers.

5

Conclusion

In this paper, we have proposed an adversarial steganography architecture with generative adversarial networks. On the basis of generative adversarial networks, we leverage the adversarial structure to form an effective steganographic method. Encouraging
results are received from experiments conducted on the widely used datasets in comparison with several state-of-the-art techniques. We think it could be used for adaptive
steganographic algorithm for social network in the future. We believe that, by exploring
more steganography properties, better performance can be achieved.
References
1. Abadi M, Andersen D G. Learning to Protect Communications with Adversarial Neural
Cryptography[J]. 2016:15.
2. Holub V, Fridrich J. Designing steganographic distortion using directional filters[C]// IEEE
International Workshop on Information Forensics and Security. IEEE, 2012:234-239.
3. Holub V, Fridrich J, Denemark T. Universal distortion function for steganography in an
arbitrary domain[J]. Eurasip Journal on Information Security, 2014, 2014(1):1.
4. Pevný T, Filler T, Bas P. Using High-Dimensional Image Models to Perform Highly Undetectable Steganography[M]// Information Hiding. Springer Berlin Heidelberg, 2010:161177.
5. Xu G, Wu H Z, Shi Y Q. Structural Design of Convolutional Neural Networks for Steganalysis[J]. IEEE Signal Processing Letters, 23(5):708-712, 2016.

11
6. Xu G, Wu H Z, Shi Y Q. Ensemble of CNNs for Steganalysis: An Empirical Study[C]//
ACM Workshop on Information Hiding and Multimedia Security. ACM, 2016:103-107.
7. Goodfellow I J, Pouget-Abadie J, Mirza M, et al. Generative Adversarial Networks[J]. Advances in Neural Information Processing Systems, 3:2672-2680, 2014.
8. Liu Z, Luo P, Wang X, et al. Deep Learning Face Attributes in the Wild[J]. pp. 3730-3738,
2014.
9. Abadi M, Agarwal A, Barham P, et al. TensorFlow: Large-Scale Machine Learning on Heterogeneous Distributed Systems[J]. 2016.
10. Yinlong Qian, Jing Dong, WeiWang, and Tieniu Tan. Deep learning for steganalysis via
convolutional neural networks. In IS&T/SPIE Electronic Imaging, pp. 94090J–94090J. International Society for Optics and Photonics, 2015a.
11. Browne M, Ghidary S S, Mayer N M. Convolutional Neural Networks for Image Processing
with Applications in Mobile Robotics[J]. Studies in Computational Intelligence, 2008,
83:327-349.
12. Mielikainen, Jarno. Lsb matching revisited. IEEE signal processing letters, 13(5):285–287,
2006.
13. Andrew D Ker. Resampling and the detection of lsb matching in color bitmaps. In Eletronic
Imaging 2005, pp. 1–15. International Society for Optics and Photonics, 2005.
14. Arjovsky M, Chintala S, Bottou L. Wasserstein GAN[J]. 2017.
15. Radford, Alec, Metz, Luke, and Chintala, Soumith. Unsupervised representation learning
with deep convolutional generative adversarial networks. CoRR, abs/1511.06434, 2015.
URL http://arxiv.org/abs/1511.06434.
16. Odena A, Olah C, Shlens J. Conditional Image Synthesis With Auxiliary Classifier
GANs[J]. 2016.
17. Chen X, Duan Y, Houthooft R, et al. InfoGAN: Interpretable Representation Learning by
Information Maximizing Generative Adversarial Nets[J]. 2016.
18. Reed S, Akata Z, Yan X, et al. Generative Adversarial Text to Image Synthesis[J].
2016:1060-1069.
19. Shi H, Dong J, Wang W, et al. SSGAN: Secure Steganography Based on Generative Adversarial Networks[C]. 2017.

