1

Coverless information hiding based on
Generative Model

arXiv:1802.03528v1 [cs.CV] 10 Feb 2018

Xintao Duan, Haoxian Song
Abstract—A new coverless image information hiding method based on generative model is proposed, we feed the secret image to the
generative model database, and generate a meaning-normal and independent image different from the secret image, then, the
generated image is transmitted to the receiver and is fed to the generative model database to generate another image visually the
same as the secret image. So we only need to transmit the meaning-normal image which is not related to the secret image, and we
can achieve the same effect as the transmission of the secret image. This is the first time to propose the coverless image information
hiding method based on generative model, compared with the traditional image steganography, the transmitted image does not embed
any information of the secret image in this method, therefore, can effectively resist steganalysis tools. Experimental results show that
our method has high capacity, safety and reliability.
Index Terms—Generative model, Coverless information hiding, Information safety

F

1

I NTRODUCTION

M

OST of the current information hiding technologies
embed the secret information into the carrier with the
slight modification of the carrier data (digital image, video
and audio), and hide the dense carrier as a disguise of the
secret information. The popularization of personal computers and the proliferation of multimedia data on the internet
have provided convenient conditions for implementing information hiding and have made information hiding rapid
development. However, the pace of development in recent
years has slowed down. The main reason is that at the
same time as the development of information hiding, the
detection technology for hidden information, also called
steganalysis, has also been rapidly developed. The technology is based on the statistical anomaly of the carrier data
caused by information embedding to determine whether the
secret information exists, and it has posed a serious threat
to information hiding. According to the different hiding
methods, the commonly used steganography methods are
divided into two types: space domain hiding method and
transform domain hiding method. The space domain hiding
method has the adaptive LSB hiding method [1], the spatial
adaptive steganography algorithm S-UNIWARD [2], HUGO
[3], WOW [4] and so on. The transform domain method is
to modify the host image data to change some statistical features to achieve data hiding, such as the hidden method in
DFT(discrete Fourier transform) domain [5], DCT (discrete
cosine transform) domain [6], and DWT (discrete wavelet
transform) domain [7]. These methods inevitably leave some
modifications to the carrier. In order to fundamentally resist
the detection of various detection algorithms, this paper
presents a new coverless image information hiding method
based on generative model. As shown in Fig.1, we only need

•

Xintao Duan, Haoxian Song were with School of Computer and Information Engineering, Henan Normal University, Xinxiang, Henan, CHINA,
453007.
E-mail: duanxintao@126.com

to deliver a meaning-normal image which is not related to
the secret image to the receiver, so that the receiver can
generate an image visually the same as the secret image
without worrying about the analysis of the steganography,
even less attack.

Fig. 1
As mentioned above, we proposed a new approach to
hide image information, it can generate visually the same
image as the secret image by sending a generated image
that is not related to the secret image. The transmitted image
is only a normal-meaningful image rather than the image
embedded any information of the secret image, and also
achieve the same effect as transferring the secret image. This
method can effectively resist steganalysis tools, and greatly
improves the security of the image. To summarize, the major
contributions of our work as below:
•

We do not need to pass the secret image, on the contrary, we transmit a meaning-normal image which
is completely unrelated to the secret image. This
method has high security.

•

The image we transmit does not embed any secret
information, it is a normal image, and the image
steganography analysis does not work.

2
•

2

As long as the training is enough, this effect can be
achieved and the capacity is large.

R ELATED WORK

Restricted Boltzmann Machines (RBMs) [8], deep Boltzmann machines (DBMs) [9] and their numerous variants
are undirected graphical models with latent variables. The
interactions within such models are represented as the product of unnormalized potential functions, normalized by a
global summation/integration over all states of the random
variables. This quantity and its gradient are intractable for
all but the most trivial instances, although they can be
estimated by Markov chain Monte Carlo (MCMC) methods.
Mixing poses a significant problem for learning algorithms
that rely on MCMC [10], [11]. Deep belief networks (DBNs)
[12] are hybrid models containing a single undirected layer
and several directed layers. While a fast approximate layerwise training criterion exists, DBNs incur the computational
difficulties associated with both undirected and directed
models. Variational Auto-Encoders (VAEs) [13] and Generative Adversarial Networks (GANs) [14] are well known
to us. VAEs focus on the approximate likelihood of the
examples, and they share the limitation of the standard
models and need to fiddle with additional noise terms.
Ian Goodfellow put forward GAN [15] in 2014. Goodfellow
theoretically proved the convergence of the algorithm, and
when the model converges, the generated data has the same
distribution as the real data. GAN provides a new training
idea for many generative models and has hastened many
subsequent works. GAN takes a random variable (it can be
Gauss distribution, or uniform distribution between 0 and
1) to carry on inverse transformation sampling of the probability distribution through the parameterized probability
generative model (it is usually parameterized by a neural
network model), then a generative probability distribution
is obtained. The GAN model includes a generative model G
and a discriminative model D. The training objective of the
discriminative model D is to maximize the accuracy of its
own discriminator, and the training objective of generative
model G is to minimize the discriminator accuracy of the
discriminative model D. The objective function of GAN is
a zero-sum game between D and G and also a minimum
- maximization problem. GAN adopts a very direct way of
alternate optimization, and it can be divided into two stages.
In the first stage, the discriminative model D is fixed, the
generative model G is optimized to minimize the accuracy
of the discriminative model. In the second stage, the generative model G is the fixed in order to improve the accuracy
of the discriminative model D. As a generative model, GAN
is directly applied to modeling of the real data distribution,
including generating images, videos, music and natural sentences, etc. Because of the mechanism of internal confrontation training, GAN can solve the problem of insufficient data
in some traditional machine learning. GANs offer much
more flexibility in the definition of the objective function,
including Jensen-Shannon, and all f-divergences [16] as well
as some exotic combinations. Therefore, it can be used
in semi-supervised learning, unsupervised learning, multiview learning and multi-tasking learning. In addition, it has
been successfully used in reinforcement learning to improve

its learning efficiency. Although GAN is applied widely,
there are some problems with GAN, difficulty in training,
lack of diversity. Besides, generator and discriminator cannot indicate the training process. On the other hand, training
GANs is well known for being delicate and unstable. The
better discriminator is trained, the more serious gradient
of the generator disappears, leading to gradient instability
and insufficient diversity. WGAN (Wasserstein Generative
Adversarial Networks [?], [?]) is an improvement to GAN,
and it applies Wasserstein distance instead of JS divergence
in the GAN. Compared to KL divergence and JS divergence,
the advantage of Wasserstein distance is that it can still
reflect their distance even if there is no overlap between the
two distributions. At the same time, the problem of training
stability and process indicating are solved.
Therefore, this paper chooses Wasserstein GAN so as to
guarantee training stability instead of GAN. It is no longer
necessary to carefully balance the training extent between
generator and discriminator. It basically solves the problem
of collapse mode and ensures the diversity of samples.

3

A PPROACH

The WGAN model is applied to generate the handwritten
word by feeding the random noise z, but when the random
noise z is changed to a secret image img, the model can
still generate the meaning-normal and independent image
IMG’ which is not related to the secret image we want
to transmit. These several images taken from the standard
set of images were evaluated in the paper, they are Lena,
baboon, cameraman and peppers, and they have the same
size as 256 by 256. The feed is the secret image, and we train
the generative model database through the WGAN, then
it can generate a meaning-normal and independent image
which is not related to the secret image. So we transmit the
meaning-normal image to the receiver, and this generated
image is fed to the generative model database to generate
another generated image visually the same as the secret
image. The flow charts of the whole experiment are shown
in Fig. 2 and Fig. 3.

Fig. 2

Fig. 3

3

D and G play the following two-player minimax game
with value function
V (G; D)
in WGAN:

min max V (D, G) = Ex∼pdata(x) [logD(x)]+Ez∼pz (z) [log(1−D(G(z)))]
G

D

D(x) represents the probability that x came from the data
rather than pg. We train D to maximize the probability of
assigning the correct label to both training examples and
samples from G. We simultaneously train G to minimize

Fig. 4

log(1 − D(G(z)))
. We first make a gradient ascent step on D and then a
gradient descent step on G, then the update rules are:
Keeping the G fixed, update the model D by

θ D ← θ D + γD ∇ D L
with

∇D L =

∂
{Ex∼P data(x) [logD(x, θD )]+Ez∼P noise(z) [log(1−D(G(z, θG ), θD ))]}
∂θD

Keeping D fixed, update G by

Fig. 5

θ G ← θ G − γG ∇ G L
where

∂
Ez∼P data(z) [log(1 − D(G(z, θG ), θD ))]
∂θG
Wasserstein distance is also called the EM(Earth-Mover)
distance
∇G L =

W (Pr , Pg ) =

γ∼

E(x,y)∼γ [k
Qinf
(pr, pg )

x − y k]

Q
Where
(Pr , Pg ) denotes the set of all joint distributions γ(x, y) whose marginal are respectively Pr and Pg .
Intuitively, γ(x, y) indicates how much mass must be transported from x to y in order to transform the distributions Pr
into the distribution Pg . The EM distance then is the cost of
the optimal transport plan.

4

cameraman and peppers as the secret image to experiment
respectively, and they can generate corresponding peppers
and cameraman. We also save the corresponding generative
model G3 and G4 of generating visually the same as peppers
and cameraman respectively, and apply them to the next
experiment, instead of the WGAN. We put the generative
model G1, G2, G3 and G4 of generating visually the same
as Baboon, Lena, peppers and cameraman in a database
respectively, so that the generative model database is built.
Since both the sender and the receiver train well the generative model database, we perform experiments as shown in
Fig. 6 and Fig. 7.

E XPERIMENTS

In this paper, 5,000 images are randomly selected from the
CelebA dataset to experiment, and the results show that
the coverless image information hiding based on generative
model method can be implemented well. The sender and
receiver share the same dataset and the same parameters. As
shown in Fig. 4 and Fig. 5, we feed the secret image img into
the generative model, generating the meaning-normal and
independent IMG which is not related to the secret image
we want to transmit.
As shown above, we choose Lena as the secret image
img, it can generate the IMG visually the same as Baboon
we want to transmit. In the meantime, we also trained
Baboon to generate the IMG visually the same as Lena
through the WGAN. We save the corresponding generative
model G1 and G2 of generating visually the same as Baboon
and Lena respectively. Using the same method, we take the

Fig. 6

4

A fed image corresponds uniquely to a secret image. This
method is practical. Therefore, it can be applied to image
hiding and image protection.

ACKNOWLEDGMENT
This work was supported by the National Natural Science
Foundation of China under Grant NO.U1204606, U1404603,
the Science and Technology Foundation of Henan Province
under Grant No.172102210335.

R EFERENCES
[1]

[2]

Fig. 7

[3]
[4]

As shown above, when the sender wants to transmit
the secret image Lena, the generated image Baboon can be
transmitted to the receiver to generate a generated image
visually the same as the secret image Lena, similarly, if you
want to transmit Baboon, you can transmit the generated
image Lena, if you want to transmit cameraman, you can
transmit the generated image peppers, if you want to transmit peppers, you can transmit the generated image cameraman. In this experiment, we have successfully achieved
the effect of coverless image information hiding based on
generative model method by feeding a secret image to
generate a meaning-normal and independent image which
is not related to the secret image we want to transmit, and
when the secret image is given, the transmitted image is
unique and specific. Consequently, the image information
hiding method proposed in this paper is feasible. In practical
application, we are more concerned with the content of
the image rather than the pixels in addition to professional
image workers, this method can produce a meaning-normal
and independent image which is not related to the secret
image we want to transmit, which can satisfy most requirements, thereby, we suppose that if you want to send a secret
image, you only need to transmit a meaning-normal and
independent image to the receiver, the receiver only need
to feed transmitted image to the generative model database,
generate an image visually the same as the secret one, no
needing direct transmission of the secret image. Besides, the
transmitted image does not embed any information of the
secret image, so it does not give visual cues to attackers,
and the image steganography analysis does not work. This
method can resist detection of all the existing steganalysis
tools, and improve the security of the image.

5

C ONCLUSION

To sum up, the paper proposed the coverless image information hiding based on generative model method. An
image visually the same as the secret image is generated
by transmitting a normal-meaningful image to the receiver.

[5]
[6]
[7]

[8]
[9]
[10]
[11]
[12]
[13]
[14]
[15]

[16]

[17]
[18]

C. Yang, C. Weng, S. Wang, and H. Sun, “Adaptive data hiding
in edge areas of images with spatial lsb domain systems,” IEEE
Transactions on Information Forensics and Security, vol. 3, no. 3, pp.
488–497, 2008.
V. Holub, J. Fridrich, and T. Denemark, “Universal distortion function for steganography in an arbitrary domain,” Eurasip Journal on
Information Security, vol. 2014, no. 1, p. 1, 2014.
T. Pevny, T. Filler, and P. Bas, “Using high-dimensional image
models to perform highly undetectable steganography,” Lecture
Notes in Computer Science, vol. 6387, pp. 161–177, 2010.
V. Holub and J. Fridrich, “Designing steganographic distortion
using directional filters,” in IEEE International Workshop on Information Forensics and Security, 2012, pp. 234–239.
J. J. K. O. Ruanaidh, W. J. Dowling, and F. M. Boland, “Phase
watermarking of digital images,” in International Conference on
Image Processing, 1996. Proceedings, 1996, pp. 239–242 vol.3.
I. J. Cox, J. J. Kilian, and T. G. Shamoon, “Secure spread spectrum
watermarking for multimedia data,” p. 1673, 1999.
W. H. Lin, S. J. Horng, T. W. Kao, P. Fan, C. L. Lee, and Y. Pan, “An
efficient watermarking method based on significant difference of
wavelet coefficient quantization,” IEEE Transactions on Multimedia,
vol. 10, no. 5, pp. 746–757, 2008.
P. Smolensky, Information processing in dynamical systems: foundations of harmony theory. MIT Press, 1986.
R. Salakhutdinov and G. Hinton, “Deep boltzmann machines,”
Journal of Machine Learning Research, vol. 5, no. 2, pp. 1967 – 2006,
2009.
Y. Bengio, G. Mesnil, Y. Dauphin, and S. Rifai, “Better mixing via
deep representations,” pp. I–552, 2012.
Y. Bengio, ric ThibodeauLaufer, G. Alain, and J. Yosinski, “Deep
generative stochastic networks trainable by backprop,” Computer
Science, vol. 2, pp. 226–234, 2014.
G. E. Hinton, S. Osindero, and Y. W. Teh, “A fast learning algorithm for deep belief nets,” Neural Computation, vol. 18, no. 7, p.
1527, 2006.
X. Glorot, A. Bordes, and Y. Bengio, “Deep sparse rectifier neural
networks,” vol. 15, pp. 315–323, 2011.
Y. Bengio, L. Yao, G. Alain, and P. Vincent, “Generalized denoising
auto-encoders as generative models,” Advances in Neural Information Processing Systems, pp. 899–907, 2013.
I. J. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. WardeFarley, S. Ozair, A. Courville, and Y. Bengio, “Generative adversarial nets,” in International Conference on Neural Information Processing
Systems, 2014, pp. 2672–2680.
G. E. Hinton, N. Srivastava, A. Krizhevsky, I. Sutskever, and R. R.
Salakhutdinov, “Improving neural networks by preventing coadaptation of feature detectors,” Computer Science, vol. 3, no. 4,
pp. pgs. 212–223, 2012.
Martin Arjovsky and Lon Bottou, “Towards principled methods
for training generative adversarial networks,” In International
Conference on Learning Representations, 2017. Under review.
Martin Arjovsky, Soumith Chintala and Lon Bottou, “Wasserstein
GAN,” arXiv preprint arXiv:1701.078752017, 2017.

