Can We Do Better than F5 Image Steganography? Francisco Ruiz, IIT - - PowerPoint PPT Presentation

Can We Do Better than F5 Image Steganography?

Francisco Ruiz, IIT

Forensecure 2017

JPEG embedding

• DCT AC coefficients:

blocks x (luma + 2 chroma) x 64

• Most of them are

zeros: good compression

• Next in number are

+1, -1, +2, -2, etc.

0.01 0.02 0.03 0.04 0.05

• 10
• 9 -8 -7 -6 -5 -4 -3 -2 -1 0

1 2 3 4 5 6 7 8 9 10

Here’s the cover image (82 kB jpeg)

F5 encoding (A. Westfeld 1999)

• 1. Permute the data.
• 2. Encode binary message as odd-even, by decreasing

absolute value of non-zeros.

• 3. Un-permute the data so that the image is recovered

and changes are scattered.

• 4. Matrix encoding minimizes changes.

Anything wrong with F5?

• Still the champion, but it has some problems:
• 1. If starting from +1 or -1, we might get a 0 result.
• 2. Zeros are skipped when decoding, so these data

must be encoded again until the result is not zero, reducing capacity (shrinkage).

• 3. The process creates extra zeros. This happens
• ften because those are the next most frequent

values.

How bad is it?

• Pretty bad, but the

effect is similar to that of reducing the quality of the image.

• Unfortunately for the

embedder, it can be detected (Fridrich et al., Siergiej et al.)

0.01 0.02 0.03 0.04 0.05

• 10
• 9 -8 -7 -6 -5 -4 -3 -2 -1 0

1 2 3 4 5 6 7 8 9 10 cover F5 Q = 5

Detection: compare to cropped image

• When the original is

unavailable, crop the image 1 pixel all around to make it re-block, then save with same quality (from file header)

• Frequencies will change,

so normalize with frequency of zero

• Normalized histogram

won’t change a lot

0.01 0.02 0.03 0.04 0.05

• 10
• 9 -8 -7 -6 -5 -4 -3 -2 -1 0

1 2 3 4 5 6 7 8 9 10 cover cover-cropped

The histogram of a F5-embedded image goes a lot flatter after cropping

0.01 0.02 0.03 0.04 0.05

• 10
• 9 -8 -7 -6 -5 -4 -3 -2 -1 0

1 2 3 4 5 6 7 8 9 10 F5 F5-cropped

• This is because the original

quality is still in the header.

• Saving the cropped image re-

computes the coefficients, with a smaller fraction of zeros.

• Possibly can be fixed by re-

writing the header so the histogram for that Q value matches the F5 histogram.

PassLok eliminates the problem:

• 1. Don’t make any extra zeros: change +1 to -1,
• 1 to +1. Parity is reversed for negative

numbers so this works.

– Added bonus: no shrinkage, larger capacity

• 2. Occasionally increment absolute value rather

than decrement.

– Pick those randomly, fraction to increment Y: Y = #2’s/(#1’s + #2’s) (around 20% for the sample cover)

How we find that fraction

• Probability of change: p
• Fraction being incremented:

y

• B column won’t change if:

p(1-y)B + pyB = pB = pyA + p(1-y)C

• Assuming A/B = B/C, result:

y = B/(A+B)

p(1-y)B p y B p y A p(1-y)C A B C

PassLok “nails” the frequencies

5000 10000 15000 20000

• 10
• 9
• 8
• 7
• 6
• 5
• 4
• 3
• 2
• 1

1 2 3 4 5 6 7 8 9 10 cover F5 PassLok

The image ends up looking sharper

F5 (47 kB) PassLok (55 kB)

both with 83% embedding into luma and chroma channels (6.7 kB)

What happens when cropped?

PassLok goes a little flatter But so does a sharpened cover

0.01 0.02 0.03 0.04 0.05

• 10 -8
• 6
• 4
• 2

2 4 6 8 10 PassLok PL-cropped 0.01 0.02 0.03 0.04 0.05

• 10 -8
• 6
• 4
• 2

2 4 6 8 10 sharp sharp-cropped

Conclusion

• PassLok achieves near-perfect preservation of

the DCT AC coefficient histogram, with no shrinkage.

• The image looks “sharper” possibly as a

consequence of incremented coefficients.

• When cropped, the histogram changes like

that of a sharpened image.

• Will perceived sharpening be detectable in the

absence of the cover image?

Thanks!

• Comments: ruiz@iit.edu
• See PassLok in action at https://passlok.com

It does PNG stego and encryption too!

• Kind regards to Jean-Claude Rock for his

contribution