Can We Do Better than F5 Image Steganography? Francisco Ruiz, IIT - PowerPoint PPT Presentation

Can We Do Better than F5 Image Steganography? Francisco Ruiz, IIT Forensecure 2017

JPEG embedding 0.05 • DCT AC coefficients: blocks x (luma + 2 0.04 chroma) x 64 • Most of them are 0.03 zeros: good compression 0.02 • Next in number are 0.01 +1, -1, +2, -2, etc. 0 - -9 -8 -7 -6 -5 -4 -3 -2 -1 0 1 2 3 4 5 6 7 8 9 10 10

Here’s the cover image (82 kB jpeg)

F5 encoding (A. Westfeld 1999) 1. Permute the data. 2. Encode binary message as odd-even, by decreasing absolute value of non-zeros. 3. Un-permute the data so that the image is recovered and changes are scattered. 4. Matrix encoding minimizes changes.

Anything wrong with F5? • Still the champion, but it has some problems: 1. If starting from +1 or -1, we might get a 0 result. 2. Zeros are skipped when decoding, so these data must be encoded again until the result is not zero, reducing capacity (shrinkage). 3. The process creates extra zeros. This happens often because those are the next most frequent values.

How bad is it? 0.05 • Pretty bad, but the effect is similar to 0.04 that of reducing the quality of the image. 0.03 cover • Unfortunately for the F5 Q = 5 0.02 embedder, it can be detected (Fridrich et 0.01 al., Siergiej et al.) 0 - -9 -8 -7 -6 -5 -4 -3 -2 -1 0 1 2 3 4 5 6 7 8 9 10 10

Detection: compare to cropped image 0.05 • When the original is unavailable, crop the 0.04 image 1 pixel all around to make it re-block, then save with same quality 0.03 (from file header) cover • Frequencies will change, cover-cropped 0.02 so normalize with frequency of zero • Normalized histogram 0.01 won’t change a lot 0 - -9 -8 -7 -6 -5 -4 -3 -2 -1 0 1 2 3 4 5 6 7 8 9 10 10

The histogram of a F5-embedded image goes a lot flatter after cropping 0.05 • This is because the original quality is still in the header. 0.04 • Saving the cropped image re- computes the coefficients, 0.03 with a smaller fraction of zeros. F5 F5-cropped • Possibly can be fixed by re- 0.02 writing the header so the histogram for that Q value 0.01 matches the F5 histogram. 0 - -9 -8 -7 -6 -5 -4 -3 -2 -1 0 1 2 3 4 5 6 7 8 9 10 10

PassLok eliminates the problem: 1. Don’t make any extra zeros: change +1 to -1, -1 to +1. Parity is reversed for negative numbers so this works. Added bonus: no shrinkage, larger capacity – 2. Occasionally increment absolute value rather than decrement. Pick those randomly, fraction to increment Y : – Y = #2’s/(#1’s + #2’s) (around 20% for the sample cover)

How we find that fraction • Probability of change: p A B C • Fraction being incremented: p(1-y)B y • B column won’t change if: p y B p(1-y)B + pyB = pB = pyA + p(1-y)C • Assuming A/B = B/C, result: y = B/(A+B) p y A p(1-y)C

PassLok “nails” the frequencies 20000 15000 cover F5 PassLok 10000 5000 0 -10 -9 -8 -7 -6 -5 -4 -3 -2 -1 0 1 2 3 4 5 6 7 8 9 10

The image ends up looking sharper F5 (47 kB) PassLok (55 kB) both with 83% embedding into luma and chroma channels (6.7 kB)

What happens when cropped? But so does a sharpened cover PassLok goes a little flatter 0.05 0.05 0.04 0.04 0.03 0.03 sharp PassLok sharp-cropped PL-cropped 0.02 0.02 0.01 0.01 0 0 -10 -8 -6 -4 -2 -10 -8 -6 -4 -2 0 2 4 6 8 10 0 2 4 6 8 10

Conclusion • PassLok achieves near-perfect preservation of the DCT AC coefficient histogram, with no shrinkage. • The image looks “sharper” possibly as a consequence of incremented coefficients. • When cropped, the histogram changes like that of a sharpened image. • Will perceived sharpening be detectable in the absence of the cover image?

Thanks! • Comments: ruiz@iit.edu • See PassLok in action at https://passlok.com It does PNG stego and encryption too! • Kind regards to Jean-Claude Rock for his contribution