Detection of Content Adaptive LSB Matching (a Game Theory Approach)

Transcription

1 Detection of Content Adaptive LSB Matching (a Game Theory Approach) Tomáš Denemark, Jessica Fridrich / 5

2 Content-adaptive steganography Every pixel is changed with probability β i = exp( λρ i) + exp( λρ i ), where ρ i 0 are costs for each pixel and λ determined from the payload constrain n n i= h(β i) = α. Costs determined by image content = approximately available to Warden who can adjust detector accordingly. How does this change Alice s embedding strategy? 2 / 5

3 Two fundamental approaches Omnipotent Warden [Cachin, 998] Warden knows payload and embedding probabilities for each pixel. Alice minimizes KL divergence between cover/stego distributions. 2 Ignorant Warden [Böhme, 202] Warden knows only the payload. Alice can embed suboptimally (not minimize KL-div) to utilize mismatch of Warden s detector. Our contribution We investigate modern steganography (LSBM). Warden uses LRT for detection. 3 / 5

4 Notation Gaussian density with mean µ and variance σ 2 : ( ) f (x; µ, σ 2 ) = (2πσ 2 ) /2 (x µ)2 exp 2σ 2, {, 0, }-mixture of Gaussian densities with a parameter 0 β /2: f β (x; σ 2 ) = β 2 f (x;, σ2 ) + ( β)f (x; 0, σ 2 ) + β 2 f (x;, σ2 ). 4 / 5

5 Cover Model We assume cover is a sequence of n independent Gaussians X i with unequal variances σ 2 i : X = (X,..., X n ), X i N(0, σ 2 i ), i =,..., n. 5 / 5

6 Embedding Method Alice uses LSBM with change rates β (A) i, i =,..., n. Stego image Y = (Y,..., Y n ), β (A) i /2 for s i =, Pr(Y i = x i + s i ) = β (A) i for s i = 0, β (A) i /2 for s i =. Therefore Y i f (A) β (x, σi 2 ) i Change rates must satisfy payload constraint n i= h(β (A) i ) = αn 6 / 5

7 Warden s Detector Simple binary hypothesis test: β (W) i H 0 : X i f (x, 0, σ 2 i ), i, H : X i f (W) β (x, σi 2 ), i, i are change rates assumed by Warden Warden uses the Likelihood Ratio Test (LRT): T(x; β (W), σ 2 ) = n i= f (W) β (x i, σi 2 ) i f (x i, 0, σi 2) β (W) = (β (W),..., β (W) n ) and σ 2 = (σ 2,..., σ2 n) 7 / 5

8 Alice and Warden Play Game Players: Alice and Warden Strategies: β (A) = (β (A),..., β n (A) ) and β (W) = (β (W),..., β n (W) ) Payoff function: total error probability P E = min P FA ( 2 (P FA + P MD ) The game solution is in Nash equilibrium. ) 8 / 5

9 Two Pixel Model Because of the computational and numerical complexity we limit ourselves to covers consisting of two pixels. Strategies: (β (A), β (A) 2 ), (β (W), β (W) 2 ) are in fact one-dimensional since the second beta is determined from payload. [Omnipotent Warden] KL divergence minimal at (β (A,), β (A,) 2 ) [Ignorant Warden] Nash equilibrium at (β (A,2), β (A,2) 2 ) 9 / 5

10 Solution PE β (W) β (A) 0. Figure: Payoff function P E (β (A), β (W) ) for α = 0.2, σ 2 =, σ 2 2 =.2. Smooth, with a unique saddle point [Kuhn, 2003] solution exists in pure strategies, in said saddle point. 0 / 5

11 Results KL divergence KL divergence P E / β (A) P E / β (W) PE/ β (A,W) β (A) = β (W) Figure: α = 0.2, σ 2 =, σ 2 2 =.2. / 5

12 Results β (A,) β (A,2) β (A) α Figure: Alice s strategies under both scenarios β (A,), β (A,2) as a function of α for σ 2 = and σ 2 2 =.2. 2 / 5

13 Results β (A,) β (A,2) 0. β (A) σ 2 2 /σ2 Figure: Alice s strategies under both scenarios β (A,), β (A,2) as a function of content diversity measured by the ratio σ 2 2/σ 2 for α = 0.4 and σ 2 =. 3 / 5

14 D KL Results 4 D KL /D () KL DKL DKL/D () KL α Figure: Warden s loss in her ability to detect Alice s embedding, D KL (ln T H 0 ln T H ) and D KL /D () KL, as a function of α for σ 2 = and σ2 2 =.2. 4 / 5

15 Summary In practice Warden rarely has full access to the steganographic channel. Even the simplistic two pixel cover source reveals interesting phenomena: Nash equilibrium point of minimal KL divergence. It pays off for Alice to trade optimality for a mismatched detector. It is always advantageous for Alice to embed a slightly larger payload into the element with a smaller variance. The difference between optimal strategies increases with increasing α. The difference between optimal strategies decreases with increasing differences between σ 2 and σ 2 2. Computational complexity and numerical issues prevent scaling up this approach to realistic covers. 5 / 5