Generative Reversible Data Hiding by Image to Image Translation via GANs

The traditional reversible data hiding technique is based on cover image modification which inevitably leaves some traces of rewriting that can be more easily analyzed and attacked by the warder. Inspired by the cover synthesis steganography based generative adversarial networks, in this paper, a novel generative reversible data hiding scheme (GRDH) by image translation is proposed. First, an image generator is used to obtain a realistic image, which is used as an input to the image-to-image translation model with CycleGAN. After image translation, a stego image with different semantic information will be obtained. The secret message and the original input image can be recovered separately by a well-trained message extractor and the inverse transform of the image translation. Experimental results have verified the effectiveness of the scheme.


Introduction
Information hiding [1][2][3][4][5], also called data hiding, is an important information security technique widely used in secret transmission [6], digital copyright protection [7], and other scenarios.If we classify data hiding by the reversibility of cover image, data hiding can generally be divided into two types: irreversible data hiding (IDH) [8][9] and reversible data hiding (RDH) [10][11][12].The traditional data hiding methods can be classified into the former type while the latter type is a special technique which is mainly applied to medical, judicial, and military fields.
With the emergence and development of artificial intelligence [13][14][15][16] and other new techniques, the IDH methods using deep learning models have achieved a series of breakthrough in methods and performance, and become the trend of development in this field [17][18][19][20].Among these new methods, secret data can be hidden and extracted well without any modification in the original cover image, and cannot be detected by the warder (steganalysis algorithm).Comparatively, RDH with deep learning has received less attention.As far as our best knowledge, there is currently no RDH method can hide data without modification.At present, RDH methods can be divided into two types: RDH in unencrypted images [21][22][23] and RDH in encrypted images [24][25].Among these RDH methods, data hiding is based on cover image modification, which is more and more easily to be detected by increasingly advanced machine learning detection tools.
In [18], a new image steganography method via deep convolutional generative adversarial networks (DCGAN) is proposed.In this method, a mapping from the secret data to random noise is designed.With this mapping, a corresponding relationship between secret data and the stego image generated by DCGAN model is obtained, and an extractor used to extract secret data is trained.This method has a strong ability to resist state-of-the-art detection tools, and it has provided great inspiration for RDH method without modification.
Cycle-Consistent Generative Adversarial Networks (CycleGAN) [26]  In [27], a framework for RDH in encrypted images based on reversible image transformation is proposed.At first, a cover image is transformed into another target image by image transformation.Then, secret data is embedded into the transformed image, which regarded as encrypted image.There have been many similar methods [28][29][30].In this type of method, the image transformation is regarded as a special type of image encryption.And the embedding method belongs to the traditional method and is essentially relied on pixel modification.However, the generative model uses neural networks to learn the data distribution rule of samples, and the generated image has strong randomness, which enhances the security of the data hiding algorithms.This advantage is far superior to traditional methods.
In this paper, the generative reversible data hiding (GRDH) method based on GANs model is proposed.Learning the secret data mapping method in [18] and the image recovery method in CycleGAN, a new GRDH framework is proposed.In this framework, a cover image is generated by a noise vector, which is transformed by the secret data.Then, the cover image is transformed into a marked image by CycleGAN model.Similar to the frame in [27], the transformed image can be regarded as a special encrypted image.In addition, a new extractor is trained to extract the secret data, which make the data hiding framework reversible.Experimental results have proved the feasibility of the proposed GRDH method.

DCGAN and CycleGAN
DCGAN [31] is an upgraded version of GAN.In DCGAN model, convolution neural network is introduced to design generator and discriminator.To improve the quality of generated samples and the speed of convergence process, some changes to the structure of original convolution neural network have been made.With the powerful feature extraction ability of convolution neural network, the learning effect of the generative adversarial network has been significantly improved.Illustration of DCGAN model has been shown in Fig. 1.The fake image is generated by random noise and a generator.The discriminator is designed in order to judge whether the generated image is real image or fake image.The goal of generator is to generate real images to deceive discriminator.The goal of discriminator is to separate the fake image from the real one as far as possible.In this way, generator and discriminator constitute a dynamic game process.The illustration of GRDH has been shown in Fig. 4.

Illustration of the proposed GRDH method
There are two processes in GRDH: prepare process and implementation process, consisting of 5 phase: G can be regarded as cover image and marked image.Then, the sender sends the to the receiver.At the receiver side, recover image can be obtained and the embedded data can be extracted.We will go into detail about the various phases in the following.

Prepare process
The purpose of the prepare process is to train related models and prepare for data and X Y defined in [26], and the full objective function can be described as follows.Denote x and data P as the real image and its distribution from cover image database CDB , then the objective function to be optimized is as follows. ))] Other unsupervised GAN models (e.g.BEGAN) can also be used for generator training.

Phase 3: Extractor training
After Phase 1 and Phase 2, two generators 1 G and 2 G have been trained.Based on these two generators and input noise 1 z , the marked image can be generated by . Our goal of Phase 3 is to train an extractor E for secret data.We draw on Hu's method [18].The construction method of E is similar to that of the discriminator in DCGAN model, which has four convolutional layers and a fully connected layer.A leak-Relu activation function and batch normalization are used in each layer.Different from conventional CNN models, there is no pooling layer or dropout operation in the extractor.Illustration of the extractor in GRDH method has been shown in Fig. 5.

Fig. 5 Illustration of the extractor in GRDH method
If the input of E is the marked image with the size 64×64×3, the output after the first layer is 32×32×64.In the following layers, the image dimensions are halved, and the number of channels is doubled from the previous layer.The final output is a noise vector of 100 dimensions.Each noise value in the vector is between -1 and 1.The defined loss function for the extractor training can be described as follows.
We use this loss function to train the extractor as much as possible so that its output is as close as possible to the input noise 1 z .

Implementation process
After the prepare process, two generators 1 G and 2 G , an extractor E , and a restorer F are obtained.As shown as in Fig. 4, the sender holds 1 G and 2 G and sends E and F in advance by a secure channel.The above process is similar to that of key distribution in public key cryptography.
According to the steps of prepare process, the noise vector Z is transformed into to the receiver.At the receiving end, the receiver can recover the cover image by the restorer F , and extract the noise vector by the extractor E .From the view of RDH in encrypted images, the above process at the receiving end belongs to separable scheme.It means that the receiver can not only recover the image before data extracting, but also recover the image after data extracting.Beyond that, the mapping method proposed in [18] is used to realize the mapping from the secret binary bits to noise vector.The mapping method can be described as follows.
At first, divide the secret binary bits into several groups.Each group contains k bits.For example, divide {110101100} into three groups {110}, {101} and {100} when 3 k . Then, map each group to a random noise r with a given interval according to the following equation.
Where m denotes the decimal value of the group to be mapped, and denotes the gap between the divided intervals.For example, 3 k , 001 .0 .We map every three secret bits into a random noise with the value between -1 and 1.The mapping from the group to the interval can be shown in Table 1.At last, package all the mapped noise into a vector.The above mapping method allows a deviation tolerance in data extracting, and ensures the extraction accuracy of the secret data during the implementation process.This mapping method will be shared by both the sender and the receiver.The sender maps secret data to noise vector and the receiver maps noise vector to secret data.

Experimental results
In this section, a group of experiments is conducted to verify the effectiveness of the GRDH method proposed in this paper.These experiments consist of two parts.
First, we train the GANs models and the extractor for GRDH preparation.Then, we use these trained models for GRDH to verify the feasibility of the method.In all the experiments, we generate random bits (using random.randintfunction in NumPy) as      From the experimental results, it can be seen that the extractor converges rapidly and will eventually converge to a small value, which means that the output of the extractor is very close to the input noise vector.This means that we can reverse map the output of the extractor back to the secret message using Table 1.

Experiments for GRDH implementation
First, the secret information bit string (generated using random.randint in NumPy) is divided into several segments (3 bit/segment, i.e. k=3), and then the binary bit form segment is converted into a random noise form of the range [-1, 1] by Formula (4).In addition, we calculated the average value of peak signal-to-noise ratio (PSNR) for 1,000 recovered images from two GAN models separately, as shown in table 2.  From the tables, the recovery accuracy R significantly decreases with the rising of parameter k and slightly increases with the rising of parameter .To analyze the reason, it is just because that the smaller the parameter k is, the better correction capability the algorithm will be.Although the extractor recovery accuracy is not perfect, this problem can be resolved by including error-correction codes in the input noise.
Because the generative steganography is to fully fit the data distribution in the natural image dataset through the training generator, this technique is very resistant to the machine learning based steganographic analyzer, which was mentioned in [18].In other words, it is safer than traditional modification-based steganography.Besides, because of the data hiding principle, the embedding capacity is very limit now.In the future, with the progress of GAN model, the steganographic capacity of this scheme will gradually increase.

Conclusions
In this paper, a novel RDH scheme named GRDH based on GANs model is proposed.Firstly, we use the GAN model to train a powerful image generator to get realistic images.This image is imported into the CycleGAN model to obtain images with different semantic information.In order to achieve message embedding, then, we establish a mapping relationship between noise and messages.The extraction of the message is achieved by training an extractor to recover noise from the final dense image.Experimental results have demonstrated the effectiveness of the proposed method.Although the 100 percent reversibility cannot be achieved due to the existing performance of CycleGAN, the proposed method can achieve the first RDH scheme without cover modification.However, compared with the traditional methods, the embedding capacity of the proposed method is very limit but the security is higher.In future work, we will try to experiment with some new generative models to improve the quality of restored images and to improve the steganographic capacity of the method.
is a newly proposed image to image translate model, which learns to automatically translate an image from a source domain into a target domain in the absence of paired examples.In this generative adversarial network (GAN) model, there are two generators and two discriminators.Cycle-consistency loss is defined to train CycleGAN model.Using CycleGAN, one type of picture can be transformed into another, and this transformation is reversible.Obviously, this kind of technique can be applied to RDH field.

Fig. 1 2 .
Fig. 1 Illustration of DCGAN modelCycleGAN[26] is an essentially ring network which is made up of two symmetrical GAN models.Illustration of CycleGAN model has been shown in Fig.2.On the one hand, two GAN models share two generators.On the other hand, each GAN model contains a discriminator.Thus, there are two generators and two discriminators in a CycleGAN model.Fig.3shows the illustration of a one-way GAN model.Real images in domain A can be transformed to fake images in domain B based on a discriminator, and then transformed to recovered image of domain A by

Fig. 2 Fig. 3
Fig. 2 Illustration of CycleGAN model hiding, including three phases: CycleGAN training, generator training, and extractor training.The detailed steps can be described as follows: Phase 1: CycleGAN training Our goal of this phase is to generate a marked image generator 1 G a n d a recovered image restorer F .Without loss of generality, we choose the original CycleGAN model to train.Assume X and Y denote two image collections, which corresponding to cover image and marked image respectively.Firstly, build two image databases: a cover image database ( CDB ) and a marked image database ( MDB ).Each database contains one type of images.For example, CDB contains images of normal horses and MDB contains images of zebras.Then, the cover image in the following phases will be an image of normal horse and the marked image sending to the receiver can be an image of zebra.In Phase 1, the training process is based on the original CycleGAN model.We apply the two adversarial losses:

Fig. 6
Fig. 6 Partial experimental results of CycleGAN training The first line stands for the mapping from X domain (horse) into Y domain image (zebra).There images from left to right are respectively the original image, the transformed image and the reconstructed image.The second line stands for the mapping from Y domain image (zebra) into X domain (horse).From Fig. 6, When the model was trained to 210000 steps the visual results of image transformation and image recovery can be acceptable in some special scenes when the demand for reversibility is not high.The visual results are related with the chosen image database and sample size.We also use the man2woman image set[34]  to train the model.The batch size is set to 100; the random number seed is set to 1234; the initial learning rate initial value is set to 0.002; the rate remains the same in the first 10,000 steps, then decays every 10,000 steps until it decays to zero (one step represents a batch of image training).Assuming that the Man image set is X and the Woman image set is Y, the adjustment parameters are set to 10.0. in the training in both directions X->Y and Y->X.The first moment parameter of the gradient descent optimizer is set to 0.5, and the number of

Fig. 8
Fig. 8 BEGAN model training results

Fig. 10
Fig. 10 The loss function value of extractor in training Image generation, image transformation and image restoration were performed using the trained CycleGAN model and BEGAN model.Among them, CycleGAN model training image set is Man image set and Woman image set; the training frequency is 600,000 steps; BEGAN model training image set is CelebA image library; the training frequency is 400,000 steps; the noise dimension is set to 100, so the amount of embedded data in the experiment was set to 300 bit (i.e.100×3).The experimental results of image generation, image transformation and image restoration in some samples are shown in Fig. 11(a).Due to the limitations of image quality generated by BEGAN, the visual quality of gender conversion and image restoration is relatively l ow .F i g . 1 1 ( b ) s h ow s s om e ex p e ri m en tal r e s ul ts w h e n th e S ty l e GA N m od el i s adopted in the image generation process.

Fig. 11
Fig. 11 The results of Image generation, image conversion, and image restoration Phase 1, CycleGAN training.A generator 1G and a restorer F are generated by 2G obtained earlier, we can achieve the transformation from random noise to image collection Y .Then, we train a new extractor E based on GAN technique and ensure that the generated output 2 Z i s s a m e w i t h t h e i n p u t 1 Z as closely as possible.Phase 4, Send and receive.Before data hiding, the sender sends extractor E and restorer F to the receiver.Both sides learn a mapping from secret data M to noise Z .Corresponding to the traditional RDH methods, the image generated by 1 G and 2

Table 1
The mapping from the group to the interval

Table 2
The average values of PSNRs of recovered images Although the average PSNR value of restored images is not high, the subjective visual effect is acceptable.Meanwhile, it is easy to see from the figure that the visual quality of gender conversion and image restoration is relatively high.Therefore, whether in the preparation phase or the implementation phase, the image visual quality is mainly affected by the type of the selected GAN model.To test the extractor, we measured the accuracy of the extraction of secret information from 1,000 marked images.The average extraction accuracy of the extractor is 88.7%.In addition, to test the effect of parameters k and on extractor recovery accuracy rate R , some further experiments are carried on.The effect of parameters k and on recovery accuracy R were shown in Table3and Table4respectively.

Table 3
The effect of parameter k on recovery accuracy