WebP, as an image format increasingly adopted across the internet, is becoming an important cover for steganography, yet its steganographic capacity remains largely unexplored. The distinctive structure of lossy WebP compression, particularly its predictive coding and uniform quantization, poses significant challenges to conventional embedding cost modeling. These include nonlinear relationship between Discrete Cosine Transform (DCT) coefficients and reconstruction pixels, quantization uniformity obscuring frequency sensitivity, and distortion propagation across blocks. To address these challenges, we propose WebP-Adaptive Residual-reconstruction-united and Predictive-aware steganography (WARP), a novel embedding framework specifically designed for WebP images. WARP introduces a unified cost modeling paradigm that integrates reconstruction-domain texture complexity, residual-frequency quantization behavior, and predictive coding order. Specifically, it precisely identifies secure embedding regions by calculating reconstruction-domain texture-adaptive costs and then refining them with residual-domain frequency sensitivity. Furthermore, to mitigate inter-block distortion propagation inherent in predictive coding, WARP incorporates a novel predictive-order-aware cost decay mechanism that adjusts embedding costs based on block coordinates. To the best of our knowledge, this work represents the first comprehensive study on secure adaptive WebP steganography. Extensive experiments demonstrate that WARP achieves superior security performance against state-of-the-art steganalysis while maintaining high visual quality.

The proliferation of deepfake faces poses huge potential negative impacts on our daily lives. Despite substantial advancements in deepfake detection over these years, the generalizability of existing methods against forgeries from unseen datasets or created by emerging generative models remains constrained. In this paper, inspired by the zero-shot advantages of Vision-Language Models (VLMs), we propose a novel approach that repurposes a well-trained VLM for general deepfake detection. Motivated by the model reprogramming paradigm that manipulates the model prediction via input perturbations, our method can reprogram a pre-trained VLM model (e.g., CLIP) solely based on manipulating its input without tuning the inner parameters. First, learnable visual perturbations are used to refine feature extraction for deepfake detection. Then, we exploit information of face embedding to create sample-level adaptative text prompts, improving the performance. Extensive experiments on several popular benchmark datasets demonstrate that (1) the cross dataset and cross-manipulation performances of deepfake detection can be significantly and consistently improved (e.g., over 88% AUC in cross-dataset setting from FF++ to Wild-Deepfake); (2) the superior performances are achieved with fewer trainable parameters, making it a promising approach for real-world applications.

A significant challenge in audio deepfake detection (ADD) is to improve model generalization against unseen vocoders and other unknown factors, as existing methods often overfit to specific vocoder patterns or synthetic-irrelevant factors. To overcome this challenge, by focusing on vocoder-agnostic features and synthetic traces for generalizable ADD, we propose a novel dual-level disentanglement with meta-learning (ALDEN ) framework. Specifically, we first introduce an adversarial-training-based disentanglement learning (ADL) module to explicitly learn vocoder-agnostic and vocoder-specific features, effectively disentangling audio signals in terms of low-level characteristics. To suppress synthetic-irrelevant information, such as semantics and speaker identities, we simultaneously employ a reconstruction-based disentanglement learning (RDL) module, which further disentangles both synthetic-relevant and synthetic-irrelevant features from vocoder-agnostic features at a high-level of semantics. Additionally, as low-level non-semantic features are more critical in ADD, a vocoder-agnostic meta-learning (VAML) module is proposed to simulate cross-vocoder scenarios so as to further boost generalization performance. Extensive experiments demonstrate that ALDEN outperforms state-of-the-art methods in cross-vocoder and in-the-wild scenarios. The code, model, and supplementary materials will be released on the project page: https://beyond0814.github.io/ALDEN/.

Securing personal identity against deepfake attacks is increasingly critical in the digital age, especially for celebrities and political figures whose faces are easily accessible and frequently targeted. Most existing deepfake detection methods focus on general-purpose scenarios and often ignore the valuable prior knowledge of known facial identities, e.g., "VIP individuals" whose authentic facial data are already available. In this paper, we propose **VIPGuard**, a unified multimodal framework designed to capture fine-grained and comprehensive facial representations of a given identity, compare them against potentially fake or similar-looking faces, and reason over these comparisons to make accurate and explainable predictions. Specifically, our framework consists of three main stages. First, we fine-tune a multimodal large language model (MLLM) to learn detailed and structural facial attributes. Second, we perform identity-level discriminative learning to enable the model to distinguish subtle differences between highly similar faces, including real and fake variations. Finally, we introduce user-specific customization, where we model the unique characteristics of the target face identity and perform semantic reasoning via MLLM to enable personalized and explainable deepfake detection. Our framework shows clear advantages over previous detection works, where traditional detectors mainly rely on low-level visual cues and provide no human-understandable explanations, while other MLLM-based models often lack a detailed understanding of specific face identities. To facilitate the evaluation of our method, we build a comprehensive identity-aware benchmark called **VIPBench** for personalized deepfake detection, involving the latest 7 face-swapping and 7 entire face synthesis techniques for generation. Extensive experiments show that our model outperforms existing methods in both detection and explanation. The code is available at https://github.com/KQL11/VIPGuard .

The trace of double compression can serve as a crucial evidence of image manipulation for forensic investigation. With the ever-increasing popularity of WebP format, a new type of double compression case, WebP-JPEG transcoding, has emerged. However, distinguishing it from two common compression cases, single JPEG (SJPEG) and double JPEG (DJPEG) has not yet been studied. In this paper, we propose a specialized method for the new task. Firstly, a detailed analysis is conducted to reveal the differences in compression artifacts between WebP-JPEG and SJPEG/DJPEG, which manifests in the distributions of$4\times 4$/$8\times 8$DCT coefficients and the high-frequency portions of image spectrum. Then, multi-modality DCT histograms (MMDH) and high-pass-filtered image residuals (HPFIR) are proposed as front-end dual-domain forensic features to expose the above differences. An indispensable part of these features are extracted through a novel frequency-isolation module (FIM), offering additional information based on the derived relationship between$4\times 4$and$8\times 8$DCT coefficients. Finally, a CNN-ViT (Convolutional Neural Network-Vision Transformer) dual-stream network is designed to learn back-end deep features for a reliable detection, where a CNN stream is used to process statistical features in MMDH while a ViT stream to learn spatial correlations in HPFIR. Extensive experimental results demonstrate that the proposed method significantly outperforms state-of-the-art double compression detection methods in distinguishing WebP-JPEG from SJPEG/DJPEG and is more effective in tampering localization. In specific, the proposed method achieves an average detection accuracy of 0.942 for small images of size$128\times 128$.

Recent research has shown that architectures utilizing reinforcement learning (RL) are effective in cost-based image steganography. However, these architectures only learn embedding probabilities rather than costs, and are trained for a specific embedding payload, making it difficult to extend the trained model to serve other payloads. In this paper, we propose a payload-independent cost learning framework using RL called PICO-RL. This framework directly learns universal costs that can be applied to any payload. PICO-RL incorporates an optimal probability approximation (OPA) module that can calculate the required probability map for embedding simulation directly from a learned cost map for any payload, eliminating the need for time-consuming searches for a valid probability scaling parameter. Additionally, PICO-RL uses an advanced steganalysis environment network to provide more effective reward feedback for learning. During RL training, the learned cost maps of different payloads converge and eventually become similar under the OPA constraint, resulting in payload independence. Experimental results demonstrate that a well-trained PICO-RL model, which acts as a universal cost function, defines costs with superior security performance against steganalysis and has better coding compatibility when encoding with practical steganographic codes.

The development of generative AI applications has revolutionized the data environment for steganography, providing a new source of steganographic cover. However, existing generative data-based steganography methods typically require white-box access, rendering them unsuitable for black-box generative models. To overcome this limitation, we propose a novel steganography method for generated images, which leverages the volatility of generative models and is applicable in black-box scenarios. The volatility of generative models refers to the ability to generate a series of images with slight variations by fine-tuning the input parameters of the model. These generated images exhibit varying degrees of volatility in different areas. To resist steganalysis, we mask steganographic modifications by confusing them with the inherent volatility of the model. Specifically, by modeling distributions of generated pixels and estimating the parameters of the distributions, the occurrence probabilities of generated pixels can be obtained, which serve as an effective measure for steganographic modification probabilities to render stego images as indistinguishable as possible from the images producible by the model. Moreover, we further combine it with existing costs to develop a more comprehensive steganographic algorithm. Experimental results show that the proposed method significantly outperforms baseline and comparative methods in resisting both feature-based and CNN-based steganalyzers.

Digital watermarking is a widely adopted authentication technique and one of its primary concerns in practical usage is robustness. However, existing audio watermarking methods face challenges in countering desynchronization attacks and replay attacks, which can easily lead to watermark extraction failure. In this paper, we introduce a learning-based scheme, named DRAW (Dual-decoder-based Robust Audio Watermarking), to overcome the robustness issue. Specifically, a watermark encoder embeds payloads together with synch codes into audio frames with high imperceptibility. For reliable watermark extraction, two separate decoders are designed, one for Fixed Length Synchronization Decoding (FLSD) and the other for Variable Length Payload Decoding (VLPD). The dual decoders are trained with the encoder with different weights in the loss function by considering their different roles for watermark extraction. To better resist attacks, a distortion layer is incorporated in-between the encoder and the decoders to simulate distortion and facilitate end-to-end learning. For the more challenging replay attacks, a pre-trained Replay Attack Simulation Network (RASN) is applied to simplify the simulation of re-recording with background noise and reverberation. Extensive experimental results show that the proposed method can be applied to variable-length audio clips with better auditory quality, and it outperforms state-of-the-art methods in robustness against various kinds of attacks.

The effectiveness of deep learning-based steganalyzers is significantly compromised by adversarial steganography. In response to this challenge, recent efforts have been devoted to identifying distinct traces of adversarial perturbations, yet they have overlooked the inherently adversarial robustness required in steganalyzers. This paper aims to develop a steganalytic model that defends against adversarial steganography by increasing the difficulty of generating adversarial stego images. To achieve this objective, the techniques of learning neighboring feature relationships and self-adversarial adjustment are proposed with three essential modules. The first one, named K-times Dropout Neighboring Feature Transformer (KDNFT), is designed to accept a set of neighboring features obtained by dropout as input. Based on the finding that K-times dropout neighboring features have different distributions for covers and adversarial stegos, KDNFT effectively learns to exploit the relationships among these features for adversarial steganalysis. To facilitate adversarial training, which is an effective way to improve intrinsic robustness, the second module called Pseudo Adversarial Stego Generator (PASG) is proposed to synthesize samples for training. The third module is a Test-time Active Perturbation (TAP) module that adjusts the results of adversarial stego samples close to the decision boundary in a self-adversarial way. Extensive experiments demonstrate that our method achieves improvements in steganalyzing various kinds of adversarial steganographic methods.

Recent studies have shown that side-information estimation (SIE) via JPEG image deblocking/restoration is effective in enhancing steganographic security when the side-information of JPEG rounding errors is unavailable. The polarity map of deblocking errors can work well in modulating handcrafted embedding costs. However, it may not be easy to design an optimal deblocking method that is universal to enhance security for all images, and it is unclear how to better utilize the polarity map in modulating statistical model-based embedding costs. To circumvent the difficulty of deblocking method design, we propose an optimal polarity map selection (OPMS) method leveraging existing well-performed deblocking methods. OPMS is designed based on polarity-oriented synthetic stego and minimum feature distance, so that the selected optimal polarity map (OPM) ensures a high security performance to each image. Besides, we propose a statistical model-based modulation method to better exploiting OPM in a quaternary quantized Gaussian embedding (QQGE) model. Through shifting the mean of the distribution, QQGE can derive effective modulated embedding probabilities and reduce the number of modified coefficients without increasing coding complexity. Experimental results demonstrate that the proposed overall steganographic method, called OPMS-QQGE, greatly surpasses existing state-of-the-art SIE-based methods in resisting both CNN-based and feature-based steganalyzers.

Three-dimensional (3-D) meshes are commonly used to represent virtual surfaces and volumes. Over the past decade, 3-D meshes have emerged in industrial, medical, and entertainment applications, being of large practical significance for 3-D mesh steganography and steganalysis. In this article, we provide a systematic survey of the literature on 3-D mesh steganography and steganalysis. Compared with an earlier survey (Girdhar et al., 2017), we propose a new taxonomy of steganographic algorithms with four categories: 1) two-state domain, 2) LSB domain, 3) permutation domain, and 4) transform domain. Regarding steganalysis algorithms, we divide them into two categories: 1) universal steganalysis and 2) specific steganalysis. For each category, the history of technical developments and the current technological level are introduced and discussed. Finally, we highlight some promising future research directions and challenges in improving the performance of 3-D mesh steganography and steganalysis.

Recently, Li et al. proposed an effective non-additive distortion model for JPEG steganography by preserving Block Boundary Continuity (BBC) in the spatial domain. However, the method based on BBC only explored how the modifications of DCT coefficient pairs at the same mode in adjacent blocks will impact on BBC. In this paper, we propose a method to enhance the BBC, called BBC++, by considering the mutual impact on the BBC from all DCT coefficients in adjacent blocks. To do that, we design updating strategies for both covers and costs in multi-round embedding processions. During the embedding, the cover is updated to repair the BBC after embedding and the corresponding costs are updated to keep the BBC from being destroyed in the next embedding. Experimental results show that the BBC++ can better maintain BBC and outperform previous non-additive distortion steganography when resisting modern JPEG steganalyzers.

Recent advances show that a reasonable non-additive cost function can significantly improve the security level of additive cost based steganography. So far, there is only one principle, called block boundary continuity (BBC), that has been proposed to define the non-additive cost function for JPEG steganography, and it aims at synchronizing the modification direction of inter-block boundaries in the spatial domain. In this article, we found that JPEG steganography usually introduces more and larger modifications on the boundary than on the inside of each intra-block in the spatial domain, which is another important factor affecting security. Therefore, we present a new principle, called block boundary maintenance (BBM), to minimize the modifications on the spatial block boundaries. In theory, we deduce the BBM principle on how to modify a pair of DCT coefficients of the intra-block to reduce the modifications on the spatial block boundary. According to the BBM principle, we design a new strategy to define non-additive cost functions for JPEG steganography by exploiting the coefficient correlation of the intra-block in the DCT domain. The experimental results show that the BBM-based strategy can minimize modifications on the spatial block boundaries and thus achieve a high-security level when resisting modern JPEG steganalysis. Furthermore, the two principles of BBC and BBM can be fused to further improve the empirical security.

Steganography is an information hiding technique for covert communication. So far Syndrome-Trellis Codes (STC), a convolutional codes-based method, is the only near-optimal coding method, i.e., it can approach the rate-distortion bound of content-adaptive steganography in practice. However, as a secure communication application, steganography needs the diversity of coding methods. This paper proposes another and a better near-optimal steganographic coding method based on polar codes, using Successive Cancellation List (SCL) decoding algorithm to minimize additive distortion in steganography. Considering a steganographic channel as a binary symmetric channel, the proposed Steganographic Polar Codes (SPC) chooses parity-check matrix by setting embedding payload as the initial value of Arikan's heuristic and computes decoding channel metric from the optimal modification probability of minimal distortion model. To overcome the inherent defect of polar codes only suiting for code length of a power of 2, we introduce three strategies to generalize SPC for arbitrary length. Experimental results validate the versatility of SPC to minimize arbitrary distortion. When compared with STC, the overall coding performance of SPC is more superior with low embedding complexity. This work verifies the availability of polar codes for the practical construction of steganographic codes and provides a methodology for designing better steganographic codes based on any advance of polar coding/decoding.

Steganography is the art of covert communication, which aims to hide the secret messages into cover medium while achieving high undetectability. To this end, the framework of minimal distortion embedding is widely adopted for adaptive steganography, where a well-designed distortion function is significant. In this paper, inspired by the phenomenon that the modification of audio samples with the low amplitude will be easily detected, a novel distortion is presented for audio steganography. Taking the fragility of the low amplitude audio samples into account, the proposed distortion is inversely proportional to the amplitude. Furthermore, in order to resist the strong steganalysis, the derivative filter is utilized for acquiring the residual of audio, which plays an important role in distortion definition. The experimental results show that the proposed distortion outperforms the state-of-the-art methods defending strong steganalytic methods. To take a step forward, considering the mutual impact caused by embedding modification, the non-additive extensions of the proposed methods are put forward. The extending experiments show that in most cases, the proposed non-additive extensions can achieve higher level of security than the original methods.

Previous studies have exhibited that incorporating side-information, e.g., a high-quality precover image, can significantly improve steganographic security for JPEG images. This motivates us to estimate the side-information for traditional steganographic scenario in which only a JPEG image is available. It is expected to achieve high-level security by utilizing the estimated side-information similar to side-informed steganography, even though the estimated side-information is not perfectly precise. In this paper, a general framework of side-information estimated (SIE) JPEG steganography is proposed, under which the core problems are how to better estimate the precover and modulate the distortion function correspondingly. To address the two problems, we test several denoising filters and a deblocking filter to obtain the estimated precover, and we introduce two implementation models for modulating the costs. We finally recommend the combination of the deblocking filter and the modulation model using the polarity of the estimated rounding error. The experimental results show that the proposed method dramatically improves the existing additive distortions for images of an arbitrary quality factor and outperforms the state-of-the-art methods based on estimating side-information when resisting modern steganalysis.

Recently, the most effective steganographic schemes for JPEG images are based on minimal distortion model with Syndrome-Trellis Codes (STCs) as the coding method. However, the execution time of STCs will be severely long for message embedding to the cover object of large size, which cannot meet the demand for real-time communication in a real-world application. According to the time complexity O(2hn), it is suggested in the STCs to accelerate the embedding process by decreasing the constraint height h. However, smaller h corresponds to lower steganographic security. In this paper, we investigate the possibility of shortening the cover (reducing the length n) for speeding up the execution of STCs without weakening the steganographic security. After introducing some properties of cover selection with proofs, we propose several algorithms designed for JPEG images to construct a preferable shortened cover containing DCT coefficients of smaller costs as much as possible. The experimental results display the superiority of the proposed algorithm on the speed profit and the security when compared with the method of decreasing h. With confidence, a JPEG image of arbitrary quality factor can be safely shortened to 1/4 of the original, and correspondingly the execution of STCs can be four times faster.

Despite the strong presence of color images for communication, scholars have mainly devoted their attention to research on steganography for grayscale images. In contrast to grayscale images, color images have three interrelated color channels, and the relationships among the three channels have a strong impact on the steganography security. In this paper, we present a steganographic scheme for spatial color images by exploiting the correlations and differences between the color channels. We find that the G channel has a stronger correlation with R and B than the one between R and B, and thus, synchronizing the modification directions of the R and B channels with those from the G channel will have better resistance to detection. In addition, the payload capacity and the distribution of complex regions between channels are different. Based on these findings, we design a new strategy for defining non-additive costs for color image steganography, called G-channel-related Inter-channel Non-Additive (GINA) strategy. The GINA strategy can make the modification directions of the R and B channels consistent with those of the G channel and can adaptively distribute the embedding capacity between the three channels. Specifically, this strategy will not violate the Complexity Prior rule. The experimental results show that the proposed GINA strategy can significantly improve the performance in terms of resisting color image steganalysis compared with previous methods.

Currently, the most successful model for image adaptive steganography is the framework of minimal distortion, in which a reasonable definition of costs can improve the security level. In the authors' previous work, they developed a rule for cost reassignment in spatial domain called the ‘controversial pixel prior (CPP)’ rule, which defines controversial pixels by utilizing the controversies among several comparable schemes. The CPP rule gives controversial pixels higher modification priorities. In this study, they investigate migrating the CPP rule from the spatial domain to the joint photographic experts group (JPEG) domain and name it the J‐CPP rule. In JPEG images, the cover elements are discrete cosine transform (DCT) coefficients and variant factors mayinfluence the distortion definition includingquantisation step, inter‐blocks correlation and block energy. However, there is no evidence to reveal which factor is of highest priority for promoting security. In this work, they investigate which factor is more helpful in promoting J‐CPP rule, and they finally determine to set the spatial block residual as a penalty to perfect J‐CPP rule. Through extensive experiments on different JPEG steganographic algorithms and steganalysis features, they demonstrate that the J‐CPP rule can improve the security of JPEG adaptive steganography.

Recent studies have shown that the non-additive distortion model of Decomposing Joint Distortion ($DeJoin$) can work well for spatial image steganography by defining joint distortion with the principle of Synchronizing Modification Directions (SMD). However, no principles have yet produced to instruct the definition of joint distortion for JPEG steganography. Experimental results indicate that SMD can not be directly used for JPEG images, which means that simply pursuing modification directions clustered does not help improve the steganographic security. In this paper, we inspect the embedding change from the spatial domain and propose a principle of Block Boundary Continuity (BBC) for defining JPEG joint distortion, which aims to restrain blocking artifacts caused by inter-block adjacent modifications and thus effectively preserve the spatial continuity at block boundaries. According to BBC, whether inter-block adjacent modifications should be synchronized or desynchronized is related to the DCT mode and the adjacent direction of inter-block coefficients (horizontal or vertical). When built into $DeJoin$, experiments demonstrate that BBC does help improve state-of-the-art additive distortion schemes in terms of relatively large embedding payloads against modern JPEG steganalyzers.