With the rapid development of generative AI, image steganography has garnered widespread attention due to its unique concealment. Recent studies have demonstrated the practical advantages of Fixed Neural Network Steganography (FNNS), notably its ability to achieve stable information embedding and extraction without any additional network training. However, the stego images generated by FNNS still exhibit noticeable distortion and limited robustness. These drawbacks compromise the security of the embedded information and restrict the practical applicability of the method. To address these limitations, we propose Robust Fixed Neural Network Steganography (RFNNS). Specifically, a texture-aware localization technique selectively embeds perturbations carrying secret information into regions of complex textures, effectively preserving visual quality. Additionally, a robust steganographic perturbation generation (RSPG) strategy is designed to enhance the decoding accuracy, even under common and unknown attacks. These robust perturbations are combined with AI-generated cover images to produce stego images. Experimental results demonstrate that RFNNS significantly improves robustness compared to state-of-the-art FNNS methods, achieving an average increase in SSIM of 23% for recovered secret images under common attacks. Furthermore, the LPIPS value of recovered secrets images against previously unknown attacks achieved by RFNNS was reduced to 39% of the SOTA method, underscoring its practical value for covert communication.

Learning on multi-view data is a fundamental task, which integrates the information from different views to improve the final performance. It is also a basic task for learning on the long-tailed data in real applications, followed by the downstream tasks, i.e., classification. The existing works for trusted classification on multi-view data or long-tailed data usually aim to improve the final performance and dynamically consider the confidence of prediction for the data which is crucial in cost-sensitive domains. However, these methods pay few attentions to the pairwise trusted problem which considers the trusted pairs instead of trusted annotated data points. Besides, the problem of classification on long-tailed multi-view data has never been studied so far. In this work, we focus on the pairwise trusted problem on long-tailed multi-view classification and give a general framework, which considers the trusted pairs instead of trusted annotated data points. We then construct a specific example under the general framework and introduce a novel Enhanced Normal-Inverse Gamma distribution (ENIG). ENIG is a joint probabilistic distribution built on Dirichlet distribution and NIG. A novel combination rule based on ENIG for long-tailed multi-view data is also given, which adaptively integrates the long-tailed data from different views to achieve a consensus one at the level of evidence and effectively produces a trusted long-tailed multi-view classification result. Our method is robust and able to be dynamically aware of the uncertainty for the long-tailed data from each view. The accurate uncertainty can be induced by the proposed learning framework, leading to both robustness and reliability for classification on long-tailed multi-view data. Experimental results on different long-tailed multi-view datasets demonstrate the effectiveness of our method in terms of accuracy, robustness and reliability.

Protecting the intellectual property of Large Language Models (LLMs) is critical because training them requires massive computational resources and data. A key challenge is determining whether a suspicious model is derived from a specific base model after fine-tuning or structural modification. Existing fingerprinting methods rely on model weights or high-dimensional representations, leading to substantial storage overhead. We propose a non-intrusive fingerprinting framework Concept REsponse Fingerprints (CREF). Inspired by activation engineering, CREF constructs a set of concept activation vectors as semantic probes. It then measures the response strength of hidden representations along these concept activation vectors using shared inputs. The resulting concept response matrix serves as a compact fingerprint, and similarity between models is measured using centered kernel alignment. Experiments on multiple LLM families show that CREF reliably distinguishes derived models from independently trained models and remains robust to fine-tuning, pruning, parameter permutation, and scaling. Moreover, the fingerprint requires only kilobyte-level storage, making it practical for large-scale deployment and ownership verification.

Abstract Deep neural networks are used increasingly in daily life. Many models contain redundant parameters that render them susceptible to being exploited for transmitting secret data, thereby injecting malware or stealing sensitive data. Research on steganographic schemes for neural networks is therefore necessary. Existing steganalysis methods often require access to network parameters, while black-box approaches achieve limited accuracy. In this work, we propose a black-box steganalysis scheme that feeds a fixed sequence of images into the target network to extract implicit features, which are then used to train a steganalysis network. This is a black-box steganalysis framework without access to internal network parameter, leveraging output probabilities from fixed image sequences to capture model behavior and enabling steganography detection across diverse network architectures. Experiments show that our method improves accuracy by 6–39.65% compared to existing steganalysis schemes.

The application of Stable Diffusion Models (SDMs) in Internet of Things (IoT) image processing raises significant ethical concerns, particularly regarding model copyright infringement and the dissemination of inappropriate Artificial Intelligence (AI)-generated images. Model watermarking technology has proven effective for copyright verification and tracing the source model of AI-generated content. While initial-noise-modification-based watermarking can provide provable security and achieve lossless embedding, existing methods rely on Denoising Diffusion Implicit Model (DDIM) inversion for watermark extraction, which suffer from inherent precision limitations that compromise extraction accuracy. More critically, most of the existing approaches of this type still rely on access to the original or a compatible SDM during watermark verification, which introduces considerable practical constraints due to the model’s size and computational demands. To address these limitations, an end-to-end flexible SDM watermarking framework is proposed that replaces the DDIM inversion process with a lightweight watermark extractor, thereby eliminating the dependency on inversion in conventional provably secure watermarking. Specifically, a universal watermark extractor across SDM V1/V2 variants is designed based on a Transformer and Multilayer Perceptron (MLP) framework, complemented by fine-tuning a pre-trained watermark decoder, to directly recover watermark information from generated images. Experimental results confirm that our watermarking method yields superior performance in terms of fidelity and robustness. The lightweight extractor offers additional advantages of low computational cost and high transmission efficiency, providing an efficient and practical solution for watermark extraction in SDM-generated image.

Secure and high-capacity secret information transmission is an important task of the image hiding research. The existing image hiding methods face some critical issues: cover-based methods offer high capacity but introduce image distortion and security risks, whereas secure coverless methods have low capacity. To address these issues, this paper proposes a novel generative-based coverless multi-image hiding method called GCL-MIH, which can achieve high capacity and high security. The GCL-MIH first utilizes a feature reverse module to compress multiple secret images into multiple feature vectors and then normalizes them to generate a vector that conforms to a standard normal distribution, and finally inputs this vector into an invertible generative network (Flow-GAN) to generate a face image, enabling coverless multiple-image hiding without a predefined cover image. Experimental results demonstrate that the GCL-MIH successfully hides up to four images within a single generated face image, achieving a maximum embedding rate of 32 bpp. This capacity far exceeds those of the existing coverless methods. On the COCO test set, the generated stego images of the GCL-MIH are highly realistic (FID score: 11.98), and the recovered secret images exhibit satisfactory fidelity (the average PSNR and SSIM of four recovered secret images are 33.18 dB and 0.9412).

The proliferation of AI-generated imagery poses escalating challenges for multimedia forensics, yet many existing detectors depend on assumptions about the internals of specific generative models, limiting their cross-model applicability. We introduce a self-supervised approach for detecting AI-generated images that leverages camera metadata-specifically exchangeable image file format (EXIF) tags-to learn features intrinsic to digital photography. Our pretext task trains a feature extractor solely on camera-captured photographs by classifying categorical EXIF tags (e.g., camera model and scene type) and pairwise-ranking ordinal and continuous EXIF tags (e.g., focal length and aperture value). Using these EXIF-induced features, we first perform one-class detection by modeling the distribution of photographic images with a Gaussian mixture model and flagging low-likelihood samples as AI-generated. We then extend to binary detection that treats the learned extractor as a strong regularizer for a classifier of the same architecture, operating on high-frequency residuals from spatially scrambled patches. Extensive experiments across various generative models demonstrate that our EXIF-induced detectors substantially advance the state of the art, delivering strong generalization to in-the-wild samples and robustness to common benign image perturbations.

Generative steganography has recently attracted considerable attention due to its superior security properties. However, most existing approaches suffer from limited hiding capacity. To address this issue, this paper proposes a high-capacity image steganography framework that integrates an encoder–decoder architecture with a latent diffusion model. Specifically, a message encoder is designed to transform binary secret messages into latent-space representations through a series of ResDense modules, enabling efficient hiding of large-scale information. The encoded latent features are then guided by the latent diffusion model to synthesize visually realistic stego images. During message extraction, the stego image undergoes iterative noise addition within the diffusion process to reconstruct the latent representation, from which a message decoder accurately recovers the hidden message. Extensive experimental results demonstrate that the proposed method achieves a high hiding capacity of over 30,000 bits, outperforming state-of-the-art methods while ensuring reliable message recovery under common image storage formats such as JPEG and PNG.

Deep functionality hiding is an emerging technique that embeds confidential or sensitive functions within seemingly benign deep learning models (DLMs), which perform ordinary machine learning tasks. This enables such models to execute covert tasks while remaining undetected. Despite the rapid progress in deep functionality hiding, countermeasures remain unexplored. In this paper, we propose Distribution Offset Analysis (DOA), a novel method for detecting hidden functionalities in DLMs. Our key insight is that the weight distribution of a benign DLM typically follows a Gaussian distribution, whereas a container DLM with hidden functionalities exhibits notable statistical deviations from this Gaussian pattern. In our methodology, we first compute the distributional distance (i.e.,offsets) between the model's weights and an ideal Gaussian distribution. We then fuse these offsets with weight features into a unified representation, which is subsequently used to train a meta-classifier for hidden functionality detection. Through extensive experiments, we demonstrate the effectiveness of the proposed DOA method, which achieves an average detection rate of over 87% against existing state-of-the-art deep functionality hiding techniques.

With the rapid development of large language models, the fine-tuning of downstream tasks has become a key problem. As a new learning paradigm, prompt learning can greatly reduce the number of updated parameters and effectively reduce the communication cost in federated learning scenarios by freezing the pre-trained model and fine-tuning soft prompt parameters. However, for the federated prompt tuning, the local prompt usually contains the user's personal information, and the text input of the user are easily leaked through the aggregation directly on the server. Meanwhile, the soft prompt is vulnerable to poisoning attacks launched by malicious users (such as backdoor). For the above problems, this paper proposes a privacy-preserving federated prompt fine-tuning against poisoning attacks. Specifically, we use homomorphic encryption to ensure the confidentiality of local prompts, and aggregate prompts under ciphertext to generate global prompts. Secondly, the proposed mechanism of backdoor detection is used to judge whether the prompt contains backdoors to resist the malicious attacks in the form of ciphertext. Both local and global prompts are invisible to the server during the entire training process. Finally, theoretical analysis and experimental results show that the accuracy error between the plaintext domain and the ciphertext domain is controlled within 2%-5% under backdoor attack, which effectively enhances the robustness of the model.

Recent advances have highlighted the potential of diffusion models in Video Anomaly Detection (VAD). Diffusion models are typically employed to generate negative instances to distinguish them from positive ones. However, the existing diffusion model architectures, generally based on the reconstruction of low-level noisy features, introduce spurious correlations due to shortcut learning, which undermines the robustness of anomaly detection. In this work, we leverage normal-specific representations to guide behavior restoration by aligning disentangled task-relevant representations within the diffusion model. we propose a normal representation-guided conditional diffusion model for unsupervised VAD by aligning normal-specific representations. Inspired by prior knowledge of anomaly discrimination, we decompose normal behavior features into normal-specific and VAD-irrelevant representations into independent channels based on contrastive learning. We introduce a group-supervised learning strategy in learning patch-wise generation guided by normal-specific representations. A gradient-based representation alignment loss enforces the alignment between normal semantics and the target patches. This process enables the diffusion model to understand normal patterns for anomaly detection. Extensive experimental results conducted on VAD benchmarks demonstrate the effectiveness of our methods.

WebP, as an image format increasingly adopted across the internet, is becoming an important cover for steganography, yet its steganographic capacity remains largely unexplored. The distinctive structure of lossy WebP compression, particularly its predictive coding and uniform quantization, poses significant challenges to conventional embedding cost modeling. These include nonlinear relationship between Discrete Cosine Transform (DCT) coefficients and reconstruction pixels, quantization uniformity obscuring frequency sensitivity, and distortion propagation across blocks. To address these challenges, we propose WebP-Adaptive Residual-reconstruction-united and Predictive-aware steganography (WARP), a novel embedding framework specifically designed for WebP images. WARP introduces a unified cost modeling paradigm that integrates reconstruction-domain texture complexity, residual-frequency quantization behavior, and predictive coding order. Specifically, it precisely identifies secure embedding regions by calculating reconstruction-domain texture-adaptive costs and then refining them with residual-domain frequency sensitivity. Furthermore, to mitigate inter-block distortion propagation inherent in predictive coding, WARP incorporates a novel predictive-order-aware cost decay mechanism that adjusts embedding costs based on block coordinates. To the best of our knowledge, this work represents the first comprehensive study on secure adaptive WebP steganography. Extensive experiments demonstrate that WARP achieves superior security performance against state-of-the-art steganalysis while maintaining high visual quality.

Image-in-image hiding, which embeds a full-size secret image into a cover image with minimal perceptual distortion and accurate recovery, has attracted increasing attention because of its wide applications in copyright protection, covert communication, and digital forensics. However, when facing full-size secret images, the secret data often exceed the capacity limitation of individual cover images, resulting in existing solutions struggling to achieve an effective balance among robustness, high load capacity, and resistance to steganalysis and detection capabilities, which is particularly prominent when encountering social noise interference in real-world scenarios. To address these challenges, we propose MambaRIS, a robust and efficient image steganography framework that combines the dual-tree complex wavelet transform (DTCWT) with a state space model. The DTCWT module enables directionally selective decomposition of the input, enriching frequency-domain representations and providing more resilient embedding regions for robust cross-frequency hiding and recovery. Furthermore, we introduce a Mamba-based autoencoder architecture equipped with a novel spatial channel Mamba block (SCMB), which integrates spatial and channel attention mechanisms with linear-time global dependency modeling, significantly improving embedding adaptability under complex noise and distortion conditions. Extensive experiments demonstrate the superiority of the proposed scheme in terms of visual quality, robustness, and resistance to steganalysis. In JPEG compression with a quality factor of Q = 80, our method achieves an average improvement in hiding and recovery accuracy (measured by PSNR) of 0.87 dB compared with state-of-the-art architectures, while reducing the number of parameters by 33%.

As societal focus on image authenticity grows, image manipulation localization has become a crucial and challenging task in computer vision. Current methods relying on dual-stream encoders to extract features from both RGB and noise images often suffer from feature misalignment and information loss during fusion. Moreover, many localization methods use loss functions to identify manipulated areas, but balancing weights between manipulated regions and edges remains challenging. To address these challenges, we propose a novel method that integrates features in dual-stream networks with adaptive selective state spaces. By treating the two output features from the dual-stream encoder as system inputs, we construct a feature space that optimizes the system’s state space. Introducing temporal dynamics enriches the feature representation and enhances learning capabilities, significantly improving the accuracy and reliability of image manipulation localization. Additionally, we propose an edge residual review module that refines the boundaries of manipulated regions from the preliminary output, subsequently enhancing the input features for improved re-localization accuracy. Extensive experiments demonstrate that our approach yields competitive results on diverse large-scale image datasets, outperforming most state-of-the-art methods in both precision and robustness.

Reversible data hiding (RDH) in shared images is an effective technique for securely storing and managing confidential images. However, most existing methods suffer from a noticeable data expansion and cannot achieve a good trade-off between data expansion and embedding rate. To address this issue, we propose a novel RDH in shared images (RDHSI) using overlapped coefficients in polynomials. In the proposed method, an original image is compressed losslessly to reduce its size before sharing, and then the compressed image is divided into a series of groups, where any two adjacent groups have an overlapped part. Next, each group is shared by our proposed (k,n)-threshold based sharing technique, which is performed by the polynomial over Galois field GF(28) with overlapped coefficients. Finally, data embedding is performed on each shared image by bit replacement according to a constructed 0-1 matrix. Experimental results demonstrate that the proposed method can effectively reduce the sizes of the shared images and achieve a high embedding capacity.

The development of the internet has greatly facilitated the transmission of images over social networks, while also triggering serious copyright issues. Deep robust watermarking serves as a crucial technique for image copyright protection. However, the image distortions caused by Social Network Transmission Operations (SNTOs) make existing deep robust watermarking methods fragile in real-world social network scenarios. To address this, we propose a Curriculum Learning-based Deep Robust Watermarking method, called CL-DRW, to generate watermarks that can be resilient to SNTOs. Specifically, we develop a watermarking model constructed with an invertible neural network and present a multi-stage training framework based on curriculum learning to train it effectively. We incrementally introduce noise attacks based on their disruptive impact on the watermark, from weak to strong, thereby enabling our model to build robustness against SNTOs gradually. Additionally, we design an SNTOs simulation noise layer, which is built upon a transformer-based deep network and incorporates differentiable JPEG, to simulate the black-box distortions caused by SNTOs. Extensive experiments indicate that our proposed CL-DRW outperforms state-of-the-art deep watermarking methods in terms of robustness against real-world social network transmission operations. Source code is available at https://github.com/yingshuai-zhao/CL-DRW.

The rapid development of deep learning-based image inpainting poses serious challenges to image authenticity. As inpainting methods continue to evolve, the inpainted images exhibit extremely high visual fidelity, presenting recognition difficulties to the forgery detection model due to differences in operational mode and forgery traces among methods. In particular, the detection performance tends to drop significantly in the testing phase when the test samples differ from the training data. To address this issue, we propose a test-time adaptive detection framework for image inpainting forgeries. First, we propose an image gradient-based metric that quantifies model uncertainty and orchestrates the entire adaptation process. Integrating this metric with sample-specific batch normalization (BN) statistics enhances the ability of pretrained models in the inference stage. Second, we introduce a cross-attention module as a side-tuning module, enabling the model to adapt dynamically to reliable test samples without altering the backbone network. To validate the effectiveness of the proposed method, we construct a dataset comprising synthetic images of multiple inpainting methods and design experiments under two scenarios of distributional bias. The results demonstrate that our proposed framework outperforms the existing baseline method, enhancing the adaptability and detection performance of the forgery detection model in dynamic environments.

Recently, many compressed neural network models have been implemented on embedded platforms. However, there is still a lack of steganographic methods that utilizes these compressed models for covert communication. In this paper, we propose a steganographic method during the model compression process, embedding secret data into the model to create a steganographic network, which applies to most model compression methods, such as model quantization, model pruning, and model distillation. The secret data receiver can extract the secret data using a corresponding extraction network, while ordinary users remain unaware of the existence of the secret data, thereby preventing suspicion. The extraction network is utilized concurrently with model compression to embed secret data, minimizing the impact of data embedding. Experimental results validate the effectiveness of the steganographic network in terms of size reduction, inference time reduction, and high accuracy, and the effectiveness in terms of capacity, security, and robustness for steganography. To enhance understanding of our work, we have uploaded a set of application instances embedding abstract content tohttps://github.com/timedeadline/Model_Steganography_during_Model_Compression.

Steganography aims to hide secret data into a cover media by subtle perturbation. Recently, deep neural network (DNN) based steganography has attracted a lot of research interests. Most of the existing DNN-based steganographic schemes design the secret encoder and decoder in an asymmetrical manner, the performance of which is heavily dependent on the content of cover media. In addition, they are weak in preventing unauthorized data extraction from the stego-media (i.e., the media with hidden data). To address these two issues, we propose a novel DNN steganographic framework termed the Cover Independent DNN Steganography (CIDS). In our CIDS, we take advantage of the powerful generative models to obtain AI-generated cover media for both the sender and receiver according to a key. Then, we propose a pair of symmetrical secret encoder and decoder to conduct a bijective transformation between the secrets and perturbations. While the perturbation is combined with the cover media to produce the stego-media. Such a secret encoding/decoding strategy focuses only on the secrets and is independent of the cover media. We also propose to encrypt the perturbations to effectively prevent unauthorized data extraction. Comprehensive experiments demonstrate the advantage of our CIDS over the state-of-the-art approaches for image steganography.

The reversibility of robust reversible watermarking (RRW) strictly depends on the premise that the watermarked image has not been attacked. However, in practical applications, multimedia content often suffers from various attacks, and existing RRW technologies completely lose their reversible recovery capabilities. Therefore, this paper proposes a self-recovery robust watermarking (SRRW) algorithm, which provides a new ability to recover the watermarked and attacked image more closely to the original image while the watermark maintains strong robustness to those common signal processing operations and geometric attacks. First, the watermark information is inserted into low-order Zernike moments of a cover image by using quantization watermarking technique so that the watermark is resistant to those additive noise- like operations ( like JPEG compression and Gaussian noises) and invariant to geometric transforms ( like rotation and scaling). Then, the scaled difference vectors between the cover vectors and its quantized watermarked vectors are luminously and ingeniously computed as the distortion compensation information added back to the quantized watermarked vectors for restoration of the cover image. Finally, at the receiver side, based on the watermark bits extracted from the watermarked image or its distorted versions, those Zernike moments embedded data can be restored by the known scaling factor of the difference vector. Furthermore, a self-recovery image resembling the original image more closely can be reconstructed. Experimental results show that the proposed SRRW scheme can effectively restore those distorted images due to the 128-bit watermark embedding, JPEG compression with the quality factor 60 or JPEG2000 compression with the compression ratio 9, while providing strong robustness performance to various kinds of attacks. Compared with the attacked watermarked images, the restored images show PSNR improvements of 1.66 dB, 3.53 dB, and 1.72 dB under JPEG compression ($Q = 90$), JPEG2000 compression ($R = 3$), and AWGN ($\sigma = 0.0001$), respectively.

Steganography can be mainly classified into two categories: modification-based and generation-based approaches. Modification-based steganography embeds secret messages by altering specific statistical properties of the cover image, offering relatively high capacity and robustness. However, such modifications also make the stego images more susceptible to be detected by steganalysis tools. In contrast, generation-based steganography, which directly generates them via generative models, provides higher security but suffers from limited hiding capacity and poor robustness. To address these limitations, we propose a unified deep network for image steganography (U-StegNet) that integrates the high capacity and robustness of modification-based steganography with the high security of generation-based steganography. Specifically, we design a dual stage hiding strategy. In the first stage, we utilize a generative model to produce an intermediate image that hides part of the secret message while preserving statistical properties consistent with natural images, thereby enhancing resistance to steganalysis. In the second stage, we design a U-Net-based encoder to hide the remaining secret message into the intermediate image, while simultaneously enhancing fine-grained visual details. Moreover, we introduce a message division module that adaptively allocates the message length for each stage based on the image content and capacity constraints, thereby improving both imperceptibility and robustness. Extensive experimental results demonstrate the effectiveness of our U-StegNet. It achieves a PSNR of 44.41 dB and an SSIM of 0.9968 on stego images, which demonstrates the high imperceptibility of our method. Furthermore, it maintains strong robustness across nine types of common attacks, with message extraction accuracy nearly above 98%.

Federated learning (FL) enables multiple clients to collaboratively train machine learning (ML) models without exposing their private data. The recent surge in poisoning attacks and privacy leakage against FL has driven the development of secure federated learning (SFL) solutions. However, existing SFL schemes show inadequate performance when confronted with non-independent and identically distributed ( non-IID) data. In addition, traditional SFL architectures are prone to single point of failure (SPOF) issues due to the heavy computational and communication burdens imposed on a single server. In response to these issues, a novel blockchain-based secure federated learning (BSFL) framework is proposed in this paper. Specifically, we devise a proof of verification (PoV) consensus protocol to identify poisoning attacks under non-IID situations, while preventing the waste of computational and communication resources. Subsequently, we present a personalized differential privacy (PDP) mechanism, which achieves comprehensive privacy protection with lower noise levels. Furthermore, the integration of the blockchain with the proposed reward mechanism overcomes SPOF and fosters constructive participation through transparent processes. Formal theoretical analysis demonstrates the security, privacy, and efficiency of our framework. Extensive experimental evaluations indicate that BSFL exhibits strong resilience against various poisoning attacks and achieves better model accuracy compared to existing SFL solutions.

Diffusion models have made tremendous progress in generating visually realistic images. However, these images are statistically different from the real images, which could be accurately classified by carefully designed detectors. To evade detection, researchers have proposed various adversarial example generation schemes for AI-generated images. Despite the progress, most of these schemes have the tendency to post-process the images and the distortion is inevitable. In this paper, we propose an Adversarial Diffusion Model (ADM), which is able to directly generate high quality and undetectable images from scratch on top of a pre-trained stable diffusion model. In the ADM, an adversarial denoising U-Net is proposed for searching an adversarial latent. This latent is helpful for generating a prompt consistent adversarial example which is able to deceive the detector. Then, we propose a latent compensation module to make the adversarial examples have a similar reconstruction error to that of the real images. We further propose an adversarial decoder to minimize the difference between the high-frequency components of the real and adversarial examples. Comprehensive experiments are carried out to demonstrate the advantages of our ADM in generating adversarial AI-generated images.

With the growing demand for outsourcing data to decentralized storage systems, ensuring the integrity of out-sourced data becomes a critical challenge. Existing auditing schemes, however, often assume single-copy or centralized models, and suffer from inefficiency, lack of public verifiability, or poor scalability in multi-replica settings. To address these limitations, we propose MPA, a lightweight and publicly verifiable auditing scheme tailored for multi-copy cloud storage. By integrating polynomial commitment schemes with Merkle trees, our design achieves efficient block-level integrity verification while enabling dynamic updates. To mitigate collusion between cloud service providers, each data copy is uniquely encrypted, and the audit process supports simultaneous verification across multiple providers. Furthermore, we introduce an optimized batch auditing mechanism that allows the verifier to aggregate proofs across different files and providers, reducing both computation and communication overhead. To enhance audit transparency and unpredictability, we adopt a blockchain-assisted challenge generation protocol based on commit-and-reveal randomness. Theoretical analysis and performance evaluation demonstrate that MPA achieves strong security guarantees under standard assumptions, while significantly outperforming existing solutions in terms of efficiency and scalability.

The widespread deployment of deep learning models across various applications has raised significant concerns regarding data privacy. Membership inference attacks (MIAs), a major privacy threat, aim to determine whether a specific sample is used during model training, thereby posing significant risks to sensitive information. Most existing MIA methods rely on the model’s final state output, overlooking the process by which the model memorizes training samples. To better exploit model memorization for MIAs, we propose a novel attack method called machine unlearning-based membership inference attack (MU-MIA). The proposed method introduces machine unlearning to incrementally reduce the model’s memorization of specific samples, generating a forgetting trajectory for each sample. The forgetting trajectory is composed of temporal variations in different metrics of the sample during machine unlearning. To distinguish member from non-member samples, we design a BiLSTM-based binary classifier with attention, which captures discriminative temporal patterns within each forgetting trajectory. Moreover, the machine unlearning phase of our attack is conducted under a zero-shot setting, which eliminates the need for any real data during the unlearning process, thereby improving the practicality and generalizability of the attack. We evaluate the proposed MIA method across different datasets and model architectures, and the comparative experimental results show that our method outperforms existing baseline attack methods.

Chain-of-Thought (CoT) enhances an LLM’s ability to perform complex reasoning tasks, but it also introduces new security issues. In this work, we present ShadowCoT, a novel backdoor attack framework that targets the internal reasoning mechanism of LLMs. Unlike prior token-level or prompt-based attacks, ShadowCoT directly manipulates the model’s cognitive reasoning path, enabling it to hijack multi-step reasoning chains and produce logically coherent but adversarial outcomes. By conditioning on internal reasoning states, ShadowCoT learns to recognize and selectively disrupt key reasoning steps, effectively mounting a self-reflective cognitive attack within the target model. Our approach introduces a lightweight yet effective multi-stage injection pipeline, which selectively rewires attention pathways and perturbs intermediate representations with minimal parameter overhead (only 0.15% updated). ShadowCoT further leverages reinforcement learning and reasoning chain pollution (RCP) to autonomously synthesize stealthy adversarial CoTs that remain undetectable to advanced defenses. Extensive experiments across diverse reasoning benchmarks and LLMs show that ShadowCoT consistently achieves a state-of-the-art average Attack Success Rate of 91.2% (peaking at 94.4%) and a Hijacking Success Rate of 84.9% while preserving benign performance. These results reveal an emergent class of cognition-level threats and highlight the urgent need for defenses beyond shallowsurface-levelconsistency.

We present 'Burn After Reading' - an innovative data protection mechanism featuring self-destructive capability - and integrate it into the steganography model, thus establishing the Burn After Reading Steganography Model (BARStega), a new architectural paradigm for secret data steganography. The concept of 'Burn After Reading' was first introduced into steganography research, it can be characterized as a self-destructive steganography protocol in which the stego image becomes invalidated after the initial data extraction operation, thus preventing subsequent attempts at secret data extraction. Our BARStega model ensures persistent protection of preexisting secret data, even in scenarios where the receiver's model is stolen by adversary. Through systematic optimization of the Stable Diffusion architecture for steganography requirements, our BARStega model enables both high controllability and high visual quality in stego image generation. Experimental results demonstrate that the proposed BARStega effectively facilitates the functionality of 'Burn After Reading'. Moreover, the model demonstrates competitiveness in both the accuracy of secret data extraction and security.

Unrestricted adversarial attacks that modify the attributes or content of images have demonstrated significant potential. Among unrestricted adversarial attacks, color modification attacks that targeting image color have increasingly obtained attention from researchers. By perturbing the color information of images, color modification attacks can be more imperceptible to human vision compared with traditional adversarial perturbations constrained by$ L_{p}$-norm. Furthermore, the alteration of image attributes significantly disrupts the low-level features extracted by Deep Neural Networks (DNNs), effectively enhancing the transferability. However, current work focus solely on global image attributes, which limit the attack effectiveness. Therefore, this paper proposes Local-Global-Local (LGL), a novel color modification attack framework that incorporates spatial and color information of the image. The color distribution of the image is initialized at first, and then the color filter and spatial masks are used to adjust the global and local color distribution in more detail. Experimental results show that the proposed method achieves superior performance in terms of adversariality and transferability, while also demonstrating robustness against defense methods.

Multi-view clustering has gained increasing attention by utilizing the complementary and consensus information across views. To alleviate the computation cost for the existing multi-view clustering approaches on datasets with large scales, studies based on anchor have been presented. Although extensively adopted in the real scenarios, most of these works ignore to learn an integral subspace revealing the cluster structure with anchors from different views being aligned, where the centroid and cluster assignment matrix can be directly achieved based on the integral subspace. Moreover, these works neglect to perform the alignment among anchors and integral subspace learning in a unified model on the incomplete multi-view dataset. Then the mutual improvements among aligning anchors and learning integral subspace are not guaranteed in optimizing the objective function, which inevitably limit the representation ability of the model and result in the suboptimal clustering performance. In this paper, we propose a novel anchor learning method for incomplete multi-view dataset termed Scalable One-pass incomplete Multi-view clustEring by Aligning anchorS (SOME-AS). Specifically, we capture the complementary information among multiple views by building the anchor graph for each view on the incomplete dataset. The integral subspace reflecting the cluster structure is learned with the alignment among anchors from different views being considered. We build the cluster assignment and centroid representation with orthogonal constraint to approximate the integral subspace. Then the subspace itself and the partition are simultaneously taken into account in this manner. Besides, the mutual improvements among aligning anchors and learning integral subspace are able to be ensured. Experiments on several incomplete multi-view datasets validate the efficiency and effectiveness of SOME-AS.

Embedding links in brand logos is a promising technology, which allows consumers to access the online information of products by capturing physical logo images. Previous physical data hiding methods primarily embed data within cover media in a global manner, making them ineffective for processing brand logos in vector graphics format with a transparent background. To address this issue, we propose in this paper a novel physical deep hiding scheme for invisibly embedding links in printed trademarks. Specifically, the encoder embeds links only into the area of the brand logo under the constraints of a mask, which is generated from the transparency information of the logo image. A background variation distortion is introduced into the distortion layer that approximate practical logo print-camera environments, such that the decoder could be learnt to retrieve the link from the camera-captured logo with various backgrounds. A feature prompt subspace modulator is further proposed and employed in the encoder to enhance the invisibility of the encoded logo pattern and in the decoder to boost hyperlink extraction accuracy. Various experiments have been conducted to demonstrate the advantage of our proposed method for embedding links in printed brand logos, which provides reliable extraction accuracy under both simulated and real scenarios.

The proliferation of digital images on the Internet has provided unprecedented convenience, but also poses significant risks of malicious theft and misuse. Digital watermarking has long been researched as an effective tool for copyright protection. However, it often falls short when addressing partial image theft, a common yet little-researched issue in practical applications. Most existing schemes typically require the entire image as input to extract watermarks. However, in practice, malicious users often steal only a portion of the image to create new content. The stolen portion can have arbitrary shape or content, being fused with a new background and may have undergone geometric transformations, making it challenging for current methods to extract correctly. To address the issues above, we propose WOFA (Watermarking One for All), a robust watermarking scheme against partial image theft. First of all, we define the entire process of partial image theft and construct a dataset accordingly. To gain robustness against partial image theft, we then design a comprehensive distortion layer that incorporates the process of partial image theft and several common distortions in channel. For easier network convergence, we employ a multi-level network structure on the basis of the commonly used embedder-distortion layer-extractor architecture and adopt a progressive training strategy. Abundant experiments demonstrate that our superior performance in the scenario of partial image theft, offering a more reliable solution for protecting digital images against unauthorized use in practical use.

The prevalence of AI-generated images has evoked concerns regarding the potential misuse of image generation technologies. In response, numerous detection methods aim to identify AI-generated images by analyzing generative artifacts. Unfortunately, most detectors quickly become obsolete with the development of generative models. In this paper, we first design a low-level feature extractor that transforms spatial images into feature space, where different source images exhibit distinct distributions. The pretext task for the feature extractor is to distinguish between images that differ only at the pixel level. This image set comprises the original image as well as versions that have been subjected to varying levels of noise and subsequently denoised using a pre-trained diffusion model. We employ the diffusion model as a denoising tool rather than an image generation tool. Then, we frame the AI-generated image detection task as a one-class classification. We estimate the low-level intrinsic feature distribution of real photographic images and identify features that deviate from this distribution as indicators of AI-generated images. We evaluate our method against over 20 different generative models, including those in GenImage and DRCT-2M datasets. Extensive experiments demonstrate its effectiveness on AI-generated images produced not only by diffusion models but also by GANs, flow-based models, and their variants.

Audio watermarking has been widely applied in copyright protection and source tracing. However, due to the inherent characteristics of audio signals, watermark localization and resistance to desynchronization attacks remain significant challenges. In this paper, we propose a learning-based scheme named SyncGuard to address these challenges. Specifically, we design a frame-wise broadcast embedding strategy to embed the watermark in arbitrary-length audio, enhancing time-independence and eliminating the need for localization during watermark extraction. To further enhance robustness, we introduce a meticulously designed distortion layer. Additionally, we employ dilated residual blocks in conjunction with dilated gated blocks to effectively capture multi-resolution time-frequency features. Extensive experimental results show that SyncGuard efficiently handles variable-length audio segments, outperforms state-of-the-art methods in robustness against various attacks, and delivers superior auditory quality.

Digital steganography embeds secret messages into images via invisible modifications, posing challenges for steganalysis, which seeks to detect these alterations by analyzing subtle shifts in image distributions. Previous steganalysis efforts primarily focus on enhancing the steganographic signal while suppressing image semantic content, such as through high-pass filtering. However, these empirically designed methods often lack theoretical underpinnings, exhibiting reduced detection accuracy, particularly at low embedding capacities. To address these limitations, we propose an innovative steganalysis approach that transforms images into pure Gaussian noise representations, actively amplifying the subtle distribution shifts introduced by the steganographic processes in spatial images. This paper pioneers the application of diffusion models to magnify steganographic signals, proposing a new paradigm for further research. Specifically, we iteratively perform forward steps of the probability flow in diffusion models to diminish semantic information. By utilizing the natural spreading properties of the diffusion process, we have theoretically validated the efficacy of each forward step in amplifying differences in noise patterns between cover and stego samples. These magnified differences can be easily captured by a simple classifier—a two-layer MLP. Extensive experiments demonstrate the effectiveness of our method, highlighting detection accuracy gains of 10% to 20% under standard conditions and an average 6.7% increase at low embedding rates compared to existing schemes.

The exorbitant cost of training Large Language Models (LLMs) makes it essential to protect the models from illegal copying and unauthorized usage. Recent attempts at LLM protection utilize black-box watermarking schemes, which embed distinctive input-output mapping (i.e., trigger set) directly into the models. However, most of them construct trigger inputs by injecting abnormal characters into normal text, which can easily be filtered out by unauthorized users, leading to a failure in watermark verification. In this paper, we propose a novel filtering-resistant LLM watermarking scheme, which takes advantage of imperceptible text styles to trigger the watermark. To achieve this, we adopt a trigger generation network to transform normal text into stylized sentences, which are assigned a specific watermarking label to build the trigger set. We then fine-tune the LLMs on both the trigger sets and clean samples for watermark embedding and performance stabilization. To boost watermark accuracy, we further propose a feature separation loss term to distinguish between normal and trigger inputs. Experimental results indicate the effectiveness of our proposed scheme for resisting the filtering attack.

Pancreatic NEuroendocrine Tumors (pNETs) are very rare endocrine neoplasms that account for less than 5% of all pancreatic malignancies, with an incidence of only 1–1.5 cases per 100,000. Early detection of pNETs is critical for improving patient survival, but the rarity of pNETs makes segmenting them from CT a very challenging problem. So far, there has not been a dataset specifically for pNETs available to researchers. To address this issue, we propose a pNETs dataset, a well-annotated Contrast-Enhanced Computed Tomography (CECT) dataset focused exclusively on Pancreatic Neuroendocrine Tumors, containing data from 469 patients. This is the first dataset solely dedicated to pNETs, distinguishing it from previous collections. Additionally, we provide the baseline detection networks with a new slice-wise weight loss function designed for the UNet-based model, improving the overall pNET segmentation performance. We hope that our dataset can enhance the understanding and diagnosis of pNET Tumors within the medical community, facilitate the development of more accurate diagnostic tools, and ultimately improve patient outcomes and advance the field of oncology.

The exorbitant cost of training Neural Radiance Fields (NeRF) makes it essential to protect them from illegal copying and unauthorized usage. Recent attempts at NeRF protection utilize watermarking schemes, which subtly alter NeRFs such that their rendered images contain watermarks that can be extracted by a decoder. In this paper, we investigate the robustness of existing NeRF watermarking schemes against surrogate model attacks, which train a surrogate NeRF using the input-output pairs of a victim NeRF. By proposing a Feature-Modulation Surrogate Model Attack (FM-SMA), we successfully crack most of the existing NeRF watermarking schemes. As a remedy, we further propose Texture-Aware Neural Radiance Fields Watermarking (TA-NFW), which resists FM-SMA attacks by embedding watermarks within the textures of NeRF-rendered results. Various experiments have been conducted to demonstrate the vulnerability of existing NeRF watermarking methods and the robustness of TA-NFW against the proposed FM-SMA attack.

Multi-view clustering aims to improve the final performance by taking advantages of complementary and consistent information of all views. In real world, data samples with partially available information are common and the issue regarding the clustering for incomplete multi-view data is inevitably raised. To deal with the partial data with large scales, some fast clustering approaches for incomplete multi-view data have been presented. Despite the significant success, few of these methods pay attention to learning anchors with high quality in a unified framework for incomplete multi-view clustering, while ensuring the scalability for large-scale incomplete datasets. In addition, most existing approaches based on incomplete multi-view clustering ignore to build the relation between anchor graph and similarity matrix in symmetric nonnegative matrix factorization and then directly conduct graph partition based on the anchor graph to reduce the space and time consumption. In this paper, we propose a novel fast incomplete multi-view clustering method for the data with large scales, termed Fast Incomplete Multi-view clustering by flexible anchor Learning (FIML), where graph construction, anchor learning and graph partition are simultaneously integrated into a unified framework for fast incomplete multi-view clustering. To be specific, we learn a shared anchor graph to guarantee the consistency among multiple views and employ a adaptive weight coefficient to balance the impact for each view. The relation between anchor graph and similarity matrix in symmetric nonnegative matrix factorization can also be built, i.e., each entry in the anchor graph can characterize the similarity between the anchor and original data sample. We then adopt an alternative algorithm for solving the formulated problem. Experiments conducted on different datasets confirm the superiority of FIML compared with other clustering methods for incomplete multi-view data.

Text-to-image (T2I) diffusion models exhibit impressive generation capabilities in recently studies. However, they are vulnerable to backdoor attacks, where model outputs are manipulated by malicious triggers. In this paper, we propose a novel input-level defense method, called Fine-grained Prompt Screening (GrainPS). Our method is motivated by the phenomenon, i.e., Semantics Misalignment, where the backdoor trigger causes the inconsistency between the cross-attention projections of object words (the key words to determine the main content of the generated image) and their true semantics. In particular, we divide each prompt into pieces and conduct fine-grained analysis by examining the impact of the trigger on object words in the cross-attention layers rather than their global influence on the entire generated image. To assess the impact of each word on object words, we formulate "semantics alignment score'' as the metric with a carefully crafted detection strategy to identify the trigger. Therefore, our implementation can detect backdoor input prompts and localize of triggers simultaneously. Evaluations across four advanced backdoor attack scenarios demonstrate the effectiveness of our proposed defense method.

Bitwise Vision AutoRegressive (BVAR) Model, as a distinguished source of young blood, has been taking the lead in the track of text-to-image synthesis, which at the same time raises legal and ethnic concerns such as copyright and authenticity. However, existing methods mainly focus on watermarking within diffusion models, which rely on the distinctive attributes of diffusion steps and cannot be directly transferred to new circumstances. To this end, we propose Safe-BVAR, the first watermark framework to embed bit strings during image generation in BVAR. Our study discovers the local similarity of the inferenced latent feature and the element-wise robustness of image autoencoder. Therefore, combined with the residual-accumulative nature of BVAR, we propose a novel Late Stage Residual Implanter to embed watermark and extract the information based on Local Contextual Extractor. Furthermore, we propose a Distributed Rotational Arranger to enhance watermark against local distortions. Our method is training-free and plug-and-play. Meanwhile, it can be easily applied to flexible-sized images. We evaluate the robustness and invisibility of the watermark, showing that it can resist common image attacks and cast inappreciable influence on the image.

Online face recognition systems usually store face features in the server database for authentication, which are vulnerable to face reconstruction attacks. Various face privacy protection approaches have been proposed to address this issue, where transformation-based schemes are shown to be promising. However, the existing transformation-based schemes are all hand-crafted approaches which are difficult to balance the privacy protection and face recognition. In this paper, we propose to learn a set of discrepant convolutional neural networks (DCNNs) to protect the privacy of face features. We randomly split the original face features into different sub-features. Each of the DCNNs transforms an original sub-feature into a protected one. We adopt appropriate strategies to make the DCNNs as diverse as possible to improve the ability of our protected features to resist different face reconstruction attacks, where a face recognition loss and a privacy protection loss are designed for training. The former ensures that the protected feature can be matched directly using the existing face recognizers, while the latter incorporates a shadow face reconstruction model to interrupt the correlation between the protected features and the face images. Experimental results demonstrate the advantage of our method over existing schemes for face privacy protection. Our protected features can be accurately matched using existing face recognizers, which are capable of resisting both black-box and white-box face reconstruction attacks.

Fake document detection is an important area in image forensics. Most of the existing techniques focus on the detection of digitally forged documents. In this paper, we look into the forgery of generalized physical occlusion, which is a simple and effective strategy to generate fake document images. We propose an Adversary Decomposition Network (ADDNet) to effectively extract generalized physical occlusion features from various types of documents, where two adversarial classifiers are designed and trained for feature decomposition. On top of the ADDNet, we further propose a lightweight Document Adapter (DA) for flexible and scalable fake document detection, which works well when we encounter a new type of document with limited samples for fine-tuning. To facilitate the research, we newly construct a dataset for physical occlusion detection on different types of documents. Various experiments are carried out to demonstrate the advantage of our proposed scheme over the existing schemes for physical occlusion detection, especially when the document is unseen or has limited samples in training.

Abstract There are many cover selection methods currently in use within steganography to ensure that secret data embedded in digital images is hard to detect. This paper proposes an improved steganalytic method to enhance the detection accuracy on steganography in digital images by considering image texture complexity. We propose a measurement of image texture complexity based on gray level co-occurrence matrix-based (GLCM) multi-scale fusion, which is integrated into the classifier’s detection process. Our method refines the traditional classification process by exponentiating the probability of an image being voted “clear” with its calculated complexity value and comparing this value to the probability of it being voted “stego”. Images with higher texture complexity are more likely to be identified as containing secret data. Experimental results show that our method can effectively increase detection accuracy of steganalysis when cover selection is employed in steganography.

In this article, our idea is to propose a general steganographic framework for neural network models, embedding secret data during the network training process to obtain a stego network for covert communication. A novelty of this method is that it can be applied to various types of neural networks, such as neural networks that perform image classification, image segmentation, image generation, and language generation tasks. Additionally, our method enables data embedding in different layers of neural networks, including linear layers, convolutional layers, and transpose convolutional layers. In cover networks, the hidden layer is transformed into a graph structure to facilitate data embedding using graph convolutional networks (GCNs). Another novelty is that the parameters of the GCN can be randomly initialized or directly specified. The connectivity of the graph structure is predetermined collaboratively by the sender and receiver, eliminating the need to transmit the GCN parameters and graph connectivity. Using our framework, embedding and extraction of secret data can be successfully applied to different layers of the stego network. Experimental results demonstrate that the proposed method offers higher security at the same capacity and exhibits sufficient robustness. To enhance understanding of our work, we have uploaded a set of application instances embedding abstract content tohttps://github.com/timedeadline/ApplicationInstance.

Federated Learning (FL) is increasingly adopted in Internet of Things (IoT) ecosystems, where distributed devices collaboratively train machine learning models while preserving data privacy. Well-trained models have high commercial value. If stolen, it will severely harm the interests of the model owner. In FL, a free-rider client can avoid contributing data or computing resources by establishing a deceptive local model and illegally obtaining the valuable global model for free, undermining the central server’s interests. While existing model watermarking methods primarily concentrate on identifying deep learning model misuse, they fail to adequately tackle the issue of identifying free-riders. To address such an issue, this paper presents a box-free watermarking scheme that enables multiple clients who participated in the training to embed private watermarks within the jointly trained federated deep learning model, while the free rider cannot if he did not participate in the training. To avoid conflicts between different clients, each client selects a unique trigger class and embeds watermarks into the global model during the training process. Furthermore, we propose a memory-enhancing local updating strategy to effectively fuse different watermarks into the global model. The proposed method can assist the center in identifying free-rider clients while also safeguarding the FL model’s intellectual property rights. The efficiency of the embedded watermarks is validated by experiments conducted on different models, and the performance of the resilience across various training settings and the robustness against different watermark removal methods are also tested.

We propose a novel data hiding framework based on a multimodal generative model, named Burn After Reading Data Hiding (BarDH). Unlike previous related work in the field of data hiding, our proposed BarDH introduces a novel function: once the receiver extracts the secret data, the secret data cannot be extracted again. We have named this function as ‘Burn After Reading’. The concept of ‘Burn After Reading’ was first introduced into data hiding research. We believe that this mechanism constitutes a highly effective means of safeguarding secret data, such as in scenarios where the receiver's device has been hacked or stolen. Our proposed BarDH model enhances the multimodal generative model, Latent Diffusion Models (LDMs), better aligning it with data hiding tasks and requirements. Experimental results demonstrate that the proposed BarDH framework effectively facilitates the functionality of ‘Burn After Reading’. Simultaneously, the framework demonstrates competitiveness in both the accuracy of secret data extraction and security.

Existing steganalysis methods perform well under ideal conditions but encounter challenges in real-world scenarios with uncertain embedding rates. This paper proposes a novel steganalysis network based on refocusing learning to enhance detection accuracy for blind embedding rate contexts. The proposed network incorporates a detail gradient guided module (DGGM) to capture subtle spatial changes, which are integrated into multiple layers to ensure the model consistently focuses on these critical details. Additionally, a two-stage training strategy is employed. It is initially trained to obtain a pre-trained model, while the second stage optimizes the pre-trained convolutional kernels by refocusing learning. This approach enhances the feature extraction ability by indirectly strengthening connections between different channels. Experimental results demonstrate that the proposed method achieves strong detection performance across various spatial and JPEG domain steganographic algorithms with blind embedding rates, outperforming SRNet, EfficientNet-B4, and DATNet in detection accuracy.

Deep neural networks are increasingly used in image processing tasks. However, deep learning models often show vulnerability when facing adversarial attacks. Active defense is an important method to deal with adversarial attacks in image identification. This letter proposes an active defense strategy for Generative Adversarial Networks (GAN) against adversarial attacks. The proposed method is that when the target network has been trained and remains unchanged, the perturbation generated by the generator is added to the original image and then input to the target network, which has little effect on the performance of the target network and can resist adversarial attacks well. The experimental results of implementing five adversarial attacks on three target network models based on the dataset MNIST and two target network models based on CIFAR10 and comparing them with two defense methods show that our method has achieved good performance in defense effect.

To protect sender's identity of covert communication, this paper proposes a new concept of steganography called untraceable steganography. The receiver can extract secret data from stego media without knowing who was the sender. Specifically, the stego media is produced by a number of individuals (including the sender and other normal individuals). Thus, the receiver cannot know who was the sender, since the media produced by the sender is only a part of stego media and the receiver cannot find the part produced by the sender from stego media. Therefore, the sender is anonymous during the whole process of steganography. That means this kind of steganography is untraceable. In this case, the sender's identity can be protected, and thus the security of steganography can be advanced in a higher level. A specific untraceable steganography scheme is designed in this paper for digital images, which achieves the function of untraceable steganography without decrease the undetectability of stego media.

The artist's style can be quickly imitated by fine-tuning a text-to-image model using artist's artworks, which raises serious copyright concerns. Scholars have proposed many watermarking methods to protect the artists' copyright. To evaluate the security and enhance the performance of existing watermarking, this paper proposes a watermark removal attack for text-to-image generative model watermarking for the first time. This attack aims to invalidate watermarking designed to detect art theft mimicry in text-to-image models. In this method, a watermark recognition network and a watermark removal network are designed. The watermark recognition network identifies whether an artwork contains watermark, and the watermark removal network is used to remove it. Consequently, text-to-image models fine-tuned with watermark-removed artworks can reproduce an artist's style while evading watermark detection. This makes the copyright authentication of artworks ineffective. Experiments show that the proposed attack can effectively remove watermarks, with watermark extraction accuracy dropping below 48.64%. Additionally, the images after watermark removal retain high similarity to the original images, with PSNR exceeding 27.96 and SSIM exceeding 0.92.

This paper proposes an end-to-end two-branch network for a document image perceptual hashing scheme, where the two branches focus on image visual features and text features, respectively. Existing perceptual hashing schemes cannot solve the problem of the tiny proportion of text tampering detection, while simple text detection is unable to solve the problem of background region-aware matching. To address these issues, we extract text information via optical character recognition (OCR) and then generate the text features using the bidirectional encoder representations from Transformers (BERT). Visual features of the image are extracted from the local and global features of the image using ResNet and Vision Transformer cascades, and then fused to generate the final hash sequence through the fully connected layer. The proposed network considers both image visual features and textual information to verify that the document image has not been tampered with. In our network, the OCR module enables accurate and intelligent text detection and recognition, particularly for dealing with text tampering that has only been conducted in tiny portions. It also provides more efficient and robust text recognition services. Experimental results show that the proposed hashing scheme is robust and discriminative in document images.

The image hosting platform is becoming increasingly popular due to its user-friendly features, but it is prone to causing privacy concerns. Only protecting privacy, in fact, can be easy to come true, but usability is frequently sacrificed. Visual privacy protection schemes aim to make a balance between privacy and usability, whereas they are often irreversible. Recently, some reversible visual privacy protection schemes have been proposed by preserving thumbnails (known as TPE). However, they either have excessive states in the Markov chain modeled by the scheme or cannot reverse losslessly. Meanwhile, images encrypted by existing TPE schemes can not embed additional information and thus the usability is limited to visual observation. In view of this, we pertinently propose a reversible and usability-enhanced visual privacy protection scheme (called PR3) based on thumbnail preservation and data hiding. In this scheme, we utilize the sum-preserving data embedding algorithm to substitute the the lowest seven bits of the image without changing the sum. Any data overflow resulting from the above process is stored in the vacated space of the most significant bits. The remaining space serves two purposes: embedding additional information and adjusting the image to approximate the thumbnail. Compared with existing TPE works, PR3 has fewer states in the Markov chain and supports lossless recovery of images. In addition, additional information can be embedded in the encrypted image to enhance usability.

Image manipulation has sparked widespread concern due to its potential security threats on the Internet. The boundary between the authentic and manipulated region exhibits artifacts in image manipulation localization (IML). These artifacts are more pronounced in heterogeneous image splicing and homogeneous image copy-move manipulation, while they are more subtle in removal and inpainting manipulated images. However, existing methods for image manipulation detection tend to capture boundary artifacts via explicit edge features and have limitations in effectively addressing subtle artifacts. Besides, feature redundancy caused by the powerful feature extraction capability of large models may prevent accurate identification of manipulated artifacts, exhibiting a high false-positive rate. To solve these problems, we propose a novel edge-aware network (EAN) to capture boundary artifacts effectively. This network treats the image manipulation localization problem as a segmentation problem inside and outside the boundary. In EAN, we develop an edge-aware mechanism to refine implicit and explicit edge features by the interaction of adjacent features. This approach directs the encoder to prioritize the desired edge information. Also, we design a multi-feature fusion strategy combined with an improved attention mechanism to enhance key feature representation significantly for mitigating the effects of feature redundancy. We perform thorough experiments on diverse datasets, and the outcomes confirm the efficacy of the suggested approach, surpassing leading manipulation localization techniques in the majority of scenarios.

By now, many works have been done on shadow removal for image manipulation. As a result, detecting shadow removal has become a critical part to reveal the traces of image manipulation. However, there are only a few works conducted on shadow removal detection, and these works cannot accurately localize the image regions where the shadows have been removed. In this paper, we present a novel model called Multi-level Feature Fusion Network (MFF-Net) for shadow removal detection. MFF-Net consists of two parts: a dual-branch feature extraction encoder and a dense prediction decoder. The encoder anchors the approximate position of the manipulated regions, while the decoder progressively fills in the details of the estimated shadow masks by integrating multi-level information. In the encoder part, a global modeling branch is constructed to capture long-range dependencies, while a local feature extraction branch is designed to extract local structural information. The features extracted by these two branches are integrated using a feature fusion module. In the decoder part, a multi-scale feature upsampling module is proposed to upsample the input features and integrate them with the low-level features obtained from the encoder part. Meanwhile, the cross attention mechanism is introduced to guide the multi-level feature fusion process. Finally, the features of different resolutions are employed to estimate the shadow masks in a coarse-to-fine manner. Extensive experiments on shadow removal detection demonstrate the superiority of MFF-Net over the state-of-the-art methods. The source code of MFF-Net is publicly available athttps://github.com/HITFuxiwen/MFF-Net.

To address the issues of privacy leakage and copyright infringement in screen-camera scenarios, we propose a robust image watermarking method, which incorporates kolmogorov–arnold network (KAN) blocks and a simulation-enhanced noise pool to resist screen-camera noise attacks. Specifically, we first modify the traditional convolutional blocks for processing high-dimensional features in the U-Net-based encoder to KAN blocks. This operation enhances the ability of encoder to model nonlinear relationships between complex features, while preserving global structure of the original image and minimizing the damage to local details caused by watermark embedding, thereby improving visual quality of the watermarked image. Additionally, to enhance the robustness of the proposed method against complex screen-camera noise attacks, a simulation-enhanced noise pool containing mathematical models and a deep noise simulation network, called NSim-Net, is designed. Especially, in NSim-Net, adversarial training between the simulator based on the improved U-Net and the discriminator based on PatchGAN effectively improves the ability to simulate complex noise. Experimental results demonstrate that, compared to typical screen-camera resilient watermarking methods, the watermarked image generated by the proposed method achieves a maximum peak signal-to-noise ratio (PSNR) improvement of 4.78 dB. Furthermore, based on our simulation-enhanced noise pool, the watermark extraction accuracy of the proposed method exceeds 98% under various screen-camera noise attacks.

Generative artificial intelligence has made great progress in enabling clients to create a variety of realistic visual content (such as images, videos and audios), where diffusion model as an emerging generative model can obtain higher quality images than generative adversarial networks (GANs). For resource-constrained devices, high-definition images can be generated by outsourcing the AI model to the server, but the client’s local prompts and generated images may contain private information, increasing the risk of privacy disclosure. In order to alleviate these concerns, we adopt the idea of split learning and homomorphic encryption technology to ensure the privacy of data and prevent the attacker from stealing. Specifically, adopt homomorphic encryption to ensure the confidentiality of the text embedding and prevent the server from obtaining the prompt and text embedding. Secondly, during the process of denoising, a secure cross-attention mechanism is designed for ciphertext based on the embedding matrix to ensure the normal follow-up steps and prevent denoising model parameters from leaking to clients. In addition, since the decoder is deployed locally, the image generated by the denoising model is latent spatial features rather than pixel spatial features, so the generated image is not visible to the server. Finally, through the theoretical analysis and quantitative index of experiments, it is proved that the image generated under ciphertext prompt is almost the same as the image generated under plaintext prompt, which indicates the security and effectiveness of the proposed protocol.

Semantic communication (SC) is an emerging communication paradigm that transmits only task-related semantic features to receivers, offering advantages in speed. However, existing robust steganography cannot extract message correctly after SC. To address this issues, we propose a novel steganography framework based on Generating Adversarial Networks (GANs) for SC, called “Image Semantic Steganography”. Our framework embeds message into semantic features to guarantee extraction while considering both pixel-level and semantic-level distortions to enhance security. Experimental results show that our framework not only achieves message extraction successfully and behavioral covertness during and after SC, but also does not impact the implementation of SC.

Image steganography, the technique of hiding secret messages within images, has recently advanced with generative image steganography, which hides messages during image creation. However, current generative steganography methods often face criticism for their low extraction accuracy and poor robustness—particularly their vulnerability to JPEG compression. To address these challenges, we propose a novel generative image steganography method based on the text-to-image multimodal generative model (StegaMGM). StegaMGM utilizes the initial random normalization distribution in the generative process of latent diffusion models (LDMs), the secret message is hidden in the generated image through message sampling, ensuring it follows the same probability distribution as typical image generative. The content of the stego image can also be controlled through the prompts. On the receiver side, using the shared prompt and diffusion inversion, can extract secret message with high accuracy. In the experimental section, we conducted detailed experiments to demonstrate the advantages of our proposed StegaMGM framework in extraction accuracy, resistance to JPEG compression, and security.

In recent years, the rapid development of deep learning has brought new opportunities for steganography. However, the current advanced white-box model steganography methods are not suitable for large language models. Since the parameter scale and complexity of large language models are far beyond that of ordinary models, retraining them to hide secret data is extremely challenging. Moreover, the cover parameters or structures of the embedded data are vulnerable to detection by attackers. To enhance practicality, we propose a black-box steganographic scheme for large language models, which embeds secret data into the third-party pre-trained large language models using backdoor techniques without knowing the internal complex structure and parameters of the large language models. Specifically, the sender first encodes the secret data into trigger labels and then uses a certain proportion of trigger samples and clean samples to fine-tune the third-party large language model to embed the secret data without significantly reducing the model performance. The receiver uses trigger samples to extract the secret data by interacting with the large language model, thereby achieving covert communication of the secret data. Experiments demonstrate the effectiveness of the proposed scheme in terms of embedding capacity, robustness, and security.

Graphics Interchange Format (GIF) encoding is the art of reproducing an image with limited colors. Existing GIF encoding schemes often introduce unpleasant visual artifacts such as banding artifact, dotted-pattern noise and color shift, especially when the palette size is small. To address the issues above, we propose VivID, a Visually Improved GIF Encoding Network Design, which is compatible with exiting GIF decoders. VivID consists of three modules and two of them provide the functionality within the GIF encoding pipeline. Firstly, in order to reduce the color shift introduced by color quantization, we design the multi-palette extractor to create a GIF image with minimal distortion by extracting a near-optimal palette. This module can significantly improve the image fidelity and gains adaptability to multiple palette sizes after only one-time training. Furthermore, to reduce banding artifact and the dotted-pattern noise caused by dithering process, we propose banding remover which can randomize quantization error to neighbourhood by utilizing a learnable dithering pattern. Moreover, to further eliminate the banding artifacts, we design the banding scorer module, which is a novel metric for evaluating banding artifact and it correlates well with subjective perception. We adopt it as a customized loss for training dithering module. Extensive experiments across various aspects demonstrate that VivID produces visually pleasing results even when the palette size is extremely small, outperforming both traditional and existing learning based GIF encoding methods.

In recent years, due to the rich parameters contained in deep neural network (DNN) models, researchers have proposed DNN model steganography, using DNN models as carriers. In this paper, we propose a constructive DNN model steganography method based on parameter initialization. Unlike existing DNN model steganography methods that embed secret information into a pre-trained DNN model, we generate parameters containing secret information through parameter initialization for a DNN model structure, and the embedded secret information can still be extracted after model training. Specifically, we first generate the model parameters needed for the DNN model structure through a secret information-driven encoder, and then we jointly train the encoder and decoder to ensure the correct extraction of secret information. Additionally, we introduce a noise layer to simulate the model training process to guarantee the robustness of our method. Experimental results demonstrate that our method not only achieves high hiding capacity but also exhibits satisfactory stealthiness and robustness. Furthermore, our method is generalizable, which can be applied to various network structures, such as multilayer perceptron (MLP), convolutional neural networks (CNNs), recurrent neural networks (RNNs), and Transformers.

The rapid growth of generative models has led to a new direction in steganography called generative steganography (GS). It allows message-to-image generation without the need for a carrier image. Recently, generative steganography methods have been proposed using generative adversarial networks (GANs) and Flow models. On the one hand, methods that use GANs to generate stego images struggle to fully recover the hidden message because the networks are not reversible. On the other hand, methods based on Flow encounter a problem where the images they create might not look real, mainly because the network has limitations in being reversible. Diffusion models fulfill network reversibility while generating high-quality images. However, the framework of existing diffusion models is reversible, but hidden message recovery is not perfectly reversible, resulting in the recovered message being similar but not exactly the same as the hidden one. Existing diffusion models are typically trained for one-directional image generation tasks, so they face some problems when dealing with bi-directional steganography tasks. If pre-trained diffusion models are directly used to generate stego images, exact secret data extraction through the diffusion process cannot be achieved. In this paper, we present an improved generative steganography based on the diffusion model (GSD), which conceals secret data in the frequency domain of random noise to enhance the security and accuracy of steganography, and re-trains the denoising diffusion implicit model (DDIM) for steganography, called the StegoDiffusion. During training StegoDiffusion, random noise is injected into the clean natural images and then trained through the forward diffusion process to obtain the re-trained StegoDiffusion. Our proposed GSD scheme achieves a 100% extraction accuracy for hidden secret data with a payload of 1 bit-per-pixel (bpp) in a single channel, and generates high-quality stego images in PNG format.

In recent years, neural network models have been widely used in many tasks, however, tampering operations from malicious attackers, e.g., backdoor attacks and parameter malicious tampering, can easily degrade the model performance or cause a malfunction. To protect the integrity of neural network model, in this paper, we propose a neural network watermarking scheme with hierarchical recoverability (NNWHR), which not only can identify and locate the tampered parameters, but also can recover the tampered parameters in a hierarchical way. Detailedly, the parameters of to-be-protected network layers are first sorted according to the parameter importances, which are calculated through a specifically designed strategy for parameter evaluation. Then, the reference sharing mechanism is used to generate more number of recovery bits and provide greater perfect recovery probabilities for the parameters with higher importances, which can also deal with larger tampering rates through bit interleaving. Finally, the recovery bits and the authentication bits of model parameters are incorporated as watermark bits and embedded into the model redundant space after scrambling. Experimental results show that our scheme can locate tampered model parameters and recover corresponding model performance with satisfactory accuracy, and can also be applied to eliminate backdoor attacks. In addition, our scheme exhibits satisfactory generalizability, which makes it applicable to various types of neural networks.

Universal low bit-rate speech steganalysis is a cutting-edge research task addressing real-world application needs and has garnered significant attention recently. However, the existing methods are still inadequate in extracting available information from various steganographic domains and fail to deliver interpretable forensic results for specific steganographic domains containing embedded information. In view of this, we present a novel universal low bit-rate speech steganalysis approach that seamlessly combines domain-specific and domain-shared information, enabling comprehensive and effective speech steganography detection. This approach comprises two vital components: the Matching Identification Network (MIN) and the Content Alignment Network (CAN). The MIN incorporates three effective separable backbones for capturing informative domain-specific embeddings, inherently unveiling local and global dependencies. In this network, we also design a cross-domain matching module to establish correlations among steganographic domains, thereby enhancing detection performance through multi-domain collaboration and facilitating effective forensics for the embedded domains. Moreover, the CAN acquires more informative domain-shared embeddings by using a metric learning-based Siamese architecture to process pairs of naive and recompressed speech samples. Experimental results demonstrate that the presented method not only significantly surpasses the existing universal steganalysis methods, but also competes with or even surpasses dedicated steganalysis methods in certain cases. In addition, our method can provide accurate forensic results regarding the existence of hidden information within each steganographic domain without relevant supervisory information, marking a significant milestone in pursuit of speech steganalysis. The source code for this work will be publicly available on GitHub.

Generative steganography (GS) is a novel data-hiding technique that generates stego images directly from secret data without using cover images, which is different from traditional steganography. However, existing steganography methods have shortcomings in terms of hiding capacity, extraction accuracy, and diversity of stego images. To address these limitations, we propose a high-performance Conditional Flow-based Generative Steganography (CFGS). First, to achieve exact extraction of secret data in high-capacity scenarios, we hide secret data in the frequency domain to resist the impact of stego image distortion. In addition, to enhance the diversity of stego images, we introduce a novel conditional generative flow model (C-Flow) to generate stego images, which consists of two newly designed layers, the Conditional Attention-based Affine Coupling layer and the Conditional Invertible Norm layer. C-Flow can accurately guide the visual content of stego images through different conditions, enhancing the diversity of stego images. Our approach is the first GS method capable of conditional guidance of stego image visual content, and achieves extraction accuracy of hidden secret data equal to or close to 100% for payloads up to 1 bit-per-pixel (bpp). Extensive experiments demonstrate that our proposed approach outperforms state-of-the-art GS methods.

Copy detection is crucial for protecting image copyright. This paper proposes a robust image hashing approach via Weighted Saliency Map (WSM) and Laplacian Eigenmaps (LE) (hereafter WSM-LE approach). An important contribution is the WSM construction via the edge map and the saliency map. As the WSM can indicate the interest regions of image, hash calculation based on WSM can provide robustness of our WSM-LE approach. Another contribution is the low-dimensional feature learning by the LE technique. As the LE technique can effectively learn the internal geometric relationships of image, the extracted low-dimensional features can improve discrimination of our WSM-LE approach. In addition, the low-dimensional features are treated as vectors and the vector distances are used to create a compact and encrypted hash. Numerous experiments and comparisons are conducted to confirm the effectiveness and superiority of our WSM-LE approach. The results indicate that our WSM-LE approach has excellent classification and copy detection performances than some baseline approaches.

Data confidentiality, a fundamental security element for dependable cloud storage, has been drawing widespread concern. Public-key encryption with keyword search (PEKS) has emerged as a promising approach for privacy protection while enabling efficient retrieval of encrypted data. One of the typical applications of PEKS is searching sensitive electronic medical records (EMR) in healthcare clouds. However, many traditional countermeasures fall short of balancing privacy protection with search efficiency, and they often fail to support multi-user EMR sharing. To resolve these challenges, we propose a novel lightweight multi-user public-key authenticated encryption scheme with keyword search (LM-PAEKS). Our design effectively counters the inside keyword guessing attack (IKGA) while maintaining the sizes of ciphertext and trapdoor constant in multi-user scenarios. The novelty of our approach relies on introducing a dedicated receiver server that skillfully transforms the complex many-to-many relationship between senders and receivers into a streamlined one-to-one relationship. This transformation prevents the sizes of ciphertext and trapdoor from scaling linearly with the number of participants. Our approach ensures ciphertext indistinguishability and trapdoor privacy while avoiding bilinear pairing operations on the client side. Comparative performance analysis demonstrates that LM-PAEKS features significant computational efficiency while meeting higher security requirements, positioning it as a robust alternative to existing solutions.

Due to the powerful feature extraction capabilities of deep neural networks (DNNs), deep image hashing has extensive applications in the fields such as image authentication, copy detection and content retrieval, making its security a critical concern. Among various security metrics, collision resistance serves as a crucial indicator of deep image hashing methods. Research on collision attacks not only reveals the potential vulnerabilities of deep image hashing but also can promote the development of more robust and secure hashing methods. In this paper, we propose a novel generative collision attack scheme, which achieves several advantages over existing attack schemes based on adversarial examples. Our scheme requires no additional perturbations added to the image, and can simultaneously generate multiple hash collision images of different classes specified by the attacker. To the best of our knowledge, this is the first generative collision attack scheme effective across various deep image hashing methods. Specifically, our attack framework consists of three parts, i.e., a Hash-to-Noise Network (HTNN), a pretrained BigGAN generator and a conditional discriminator. The designed HTNN embeds the hash code of the target image and the attacker-specified generation class information into a “noise” vector. By optimizing various hash distance loss functions between the generated and target images, this “noise” guides the generator to directly generate images that meet the collision requirement. At the same time, the discriminator ensures that the generated images are visually realistic. Extensive experimental results verify that our scheme can effectively generate multiple high-quality images with attacker-specified classes, achieving the high success rate of hash collision attack and the applicability across state-of-the-art deep hashing methods.

Collaborative searchable encryption for group data sharing enables a consortium of authorized users to collectively generate trapdoors and decrypt search results. However, existing countermeasures may be vulnerable to a keyword guessing attack (KGA) initiated by malicious insiders, compromising the confidentiality of keywords. Simultaneously, these solutions often fail to guard against hostile manufacturers embedding backdoors, leading to potential information leakage. To address these challenges, we propose a novel privacy-preserving collaborative searchable encryption (PCSE) scheme tailored for group data sharing. This scheme introduces a dedicated keyword server to export server-derived keywords, thereby withstanding KGA attempts. Based on this, PCSE deploys cryptographic reverse firewalls to thwart subversion attacks. To overcome the single point of failure inherent in a single keyword server, the export of server-derived keywords is collaboratively performed by multiple keyword servers. Furthermore, PCSE extends its capabilities to support efficient multi-keyword searches and result verification and incorporates a rate-limiting mechanism to effectively slow down adversaries' online KGA attempts. Security analysis demonstrates that our scheme can resist KGA and subversion attack. Theoretical analyses and experimental results show that PCSE is significantly more practical for group data sharing systems compared with state-of-the-art works.

Although screen-camera resilient watermarking addresses issues such as privacy leakage and copyright infringement in digital images to some extent during screen-camera communication. However, in screen-camera scenarios, uncontrolled shooting environments, various display devices, and different lens types introduce more complex noise into the watermarked images. Because some noise generated during the screen-camera process cannot be quantitatively analyzed, the integrity of the embedded watermark is compromised, making copyright verification and information acquisition still difficult. To solve this problem, we establish a large-scale screen-camera image dataset (SCISet) and propose a noise simulation network (NoS-Net). Specifically, we obtain 36,000 screen-camera images under various shooting environments with multiple types of screens and cameras. Then, we use SCISet to train the proposed NoS-Net based on the U-Net architecture, which can learn multi-level and complementary feature information of screen-camera images, enhancing its ability to simulate complex noise. Experimental results show that integrating the proposed NoS-Net into mainstream screen-camera resilient watermarking methods significantly improves their ability to resist screen-camera noise attacks. Furthermore, the diversity of SCISet plays an important role in advancing robust watermarking research.

Cloud services have attracted extensive attention due to low cost, agility and mobility. However, when processing data on cloud servers, users may worry about semi-honest third parties stealing private information from them, hence, data encryption is applied for privacy protection. Inpainting is a technique that reconstructs certain undesirable regions in an image through an imperceptible manner, which can be accomplished by searching for well-matching candidate patches and copying them to to-be-inpainted locations. However, when the image is encrypted, the matched candidate patch searching is a challenging dilemma. Therefore, tackling these data-privacy issues for image inpainting over a cloud infrastructure, we propose an image inpainting scheme using Markov random field (MRF) modeling in encrypted domain. In this scheme, the sender encrypts the to-be-inapinted image by using a homomorphic cryptosystem that supports homomorphic ciphertext comparison. Then, the cloud realizes the MRF-based inpainting for encrypted images through some specific homomorphic operations. In addition, secure context descriptors are utilized to improve the inpainting of textures and structures. Finally, the receiver obtains the inpainted result through image decryption. The proposed scheme is proved to be secure through various cryptographic attacks. Qualitative and quantitative results demonstrate our scheme achieves better inpainted results in structure compared with state-of-the-art schemes in encrypted domain.

Multi-image steganography refers to the technique of embedding multiple secret images into a single cover image while ensuring that the secret images remain imperceptible and can be perfectly recovered by the recipient. Traditional single-image-based steganography often leads to noticeable contour shadows or color distortions in the cover image, making the hidden image more detectable. In contrast, cascaded invertible neural network-based steganography introduces a large number of parameters, complicating the network structure and resulting in a time-consuming learning and training process. To address the above problems, this paper proposes a novel flow-based, end-to-end multi-image invertible steganography framework (StegFlow), which effectively integrates forward and backward data flows for image hiding and recovery. The framework employs cascading operations to enable deep hiding of multiple secret images. To enhance the coupling capabilities, we introduce an invertible permutation layer that disrupts the channel arrangement order, allowing the coupling layer to more accurately guide the embedding of secret information into regions of the image that are easy to hide and recover. In addition, a high-frequency distribution mapping (HFDM) is designed to model the lost high-frequency information during image hiding process, significantly improving the recovery performance of the secret images. Extensive experiments are performed over multiple classical datasets, and the results demonstrate that compared to state-of-the-art (SOTA) models, the proposed framework can achieve a superior overall performance in terms of visual quality and anti-steganalysis capability. Specifically, our scheme can improve the hiding accuracy (measured by PSNR) by over 3 dB and the recovery accuracy by over 1 dB when hiding two secret images.

JPEG reversible data hiding (RDH) refers to covert communication technology to accurately extract secret data while also perfectly recovering the original JPEG image. With the development of cloud services, a large number of private JPEG images can be efficiently managed in cloud platforms by embedding user ID or authentication labels. Nevertheless, data embedding operations may inadvertently disrupt the encoding sequence of the original JPEG image, resulting in severe distortion of the host image when it is re-compressed to JPEG format. To address this problem, this paper proposes a new JPEG RDH scheme based on block sorting optimization and dynamic iterative histogram modification. We firstly design a block ordering optimization strategy by combining the number of zero coefficients and the quantization table values of non-zero coefficients in a DCT block. Subsequently, a dynamic iterative histogram modification scheme is proposed by considering the local features and embedding capability of histograms generated from different texture images. According to the given payloads, we introduce different parameters to control the iterations of two-dimensional histogram and then adaptively generate the optimal histogram modification mapping, which can realize low JPEG file size increments by guaranteeing most of the AC coefficients unchanged as much as possible. Numerous experiments have shown that our scheme can achieve an effective balance among embedding capacity, visual quality, file size increment, computational complexity, and outperforms the state-of-the-arts in terms of the above metrics.

Screenshot, which is a common tool in office work, has become a significant threat to organizations like companies and research institutions. Malicious users can easily leak sensitive information like business secrets and research data by taking a screenshot and spreading onto the Internet. While existing watermarking schemes serve as useful tools for leakage tracing, they fall short in the scenario of arbitrary screenshot. Most current methods are file-targeted, focusing on embedding watermark for a single file of one type at a time, making it hard to handle arbitrary content on screen. To address the issues above and better satisfy the need of the scenario, we propose ScreenGuard, a novel watermarking scheme targeted for the screen itself to protect arbitrary screen content shown on it. Unlike previous watermarking schemes, ScreenGuard does not modify the content itself. Instead, we generate a transparent mask template based on the watermark, tile it to the size of the screen to form a complete transparent mask, and overlay this mask onto the screen. This ensures that any screenshots taken will contain our watermark. We then train a locator and a decoder to extract watermarks from suspected leaked screenshots to trace leaks to their source. We summarized five properties that needs to be satisfied in the scenario of arbitrary screenshot (Generalizable, Unseeable, Adaptable, Robust, Dynamic) and evaluate our method on these criteria. Extensive experiments demonstrate that ScreenGuard meets these five properties effectively, showcasing its superiority and broad practical applications.

Trigger-based backdoor watermarking is an extensively utilized and effective method to safeguard the copyright of deep neural networks (DNNs), in which the trigger set could be taken as the key of the watermark. However, during the verification stage, there is a risk that the trigger set could be leaked and exposed to adversaries. If this occurs, the adversaries might apply this leaked trigger set to claim ownership of the model, posing significant copyright issues for the watermarked DNN. To address such an evidence exposure problem, a secure neural network watermarking protocol is put forward in this paper. In the proposed protocol, the trigger set is not fixed, once the trigger is utilized for verification, it is invalid and cannot be used for verification in the future. As a result, even if the trigger set is leaked during the verification process and obtained by the attacker, they cannot use it for copyright verification since it is invalid. To assist the protocol, a trigger set generation method is designed, in which the auxiliary classifier generative adversarial network (ACGAN) and the target classification model are trained together. The special logits distribution and the labels of the generated trigger samples can be ensured and verified effectively in this way. The performance of the trigger generation methods regarding effectiveness, fidelity, and robustness is verified by experiments, and the security analysis of the designed watermarking protocol is conducted.

Designing an end-to-end encryption method for images using the non-linear properties of deep neural networks (DNNs) has gradually attracted the attention of researchers. In this article, we introduce a new framework for DNN-based image encryption that embeds a plaintext image as a secret message into a random noise to obtain a ciphertext image. Based on this, we propose an end-to-end robust image encryption method based on the invertible neural network (INN), which can realize secure encryption and resistance to common image processing attacks. Specifically, the INN is exploited as the shared-parameter encoder and decoder to achieve end-to-end encryption and decryption. The ciphertext image can be obtained through the forward process of the INN by inputting the plaintext image and the key, while the decrypted image can be obtained through the backward process of the INN by inputting the ciphertext image and the key. To enhance the security of our method, we design an information reinforcement module to guarantee the encryption effect and the sensitivity of the key. In addition, to improve the robustness of our method, an attack layer is employed for noise simulation training. Experimental results show that our method not only can realize secure encryption but also can achieve the robustness such as resisting JPEG compression, Gaussian noise, scaling, mean filtering, and Gaussian blurring effectively.

With accelerating development of artificial intelligence, neural network models have been applied in many fields. The structure designing and training for models consume vast manpower and computing resources, which are the core interests of related research institutions and enterprises. However, the high-value attributes of neural network models also attract the attention of pirates, who may steal them for illegal profits and also slightly modify model parameters to escape model piracy detection. In order to solve the problem, in this work, we propose a robust and secure model hashing method based on dynamic branch reorganization and multi-feature fusion. Detailedly, we dynamically adjust the branches in our model hashing network to extract the robust features of all kinds of model parameters for generating the hash sequence. Besides, we integrate the encryption and the feature matrix generation to a unified stage in the hash generation for resisting possible encryption escape attack. Thus, the pirated models, even with some modifications, can be correctly detected through calculating hash distances. Experimental results demonstrate the effectiveness and superiority of our model hashing method with respect to pirated model detection, non-pirated model discrimination and security.

Deep learning has made remarkable achievements in the field of artificial intelligence. However, a well-trained deep neural network is at risk of being tampered with. Although some model watermarking schemes have been proposed to solve this problem, most of them are only oriented to discriminant models, and the integrity authentication schemes for generative models are urgently lacking. Especially, the integrity authentication problem of generative adversarial networks (GANs) that plays an important role in computer vision has not been properly solved. To address this problem, we propose a fragile model watermarking framework for GANs. Specifically, we use a secret key to generate specific information as the label and combine it with the watermark to form a trigger set. Then, we use the trigger set to train the GAN, the training process does not damage the model performance. We can achieve integrity authentication of the GAN using the output of the GAN for the specific label. A large number of experiments show that our proposed method has excellent performance, which can realize the integrity authentication of GANs. What’s more, the proposed method has good generalization and can be easily applied to different GAN architectures.

Federated learning (FL) is widely used in neural network-based deep learning, which allows multiple users to jointly train a model without disclosing their data. However, the data quality of the users is not uniform, and some users with poor computing ability and outdated equipments called irregular ones may collect low-quality data and thus reduce the accuracy of the global model. In addition, the untrusted server may return wrong aggregation results to cheat the users. To solve these problems, we propose a verifiable privacy-preserving FL protocol with irregular users (VPFLI) based on single server. The protocol is privacy-preserving for the untrusted server and it is proved secure based on drop-tolerant homomorphic encryption. For low-quality datasets, their proportion would be decreased in the aggregation results in order to ensure the accuracy of the global model. Also, the aggregation results can be effectively verified by the users based on linear homomorphic hash. Moreover, VPFLI is proposed based on single server, which is more applicable in reality compare with the previous ones based on two non-colluding servers. The experiments show that VPFLI improves the accuracy of the model from 83.5% to 91.5% based on MNIST dataset compared to the traditional FL protocols.

Steganography is the art of hiding secret data into the cover media for covert communication. In recent years, more and more deep neural network (DNN)-based steganographic schemes are proposed to train steganographic networks for secret embedding and recovery, which are shown to be promising. Compared with the handcrafted steganographic tools, steganographic networks tend to be large in size. It raises concerns on how to imperceptibly and effectively transmit these networks to the sender and receiver to facilitate the covert communication. To address this issue, we propose in this paper a Purified and Unified Steganographic Network (PUSNet). It performs an ordinary machine learning task in a purified network, which could be triggered into steganographic networks for secret embedding or recovery using different keys. We formulate the construction of the PUSNet into a sparse weight filling problem to flexibly switch between the purified and steganographic networks. We further instantiate our PUSNet as an image denoising network with two steganographic networks concealed for secret image embedding and recovery. Comprehensive experiments demonstrate that our PUSNet achieves good performance on secret image embedding, secret image recovery, and image denoising in a single architecture. It is also shown to be capable of imperceptibly carrying the steganographic networks in a purified network. Code is available at https://github.com/albblgb/PUSNet

Deep models are being applied in numerous fields and have become a new important digital product. Meanwhile, previous studies have shown that deep models are vulnerable to backdoor attacks, in which compromised models return attacker-desired results when a trigger appears. Backdoor attacks severely break the trustworthiness of deep models. In this paper, we turn this weakness of deep models into a strength, and propose a novel revocable backdoor and deep model trading scenario. Specifically, we aim to compromise deep models without degrading their performance, meanwhile, we can easily detoxify poisoned models without re-training the models. We design specific mask matrices to manage the internal feature maps of the models. These mask matrices can be used to deactivate the backdoors. The revocable backdoor can be adopted in the deep model trading scenario. Sellers train models with revocable backdoors as a trial version. Buyers pay a deposit to sellers and obtain a trial version of the deep model. If buyers are satisfied with the trial version, they pay a final payment to sellers and sellers send mask matrices to buyers to withdraw revocable backdoors. We demonstrate the feasibility and robustness of our revocable backdoor by various datasets and network architectures.

Pioneer researches recognize evidences as crucial elements in fake news detection apart from patterns. Existing evidence-aware methods either require laborious pre-processing procedures to assure relevant and high-quality evidence data, or incorporate the entire spectrum of available evidences in all news cases, regardless of the quality and quantity of the retrieved data. In this paper, we propose an approach named SEE that retrieves useful information from web-searched annotation-free evidences with an early-termination mechanism. The proposed SEE is constructed by three main phases: Searching online materials using the news as a query and directly using their titles as evidences without any annotating or filtering procedure, sequentially Examining the news alongside with each piece of evidence via attention mechanisms to produce new hidden states with retrieved information, and allowing Early-termination within the examining loop by assessing whether there is adequate confidence for producing a correct prediction. We have conducted extensive experiments on datasets with unprocessed evidences, i.e., Weibo21, GossipCop, and pre-processed evidences, namely Snopes and PolitiFact. The experimental results demonstrate that the proposed method outperforms state-of-the-art approaches.

Watermarking text documents has become a cutting-edge research topic due to the increasing demand of protecting text documents from illegal copying, tampering, distribution and selling. When presenting a document on the computer screen, many existing text watermarking methods struggle in embedding large amounts of watermarks into documents invisibly to resist the most common screenshot attack. To deal with this problem, we present a screenshot resistant watermarking method for text documents based on font adaptive modification. In the proposed method, we generate a font variant to represent the watermark with high invisibility by adaptivly shifting the centroid of glyphs. The font variant is deemed watermarked and will be used for creating watermarked text documents. For watermark extraction, we exert a novel projection method with the support of semantic information to precisely segment glyphs in the document screenshot. The watermark is then recovered by analyzing the corresponding centroid shift of glyphs. Unlike the previous font-based watermarking method that alters the font of every glyph, we leave half of the glyphs with original font unchanged and use them to represent bit '0', which greatly improves the invisibility. Moreover, we achieve a high payload with one bit per glyph which outperforms the previous text document watermarking method. Experimental results evaluated on English and Chinese documents show that the proposed method is more robust and introduces less visual distortion than the previous method, which verify the superiority and applicability of our work.

Protecting deep neural networks (DNNs) against intellectual property (IP) infringement has attracted an increasing attention in recent years. Recent advances focus on IP protection of generative models, which embed the watermark information into the image generated by the model to be protected. Although the generated marked image has good visual quality, it introduces noticeable artifacts to the marked image in high-frequency area, which severely impairs the imperceptibility of the watermark and thereby reduces the security of the watermarking system. To deal with this problem, we propose a novel framework for generative model watermarking that can suppress the high-frequency artifacts. The main idea is to design a new watermark embedding network that can suppress high-frequency artifacts by applying anti-aliasing. To realize anti-aliasing, we use low-pass filtering for the internal sampling layers of the new watermark embedding network. Meanwhile, joint loss optimization and adversarial training are applied to enhance the effectiveness and robustness. Experimental results indicate that the marked model not only maintains the performance very well on the original task, but also demonstrates better imperceptibility and robustness on the watermarking task. This work reveals the importance of suppressing high-frequency artifacts for enhancing imperceptibility and security of generative model watermarking.

Multimodal Dialogue agents are often required to respond to conversation history using both textual and visual content. Even though current dialogue studies predominantly strive to generate natural texts or images, they fall short in considering the relevance of multimodal responses within a dialogue context, consequently confining agents from making prudent choices based on multiple alternatives and their associated relevance scores for decision-making. In this paper, we present a bidirectional multimodal dialogue framework that skillfully combines the forward generation of multiple text and image response candidates with reverse selection guided by relevance scores evaluated on dialogue context, facilitating agents in selecting the most suitable multimodal responses. Specifically, the forward generation aspect of our framework leverages a stage-wise approach, first producing textual replies and composite visual descriptions from the dialogue context, followed by the generation of visual responses aligned with the descriptions. In the reverse selection process, visual responses are translated into tangible descriptive texts that, in conjunction with textual responses, are inversely tied back to the dialogue context for relevance assessment, assigning a reference score to each multimodal response candidate to assist the intelligent agent in making informed decisions. Experimental outcomes demonstrate that our proposed bidirectional dialogue response framework markedly elevates performance in both automatic and human evaluations, yielding a range of contextually fitting multimodal responses for selection.

Image steganography is the process of hiding secret data in a cover image by subtle perturbation. Recent studies show that it is feasible to use a fixed neural network for data embedding and extraction. Such Fixed Neural Network Steganography (FNNS) demonstrates favorable performance without the need for training networks, making it more practical for real-world applications. However, the stego-images generated by the existing FNNS methods exhibit high distortion, which is prone to be detected by steganalysis tools. To deal with this issue, we propose a Cover-separable Fixed Neural Network Steganography, namely Cs-FNNS. In Cs-FNNS, we propose a Steganographic Perturbation Search (SPS) algorithm to directly encode the secret data into an imperceptible perturbation, which is combined with an AI-generated cover image for transmission. Through accessing the same deep generative models, the receiver could reproduce the cover image using a pre-agreed key, to separate the perturbation in the stego-image for data decoding. such an encoding/decoding strategy focuses on the secret data and eliminates the disturbance of the cover images, hence achieving a better performance. We apply our Cs-FNNS to the steganographic field that hiding secret images within cover images. Through comprehensive experiments, we demonstrate the superior performance of the proposed method in terms of visual quality and undetectability. Moreover, we show the flexibility of our Cs-FNNS in terms of hiding multiple secret images for different receivers. Code is available at https://github.com/albblgb/Cs-FNNS

Recently, a vast number of image generation models have been proposed, which raises concerns regarding the misuse of these artificial intelligence (AI) techniques for generating fake images. To attribute the AI-generated images, existing schemes usually design and train deep neural networks (DNNs) to learn the model fingerprints, which usually requires a large amount of data for effective learning. In this paper, we aim to answer the following two questions for AI-generated image attribution, 1) is it possible to design useful handcrafted filters to facilitate the fingerprint learning? and 2) how we could reduce the amount of training data after we incorporate the handcrafted filters? We first propose a set of Multi-Directional High-Pass Filters (MHFs) which are capable to extract the subtle fingerprints from various directions. Then, we propose a Directional Enhanced Feature Learning network (DEFL) to take both the MHFs and randomly-initialized filters into consideration. The output of the DEFL is fused with the semantic features to produce a compact fingerprint. To make the compact fingerprint discriminative among different models, we propose a Dual-Margin Contrastive (DMC) loss to tune our DEFL. Finally, we propose a reference based fingerprint classification scheme for image attribution. Experimental results demonstrate that it is indeed helpful to use our MHFs for attributing the AI-generated images. The performance of our proposed method is significantly better than the state-of-the-art for both the closed-set and open-set image attribution, where only a small amount of images are required for training.

Deceptive images can quickly spread via social networking services, posing significant risks. The rapid progress in Image Manipulation Localization (IML) seeks to address this issue. However, the scarcity of public training datasets in the IML task directly hampers the performance of models. To address the challenge, we propose a Prompt-IML framework, which leverages the rich prior knowledge of pre-trained models by employing tunable prompts. Specifically, sets of tunable prompts enable the frozen pre-trained model to extract multi-view features, including spatial and high-frequency features. This approach minimizes redundant architecture for feature extraction across different views, resulting in reduced training costs. In addition, we develop a plug-and-play Feature Alignment and Fusion module that seamlessly integrates into the pre-trained models without additional structural modifications. The proposed module reduces noise and uncertainty in features through interactive processing. The experimental results showcase that our proposed method attains superior performance across 6 test datasets, demonstrating exceptional robustness.

Traditional video steganography methods are based on modifying the covert space for embedding, whereas we propose an innovative approach that embeds secret message within semantic feature for steganography during the video editing process. Although existing traditional video steganography methods excel in balancing security and capacity, they lack adequate robustness against common distortions in online social networks (OSNs). In this paper, we propose an end-to-end robust generative video steganography network (RoGVSN), which achieves visual editing by modifying semantic feature of videos to embed secret message. We exemplify the face-swapping scenario as an illustration to demonstrate the visual editing effects. Specifically, we devise an adaptive scheme to seamlessly embed secret messages into the semantic features of videos through fusion blocks. Extensive experiments demonstrate the superiority of our method in terms of robustness, extraction accuracy, visual quality, and capacity.

Recent advances have emphasized the importance of meme stickers in open-domain dialogue systems.However, previous studies overlook the one-to-many issue that a single sticker could represent various emotions in different dialogue contexts.Additionally, they require retraining the model for new stickers which did not appear in previous training.To address the above issues, we propose in this paper an Emotion-Aware and Efficient Meme Sticker Dialogue generation framework.In the framework, we design an Emotion Adaptive Prompt to capture the emotional cues from the dialogue history, which is sent to an Emotion-Aware Fusion Decoder to guide the generation of text responses and to a meme sticker selector to choose the corresponding sticker.Furthermore, to improve the stickers' selection efficiency, we further incorporate the few-shot learning strategy into the proposed framework to avoid extensive model retraining for unseen meme stickers.Through extensive experiments, we demonstrate the superior performance of the proposed E 2 MSD compared to existing methods regarding the quality of response generation and the efficiency of meme sticker retrieval.

Text-to-image models have shown surprising performance in high-quality image generation, while also raising intensified concerns about the unauthorized usage of personal dataset in training and personalized fine-tuning. Recent approaches, embedding watermarks, introducing perturbations, and inserting backdoors into datasets, rely on adding minor information vulnerable to adversarial training, limiting their ability to detect unauthorized data usage. In this paper, we introduce a novel implicit Zero-Watermarking scheme that first utilizes the disentangled style domain to detect unauthorized dataset usage in text-to-image models. Specifically, our approach generates the watermark from the disentangled style domain, enabling self-generalization and mutual exclusivity within the style domain anchored by protected units. The domain achieves the maximum concealed offset of probability distribution through both the injection of identifier $z$ and dynamic contrastive learning, facilitating the structured delineation of dataset copyright boundaries for multiple sources of styles and contents. Additionally, we introduce the concept of watermark distribution to establish a verification mechanism for copyright ownership of hybrid or partial infringements, addressing deficiencies in the traditional mechanism of dataset copyright ownership for AI mimicry. Notably, our method achieves one-sample verification for copyright ownership in AI mimic generations. The code is available at: [https://github.com/Hlufies/ZWatermarking](https://github.com/Hlufies/ZWatermarking)

Abstract Deep neural networks are vulnerable to backdoor attacks. Previous backdoor attacks have mainly focused on images. Unlike images composed of regular pixels, 3D point clouds are composed of irregular three-dimensional XYZ coordinates, which are widely used in areas such as autonomous driving and 3D measurement. As many deep neural networks have been developed for processing 3D point clouds, these networks also face the risk of backdoor attacks. Nevertheless, backdoor attacks on 3D point clouds have rarely been investigated. This paper proposes a stealthy backdoor attack on point clouds in the physical world, aiming to generate trainable non-rigid deformations as backdoor patterns. Instead of directly adding backdoor patterns onto the point clouds, we deform the 3D space of the point clouds to a new space, ensuring that all point clouds have the same backdoor deformation. We use point cloud alignment to overcome the inconsistency of backdoor deformation caused by shifting and scaling in the physical world. We also propose a physical transformation layer to combat the physical transformations. Additionally, we propose mask contrast learning to eliminate pseudo backdoor patterns to make the network’s backdoor property stealthier. Extensive experiments indicate that the proposed method can achieve better attack success rates and stealthiness.

Abstract Deep neural network model extraction attack is the process of retraining a surrogate model based on the outputs of a target model with a given set of inputs. Such attacks are hard to defend for the sake of model owners’ interest. Recently, some work propose model watermarking scheme for image processing networks, which is able to prove the intellectual property of deep models even after the model extraction attack. This scheme makes sure that, once the target model (an image processing network) is watermarked, we can extract the watermark from the output of the surrogate model. In this paper, we propose a new model extraction attack scheme to fight against the latest method. Instead of directly using the output images of a target model, we propose to use their reconstructed versions for model retraining, where an asymmetrical UNet is proposed for image reconstruction. To thoroughly remove the watermarking traces, we propose and incorporate a referenced subspace attention module in the asymmetrical UNet, which removes the watermark by projecting the outputs of the target model into the subspaces of the reference image. Various experiments demonstrate the effectiveness of our attack.

Abstract Recent studies show that neural networks are vulnerable to backdoor attacks, in which compromised networks behave normally for clean inputs but make mistakes when a pre-defined trigger appears. Although prior studies have designed various invisible triggers to avoid causing visual anomalies, they cannot evade some trigger detectors. In this paper, we consider the stealthiness of backdoor attacks from input space and feature representation space. We propose a novel backdoor attack named sparse backdoor attack, and investigate the minimum required trigger to induce the well-trained networks to make incorrect results. A U-net-based generator is employed to create triggers for each clean image. Considering the stealthiness of the trigger, we restrict the elements of the trigger between −1 and 1. In the aspect of the feature representation domain, we adopt an entanglement cost function to minimize the gap between feature representations of benign and malicious inputs. The inseparability of benign and malicious feature representations contributes to the stealthiness of our attack against various model diagnosis-based defences. We validate the effectiveness and generalization of our method by conducting extensive experiments on multiple datasets and networks.

Remote heart rate (HR) estimation via facial videos has emerged as an attractive application for healthcare monitoring. Long short-term memory (LSTM) is a kind of deep recurrent neural network architecture used for modeling sequential information, which can be utilized for remote HR estimation. Outsourcing computation is an emerging paradigm for enterprises or individuals with a huge volume of private data but limited computing power for data modeling and analysis, but the risks of privacy leakage cannot be ignored. Prior privacy-preserving LSTM-based protocols only protect sensitive data or model parameters, or approximate nonlinear functions with somewhat utility degradation. To mitigate the aforementioned issues, we propose a verifiable outsourcing protocol of LSTM training for HR estimation (VOLHR) based on batch homomorphic encryption, which not only ensures the confidentiality of the local data and model parameters but also guarantees the verifiability of the model predictions to resist the deceptive attacks. Theoretical analysis proves that VOLHR provides a higher level of privacy protection than the prior works. Computational cost analysis demonstrates that VOLHR can reduce the computational overhead greatly compared with the original LSTM models with different structures. To exhibit the practical utility, we implement VOLHR on two real-world data sets for HR estimation. Extensive evaluations demonstrate that VOLHR achieves almost the same performance as the original LSTM model and outperforms prior related protocols.

As generative models find broader applications in Internet of Things (IoT) image processing tasks, safeguarding the copyright of these models assumes increasing significance. Embedding watermarks on the output images generated by such models has been proposed by some researchers as a means of protecting intellectual property. However, prevailing methods for generating model watermarks inadvertently introduce significant high-frequency artifacts in high-frequency regions, compromising the imperceptibility and security of the watermarking system. In pursuit of enhancing the imperceptibility of generative model watermarking, we propose a framework based on discrete wavelet transform. This framework effectively mitigates the high-frequency artifact issue and enhances the frequency-domain concealment of watermarking. Specifically, we introduce an embedded watermarking network, a frequency separation layer, and a watermark extraction network after the output of the target model. We construct a wavelet frequency domain separation layer by wavelet decomposition to decompose the image generated by the embedding network into different frequency components, and embed the watermark into the low-frequency region of the target model output image through joint training and joint loss optimization of the embedding and extraction networks. Extensive experiments conducted on two image processing tasks, i.e., painting transfer and de-raining, demonstrate that our method exhibits no discernible traces of high-frequency artifacts in the frequency domain of the image in both cases, thus boasting superior invisibility. Furthermore, our method demonstrates robustness against pre-processing attacks, such as noise addition, resizing, and image cropping.

The Vehicular Social Networks (VSNs) provide passengers, drivers and vehicles with multiple services, such as safe driving, data sharing and traffic management. However, transmitting data in VSNs can expose information such as the user’s identity and location. Malicious users who tamper with shared data can even cause serious traffic accidents. Considering the privacy protection and secure transmission of shared data in VSNs, we propose a blockchain-based and fog computing-assisted data access control scheme (BFDAC). We combine the multi-authority CP-ABE algorithm with the consortium blockchain to avoid the security and trust issues in the form of centralized key management, and outsource part of the decryption calculations to roadside units (RSUs) as fog nodes to realize lightweight calculation for users. Our BFDAC scheme also supports user tracking and revocation, while users can also revoke shared data saved in the cloud. Security analysis shows that the BFDAC scheme can effectively protect the shared data. Experiments show that our BFDAC scheme reduces 32.8% in storage cost, 9.5% in encryption cost, and 57.1% in outsourced decryption cost compared to previous ones.

In the scenario of text data and image data interact of the Internet of Things (IoT) applications, the problem of copyright protection of the text-to-image models is threatened due to the replicability and portability of the neural network model. In order to solve this problem, we propose a model watermarking for the typical text-to-image diffusion models (DMs)–stable DMs (SDMs), which is a key aspect of the copyright protection of text-to-image models. Our scheme injects watermark into an SDM and makes the SDM generate watermark through a predefined prompt. The ownership of the SDM can be proved by the different output results of the model to the predefined prompt. The proposed method does not require raw training data and internal details of SDMs, which only need a predefined prompt and watermark to fine tune the pretrained SDM with minimal epoch. A large number of experiments show that our watermarking technology is effective, and can realize the copyright protection of the SDMs on the premise of less influence on the original function.

The susceptibility of graph neural networks (GNNs) to backdoor attacks poses a significant potential threat to GNN-based Internet of Things (IoT) systems. In such attacks, GNNs are manipulated to behave abnormally when presented with maliciously crafted samples known as trigger samples, which can be exploited by attackers for their malicious intent. To address this issue, this article studies the vulnerability of GNNs from the attacker’s angle by proposing a novel backdoor attack on GNNs. Our technical motivation is that most existing backdoor attacks only treat GNNs as black box and define trigger samples in the spatial domain, which lack deeper insights and further exploitation of GNNs, limiting the attacking effectiveness. Inspired by frequency-based backdoor attacks in vision domain and spectral graph theory, we propose an effective graph backdoor attack based on the spectral domain of graph data, which injects trigger signals into the frequency spectrum of normal attributed graphs. By injecting subtle trigger signal into the important frequency band of important node features, the learning of backdoor and clean data are entangled. As a result, it becomes hard for the defender to remove the backdoor without degrading the model’s normal performance, improving the robustness of the attack. Experiments on both homophilic graphs and heterophilic graphs, with commonly used GNN architectures show that our proposed method achieves high-attack success rate without significantly degrading the normal performance of the victim GNN. The attack is also shown to be robust against various processing toward graph data due to the entanglement strategy.

How to protect the intellectual property (IP) of neural network models has become a hot topic in current research. Model hashing as an important model protection scheme, which achieves model IP protection by extracting model feature-based, compact hash codes and calculating the hash distance between original and suspicious models. To realize model IP protection across platforms and environments, we propose a robust hashing scheme for neural network models via heterogeneous graph representation, which can effectively detect the illegal copy of neural network models and doesn't degrade the model performance. Specifically, we first convert the neural network model into a heterogeneous graph and analyze its node attribute data. Then, a graph embedding learning method is used to extract the feature vectors of the model based on different attribute data of graph nodes. Finally, the hash code that can be used for model copy detection is generated based on the designed hash networks with quantization and triplet losses. Experimental results show that our scheme not only exhibits satisfactory robustness to different types of robustness graph attacks but also achieves satisfactory performances of discrimination and generalizability.

Due to enormous computing and storage overhead for well-trained Deep Neural Network (DNN) models, protecting the intellectual property of model owners is a pressing need. As the commercialization of deep models is becoming increasingly popular, the pre-trained models delivered to users may suffer from being illegally copied, redistributed, or abused. In this paper, we propose DeepDIST, the first end-to-end secure DNNs distribution framework in a black-box scenario. Specifically, our framework adopts a dual-level fingerprint (FP) mechanism to provide reliable ownership verification, and proposes two equivalent transformations that can resist collusion attacks, plus a newly designed similarity loss term to improve the security of the transformations. Unlike the existing passive defense schemes that detect colluding participants, we introduce an active defense strategy, namely damaging the performance of the model after the malicious collusion. The extensive experimental results show that DeepDIST can maintain the accuracy of the host DNN after embedding fingerprint conducted for true traitor tracing, and is robust against several popular model modifications. Furthermore, the anti-collusion effect is evaluated on two typical classification tasks (10-class and 100-class), and the proposed DeepDIST can drop the prediction accuracy of the collusion model to 10% and 1% (random guess), respectively.

With the development of social network, a large number of private JPEG images are stored in social cloud platform. Correspondingly, the platform embeds user ID or authentication labels to manage these privacy images, preventing them from being arbitrarily accessed or tampered by illegal persons. However, data embedding in JPEG domain inevitably produces irreversible modifications to DCT coefficients, thus resulting in obvious or even serious distortion in the host JPEG images. To address this problem, this paper proposes an efficient JPEG reversible data hiding (RDH) method by constructing progressive two-dimensional histogram mappings. We firstly design distortion function to calculate the cost of each DCT frequency band, and then sort them to build histogram mapping containing a series of coefficient pairs. Subsequently, a progressive mapping mechanism is introduced to maintain most of AC coefficients unchanged. According to the given capacity, this mechanism can adaptively generate an optimum two-dimensional histogram mapping to embed secret messages. Our scheme can achieve an effective balance among embedding capacity, visual quality of the marked image and file size expansion, while keeping high cost-performance complexity. Extensive experiments demonstrate that our method outperforms existing JPEG RDH schemes in terms of visual quality and file size increment of the marked image, and provides an efficient solution for the confidentiality and security access problem of sensitive private image in cloud environment.

Recent research has shown that architectures utilizing reinforcement learning (RL) are effective in cost-based image steganography. However, these architectures only learn embedding probabilities rather than costs, and are trained for a specific embedding payload, making it difficult to extend the trained model to serve other payloads. In this paper, we propose a payload-independent cost learning framework using RL called PICO-RL. This framework directly learns universal costs that can be applied to any payload. PICO-RL incorporates an optimal probability approximation (OPA) module that can calculate the required probability map for embedding simulation directly from a learned cost map for any payload, eliminating the need for time-consuming searches for a valid probability scaling parameter. Additionally, PICO-RL uses an advanced steganalysis environment network to provide more effective reward feedback for learning. During RL training, the learned cost maps of different payloads converge and eventually become similar under the OPA constraint, resulting in payload independence. Experimental results demonstrate that a well-trained PICO-RL model, which acts as a universal cost function, defines costs with superior security performance against steganalysis and has better coding compatibility when encoding with practical steganographic codes.

Recently, it has been shown that adversaries can reconstruct images from SIFT features through reverse attacks. However, the images reconstructed by existing reverse attack methods suffer from information loss and are unable to sufficiently reveal the private contents of the original images. In this paper, a two-stage deep reverse attack model called Coarse-to-Fine Generative Adversarial Network (CFGAN) is proposed to more deeply explore the information in SIFT features and further demonstrate the risk of privacy leakage associated with SIFT features. Specifically, the proposed model consists of two sub-networks, namely coarse net and fine net. The coarse net is developed to restore coarse images using SIFT features, while the fine net is responsible for refining the coarse images to obtain better reconstruction results. To effectively leverage the information contained in SIFT features, an efficient fusion strategy based on the AdaIN operation is designed in the fine net. Additionally, we introduce a new loss function called sift loss that enhances the color fidelity of reconstructed images. Extensive experiments conducted on various datasets verify that the proposed CFGAN performs favorably against state-of-the-art methods. The reconstructed images exhibit better visual quality, less texture distortion, and higher color fidelity. Source code is available at https://github.com/HITLiXincodes/CFGAN.

As a secondary generation method, video recording will cause irreversible damage to the watermark within the video, which has always been challenging in video forensics. Although many video watermarking methods are reported in the literature, these methods, however, still cannot well resist camera recording. This has motivated the authors in this paper to introduce a new video watermarking method to resist camera recording. For the proposed method, two watermarks, i.e., copyright watermark and synchronization watermark, are embedded into the well-selected frequency domain coefficients. The synchronization watermark is used to ensure that the copyright watermark can be successfully extracted at the decoder side. To extract the copyright watermark without manual assistance, a neural network based segmentation model is applied to identify the watermarked video-playing region in the camera-recorded video. Meanwhile, automatic perspective correction is performed on the watermarked video-playing region so that the watermark information can be extracted accurately. The experiments show that the watermark data can be embedded into the raw video successfully and extracted from the camera-recorded video accurately by applying the proposed method. And, the proposed method significantly outperforms related works in terms of robustness in different scenarios, which has verified the superiority and applicability of the proposed method.

A robust reversible watermarking (RRW) algorithm enables the extraction of the watermark and the restoration of the cover image without attacks while ensuring the watermark’s extraction when the image is under attack. Existing RRW methods mainly focused on achieving robustness against geometric attacks such as rotation and scaling by embedding watermarks within the global inscribed circle of an image. However, the geometric transformations targeted by the existing methods cannot cope with combined attacks that include cropping, which is a real application scenario for geometric attacks. To extend the robustness of the watermarking algorithm, this paper proposes a local Zernike moments (ZMs) embedding strategy based on feature point extraction and selection. For each local circular domain, the same watermark is embedded in the magnitude of the ZMs. After embedding, all the compensation information used to recover the robust embedded regions is embedded outside these local circular domains in a reversible way. When attacks occur, especially combined attacks involving cropping, by using side information, the local watermarked regions in the image can be localized to extract the robust watermark. Experimental results show the superiority of the proposed method under various combined attacks that include cropping operations.

Video watermarking based on frequency domain is proved to have good invisibility and robustness. However, most of the existing video watermarking schemes embed watermarks in the frequency domain based on subblock segmentation, while ignoring the variation relationship between video space and frequency domain features. Therefore, it is difficult to achieve robust authentication in complex application scenarios. In this paper, a ring subband is constructed in DT-CWT domain as the watermark embedding region by analyzing the relationship between video space and frequency domain characteristics under multiple attacks. Subsequently, the double watermark is embedded by modifying the DCT coefficient of the ring subband, with the copyright watermark alternately and repeatedly embedded within the ring subband, and the synchronous watermark is embedded in the outermost concentric circle. In addition, visual encryption (VC) and piecewise linear chaotic mapping (PLCM) methods are used to encrypt the watermark before it is embedded in the concentric rings, and two shared images are generated, one for the watermark embedding stage and the other for the watermark extraction stage. Experimental results demonstrate that the proposed scheme can resist common attacks, such as noise, JPEG compression, rotation, scaling, time synchronization attacks, and its robustness surpasses existing discrete wavelet transform (DWT) and DT-CWT based video watermarking schemes under complex attack scenarios.

Batch steganography regarding to image-selection and payload-allocation has gained increasing attention due to the secure demanding of data hiding of real scenario. However, due to the predefined selection mechanism, the chosen images are always complex which means that the diversity of the selected cover set is finite. In this paper, we develop a diverse and secure batch steganography scheme including the model-based generation and double-layered payload assignment. To construct the diverse image set, we use the Kullback-Leibler (KL) divergence to quantify the diversity increment and, relying on steganographic distortion, we select multiple image subsets (class) to create the diverse cover set in which each subset is modelled as the normal distribution with proper model parameters. Depending on the distortion of image subset, we assign the payload into all subsets with between-class allocation. Moreover, for the assigned payload of each subset, we introduce the linear model to achieve the within-class allocation. Finally, we obtain a diverse cover set along with suitable payload. Extensive experiments demonstrate the practicality of the proposed method in diversity and, compared with other selection methods, exhibit higher security on multiple steganalytic tools.

Existing effective cover selection methods aim to select the complex images as covers to achieve the highly security with the aid of the embedding distortion computed from a natural image. However, the calculation of the embedding distortion divulges the image content to a steganographer. To overcome this issue, this work proposes a novel cover selection scheme in encrypted images to achieve the image content-protection and cover-selection simultaneously. In the first phase, the content owner encrypts several most significant bits (MSBs) of each image using an encryption key and the encrypted image is shuffled by block. Meanwhile, with a sampling key, the content owner selects some encrypted blocks and outputs them to the steganographer. In the second phase, the steganographer calculates first-order noise residuals of adjacent pixels of the acquired blocks along different directions. Importantly, we design a texture descriptor named as structured Local binary pattern (SLBP) to encode all the residuals by which the images owing the maximal SLBP values are chosen as the optimal covers. We demonstrate the security of our proposed scheme on multiple steganographic and steganalytic methods and the extensive results show that our scheme exhibits excellent performance without knowing of the original image content. Moreover, the results testify that the designed SLBP achieves the perfect evaluation of image complexity.

Resisting the operations in lossy channels is a challenge for image steganography. In this article, we propose a novel robust steganographic method to resist the image downsampling operation. Unlike the existing schemes, our method guarantees lossless secret recovery from the stego-image after general image downsampling operations, which considers the undetectability of the stego-images on both sides (sender and receiver) of the lossy channel. We first downsample the cover image to get its downsampled version on the receiver side, and select a set of embeddable pixels (i.e., the pixels that can be modified for data embedding) from the downsampled image. Then, we generate a stego-image on the receiver side (termed as the receiver stego-image) such that the distortion caused by the data embedding is minimized. Based on the receiver stego-image, we modify the cover image to produce the stego-image on the sender side (termed as the sender stego-image). The modification takes the embedding cost into account and makes sure that the downsampled version of the sender stego-image produces the same embeddable pixels as the receiver stego-image. Experimental results show that our method performs significantly better than the existing schemes in terms of robustness and undetectability for resisting general image downsampling operations.

This paper tackles a recent challenge in designing an efficient steganographic distortion model, whose goal is to accurately measure the modification cost of a pixel and help design steganographic schemes with high undetectability. Existing distortion models mostly assume that different modification directions of a pixel have an identical cost value and that pixel modifications are independent. These assumptions, however, may not lead to good steganography design because the modification direction of neighbouring pixels may affect the cost measurement of the current pixel. To address this problem, we propose a new distortion calculation method using dynamic cost correction and multi-modality distortion ensemble. The proposed scheme first employs a given distortion model to generate the original cost map. The cost of each pixel is then dynamically adjusted with majority voting according to the modification directions of its neighbouring pixels. Furthermore, different distortion calculation models are integrated to make the final decision on the distortion of each pixel. Experimental results show that compared to existing additive distortion-based steganographic schemes and deep learning-based steganographic schemes, steganography using our proposed distortion model performs better when tested against state-of-the-art steganalysis methods.

Robust hashing is a useful technique for the image applications of watermarking, authentication, quality assessment and copy detection. This paper proposes a new robust hashing for image copy detection by using local tangent space alignment (LTSA). A key contribution is the weighted visual map computation based on the difference of Gaussian (DOG) and visual attention model. The weighted visual map can provide the proposed method with good robustness. Another contribution is the feature learning via LTSA from the feature matrix of the weighted visual map in discrete cosine transform domain. As it can maintain the local geometric relationships within image, the learned features can make the proposed method discriminative. Extensive experiments on public databases are conducted to validate the proposed robust hashing method. Compared with some famous robust hashing methods, the proposed robust hashing method demonstrates preferable classification performance in terms of discrimination and robustness. Copy detection performance is tested and the result verifies effectiveness of the proposed robust hashing method.

Recently, more and more attention has been focused on the intellectual property protection of deep neural networks (DNNs), promoting DNN watermarking to become a hot research topic. Compared with embedding watermarks directly into DNN parameters, inserting trigger-set watermarks enables us to verify the ownership without knowing the internal details of the DNN, which is more suitable for application scenarios. The cost is we have to carefully craft the trigger samples. Mainstream methods construct the trigger samples by inserting a noticeable pattern to the clean samples in the spatial domain, which does not consider sample imperceptibility, sample robustness and model robustness, and therefore has limited the watermarking performance and the model generalization. It has motivated the authors in this paper to propose a novel DNN watermarking method based on Fourier perturbation analysis and frequency sensitivity clustering. First, we analyze the perturbation impact of different frequency components of the input sample on the task functionality of the DNN by applying random perturbation. Then, by K-means clustering, we determine the frequency components that result in superior watermarking performance for crafting the trigger samples. Our experiments show that the proposed work not only maintains the performance of the DNN on its original task, but also provides better watermarking performance compared with related works.

Linguistic steganography (LS) aims to embed secret information into a highly encoded text for covert communication. It can be roughly divided to two main categories, i.e., modification based LS (MLS) and generation based LS (GLS). MLS embeds secret data by slightly modifying a given text without impairing the meaning of the text, whereas GLS uses a well trained language model to directly generate a text carrying secret data. A common disadvantage for MLS methods is that the embedding payload is very small, whose return is well preserving the semantic quality of the text. In contrast, GLS enables the data hider to embed a large payload, which has to pay the high price of uncontrollable semantics. In this article, we propose a novel LS method to modify a given text by pivoting it between two different languages and embed secret data using a semantic-aware information encoding strategy. Our purpose is to alter the expression of the given text, enabling a large payload to be embedded while keeping the semantic information unchanged. Experiments have shown that the proposed work not only achieves a large embedding payload, but also shows superior performance in maintaining the semantic consistency and resisting linguistic steganalysis.

Generative steganography, a novel paradigm in information hiding, has garnered considerable attention for its potential to withstand steganalysis. However, existing generative steganography approaches suffer from the limited visual quality of generated images and are challenging to apply to lossy transmissions in real-world scenarios with unknown channel attacks. To address these issues, this paper proposes a novel robust generative image steganography scheme, facilitating zero-shot text-driven stego image generation without the need for additional training or fine-tuning. Specifically, we employ the popular Stable Diffusion model as the backbone generative network to establish a covert transmission channel. Our proposed framework overcomes the challenges of numerical instability and perturbation sensitivity inherent in diffusion models. Adhering to Kerckhoff’s principle, we propose a novel mapping module based on dual keys to enhance robustness and security under lossy transmission conditions. Experimental results showcase the superior performance of our method in terms of extraction accuracy, robustness, security, and image quality.

This paper introduces a novel, lightweight deep invertible steganography network (LiDiNet) for image-in-image steganography. Traditional methods, while hiding a secret image within a cover image, often suffer from contour shadows or color distortion, making the secret image easily detectable. Additionally, the superposition of multiple invertible networks may complicate network structures and introduce excessive parameters, making the network training and learning processes difficult. LiDiNet addresses these issues by employing multiple invertible neural networks (INNs) to create a pair of coupled invertible processes for image hiding and recovery. A key innovation is the invertible convolutional layer, which streamlines the affine coupling structure in each INN for improved information fusion. In addition, a series of adaptive coordination spatial-wise attention modules are integrated to enhance the network’s effectiveness in image hiding and recovery, thereby elevating the security of the steganography. LiDiNet’s lightweight structure ensures both high-capacity steganography and robustness against steganalysis. Extensive experiments across various image datasets demonstrate LiDiNet’s superior performance, particularly in visual quality and anti-steganalysis capability, compared to existing methods.

Multi-view clustering usually attempts to improve the final performance by integrating graph structure information from different views and methods based on anchor are presented to reduce the computation cost for datasets with large scales. Despite significant progress, these methods pay few attentions to ensuring that the cluster structure correspondence between anchor graph and partition is built on multi-view datasets. Besides, they ignore to discover the anchor graph depicting the shared cluster assignment across views under the orthogonal constraint on actual bases in factorization. In this paper, we propose a novel Dual consensus Anchor Learning for Fast multi-view clustering (DALF) method, where the cluster structure correspondence between anchor graph and partition is guaranteed on multi-view datasets with large scales. It jointly learns anchors, constructs anchor graph and performs partition under a unified framework with the rank constraint imposed on the built Laplacian graph and the orthogonal constraint on the centroid representation. DALF simultaneously focuses on the cluster structure in the anchor graph and partition. The final cluster structure is simultaneously shown in the anchor graph and partition. We introduce the orthogonal constraint on the centroid representation in anchor graph factorization and the cluster assignment is directly constructed, where the cluster structure is shown in the partition. We present an iterative algorithm for solving the formulated problem. Extensive experiments demonstrate the effectiveness and efficiency of DALF on different multi-view datasets compared with other methods.

Multi-image steganography refers to a stegano- graphic method where a user tries to hide multiple confidential images within a single cover image, and all confidential images can be correspondingly recovered perfectly by the recipient. Multi-image steganography essentially belongs to a high-capacity image steganographic scheme, but such high hiding capacity may easily cause severe contour shadows or color distortion of steganographic images, resulting in a significant reduction in anti-steganalysis capability. To address the above problem, this article designs a deep invertible neural network by introducing spatial-channel joint attention mechanism, in which the confidential image hiding and recovery can be regarded as a pair of coupled invertible processes. Specifically, a series of simple invertible networks having the same structure are firstly used to construct a cascaded deep invertible neural network framework, in which multiple confidential images can be sequentially embedded into a single cover image through a series of flexible cascaded iterative operations. Subsequently, spatial-channel joint attention module is designed to re-construct invertible network model, which can guide the embedding of secret information into more secure image regions. Accordingly, this joint attention mechanism can effectively address the problem of visual quality and security degradation of steganographic images due to high embedding capacity. Extensive experiments demonstrate that our scheme can obtain superior performance over different large-scale image sets, and outperforms state-of-the art methods with higher visual quality and stronger anti-steganalysis capability.

Due to the limited number of stable image feature descriptors and the simplistic concatenation approach to hash generation, existing hashing methods have not achieved a satisfactory balance between robustness and discrimination. To this end, a novel perceptual hashing method is proposed in this paper using feature fusion of fractional-order continuous orthogonal moments (FrCOMs). Specifically, two robust image descriptors, i.e., fractional-order Chebyshev Fourier moments (FrCHFMs) and fractional-order radial harmonic Fourier moments (FrRHFMs), are used to extract global structural features of a color image. Then, the canonical correlation analysis (CCA) strategy is employed to fuse these features during the final hash generation process. Compared to direct concatenation, CCA excels in eliminating redundancies between feature vectors, resulting in a shorter hash sequence and higher authentication performance. A series of experiments demonstrate that the proposed method achieves satisfactory robustness, discrimination and security. Particularly, the proposed method exhibits better tampering detection ability and robustness against combined content-preserving manipulations in practical applications.

In this article, an effective print-camera (P-C) resistant image watermarking scheme is proposed. To achieve watermark robustness, most of existing works try to simulate P-C noise by a sophisticated math model. However, the diversity of P-C noises in the real world is ignored, and the watermarked image may not attain a good balance between high robustness and low distortion. To address the problem, we construct an efficient end-to-end network architecture for watermark embedding and extraction. To be specific, a deep noise simulation network (NSN) is designed to simulate the fusion process of real P-C noises, which can help to generate high-robust watermarked image. Also, a multitask loss function based on just-noticeable-difference (JND) is proposed to conduct constrained learning for residual image containing watermark information, thus, the distortion of generated watermarked image can be significantly reduced. Experimental results show that our scheme can achieve high robustness against P-C process while maintaining a satisfactory watermark capacity and visual quality of watermarked image.

Despite the great success of deep neural networks for style transfer tasks, the entanglement of content and style in images leads to more style information not being captured. To tackle this problem, a novel style disentanglement network is proposed to transfer multi-source style elements. Specifically, we specialize in designing a learnable content style separation module, which can efficiently extract content and style components from images in the latent space. This method differs from the previous approaches by predefining content and style layers in the network. Under the condition of content and style separation, we continue to propose the multi-style swap module, which allows the content image to match more style elements. Additionally, by introducing alternate training strategies for the main and auxiliary decoders as well as style disentanglement loss, the stylized results look very similar to the original artworks. Experimental results demonstrate the superiority of our proposed method compared with existing schemes.

Traditionally, art images have to be restored by professionals for a very long time. It is also possible to maintain the artistic value of damaged art images by digitizing them and restoring them through computer-aided means. However, existing advanced image inpainting methods are mainly intended for natural images and are not suitable for art images. Thus, we propose a novel style-guided dual-branch inpainting network (SDI-Net) to address the above-mentioned issue. Specifically, our SDI-Net consists of a style reconstruction (SR) branch and a style inpainting (SI) branch, in which the SR branch provides intermediate supervision (style and content supervision) for the SI branch. The SI branch performs art image inpainting with a coarse-to-fine approach. At the coarse inpainting stage, the content and style of art image are separated and preliminarily inpainted under the supervision of SI branch. In addition, we propose a class style learning (CSL) module to inpaint the style feature guided by the style label, which can provide more effective brushstrokes from the same class of art images. The coarse inpainted results can be obtained by fusing the inpainted style feature with the inpainted content feature. At the fine inpainting stage, a style attention (SA) module is proposed in the decoder to further refine the coarse inpainted results. We employ the style loss, the content loss, the multi-class style adversarial loss, and the reconstruction loss to jointly train the proposed SDI-Net. A variety of experiments demonstrate the effectiveness of the proposed method, which allows the filled brushstrokes to appear as realistic as possible.

Image copy-move forgery detection (CMFD) has become a challenging problem due to increasingly powerful editing software that makes forged images increasingly realistic. Existing algorithms that directly connect multiple scales of features in the encoder part may not effectively aggregate contextual information, resulting in poor performance. In this paper, an end-to-end context multiscale cross-fusion network (CMCF-Net) is proposed to detect image copy-move forgery. The proposed network consists of a multiscale feature extraction fusion (MSF) module and a multi-information fusion decoding (MFD) module. Multiscale information is efficiently extracted and fused in the MSF module utilizing stacked-scale feature fusion, which improves the network's forgery localization ability on objects of different scales. The MFD module employs contextual information combination and weighted fusion of multiscale information to guide the network in obtaining relevant clues from correlated information at multiple different scales. Experimental results and analysis have demonstrated that the proposed CMCF-Net achieves the best localization results with higher robustness.

Reversible data hiding in encrypted images (RDHEI) is an effective technology of protecting private data. In this paper, a high-capacity RDHEI method with asymmetric coding and bit-plane block compression is proposed. Our major contributions are twofold. (1) We propose an asymmetric coding technique for processing prediction error (PE) blocks before encryption. The proposed asymmetric coding technique does not generate the sign bit-plane and facilitates massive 0s converging on the high bit-planes. This is beneficial to reserve the embedding room. (2) We present a bit-plane block compression technique for improving the embedding capacity. This technique divides the PE codes in a block into two parts which are both compressed and thus contribute a large embedding room. Experimental results demonstrate that the average embedding rates of the proposed method are 4.156, 4.063 and 3.450 bpp on the BOSSBase, BOWS-2 and UCID datasets, respectively. Comparisons show that our average embedding rates on the three datasets are all bigger than those of some state-of-the-art methods.

JPEG image manipulation localization aims to accurately classify and locate tampered regions in JPEG images. Existing image manipulation localization schemes usually consider diverse data streams of spatial domain, e.g. noise inconsistency and local content inconsistency. They, however, easily ignore an objective scenario: data stream features of spatial domain are hard to directly apply to compressed image format, e.g., JPEG, because tampered JPEG images may contain severe re-compression inconsistency and re-compression artifacts, when they are re-compressed to JPEG format. As a result, the traditional localization schemes relying on general data streams of spatial domain may result in a large number of false detection of tampered region in JPEG images. To address the above problem, we a new JPEG image manipulation localization scheme, in which a wide-receptive-field attention network is designed to effectively learn JPEG compressed artifacts. We firstly introduce the wide-receptive-field attention mechanism to re-construct U-Net network, which can effectively capture contextual information of JPEG images and analyze tampering traces from different image regions. Furthermore, a flexible JPEG compressed artifact learning module is designed to capture the image noise caused by JPEG compression, in which the weights can be adjusted flexibly based on image quality, without the need for decompression operations on JPEG images. Our proposed method can significantly strength the differentiation capability of detection model for tampered and non-tampered regions. A series of experiments are performed over different image sets, and the results demonstrate that the proposed scheme can achieve an overall localization performance for multi-scale JPEG manipulation regions and outperform most of state-of-the-art schemes in terms of detection accuracy, generalization and robustness.

Reversible data hiding (RDH) in encrypted images has emerged as an effective technique for securely storing and managing confidential images in the cloud. However, most RDH methods in shared images (RDHSI) are designed for uncompressed images and cannot be applied for JPEG images. To address this issue, we propose a novel RDH in shared JPEG images. Our method consists of JPEG image sharing and data hiding in JPEG shares, which are both conducted on JPEG bit-stream. Specifically, the DC appended bits (DCA) and AC appended bits (ACA) derived from the original JPEG bit-stream are shared by ( \(k\) , \(n\) ) threshold Chinese remainder theorem-based secret sharing (CRTSS) with two different constraints, one for DC sharing and another for AC sharing. The constraint of DC sharing ensures that the DC coefficient shares do not overflow. The constraint of AC sharing ensures the sizes of ACA shares are less than the sizes of the original ACA so that the embedding room can be vacated from each shared JPEG bit-stream. Each data-hider can embed the secret data into the personal JPEG share. The original JPEG image can be recovered losslessly from any \(k\) JPEG shares. The proposed sharing and data hiding are both well compatible with the JPEG standard. Experimental results demonstrate that the proposed method not only well preserves the file size whether the JPEG shares or marked JPEG shares but also achieves outstanding security performance and a high embedding capacity.

Copy detection is a key task of image copyright protection. Most robust hashing schemes do not make satisfied performance of image copy detection yet. To address this, a robust hashing scheme with deep features and Meixner moments is proposed for image copy detection. In the proposed hashing, global deep features are extracted by applying tensor Singular Value Decomposition (t-SVD) to the three-order tensor constructed in the DWT domain of the feature maps calculated by the pre-trained VGG16. Since the feature maps in the DWT domain are slightly disturbed by digital operations, the constructed three-order tensor is stable and thus the desirable robustness is guaranteed. Moreover, since t-SVD can decompose a three-order tensor into multiple low-dimensional matrices reflecting intrinsic structure, the global deep feature calculation from the low-dimensional matrices can provide good discrimination. Local features are calculated by the block-based Meixner moments. As the Meixner moments are resistant to geometric transformation and can efficiently discriminate various images, the use of the block-based Meixner moments can make discriminative and robust local features. Hash is ultimately determined by quantifying and combining global deep features and local features. The results of extensive experiments on open image datasets demonstrate that the proposed robust hashing outperforms some state-of-the-art robust hashing schemes in terms of classification and copy detection performances.

Outsourced inference services have greatly promoted the popularization of deep learning, and neural network models can help users customize a series of personalized applications, e.g., face recognition, image classification, etc. However, untrustworthy service providers also bring a variety of security issues, such as data privacy, network model privacy, etc. Meanwhile, the malicious example will result in the output of model incorrectly. For the above concerns, this paper proposes a privacy-reserving neural network inference against adversarial example attack (PPNNI) under two non-colluding cloud servers, where a series of efficient security protocols are designed to realize private prediction based on the additive secret sharing protocol. In the semi-honest model, the servers implement the neural network's private inference in the context of an unknown input and network model. Moreover, in order to prevent malicious examples from affecting the model accuracy, we produce a method of kernel density estimation and uncertainty value in the last layer of the hidden layer to determine whether the input is adversarial examples in the domain of ciphertext. The proposed PPNNI protocol is the first effort to efficiently detect adversarial attack behaviors under the ciphertexts. The theoretical analysis illustrate that the protocol can guarantee the privacy of input data, model parameters and the inference result. The results of the experiments demonstrate that the model accuracy are about 89% and 83% respectively with malicious examples on MNIST and CIFAR10 in the domain of ciphertext and they are nearly same as 91% and 85% in the domain of plaintext, which shows the effectiveness of our protocol.

Current 3D mesh steganography algorithms relying on geometric modification are prone to detection by steganalyzers. In traditional steganography, adaptive steganography has proven to be an efficient means of enhancing steganography security. Taking inspiration from this, we propose a highly adaptive embedding algorithm, guided by the principle of minimizing a carefully crafted distortion through efficient steganography codes. Specifically, we tailor a payload-limited embedding optimization problem for 3D settings and devise a feature-preserving distortion (FPD) to measure the impact of message embedding. The distortion takes on an additive form and is defined as a weighted difference of the effective steganalytic subfeatures utilized by the current 3D steganalyzers. With practicality in mind, we refine the distortion to enhance robustness and computational efficiency. By minimizing the FPD, our algorithm can preserve mesh features to a considerable extent, including steganalytic and geometric features, while achieving a high embedding capacity. During the practical embedding phase, we employ the Q-layered syndrome trellis code (STC). However, calculating the bit modification probability (BMP) for each layer of the Q-layered STC, given the variation of Q, can be cumbersome. To address this issue, we design a universal and automatic approach for the BMP calculation. The experimental results demonstrate that our algorithm achieves state-of-the-art performance in countering 3D steganalysis.

Steganography is a technique for covert communication between two parties. With the rapid development of deep neural networks (DNN), more and more steganographic networks are proposed recently, which are shown to be promising to achieve good performance. Unlike the traditional handcrafted steganographic tools, a steganographic network is relatively large in size. It raises concerns on how to covertly transmit the steganographic network in public channels, which is a crucial stage in the pipeline of steganography in real world applications. To address such an issue, we propose a novel scheme for steganography of steganographic networks in this paper. Unlike the existing steganographic schemes which focus on the subtle modification of the cover data to accommodate the secrets. We propose to disguise a steganographic network (termed as the secret DNN model) into a stego DNN model which performs an ordinary machine learning task (termed as the stego task). During the model disguising, we select and tune a subset of filters in the secret DNN model to preserve its function on the secret task, where the remaining filters are reactivated according to a partial optimization strategy to disguise the whole secret DNN model into a stego DNN model. The secret DNN model can be recovered from the stego DNN model when needed. Various experiments have been conducted to demonstrate the advantage of our proposed method for covert communication of steganographic networks as well as general DNN models.

Multimodal Dialogue agents are often required to respond to conversation history using both textual and visual content. Even though current dialogue studies predominantly strive to generate natural texts or images, they fall short in considering the relevance of multimodal responses within a dialogue context, consequently confining agents from making prudent choices based on multiple alternatives and their associated relevance scores for decision-making. In this paper, we present a bidirectional multimodal dialogue framework that skillfully combines the forward generation of multiple text and image response candidates with reverse selection guided by relevance scores evaluated on dialogue context, facilitating agents in selecting the most suitable multimodal responses. Specifically, the forward generation aspect of our framework leverages a stage-wise approach, first producing textual replies and composite visual descriptions from the dialogue context, followed by the generation of visual responses aligned with the descriptions. In the reverse selection process, visual responses are translated into tangible descriptive texts that, in conjunction with textual responses, are inversely tied back to the dialogue context for relevance assessment, assigning a reference score to each multimodal response candidate to assist the intelligent agent in making informed decisions. Experimental outcomes demonstrate that our proposed bidirectional dialogue response framework markedly elevates performance in both automatic and human evaluations, yielding a range of contextually fitting multimodal responses for selection.

RAW files are the initial measurement of scene radiance widely used in most cameras, and the ubiquitously-used RGB images are converted from RAW data through Image Signal Processing (ISP) pipelines. Nowadays, digital images are risky of being nefariously manipulated. Inspired by the fact that innate immunity is the first line of body defense, we propose DRAW, a novel scheme of defending images against manipulation by protecting their sources, i.e., camera-shooted RAWs. Specifically, we design a lightweight Multi-frequency Partial Fusion Network (MPF-Net) friendly to devices with limited computing resources by frequency learning and partial feature fusion. It introduces invisible watermarks as protective signal into the RAW data. The protection capability can not only be transferred into the rendered RGB images regardless of the applied ISP pipeline, but also is resilient to post-processing operations such as blurring or compression. Once the image is manipulated, we can accurately identify the forged areas with a localization network. Extensive experiments on several famous RAW datasets, e.g., RAISE, FiveK and SIDD, indicate the effectiveness of our method. We hope that this technique can be used in future cameras as an option for image protection, which could effectively restrict image manipulation at the source.

Existing image cropping detection schemes ignore that recovering the cropped-out contents can unveil the purpose of the behaved cropping attack. This paper presents CLR-Net, a novel image protection scheme addressing the combined challenge of image Cropping Localization and Recovery. We first protect the original image by introducing imperceptible perturbations. Then, typical image post-processing attacks are simulated to erode the protected image. On the recipient’s side, we predict the cropping mask and recover the original image. Besides, we propose a novel Fine-Grained generative JPEG simulator (FG-JPEG) as well as a feature alignment network to improve the real-world robustness. Comprehensive experiments prove that the quality of the recovered image and the accuracy of crop localization are both satisfactory.

Model watermarking has become an important solution to protect the intellectual property right (IPR) of deep neural networks (DNN) models. However, there are few researches on the IPR protection of generative adversarial networks (GAN), which are widely used to generate photorealistic images. In the current backdoor-based watermarking method for GAN models, the trigger pattern of the watermark is easy to be detected and invalidated by the adversary, which may fail to achieve IPR protection. To address this drawback, we propose a new GAN model watermarking method, where an invisible backdoor based on steganography is injected into the target GAN model as a watermark. Experimentally, the proposed method effectively trades off the performance of GAN on original task and the robustness of watermarking for removal attacks. Moreover, the generated triggers can effectively resist being detected by attackers.

Fake news detection (FND) has attracted much research interests in social forensics. Many existing approaches introduce tailored attention mechanisms to fuse unimodal features. However, they ignore the impact of cross-modal similarity between modalities. Meanwhile, the potential of pretrained multimodal feature learning models in FND has not been well exploited. This paper proposes an FND-CLIP framework, i.e., a multimodal Fake News Detection network based on Contrastive Language-Image Pretraining (CLIP). FND-CLIP extracts the deep representations together from news using two unimodal encoders and two pair-wise CLIP encoders. The CLIP-generated multimodal features are weighted by CLIP similarity of the two modalities. We also introduce a modality-wise attention module to aggregate the features. Extensive experiments are conducted and the results indicate that the proposed framework has a better capability in mining crucial features for fake news detection. The proposed FND-CLIP can achieve better performances than previous works on three typical fake news datasets.

In this paper, we propose an end-to-end perceptual robust hashing scheme for video copy detection based on unsupervised learning. Firstly, the spatio-temporal information in videos is effectively fused and condensed into high-dimensional features through a 3D self-attention, multi-scale feature fusion model based on 3D-CNN, in which the Inception block and the 3D self-attention mechanism are integrated. Then, we calculate the correlation distances between the extracted features to differentiate perceptual contents. Based on the similarity relationship, we can dynamically generate the pseudo-labels and exploit them to further guide the model training for video hash generation. In addition, we design the dual constraints to make the hash code obtain satisfactory robustness and discrimination. Extensive experiments demonstrate that the proposed scheme achieves superior performance of copy detection compared with existing schemes and performs well even in the case of untrained manipulations.

The easy sharing of multimedia content on social media has caused a rapid dissemination of fake news, which threatens society’s stability and security. Therefore, fake news detection has garnered extensive research interest in the field of social forensics. Current methods primarily concentrate on the integration of textual and visual features but fail to effectively exploit multi-modal information at both fine-grained and coarse-grained levels. Furthermore, they suffer from an ambiguity problem due to a lack of correlation between modalities or a contradiction between the decisions made by each modality. To overcome these challenges, we present a Multi-grained Multi-modal Fusion Network (MMFN) for fake news detection. Inspired by the multi-grained process of human assessment of news authenticity, we respectively employ two Transformer-based pre-trained models to encode token-level features from text and images. The multi-modal module fuses fine-grained features, taking into account coarse-grained features encoded by the CLIP encoder. To address the ambiguity problem, we design uni-modal branches with similarity-based weighting to adaptively adjust the use of multi-modal features. Experimental results demonstrate that the proposed framework outperforms state-of-the-art methods on three prevalent datasets.

Backdoor attack aims to compromise a model, which returns an adversary-wanted output when a specific trigger pattern appears yet behaves normally for clean inputs. Current backdoor attacks require changing pixels of clean images, which results in poor stealthiness of attacks and increases the difficulty of the physical implementation. This paper proposes a novel physical invisible backdoor based on camera imaging without changing nature image pixels. Specifically, a compromised model returns a target label for images taken by a particular camera, while it returns correct results for other images. To implement and evaluate the proposed backdoor, we take shots of different objects from multi-angles using multiple smartphones to build a new dataset of 21,500 images. Conventional backdoor attacks work ineffectively with some classical models, such as ResNet18, over the above-mentioned dataset. Therefore, we propose a three-step training strategy to mount the backdoor attack. First, we design and train a camera identification model with the phone IDs to extract the camera fingerprint feature. Subsequently, we elaborate a special network architecture, which is easily compromised by our backdoor attack, by leveraging the attributes of the CFA interpolation algorithm and combining it with the feature extraction block in the camera identification model. Finally, we transfer the backdoor from the elaborated special network architecture to the classical architecture model via teacher-student distillation learning. Since the trigger of our method is related to the specific phone, our attack works effectively in the physical world. Experiment results demonstrate the feasibility of our proposed approach and robustness against various backdoor defences.

Recently, print-resist watermarking has attracted much interest. Many watermarking schemes have been proposed to achieve robustness against printing and camera-capturing. Though these studies have shown promising results overall, they overlook the scenario of film-coating photographs, which is a significant and common scenario in real-world. The film-coating process can introduce severe distortions to the original image and easily incapacitate the watermark. To address this issue, we propose WRAP, a novel Watermarking scheme Robust Against film-coating upon Printed photographs. We first construct a large dataset with 120,000 film-coating images to train a style-transfer-based film-coating simulation network. Based on the network, we propose a comprehensive distortion layer which includes film-coating simulation and common disturbances in the printing and camera-capturing process. With the distortion layer, the entire embedding and extraction network can be trained end-to-end to gain robustness against film-coating upon printed photographs. Extensive experiments demonstrate the superior performances of our model in terms of robustness and generalization capability. Our model outperforms state-of-the-art print-resist watermarking schemes when testing in film-coating scenario and achieves outstanding performance across various datasets, types of films, and cameras. To the best of our knowledge, we are the first to conduct research on digital watermarking in film-coating scenario.

Image steganography is the art of concealing secret information in images in a way that is imperceptible to unauthorized parties. Recent advances show that is possible to use a fixed neural network (FNN) for secret embedding and extraction. Such fixed neural network steganography (FNNS) achieves high steganographic performance without training the networks, which could be more useful in real-world applications. However, the existing FNNS schemes are vulnerable in the sense that anyone can extract the secret from the stego-image. To deal with this issue, we propose a key-based FNNS scheme to improve the security of the FNNS, where we generate key-controlled perturbations from the FNN for data embedding. As such, only the receiver who possesses the key is able to correctly extract the secret from the stego-image using the FNN. In order to improve the visual quality and undetectability of the stego-image, we further propose an adaptive perturbation optimization strategy by taking the perturbation cost into account. Experimental results show that our proposed scheme is capable of preventing unauthorized secret extraction from the stego-images. Furthermore, our scheme is able to generate stego-images with higher visual quality than the state-of-the-art FNNS scheme, especially when the FNN is a neural network for ordinary learning tasks.

Deep neural network (DNN) watermarking is an emerging technique to protect the intellectual property of deep learning models. At present, many DNN watermarking algorithms have been proposed to achieve provenance verification by embedding identify information into the internals or prediction behaviors of the host model. However, most methods are vulnerable to model extraction attacks, where attackers collect output labels from the model to train a surrogate or a replica. To address this issue, we present a novel DNN watermarking approach, named SSW, which constructs an adaptive trigger set progressively by optimizing over a pair of symmetric shadow models to enhance the robustness to model extraction. Precisely, we train a positive shadow model supervised by the prediction of the host model to mimic the behaviors of potential surrogate models. Additionally, a negative shadow model is normally trained to imitate irrelevant independent models. Using this pair of shadow models as a reference, we design a strategy to update the trigger samples appropriately such that they tend to persist in the host model and its stolen copies. Moreover, our method could well support two specific embedding schemes: embedding the watermark via fine-tuning or from scratch. Our extensive experimental results on popular datasets demonstrate that our SSW approach outperforms state-of-the-art methods against various model extraction attacks in whether trigger set classification accuracy based or hypothesis test based verification. The results also show that our method is robust to common model modification schemes including fine-tuning and model compression.

Many online applications require the users to upload their identity documents for authentication. The fake identity document is one of the main threats which compromises the security and reliability of such online applications. Existing techniques focus on the detection of digitally forged identity documents, which neglect the impact of physical forgeries. In this paper, we look into the problem of detecting physically occluded fake identity documents, which can be easily generated without any image processing knowledge. We observe that the physical occlusions inevitably produce occluded boundaries on the document. To take the advantage, we propose an Occluded Boundary Representation Learning (OBRL) module to progressively learn the occluded boundary features. These are then fed into an Occluded Boundary Message Passing (OBMP) module to effectively diffuse the physical occlusion traces to enhance the backbone features for robust detection. We newly construct a Physically Occluded Fake ID Card image dataset (POID) for evaluation. Various experiments are conducted on the POID, where our scheme is able to achieve 99.6% of accuracy in detecting physically occluded fake ID card images with a mAP of over 85% to localize the occlusion regions.

Neural style transfer (NST) has attracted many research interests recent years. The existing NST schemes could only generate one stylized image from a content-style image pair. They are weak in creating diverse and personalized artistic styles. On the other hand, the stylized images could easily be stolen and illegally redistributed when shared online, which has not been addressed at all in the existing NST schemes. In this paper, we propose a personalized and watermark-guided style transfer network (PWST-Net) to tackle the aforementioned issues. Our PWST-Net could generate diverse stylized images from a content-style image pair using different personalization keys. Once the style transfer is done, our stylized images are with watermarks naturally embedded for copyright protection. We propose a novel style encoder in our PWST-Net to progressively generate the stylized images, which contains a Guided Fusion (GF) block and a Style Transformation (ST) block. The GF block generates a coarse stylized image based on a personalized direction field that is specific to a personalization key and the style image. The ST block refines the coarse stylized image into the final stylized image. It embeds a watermark into the deep feature space of the stylized image during the style transfer. To make the stylized images more diverse, we further propose a new personalization loss for training our PWST-Net. Various experiments demonstrate the effectiveness of our proposed method for generating personalized and watermarked stylized images, which also outperforms the state-of-the-art NST schemes in terms of artistic visual appearance.

Neural style transfer (NST) can quickly produce impressive artistic images, which allows ordinary people to become painter. The brushstrokes of stylized images created by the current NST methods are often unpredictable, which does not conform to the logic of the artist's drawing. At the same time, the style distribution of the generated stylized image texture differs from the real artwork. In this paper, we propose an interactive image style transfer network (IIST-Net) to overcome the above limitations. Our IIST-Net can generate stylized results for brushstrokes in arbitrary directions guided by graffiti curves. The style distribution of these stylized results is closer to the real-life artwork. Specifically, we design an Interactive Brush-texture Generation (IBG) module in IIST-Net to progressively generate controllable brush-textures. Then, two encoders are introduced to embed the interactive brush-textures into the content image in the deep space for producing the fused content feature map. The Multilayer Style Attention (MSA) module is proposed to further distill multi-scale style features and transfer them to the fused content feature map for obtaining the final stylized feature map with controllable brushstrokes. Additionally, we adopt the content loss, style loss, adversarial loss and contrastive loss to jointly supervise the proposed network. Experimental comparisons have demonstrated the effectiveness of our proposed method for creating controllable and realistic stylized images.

Since the significant advancements and open-source support of latent diffusion models (LDMs) in the field of image generation, numerous researchers and enterprises start fine-tuning the pre-trained models to generate specialized images for different objectives. However, the criminals may turn their attention to generate images by LDMs and then carry out illegal activities. The watermarking technique is a typical solution to deal with this problem. But, the post-hoc watermarking methods can be easily escaped to obtain the non-watermarked images, and the existing watermarking methods designed for LDMs can only embed a fixed message, i.e., the to-be-embedded message cannot be changed unless retraining the model. Therefore, in this work, we propose an end-to-end watermarking method based on the encoder-decoder (ENDE) and message-matrix. The message can be embedded into generated images through fusing the message-matrix and intermediate outputs in the forward propagation of image generation based on LDM. Thus, the message can be flexibly changed by utilizing the message-encoder to generate message-matrix, without training the LDM again. On the other hand, the security mechanism in our watermarking method can defeat the attack that the users may escape the message-matrix usage during image generation. A series of experiments demonstrate the effectiveness and the superiority of our watermarking method compared with SOTA methods.

The widespread use of face retouching filters on short-video platforms has raised concerns about the authenticity of digital appearances and the impact of deceptive advertising. To address these issues, there is a pressing need to develop advanced face retouching techniques. However, the lack of large-scale and fine-grained face retouching datasets has been a major obstacle to progress in this field. In this paper, we introduce RetouchingFFHQ, a large-scale and fine-grained face retouching dataset that contains over half a million conditionally-retouched images. RetouchingFFHQ stands out from previous datasets due to its large scale, high quality, fine-grainedness, and customization. By including four typical types of face retouching operations and different retouching levels, we extend the binary face retouching detection into a fine-grained, multi-retouching type, and multi-retouching level estimation problem. Additionally, we propose a Multi-granularity Attention Module (MAM) as a plugin for CNN backbones for enhanced cross-scale representation learning. Extensive experiments using different baselines as well as our proposed method on RetouchingFFHQ show decent performance on face retouching detection.

Live video commenting, or "bullet screen," is a popular social style on video platforms. Automatic live commenting has been explored as a promising approach to enhance the appeal of videos. However, existing methods neglect the diversity of generated sentences, limiting the potential to obtain human-like comments. In this paper, we introduce a novel framework called "VCMaster" for multimodal live video comments generation, which balances the diversity and quality of generated comments to create human-like sentences. We involve images, subtitles, and contextual comments as inputs to better understand complex video contexts. Then, we propose an effective Hierarchical Cross-Fusion Decoder to integrate high-quality trimodal feature representations by cross-fusing critical information from previous layers. Additionally, we develop a Sentence-Level Contrastive Loss to enlarge the distance between generated and contextual comments by contrastive learning. It helps the model to avoid the pitfall of simply imitating provided contextual comments and losing creativity, encouraging the model to achieve more diverse comments while maintaining high quality. We also construct a large-scale multimodal live video comments dataset with 292,507 comments and three sub-datasets that cover nine general categories. Extensive experiments demonstrate that our model achieves a level of human-like language expression and remarkably fluent, diverse, and engaging generated comments compared to baselines.

Subspace clustering is useful for clustering data points according to the underlying subspaces. Many methods have been presented in recent years, among which Sparse Subspace Clustering (SSC), Low-Rank Representation (LRR) and Least Squares Regression clustering (LSR) are three representative methods. These approaches achieve good results by assuming the structure of errors as a prior and removing errors in the original input space by modeling them in their objective functions. In this paper, we propose a novel method from an energy perspective to eliminate errors in the projected space rather than the input space. Since the block diagonal property can lead to correct clustering, we measure the correctness in terms of a block in the projected space with an energy function. A correct block corresponds to the subset of columns with the maximal energy. The energy of a block is defined based on the unary column, pairwise and high-order similarity of columns for each block. We relax the energy function of a block and approximate it by a constrained homogenous function. Moreover, we propose an efficient iterative algorithm to remove errors in the projected space. Both theoretical analysis and experiments show the superiority of our method over existing solutions to the clustering problem, especially when noise exists.

Digital images are vulnerable to nefarious tampering attacks such as content addition or removal that severely alter the original meaning. It is somehow like a person without protection that is open to various kinds of viruses. Image immunization (Imuge) is a technology of protecting the images by introducing trivial perturbation, so that the protected images are immune to the viruses in that the tampered contents can be auto-recovered. This paper presents Imuge+, an enhanced scheme for image immunization. By observing the invertible relationship between image immunization and the corresponding self-recovery, we employ an invertible neural network to jointly learn image immunization and recovery respectively in the forward and backward pass. We also introduce an efficient attack layer that involves both malicious tamper and benign image post-processing, where a novel distillation-based JPEG simulator is proposed for improved JPEG robustness. Our method achieves promising results in real-world tests where experiments show accurate tamper localization as well as high-fidelity content recovery. Additionally, we show superior performance on tamper localization compared to state-of-the-art schemes based on passive forensics.

Steganography has received massive attention from the information-hiding community due to its excellent security for covert communication systems. Existing work focuses on improving security on single-modal media while cross-modal media is less explored. However, cross-modal interaction has become a prevalent social manner on current social networks, which arises potential behavioral security issues of single-modal steganography. In this letter, we propose a novel text steganography to explore the practicability of cross-modal steganography. The proposed scheme is composed with image encoder, message encoder, language model, and message extractor networks, where the generated stego texts are semantically consistent with the input reference image. In addition, current generative text steganography schemes are vulnerable to text attack based on synonym substitution since these heuristic algorithms embed information by constructing a mapping between secret messages and candidate tokens. Thus, we design a text attack layer based on synonym substitution to further improve the robustness of generated stego text. Experiments illustrate the superior performance of the proposed cross-modal steganography scheme in terms of security and robustness.

Most of the existing image steganography methods are content adaptive steganography, which prefer to modify the pixel values of texture information-rich regions, making them more difficult to be detected. Many steganography detectors have been developed using a CNN network with selected channels. However, the utilization and processing of the prior information inside the network may not be completely adequate. To address such problem, we propose a strategy based on a spatial and channel multiple attention mechanism for improving the accuracy of the network. To further exploit the texture information of the image itself, spatial attention is used throughout the network, which is achieved by fusing the Sobel operator features with the embedded probability map in a suitable way. On the other hand, channel attention uses the relationship between two-dimensional DCT and global average pooling to weight the features. Experimental results show that our strategy has competitive performance in both spatial and DCT domains on the ALASKA #2 dataset.

Recent methods with deep neural networks for text steganalysis have succeeded in mining various feature representations. However, a limited number of studies have explicitly analyzed potential security issues of generative text steganography. Furthermore, current text steganalysis approaches lack detailed consideration in the intricate design of deep learning architectures tailored to these challenges. In this article, in order to tackle these problems, we first theoretically and empirically analyze the inevitable embedding distortions of generative text steganography at a semantic and statistical levels. In light of this, we then propose an innovative text steganalysis method based on hierarchical supervised learning and a dual attention mechanism. Concretely, to extract highly effective semantic features, the proposed method involves fine-tuning a BERT extractor through the hierarchical supervised learning that combines signals from multiple softmax classifiers, rather than relying solely on the final one. The mean and standard deviation values in the Gaussian distribution of cover and stego texts are then estimated using an encoder of variational autoencoders and used to capture features representing the statistical distortion of generative text steganography. Subsequently, we introduce a dual attention mechanism that dynamically fuses the semantic and statistical features, thereby creating discriminative feature representations essential for text steganalysis. The experimental results demonstrate that our proposed text steganalysis method surpasses the current state-of-the-art techniques across three distinct text steganalysis scenarios: specific text steganalysis, semi-blind text steganalysis, and blind text steganalysis.

Reversible Data Hiding in Encrypted Images (RDHEI) has drawn increasing concern in multimedia cloud computing scenarios. It embeds secret message into the encrypted carrier while preserving the confidentiality of the image. However, most RDHEI schemes have only one hider and one image carrier which are not efficient for the distributed system with multiple participants. Moreover, if the stego-image is lost, the cover image and the embedded data cannot be restored. To solve above issues, this paper proposes Reversible Data Hiding in Shared Images based on syndrome decoding and homomorphism (RDHSI). In RDHSI, the cover image and secret data are distributed using secret sharing. Multiple data hiders embed shared data into the shared images based on the Syndrome Decoding of Hamming codes and the additive homomorphism of the polynomial. On the receiver side, the lossless cover image and secret data are obtained. The reversibility and privacy preserving of the cover image, the complete extraction of secret data, and the fault-tolerance of the proposed schemes are achieved. The experimental results show that PSNR of the marked image is above 54 dB at the embedding rate of 0.43bpp. In order to improve the payload of secret data, the Modified RDHSI is further proposed. Generally, the proposed schemes are secure, effective and fault-tolerant.

Watermarking by Zernike moments has been proven to be effective in providing high rotational resistance. However, due to the high computational complexity, the conventional video watermarking methods using Zernike moments are developed for videos with low resolution. Moreover, according to the properties of Zernike moments, only the matrices of equal height and width can be calculated since the inscribed circle of the original image matrix is selected as the area to be processed, but most of the available videos on the Internet do not meet such requirement. To solve the above problem, this paper proposes a fast watermarking method based on Zernike moments for high resolution videos to resist various attacks. In the proposed method, the frames of a video sequence are firstly grouped, from which a certain number of frame pairs are then selected for watermark embedding. For each frame pair to be embedded, we partition one frame into a set of disjoint blocks and apply singular value decomposition to each block to obtain a square feature matrix. Thereafter, by calculating all the Zernike moments, secret information is embedded into the selected Zernike moments to achieve superior robustness while keeping imperceptibility. Finally, according to the video encoding framework, we overwrite the frame difference of the frame pair by the watermark to resist compression and transcoding attacks. Furthermore, we propose two optional methods for compensating the special cases of rotation and scaling attacks during watermark detection. Experiments demonstrate the advantage of our method over the existing robust watermarking methods.

Semantic segmentation is important for scene understanding. To address the scenes of adverse illumination conditions of natural images, thermal infrared (TIR) images are introduced. Most existing RGB-T semantic segmentation methods follow three cross-modal fusion paradigms, i. e., encoder fusion, decoder fusion, and feature fusion. Some methods, unfortunately, ignore the properties of RGB and TIR features or the properties of features at different levels. In this paper, we propose a novel feature fusion-based network for RGB-T semantic segmentation, named LASNet, which follows three steps of location, activation, and sharpening. The highlight of LASNet is that we fully consider the characteristics of cross-modal features at different levels, and accordingly propose three specific modules for better segmentation. Concretely, we propose a Collaborative Location Module (CLM) for high-level semantic features, aiming to locate all potential objects. We propose a Complementary Activation Module for middle-level features, aiming to activate exact regions of different objects. We propose an Edge Sharpening Module (ESM) for low-level texture features, aiming to sharpen the edges of objects. Furthermore, in the training phase, we attach a location supervision and an edge supervision after CLM and ESM, respectively, and impose two semantic supervisions in the decoder part to facilitate network convergence. Experimental results on two public datasets demonstrate that the superiority of our LASNet over relevant state-of-the-art methods. The code and results of our method are available athttps://github.com/MathLee/LASNet.

As encryption masks the content of the original image and thus statistical characteristics of the original image cannot be used to compress the encrypted version, compressing an encrypted image efficiently remains a significant challenge today. In this study, a novel encryption-then-lossy-compression (ETLC) scheme was developed using nonuniform downsampling and a customized deep network. Specifically, the nonuniform downsampling method integrates both uniform and random sampling to achieve an arbitrary compression ratio for an encrypted image. Lossy reconstruction from the decrypted and decompressed image is described as a constrained optimization problem, and an ETLC-oriented customized deep neural network (ETCNN) is elaborately designed to solve this problem. ETCNN contains three parts: channel-wise non-local attention including residual group and non-local sparse attention, a residual content supplementation (RCS), and a downsampling constraint (DC), where RCS and DC are customized modules exploiting specific features of the downsampling-based ETLC system. Extensive experimental simulations show that the proposed scheme outperforms the state-of-the-art ETLC methods remarkably, indicating the feasibility and effectiveness of the proposed scheme exploiting the nonuniform downsampling and ETCNN-based reconstruction. Code is available athttps://github.com/hujuanzp/ETCNN.

Reversible data hiding (RDH) has been investigated for over two decades. Depending on the application scenario, it can be divided into RDH and reversible data hiding in encrypted images (RDHEI). Interestingly, almost all studies on RDH/RDHEI have been conducted on gray-scale images, and relatively few studies have been conducted on color images compared to those on gray-scale images. Moreover, very few studies have been undertaken on palette images as a widely used image format. For palette images in which pixels are not gray-scale levels but color table indexes, it is difficult to apply traditional RDH/RDHEI methods directly. Therefore, we propose a new framework for RDH/RDHEI specifically for palette images. This framework adds a route selection algorithm before the conventional RDH/RDHEI approach. To be specific, we propose a method named the shortest route with correlation and frequency selection to reorder the color table, followed by a correlation reconstruction of the remapped index image according to this color table. The experimental results show the improvement brought by our proposed route selection to the existing RDH/RDHEI methods in palette images.

With the development of robust information hiding (RIH) approaches, secret messages can be extracted successfully from stego-data after transmission through lossy channels of online social networks (OSNs). To interrupt illegal covert communications in OSNs, some methods sanitize the uploaded images by image processing operations to destroy the hidden data that may exist. However, none of the existing methods takes the RIH methods that can resist scaling into consideration, while scaling is a common operation in OSNs. In this paper, we first propose a general framework for image sanitization in OSN platforms, which serves as a countermeasure against the RIH. By using such a framework, the secret messages embedded in the upload images can be removed and the quality of the sanitized image can be well maintained. Our framework contains two deep neural networks: Scaling-Net and SC-Net. The Scaling-Net is dedicated to the sanitization of oversized images while the SC-Net is designed for other images. To achieve a good image quality, we also propose a discriminator for adversarial training of the Scaling-Net and SC-Net. Experimental results on different datasets demonstrate that our proposed method outperforms the state-of-the-art methods. The source code and pretrained models are available at our code repository (https://github.com/zyzhu19/Image_Sanitization).

Multiview clustering has received great attention and numerous subspace clustering algorithms for multiview data have been presented. However, most of these algorithms do not effectively handle high-dimensional data and fail to exploit consistency for the number of the connected components in similarity matrices for different views. In this article, we propose a novel consistency-induced multiview subspace clustering (CiMSC) to tackle these issues, which is mainly composed of structural consistency (SC) and sample assignment consistency (SAC). To be specific, SC aims to learn a similarity matrix for each single view wherein the number of connected components equals to the cluster number of the dataset. SAC aims to minimize the discrepancy for the number of connected components in similarity matrices from different views based on the SAC assumption, that is, different views should produce the same number of connected components in similarity matrices. CiMSC also formulates cluster indicator matrices for different views, and shared similarity matrices simultaneously in an optimization framework. Since each column of similarity matrix can be used as a new representation of the data point, CiMSC can learn an effective subspace representation for the high-dimensional data, which is encoded into the latent representation by reconstruction in a nonlinear manner. We employ an alternating optimization scheme to solve the optimization problem. Experiments validate the advantage of CiMSC over 12 state-of-the-art multiview clustering approaches, for example, the accuracy of CiMSC is 98.06% on the BBCSport dataset.

Content similarity is a representative property of natural images, for example, similar regions, which is utilized by modern steganalysis. Existing JPEG steganographic methods mainly focus on the complexity of content but ignore content similarity. This article investigates content similarity to improve the undetectability of JPEG steganography. Specifically, the content similarity of DCT blocks and the 64 parallel channels is used to design the distortion function. Given a JPEG image, initial embedding costs are assigned for quantized DCT coefficients using an appropriate algorithm among the existing distortion functions. Then, the similarities of blocks and channels are used to update the initial embedding costs, respectively. After combination, the final distortion function can be obtained. Using syndrome trellis coding (STC), which achieves minimal embedding distortion with respect to a given distortion function, secret data are embedded into the cover image with a final distortion function. Experimental results show that our scheme achieves better undetectability than current state-of-the-art JPEG steganographic methods.

Traditional schemes for reversible data hiding in encrypted images (RDH-EI) focus on one data hider and cannot resist the single point of failure. Besides, the image security is determined by one party, rather than multiple parties. Thus, it is valuable to design RDH-EI schemes with multiple data hiders for stronger security. In this article, we propose a multiple data hiders-based RDH-EI scheme using a new secret sharing technique. First, we devise an$(r,n)$-threshold$(r\leq n)$matrix-based secret sharing (MSS) using matrix theory, and theoretically verify its efficacy and security properties. Then, using the MSS, we propose an$(r,n)$-threshold RDH-EI scheme called MSS-RDHEI. The content owner encrypts an image to be$n$encrypted images using the MSS with an encryption key, and outsources these encrypted images to$n$data hiders. Each data hider can embed some data, e.g., copyright and identification information, into the encrypted image for the purposes of storage, management, or other processing, and these data can also be losslessly extracted. An authorized receiver can recover the confidential image from$r$encrypted images. By designing, our MSS-RDHEI scheme can withstand$n-r$points of failure. Experimental results show that it ensures the image content confidentiality and achieves a much larger embedding capacity than state-of-the-art schemes.

Perceptual image hashing is an effective and efficient way to identify images in large-scale databases, where two major performances are robustness and discrimination. A better tradeoff between robustness and discrimination is still a severe challenge for the current hashing research. Aiming at this issue, we design a novel perceptual image Hashing with Locality Preserving Projection (LPP) (hereafter HLPP). Specifically, to improve the robustness against content-preserving operations, Gabor filtering is leveraged to adaptively extract the orientation and structure features, which are consistent with the response of human visual system. The LPP is adopted to learn intrinsic local structure from the maximum Gabor filtering response. The use of LPP can discover meaningful low-dimensional information hidden in the maximum Gabor filtering response and thus improves discrimination of HLPP. During hash similarity calculation, the Hamming distance is selected as the metric. The tradeoff performance between robustness and discrimination is validated on benchmark databases, and the results indicate that the proposed HLPP is superior to some state-of-the-art algorithms. In addition, extensive experiments of copy detection also demonstrate that the proposed HLPP can provide higher accuracy than the compared algorithms.

Existing cover selection methods for steganography mainly focus on embedding distortion of each image, but ignore the similarity between images. When the cover images are similar, a number of relevant samples are provided to steganalysis, which is disadvantageous to steganography. This paper proposes a new cover selection method to joint image similarity and embedding distortion. Due to the difference between steganography and other image processing tasks, e.g., image reconstruction, image recognition, we propose a customized method to calculate image similarity for steganography based on SVD (singular value decomposition). Importantly, the small singular values (instead of the large ones) are employed, since it is suitable for the properties of steganography. In addition, embedding distortion is calculated by the current distortion minimization framework. The obtained image similarity and embedding distortion are combined to form a new cover selection strategy. As a result, the properties of batch images can be fully used. Experimental results show that our scheme outperforms the state-of-the-art cover selection methods when they are checked by modern steganalytic tools.

Recently, relying on convolutional neural networks (CNNs), many methods for salient object detection in optical remote-sensing images (ORSI-SOD) are proposed. However, most methods ignore the number of parameters and computational cost brought by CNNs, and only a few pay attention to portability and mobility. To facilitate practical applications, in this article, we propose a novel lightweight network for ORSI-SOD based on semantic matching and edge alignment, termed SeaNet. Specifically, SeaNet includes a lightweight MobileNet-V2 for feature extraction, a dynamic semantic matching module (DSMM) for high-level features, an edge self-alignment module (ESAM) for low-level features, and a portable decoder for inference. First, the high-level features are compressed into semantic kernels. Then, semantic kernels are used to activate salient object locations in two groups of high-level features through dynamic convolution operations in DSMM. Meanwhile, in ESAM, cross-scale edge information extracted from two groups of low-level features is self-aligned through$L_{2}$loss and used for detail enhancement. Finally, starting from the highest level features, the decoder infers salient objects based on the accurate locations and fine details contained in the outputs of the two modules. Extensive experiments on two public datasets demonstrate that our lightweight SeaNet not only outperforms most state-of-the-art lightweight methods, but also yields comparable accuracy with state-of-the-art conventional methods, while having only 2.76 M parameters and running with 1.7 G floating point operations (FLOPs) for$288 \times 288$inputs. Our code and results are available athttps://github.com/MathLee/SeaNet.

Robust steganography aims to hide message in cover data with high security and guarantee the success of its message extraction although it is disturbed in transmission channel. In this paper we propose a framework of coding scheme extended from Dual-Syndrome Trellis Codes (Dual-STCs) for robust adaptive steganography. We use the conditional probability distribution of correct stego bits conditioned on disturbed stego data as channel knowledge, and formulate error-correcting as maximizing this probability. By extending Dual-STCs to double-layered embedding, we design an iteratively decoding scheme for error-correcting two layer stego bits from their joint conditional probabilities, and strictly prove its convergence. Besides, we design a method to estimate these probability distributions from stego data pairs uploaded/downloaded from the lossy transmission channel. The channel knowledge can also be used by steganographer, and we propose a universal method to revise steganographic distortion values for higher robustness under the guidance of the channel knowledge. Compared with existing coding methods for robust steganography, our method can make use of channel knowledge to improve error correcting ability and meanwhile maintain high security, which is demonstrated by experimental results.

With the widespread use of automated speech recognition (ASR) systems in modern consumer devices, attack against ASR systems have become an attractive topic in recent years. Although related white-box attack methods have achieved remarkable success in fooling neural networks, they rely heavily on obtaining full access to the details of the target models. Due to the lack of prior knowledge of the victim model and the inefficiency in utilizing query results, most of the existing black-box attack methods for ASR systems are query-intensive. In this paper, we propose a new black-box attack called the Monte Carlo gradient sign attack (MGSA) to generate adversarial audio samples with substantially fewer queries. It updates an original sample based on the elements obtained by a Monte Carlo tree search. We attribute its high query efficiency to the effective utilization of the dominant gradient phenomenon, which refers to the fact that only a few elements of each origin sample have significant effect on the output of ASR systems. Extensive experiments are performed to evaluate the efficiency of MGSA and the stealthiness of the generated adversarial examples on the DeepSpeech system. The experimental results show that MGSA achieves 98% and 99% attack success rates on the LibriSpeech and Mozilla Common Voice datasets, respectively. Compared with the state-of-the-art methods, the average number of queries is reduced by 27% and the signal-to-noise ratio is increased by 31%.

Rotation invariant local binary pattern (RI-LBP) features have been applied in diverse scenarios with the advantages of gray-scale and rotation invariance. Secure fog computing has become an emerging paradigm for enterprises or individuals with a huge volume of private data, but limited computing power for feature extraction. Prior secure outsourcing protocols based on LBP and RI-LBP simply focus on local data privacy, which can only resist ciphertext-only attack, and also make extracted features exposed to the cloud. This work focuses on how to effectively ensure data confidentiality and feature integrity. We propose a verifiable privacy-enhanced protocol for RI-LBP feature extraction (VRLBP) based on the fog computing paradigm, which mitigates the aforementioned challenges by involving the proposed symmetric cryptographic scheme where local data and extracted features are proven secure against chosen plaintext attack. Meanwhile, the stage of verification can check the correctness of outsourced features with an overwhelming probability and constant computational complexity. The security analysis and computational costs demonstrate that VRLBP can reduce the computation overhead to around 30% of original feature extraction in a privacy-preserving manner. To exhibit the practical utility, VRLBP is implemented for deepfake detection on five public datasets. Extensive evaluations indicate that VRLBP achieves almost the same accuracy as the original RI-LBP algorithm and outperforms the state-of-the-art protocols.

In the context of the Internet of Everything, traditional machine learning-based intrusion detection systems (IDS) have difficulties in heterogeneous data preprocessing and fusion training, and can no longer meet the needs of heterogeneous Internet of Things (HeIoT) intrusion detection. This article proposes a deep transfer learning method based on word embedding (WE) to solve the above problems. First, a multisource data fusion method based on natural language processing is designed to maintain the consistency of the source domain and target domain tensors and complete the sample transfer. Then, use WE to map the mathematical and logical features of the physical network into feature space vectors to complete feature transfer. Finally, the heterogeneous fusion WE coefficients were imported into the deep learning model to complete the model transfer. In the simulation, the KDD CUP 99, NSL-KDD, and UNSW-NB15 datasets widely used in the IDS research field are used as the single source domain and the multisource heterogeneous fusion source domain, respectively, which verifies the effectiveness of WE combined with mainstream deep learning models in IDS. The results show that the proposed scheme can simplify the data standardization process, can better preserve data features, the WE space of heterogeneous sequences can coexist, and the convolutional neural network and bidirectional long short-term memory models perform better, the test accuracy of the single source domain and heterogeneous source domain can reach more than 98.5%, realize the integration of HeIoT network sequences, and solve the cold start problem of HeIoT IDS.

Existing methods for Salient Object Detection in Optical Remote Sensing Images (ORSI-SOD) mainly adopt Convolutional Neural Networks (CNNs) as the backbone, such as VGG and ResNet. Since CNNs can only extract features within certain receptive fields, most ORSI-SOD methods generally follow the local-to-contextual paradigm. In this paper, we propose a novel Global Extraction Local Exploration Network (GeleNet) for ORSI-SOD following the global-to-local paradigm. Specifically, GeleNet first adopts a transformer backbone to generate four-level feature embeddings with global long-range dependencies. Then, GeleNet employs a Direction-aware Shuffle Weighted Spatial Attention Module (D-SWSAM) and its simplified version (SWSAM) to enhance local interactions, and a Knowledge Transfer Module (KTM) to further enhance cross-level contextual interactions. D-SWSAM comprehensively perceives the orientation information in the lowest-level features through directional convolutions to adapt to various orientations of salient objects in ORSIs, and effectively enhances the details of salient objects with an improved attention mechanism. SWSAM discards the direction-aware part of D-SWSAM to focus on localizing salient objects in the highest-level features. KTM models the contextual correlation knowledge of two middle-level features of different scales based on the self-attention mechanism, and transfers the knowledge to the raw features to generate more discriminative features. Finally, a saliency predictor is used to generate the saliency map based on the outputs of the above three modules. Extensive experiments on three public datasets demonstrate that the proposed GeleNet outperforms relevant state-of-the-art methods. The code and results of our method are available at https://github.com/MathLee/GeleNet.

Data in real world are usually characterized in multiple views, including different types of features or different modalities. Multi-view learning has been popular in the past decades and achieved significant improvements. In this paper, we investigate three challenging problems in the field of incomplete multi-view representation learning, namely, i) how to reduce the influences produced by missing views in multi-view dataset, ii) how to learn a consistent and informative representation among different views and iii) how to alleviate the impacts of the inherent noise in multi-view data caused by high-dimensional features or varied quality for different data points. To address these challenges, we integrate these three tasks into a problem and propose a novel framework termed Noise-aware Incomplete Multi-view Learning Networks (NIM-Nets). NIM-Nets fully utilize incomplete data from different views to produce a multi-view shared representation which is consistent, informative and robust to noise. We model the inherent noise in data by defining the distribution $\Gamma $ and assuming that each observation in the incomplete dataset is sampled from the distribution $\Gamma $ . To the best of our knowledge, this is the first work to unify learning the consistent and informative representation, alleviating the impacts of noise in data and handling the view-missing patterns in multi-view learning into a framework. We also first give a definition of robustness and completeness for incomplete multi-view representation learning. Based on NIM-Nets, we present joint optimization models for classification and clustering, respectively. Extensive experiments on different datasets demonstrate the effectiveness of our method over the existing work based on classification and clustering tasks in terms of different metrics.

Symmetric nonnegative matrix factorization (SNMF) is effective to cluster nonlinearly separable data, which uses the constructed graph to capture the structure of inherent clusters. Nevertheless, many SNMF-based clustering approaches implicitly enforce either the sparseness constraint or the smoothness constraint with the limited supervised information in the form of cannot-link or must-link in a semi-supervised manner, which may not be quite satisfactory in many applications where sparseness and smoothness are demanded explicitly and simultaneously. In this paper, we propose a new semi-supervised SNMF-based approach termed Semi-supervised Structured SNMF-based clustering (S3NMF). The method flexibly enforces the block-diagonal structure to the similarity matrix, where the sparseness and smoothness are simultaneously considered, so that we can obtain the desirable assignment matrix by simultaneously learning similarity and assignment matrices in a constrained optimization problem. We formulate S3NMF with a semi-supervised manner and utilize the indirect constraints of sparseness and smoothness by cannot-link and must-link. To effectively solve S3NMF, we present an alternating iterative algorithm with theoretically proved convergence to seek for the solution of the optimization problem. Experiments on five benchmark data sets show better performance and satisfactory stability of the proposed method.

Image manipulation localization is a technique that can efficiently segment the tampered regions from a suspicious image. Existing work usually trains a detection model by fusing the features from diverse data streams, e.g., noise inconsistency, recompression inconsistency, and local inconsistency. They, however, ignore a fact that not all tampered images contain these data streams. As a result, high feature redundancy may cause a large number of false detection for tampered region. To address this problem, this paper designs an end-to-end high-confidence localization network architecture. First, deep convolutional neural networks are utilized to extract multi-scale feature sets from the RGB streams. We then design a semantic refined bi-directional feature integration module to fully fuse multi-scale adjacent features and significantly enhance feature representation. Subsequently, morphological operations are introduced to extract multi-scale edge information, which can efficiently reduce feature redundancy by generating wider high-resolution edges during image reconstructing. Finally, a deep semantic residual decoder is sequentially re-constructed by spreading deep semantic information into each decoding stage. The proposed method can not only improve the manipulation localization accuracy, but also guarantee the model robustness. Extensive experiments demonstrate that our method can obtain an effective performance in locating forged regions over different large-scale image sets, and outperforms most of state-of-the-art methods with higher localization accuracy and stronger robustness.

Compression technology for representing image is on demand for efficiently processing images in the Big Data era. Image hashing is an effective compression technology for computing a short representation based on visual content of input image. Currently, most reported image hashing algorithms have weakness in making a desirable classification between discrimination and robustness and thus can not reach good performance in copy detection. To address these issues, this paper proposes a new robust image hashing with Isometric Mapping (Isomap) and saliency map for copy detection. A key contribution is hash generation with saliency map determined by the Frequency Tuned (FT) method, which can guarantee robustness of the proposed image hashing. Another contribution is the use of Isomap in deriving hash from the FT-based saliency map. Since Isomap can discover the internal geometry features of image, the use of Isomap can learn discriminative image features and thus discrimination of the proposed image hashing is ensured. Experiments on open image databases are carried out. Comparison results illustrate that the proposed image hashing is better than some state-of-the-art algorithms in the performances of classification and copy detection.

JPEG image encryption aims at effectively converting the original JPEG image into a noise-like image that does not contain any useful information of original image. Existing schemes for JPEG image encryption, however, may not attain a good balance in terms of file size increment and encryption security. To address the problem, we design a novel JPEG image encryption scheme. Different from existing schemes, we first predict DC coefficients by an adaptive prediction method. Subsequently, the histogram of DC coefficient prediction errors is encrypted by combining the prediction errors and random integers to reduce the encoded length, which can ensure a very small increment of file size. Furthermore, we construct the RS (run/size) pairs in each DCT block and then implement the permutation for both RS pairs extracted from the upper left corner of each DCT block and all DCT blocks excluding DC coefficients, which can further distort the image contents. Extensive experiments demonstrate that, compared with existing JPEG image encryption schemes, our scheme can ensure not only the JPEG format compatibility for encrypted image, but also keep a very small file size increment and the superior security performance.

Nowadays it has still remained as a big challenge to efficiently compress color images in the encrypted domain. In this paper we present a novel deep-learning-based approach to encryption-then-lossy-compression (ETC) of color images by incorporating the domain knowledge of the encrypted image reconstruction process. In specific, a simple yet effective uniform down-sampling is utilized for lossy compression of images encrypted with a modulo-256 addition, and the task of image reconstruction from an encrypted down-sampled image is then formulated as a problem of constrained super-resolution (SR) reconstruction. A customized residual dense spatial network (RDSN) is proposed to solve the formulated constrained SR task by taking advantage of spatial attention mechanism (SAM), global skip connection (GSC), and uniform down-sampling constraint (UDC) that is specific to an ETC system. Extensive experimental results show that the proposed ETC scheme achieves significant performance improvement compared with other state-of-the-art ETC methods, indicating the feasibility and effectiveness of the proposed deep-learning based ETC scheme.

People are accustomed to utilizing mobile phones to capture images and uploading them to the cloud due to various incomparable advantages such as saving the storage space on the device. In this context, privacy concerns are raised since images may contain some sensitive information. Encrypting images by traditional schemes can alleviate privacy leak, but the usability is often deprived since it is tough to browse them on the cloud. Recently, Tajik et al. proposed an idealthumbnail-preserving encryption(TPE) scheme to achieve the balance of usability and privacy by leveraging a two-pixel substitution encryption method while the Markov chain is utilized to prove the security. However, the connectivity of Markov chain in this scheme is weak since the length of pixel groups in the encryption process is only two, leading to a long mixing time of achieving the stationary distribution of Markov chain. To this end, we firstly propose a method ofmulti-pixel sum-preserving encryption(MP-SPE) that realizes the encipherment of vectors of arbitrary length. Then, with the help of MP-SPE, a novel flexible ideal TPE scheme (F-TPE) is designed and the connection of Markov chain is improved. The experiments have demonstrated that the proposed scheme can effectively attain the balance between usability and privacy. In addition, F-TPE takes much less time in encrypting compared with the existing work.

Image Quality Assessment (IQA) is a critical task of computer vision. Most Full-Reference (FR) IQA methods have limitation in the accurate prediction of perceptual qualities of the traditional distorted images and the Generative Adversarial Networks (GANs) based distorted images. To address this issue, we propose a novel method by Unifying Dual-Attention and Siamese Transformer Network (UniDASTN) for FR-IQA. An important contribution is the spatial attention module composed of a Siamese Transformer Network and a feature fusion block. It can focus on significant regions and effectively maps the perceptual differences between the reference and distorted images to a latent distance for distortion evaluation. Another contribution is the dual-attention strategy that exploits channel attention and spatial attention to aggregate features for enhancing distortion sensitivity. In addition, a novel loss function is designed by jointly exploiting Mean Square Error (MSE), bidirectional Kullback–Leibler divergence, and rank order of quality scores. The designed loss function can offer stable training and thus enables the proposed UniDASTN to effectively learn visual perceptual image quality. Extensive experiments on standard IQA databases are conducted to validate the effectiveness of the proposed UniDASTN. The IQA results demonstrate that the proposed UniDASTN outperforms some state-of-the-art FR-IQA methods on the LIVE, CSIQ, TID2013, and PIPAL databases.

Detection of manipulated face images has attracted a lot of interest recently. Various schemes have been proposed to tackle this challenging problem, where the patch-based approaches are shown to be promising. However, the existing patch-based approaches tend to treat different patches equally, which do not fully exploit the patch discrepancy for effective feature learning. In this paper, we propose a Patch Diffusion (PD) module which can be integrated into the existing face manipulation detection networks to boost the performance. The PD consists of Discrepancy Patch Feature Learning (DPFL) and Attention-Aware Message Passing (AMP). The DPFL effectively learns the patch features by a newly designed Pairwise Patch Loss (PPLoss), which takes both the patch importance and correlations into consideration. The AMP diffuses the patches through attention-aware message passing in a graph network, where the attentions are explicitly computed based on the patch features learnt in DPFL. We integrate our PD module into four recent face manipulation detection networks, and carry out the experiments on four popular datasets. The results demonstrate that our PD module is able to boost the performance of the existing networks for face manipulation detection.

Research shows that deep neural networks are vulnerable to back-door attacks. The backdoor network behaves normally on clean examples, but once backdoor patterns are attached to examples, back-door examples will be classified into the target class. In the previous backdoor attack schemes, backdoor patterns are not stealthy and may be detected. Thus, to achieve the stealthiness of backdoor patterns, we explore an invisible and example-dependent backdoor attack scheme. Specifically, we employ the backdoor generation network to generate the invisible backdoor pattern for each example, and backdoor patterns are not generic to each other. However, without other measures, the backdoor attack scheme cannot bypass the neural cleanse detection. Thus, we propose adversarial training to bypass neural cleanse detection. Experiments show that the proposed backdoor attack achieves a considerable attack success rate, invisibility, and can bypass the existing defense strategies.

Deep neural network (DNN) watermarking is one of the main techniques to protect the DNN. Although various DNN watermarking schemes have been proposed, none of them is able to resist the DNN encryption. In this paper, we propose an encryption resistent DNN watermarking scheme, which is able to resist the parameter shuffling based DNN encryption. Unlike the existing schemes which use the kernels separately for watermarking embedding, we propose to embed the watermark into the fused kernels to resist the parameter shuffling. We further propose a MappingNet to map the the fused kernels into a higher dimension to increase the watermarking capacity. The MappingNet and the DNN are jointly trained to conduct final watermark embedding. Experimental results indicate the effectiveness of our proposed scheme for resisting the DNN encryption.

Backdoor attack against image classification task has been widely studied and proven to be successful, while there exist few researches on backdoor attack against vision-language models. In this paper, we explore backdoor attack towards image captioning models by poisoning training data. Assuming the attacker has total access to the training dataset, and cannot intervene in model construction or training process. Specifically, a portion of benign training samples is randomly selected to be poisoned. Afterwards, considering that the captions are usually unfolded around objects in an image, we design an object-oriented method to craft poisons, which aims to modify pixel values by a slight range with the modification number proportional to the scale of the current detected object region. After training with the poisoned data, the attacked model behaves normally on benign images, but for poisoned images, the model will generate some sentences irrelevant to the given image. The attack controls the model behavior on specific test images without scarifying the generation performance on benign test images. Our method proves the weakness of image captioning models to backdoor attack and we hope this work can raise the awareness of defending against backdoor attack in the image captioning field.

Recent research has shown that deep learning based methods offer more accurate detection for image steganalysis than the traditional detection paradigm based on rich media models. Existing network architectures based on deep learning, however, stack more and more convolutional layers to increase local receptive fields for image stegananlysis. Limited by hardware, the detector with several convolutional layers may not extract features of steganography images from a global perspective effectively. In this paper, we propose a Convolutional Vision Transformer for image stegananlysis, which can capture both local and global dependencies among noise features. In image processing phase, our network preserves CNN frame for its capacity of producing image noise residuals. Different from previous methods, we utilize the attention mechanism of vision transformer for feature extraction and classification. The proposed network is validated on two public image datasets (BOSSbase 1.01 and ALASKA #2). Experimental results demonstrate that our network performs well over fixed-size dataset and arbitrary-size dataset.

A large number of multi-party conversation scenarios exist in social networks, which have been seldom studied in the field of human-machine conversation. In this paper, we study a novel task of joint learning for addressee selection and response generation in multi-party conversations. Systems are expected to select whom they address and generate the corresponding response. To solve it, we propose an end-to-end addressee selection and response generation (ASRG) model, containing an addressee selection module and a response generation module. In the selection module, we develop an addressee prediction attention scheme to obtain a unique context vector for each candidate, thereby calculating the probability of the candidate more accurately. In the generation module, we propose a Focus Transformer to generate responses. These two modules are jointly learnt to fully explore the correlations between addressee and response. Experimental results show ASRG remarkably outperforms baselines and generates relevant content for different addressees.

Recent advances in linguistic steganalysis have successively applied CNN, RNN, GNN and other efficient deep models for detecting secret information in generative texts. These methods tend to seek stronger feature extractors to achieve higher steganalysis effects. However, we have found through experiments that there actually exists significant difference between automatically generated stego texts and carrier texts in terms of the conditional probability distribution of individual words. Such kind of difference can be naturally captured by the language model used for generating stego texts. Through further experiments, we conclude that this ability can be transplanted to a text classifier by pre-training and fine-tuning to improve the detection performance. Motivated by this insight, we propose two methods for efficient linguistic steganalysis. One is to pre-train a language model based on RNN, and the other is to pre-train a sequence autoencoder. The results indicate that the two methods have different degrees of performance gain compared to the randomly initialized RNN, and the convergence speed is significantly accelerated. Moreover, our methods achieved the best performance compared to related works, while providing a solution for real-world scenario where there are more cover texts than stego texts.

Deep neural networks are vulnerable to malicious fine-tuning attacks such as data poisoning and backdoor attacks. Therefore, in recent research, it is proposed how to detect malicious fine-tuning of neural network models. However, it usually negatively affects the performance of the protected model. Thus, we propose a novel neural network fragile watermarking with no model performance degradation. In the process of watermarking, we train a generative model with the specific loss function and secret key to generate triggers that are sensitive to the fine-tuning of the target classifier. In the process of verifying, we adopt the watermarked classifier to get labels of each fragile trigger. Then, malicious fine-tuning can be detected by comparing secret keys and labels. Experiments on classic datasets and classifiers show that the proposed method can effectively detect model malicious fine-tuning with no model performance degradation.

The existing image embedding networks are basically vulnerable to malicious attacks such as JPEG compression and noise adding, not applicable for real-world copyright protection tasks. To solve this problem, we introduce a generative deep network based method for hiding images into images while assuring high-quality extraction from the destructive synthesized images. An embedding network is sequentially concatenated with an attack layer, a decoupling network and an image extraction network. The addition of decoupling network learns to extract the embedded secret image from the attacked image. We also pinpoint the weaknesses of the adversarial training for robustness in previous works and build our improved real-world attack simulator. Experimental results demonstrate the superiority of the proposed method against typical digital attacks by a large margin, as well as the performance boost of the recovered images with the aid of progressive recovery strategy. Besides, we are the first to robustly hide three secret images.

Image cropping can be maliciously used to manipulate the layout of an image and alter the underlying meaning. Previous image cropping detection schemes only predict whether an image has been cropped, ignoring which part of the image is cropped. This paper presents a novel robust watermarking network for image cropping localization. We train an anti-cropping processor (ACP) that embeds a watermark into a target image. The visually indistinguishable protected image is then posted on the social network instead of the original image. At the recipient’s side, ACP extracts the watermark from the attacked image, and we conduct feature matching on the original and extracted watermark to locate the position of the cropping. We further extend our scheme to detect tampering attacks on the attacked image, and a simple yet efficient method (JPEG-Mixup) is proposed that noticeably improves the generalization of JPEG robustness. We demonstrate that our scheme is the first to provide high-accuracy and robust image cropping localization.

The security of data storage is a big issue for companies. They must take effective steps to prevent valuable image datasets from being stolen for illegal commercial purposes. While data encryption is a common solution, it drastically down-grades the visual quality and therefore forbids common yet trivial use such as eye-checking without a decryption. We present a novel solution for dataset protection in this scenario by robustly and reversibly transform the images into adver-sarial images. An invertible Image Dataset Protection NET-work (IDP-Net) is developed to introduce slight and acceptable changes to the images within the dataset. The protected images can be published and circulated on the social networks instead of their original version. Malicious attackers can only observe the images but cannot train pirated models based on them. Meanwhile, IDP-Net ensures the performance of au-thorized models, namely, trusted users can revert the protection and retrieve the protected images to their original version. Therefore, the dataset can be stored within the pro-tected version alone to ensure safety. Extensive experiments demonstrate that IDP-Net can better protect the security of image dataset against defensive methods compared to previ-ous methods. Besides, the introduced distortion is acceptable and the original images can be reconstructed nearly error-free.

Different from supervised learning which requires all training examples to be labeled, Semi-Supervised Learning (SSL) learns from a few labeled training examples and a large number of unlabeled training examples. Recently, studies have shown that SSL is also vulnerable to backdoor attacks. However, their performance is poor. In this paper, we propose a novel unlabeled backdoor poisoning attack against SSL, where only poisoning unlabeled examples in the training set to inject the backdoor into the network. Specifically, our attack exploits the vulnerability of SSL algorithms in guessing pseudo labels of unlabeled examples. We propose a backdoor generation network to generate poisoned examples with both the backdoor property and misleading function, thus inducing the victim model itself to mislabel the poisoned examples as the target class and causing the backdoor to be injected. Our attack achieves favorable attack success rates on the SSL algorithm while bypassing backdoor defenses.

Generative steganography (GS) is a new data hiding manner, featuring direct generation of stego media from secret data. Existing GS methods are generally criticized for their poor performances. In this paper, we propose a novel flow based GS approach - Generative Steganographic Flow (GSF), which provides direct generation of stego images without cover image. We take the stego image generation and secret data recovery process as an invertible transformation, and build a reversible bijective mapping between input secret data and generated stego images. In the forward mapping, secret data is hidden in the input latent of Glow model to generate stego images. By reversing the mapping, hidden data can be extracted exactly from generated stego images. Furthermore, we propose a novel latent optimization strategy to improve the fidelity of stego images. Experimental results show our proposed GSF has far better performances than SOTA works.

Backdoor attacks are rapidly emerging threats to deep neural networks (DNNs). In the backdoor attack scenario, attackers usually implant the backdoor into the target model by manipulating the training dataset or training process. Then, the compromised model behaves normally for benign input yet makes mistakes when the pre-defined trigger appears. In this paper, we analyze the drawbacks of existing attack approaches and propose a novel imperceptible backdoor attack. We treat the trigger pattern as a special kind of noise following a multinomial distribution. A U-net-based network is employed to generate concrete parameters of multinomial distribution for each benign input. This elaborated trigger ensures that our approach is invisible to both humans and statistical detection. Besides the design of the trigger, we also consider the robustness of our approach against model diagnose-based defences. We force the feature representation of malicious input stamped with the trigger to be entangled with the benign one. We demonstrate the effectiveness and robustness against multiple state-of-the-art defences through extensive datasets and networks. Our trigger only modifies less than 1\% pixels of a benign image while the modification magnitude is 1. Our source code is available at https://github.com/Ekko-zn/IJCAI2022-Backdoor.

Steganography usually modifies cover media to embed secret data. A new steganographic approach called generative steganography (GS) has emerged recently, in which stego images (images containing secret data) are generated from secret data directly without cover media. However, existing GS schemes are often criticized for their poor performances. In this paper, we propose an advanced generative steganography network (GSN) that can generate realistic stego images without using cover images. We firstly introduce the mutual information mechanism in GS, which helps to achieve high secret extraction accuracy. Our model contains four sub-networks, i.e., an image generator (G), a discriminator (D), a steganalyzer (S), and a data extractor (E). D and S act as two adversarial discriminators to ensure the visual quality and security of generated stego images. E is to extract the hidden secret from generated stego images. The generator G is flexibly constructed to synthesize either cover or stego images with different inputs. It facilitates covert communication by concealing the function of generating stego images in a normal generator. A module named secret block is designed to hide secret data in the feature maps during image generation, with which high hiding capacity and image fidelity are achieved. In addition, a novel hierarchical gradient decay (HGD) skill is developed to resist steganalysis detection. Experiments demonstrate the superiority of our work over existing methods.

With the rapid development of neural network, a vast number of neural network models have been developed in recent years, which condense numerous manpower and hardware resource. However, the original models are at risk of being pirated by the adversary to obtain illegal profits. On the other hand, malicious tampering on models, such as implanting the vulnerability and backdoor, may cause catastrophic consequences. We propose a model hash generator method to protect neural network models. Detailedly, our model hash sequence is composed of two parts: one is the model piracy identification hash, which is based on the dynamic convolution and a dual-branch network; the other is the model tampering localization hash, which can help the model owner to accurately detect the tampered locations for further recovery. Experimental results demonstrate the effectiveness of the proposed method for neural network model protection.

Online social networks have stimulated communications over the Internet more than ever, making it possible for secret message transmission over such noisy channels. In this paper, we propose a Coverless Image Steganography Network, called CIS-Net, that synthesizes a high-quality image directly conditioned on the secret message to transfer. CIS-Net is composed of four modules, namely, the Generation, Adversarial, Extraction, and Noise Module. The receiver can extract the hidden message without any loss even the images have been distorted by JPEG compression attacks. To disguise the behaviour of steganography, we collected images in the context of profile photos and stickers and train our network accordingly. As such, the generated images are more inclined to escape from malicious detection and attack. The distinctions from previous image steganography methods are majorly the robustness and losslessness against diverse attacks. Experiments over diverse public datasets have manifested the superior ability of anti-steganalysis.

Face anonymization with generative models have become increasingly prevalent since they sanitize private information by generating virtual face images, ensuring both privacy and image utility. Such virtual face images are usually not identifiable after the removal or protection of the original identity. In this paper, we formalize and tackle the problem of generating identifiable virtual face images. Our virtual face images are visually different from the original ones for privacy protection. In addition, they are bound with new virtual identities, which can be directly used for face recognition. We propose an Identifiable Virtual Face Generator (IVFG) to generate the virtual face images. The IVFG projects the latent vectors of the original face images into virtual ones according to a user specific key, based on which the virtual face images are generated. To make the virtual face images identifiable, we propose a multi-task learning objective as well as a triplet styled training strategy to learn the IVFG. We evaluate the performance of our virtual face images using different face recognizers on diffident face image datasets, all of which demonstrate the effectiveness of the IVFG for generate identifiable virtual face images.

In this paper, we show that neural networks can hide a specific task while finishing a common one. We leverage the excellent fitting ability of neural networks to train two tasks simultaneously. In a classification example, the first task is normally trained by the traditional crossentropy loss. The output of the second task can be obtained by the product of the penultimate layer and a predefined random matrix. A well-trained network looks like a benign classifier and will not arouse suspicion. For certain people, they can use a predefined random matrix to turn on the second covert function of the neural network. Experimental results demonstrate that the hidden tasks can achieve satisfactory performance without affecting the original tasks.

A lot of excellent neural network models are valuable wealth to the field of artificial intelligence, which may be plagiarized and distributed without authorization. For this reason, few research establishments and industries reveal the internals of their neural network models. To authenticate suspicious pirated models, this letter proposes a gray-box hashing method for the neural network models that designed for image classification. In the proposed method, the hash sequence of original model can be extracted without knowing both the structure and weight parameters except the vectors in output layer. To the best of our knowledge, this is the first work focusing on gray-box perceptual model hashing to identify and authenticate neural network models. Experimental results show that our method performs satisfactory perceptual robustness and discrimination capability, and can effectively classify perceptual similar versions of the original model and distinct models.

How to deal with the adversarial examples attracts a lot of interest recently. In this paper, we propose HF-Defend: a novel method to defend against the adversarial examples based on halftoning. Unlike the existing schemes, HF-Defend thoroughly removes the adversarial perturbations by transforming a 8-bit grayscale image (or one of the RGB channels in a color image) into a 1-bit halftoned image. To maintain the image quality and content, we propose a reconstruction module for the recovery of both the main contents and fine details of the image. In particular, we newly design a nonlinear low-pass filter to extract the main contents, and a FilterNet to establish a high-pass filter for the reconstruction of fine details. Experimental results demonstrate the advantage of our HF-Defend over the existing schemes.

This paper proposes a multi-source data hiding scheme for neural networks, in which multiple senders can simultaneously transmit different secret data to a receiver using the same neural network. In our scheme, multiple senders execute data embedding in the overlapping position of a network, so that the existence of other senders can be concealed. Each sender uses a unique embedding key to scramble the parameters for embedding, preventing an attacker or other senders from pretending him. In addition, data embedding is achieved during the training process of the neural network instead of modifying the neural network after training. As a result, the operation of data embedding has a tiny impact on the original neural network. On the receiver side, the corresponding embedding key is used to extract the secret data, while additional decoding networks are unnecessary. Experiments verified the effectiveness and security of our scheme, including embedding capacity and undetectability.

Videos are prone to tampering attacks that alter the meaning and deceive the audience. Previous video forgery detection schemes find tiny clues to locate the tampered areas. However, attackers can successfully evade supervision by destroying such clues using video compression or blurring. This paper proposes a video watermarking network for tampering localization. We jointly train a 3D-UNet-based watermark embedding network and a decoder that predicts the tampering mask under simulated attacks. The perturbation made by watermark embedding is close to imperceptible. Considering that there is no off-the-shelf differentiable video codec simulator, we propose to mimic video compression by ensembling simulation results of other typical attacks, e.g., JPEG compression and blurring, as an approximation. Experimental results demonstrate that our method generates watermarked videos with good imperceptibility and robustly and accurately locates tampered areas within the attacked version.

Data hiding with deep neural networks (DNNs) has experienced impressive successes in recent years. A prevailing scheme is to train an autoencoder, consisting of an encoding network to embed (or transform) secret messages in (or into) a carrier, and a decoding network to extract the hidden messages. This scheme may suffer from several limitations regarding practicability, security, and embedding capacity. In this work, we describe a different computational framework to hide images in deep probabilistic models. Specifically, we use a DNN to model the probability density of cover images, and hide a secret image in one particular location of the learned distribution. As an instantiation, we adopt a SinGAN, a pyramid of generative adversarial networks (GANs), to learn the patch distribution of one cover image. We hide the secret image by fitting a deterministic mapping from a fixed set of noise maps (generated by an embedding key) to the secret image during patch distribution learning. The stego SinGAN, behaving as the original SinGAN, is publicly communicated; only the receiver with the embedding key is able to extract the secret image. We demonstrate the feasibility of our SinGAN approach in terms of extraction accuracy and model security. Moreover, we show the flexibility of the proposed method in terms of hiding multiple images for different receivers and obfuscating the secret image.

Federated learning (FL) is a distributed machine learning framework, which allows multiple users to collaboratively train and obtain a global model with high accuracy. Currently, FL is paid more attention by researchers and a growing number of protocols are proposed. This article first analyzes the security vulnerabilities of the VerifyNet and VeriFL protocols, and proposes a new aggregation protocol for FL. We use additive homomorphic encryption and double masking to simultaneously protect the user’s local model and the aggregated global model while most of the existing protocols only consider the privacy of the local model. Also, linear homomorphic hash and digital signature are used to achieve traceable verification, which means the users can not only verify the aggregation results, but also be able to identify the wrong epoch if the results are wrong. In summary, our protocol can realize the privacy of the local model and global model and achieve verification traceability even if the cloud server colludes with malicious users. The experimental results show that the proposed protocol improves the security of FL without decreasing the efficiency of the users and classification accuracy of the training model.

In this paper, we propose an enhancing steganographic scheme by random generation and ensemble stego selection. Different from existing steganography that only focuses on distortion function designing, our scheme considers both distortion model and optimized stego generation. In specific, for given cover, we firstly train an universal steganalyzer to calculate its gradient map, which is referenced to randomly adjust cost distribution of this cover. Multiple candidate stegos are sequentially generated by combining adjusted cost and syndrome trellis coding. Furthermore, we build an ensemble selection mechanism to effectively determine the candidate that is closest to the statistical characteristics of cover image as the final steganographic image. Comprehensive experiments demonstrate that compared to existing state-of-the-art schemes, our scheme can significantly boost the anti-steganalysis capability.

Some robust data hiding approaches have been proposed to transmit secret data through online social networks (OSNs). Traditional steganalysis tools are inefficient in detecting these tailored steganographic methods. Although some algorithms have been developed to remove the hidden data of images, they are criticized for their low secret removal rate and poor image quality. Moreover, most of them are nongeneric methods, and multiple models must be trained to fit different algorithms. In this letter, we propose a general end-to-end data hiding break approach for OSNs, called the secret data remover (SDR). It is universal for algorithms of both robust steganography and robust watermarking, with which stego images are directly input and clean ones with the same appearances will then be generated. Moreover, we develop two novel techniques, namely, image fusion and latent renewal, to enhance the image quality and improve the overall performance. Experiments show that our proposed method achieves superior performance compared to state-of-the-art works. Hidden secret data are cleared while image quality is maintained or even slightly improved. At the same time, our work can be easily deployed in OSNs.

In this letter, we propose a novel linguistic steganographic method that directly conceals a token-level secret message in a seemingly-natural steganographic text generated by the off-the-shelf BERT model equipped with Gibbs sampling. Compared with all modification based linguistic steganographic methods, the proposed method does not modify a given cover text. Instead, the proposed method utilizes the secret message to directly generate the steganographic text. Compared with mainstream generation based linguistic steganographic methods, the proposed method enables the receiver to collect the tokens of the specific positions to directly constitute the secret message, without a complex decoding process and much side information shared between the sender and the receiver. Experimental results show that the proposed method can generate fluent, highly readable steganographic texts, while enjoying pretty good anti-steganalysis ability. This work has great application potential in real-time covert communication.

Video watermarking on the dual tree-complex wavelet (DT CWT) domain is shown to be effective to offer high robustness. Existing DT CWT video watermarking schemes tend to use all the coefficients on the high-pass sub-bands of the DT CWT domain for watermark embedding and detection, which lack of investigating the correlations among different sub-bands and fail to explore the stable coefficients for robust watermarking. In this paper, we propose a novel DT CWT video watermarking scheme by exploring the stable coefficients on joint sub-bands. We first extract a set of candidate coefficients by applying block singular value decomposition (SVD) on the DT CWT domain. Then, we simulate the watermark embedding by modifying the candidate coefficients on each sub-band, from which we identity two pairs of strongly correlated sub-bands termed as the joint sub-bands. The watermark is eventually embedded by modifying the candidate coefficients of the joint sub-bands on a level which is adaptively chosen according to the video resolution. During the watermark detection, we identify and extract a set of stable coefficients from the candidate coefficients of the joint sub-bands to verify the ownership of the video. Extensive experiments demonstrate the advantage of our propose scheme over the latest DT CWT based schemes, which also performs better than the existing non-DT CWT transformed domain video watermarking schemes.

JPEG Reversible data hiding (RDH) aims at correctly extracting hidden data and perfectly recovering the original JPEG image. By combining different frequency selection and block ordering manners, appropriate AC coefficients can be determined to achieve an efficient JPEG RDH scheme using histogram shifting (HS) mechanism. Nevertheless, existing methods only rely on rough frequency band distortion model by involving all DCT blocks, ignoring the dynamic influence of block ordering on embedding block selection. As a result, JPEG image containing hidden data may have an obvious distortion and file size expansion due to an inappropriate frequency band selection. To address the aforementioned problem, we design a new JPEG RDH scheme to optimize distortion model with frequency priority reassignment. Our method firstly orders all DCT blocks by referring to zero AC coefficients of each block. Subsequently, based on the given secret data, only partial ordered blocks are selected to calculate the distortion of each DCT frequency, which can further optimize unit distortion caused by shiftable coefficients. Furthermore, we employ the adjustment parameter to adaptively reassign the priority of each frequency band based on its influence on file size expansion, which can significantly reduce file size expansion of the marked JPEG image. Extensive experiments demonstrate that our method outperforms existing JPEG RDH methods with better visual quality and smaller file size increment of the marked image.

This article proposes a repeatable data hiding framework for digital images, in which the distortion caused by data hiding is invariable no matter how many times the embedding operation is executed. As a result, the usability of images can be always guaranteed. To achieve repeatable data hiding, we deduce the theoretical modification probabilities of the elements in cover image (an image used for data hiding). Then we design an embedding framework to make the practical modification probabilities of cover elements equal to the deduced ones. When additional data is embedded into cover image with the deduced probabilities, the modification-trace of current embedding is replaced by the latter embedding. That means multiple embeddings do not produce new modification-trace, so that the distortion caused by data hiding is invariable. Therefore, the repeatability of data hiding can be guaranteed. Finally, we describe some applications of repeatable data hiding, e.g., logistics management, authentication database management, and steganography, to show the practicability of our framework.

As a specific data hiding technique, reversible data hiding (RDH) has recently received extensive attention. By this technique, both the embedded data and the original cover image can be exactly extracted from the marked image. In our previous work, a general expansion-shifting model for RDH is proposed by introducing the so-called reversible embedding function (REF). With REF, RDH can be designed and the corresponding rate-distortion formulations can be established, providing an approach to optimize the reversible embedding performance. In this paper, by extending our previous work, optimal REF for one-dimensional histogram is investigated, and all optimal REF are derived in this case when the maximum modification to the cover pixel is limited as a small value. Moreover, based on the derived optimal REF for one-dimensional histogram and multiple histograms modification, a practical RDH scheme is presented and it is experimental verified better than some state-of-the-art algorithms in terms of capacity-distortion performance.

JPEG-domain enhancement improves the visual quality of JPEG images by directly manipulating the decoded DCT (discrete cosine transform) coefficients, which inevitably leads to mixed compression and enhancement artifacts. Existing forensic methods that merely consider JPEG artifacts are unsuitable to address such mixed artifacts and hence suffer a considerable performance decline in compression parameter estimation and lack the ability to estimate the enhancement parameter. This work attempts to explore the characterization of the mixed artifacts, and to further estimate both the enhancement and compression parameters of JPEG-domain enhanced images. First, a statistical likelihood function is proposed to characterize the periodicity of DCT coefficients, which can measure how well an enhanced image is de-enhanced back to its JPEG compressed version given the compression and enhancement parameters. The proposed likelihood function reaches its maximum if the parameters match their true values. Then, a forensic method of enhancement detection and parameter estimation is developed based on the proposed likelihood function for two kinds of classical JPEG-domain enhancement. Specifically, JPEG-domain enhanced images are detected by thresholding a scalar feature computed upon the likelihoods, and the enhancement and compression parameters are estimated by locating the maximal likelihood. In addition, mathematical proof of the de-enhancement feasibility is provided. Experimental results demonstrate that the proposed method outperforms the compared methods in both enhancement detection and parameter estimation.

Image quality assessment (IQA) is an important task of image processing and has diverse applications, such as image super-resolution reconstruction, image transmission and monitoring systems. This paper proposes a perceptual hashing algorithm with complementary color wavelet transform (CCWT) and compressed sensing (CS) for reduced-reference (RR) IQA. The CCWT is exploited to decompose input color image into different sub-bands. Since the calculation of CCWT uses all color channels without discarding any information, the distortions introduced by digital operations on color channels are preserved in the CCWT sub-bands. The block-based CS is used to extract features from the CCWT sub-bands. As the Euclidean distance between the block-based CS features is slightly influenced by content-preserving operations, perceptual features constructed by Euclidean distances are robust, discriminative and compact. Hash sequence is finally determined by quantifying the perceptual features. Effectiveness of the proposed hashing is verified by various experiments on four open image databases. Experimental results demonstrate that the proposed hashing is superior to some state-of-the-art algorithms in terms of classification and RR IQA application.

Reversible data hiding in encrypted images (RDHEI), an essential branch of reversible data hiding (RDH), has been in development for more than a decade. For most existing stream-cipher-based RDHEI algorithms, encryption schemes are often not the same; thus, these schemes have different effects on the encrypted images. As a result, it is not reasonable to compare the embedding rates (ERs) of RDHEI algorithms directly as we do for plaintext RDH algorithms. However, to our knowledge, many studies focus on the performance of embedding but neglect the influence of the encryption. To compare the performance of stream-cipher-based RDHEI algorithms more reasonably, this paper proposes a novel comprehensive measure to evaluate state-of-the-art RDHEI algorithms. First, the characteristics of the stream-cipher-based RDHEI algorithms are divided into two categories according to the encryption and embedding processes. Next, we use correlation and redundancy to evaluate the influence of encryption schemes and also use ER, computation complexity, visual quality, and algorithm stability to evaluate the embedding schemes. In the end, in order to combine all six indexes into the final evaluation measure, we standardize each index before applying the radar chart. The experimental results show the evaluation results of the recent RDHEI algorithms via a comprehensive analysis and demonstrate the guiding significance of the proposed method for the current RDHEI algorithm selection.

Reversible data hiding in encrypted images (RDHEI) is an effective technique of data security. Most state-of-the-art RDHEI methods do not achieve desirable payload yet. To address this problem, we propose a new RDHEI method with hierarchical embedding. Our contributions are twofold. (1) A novel technique of hierarchical label map generation is proposed for the bit-planes of plaintext image. The hierarchical label map is calculated by using prediction technique, and it is compressed and embedded into the encrypted image. (2) Hierarchical embedding is designed to achieve a high embedding payload. This embedding technique hierarchically divides prediction errors into three kinds: small-magnitude, medium-magnitude, and large-magnitude, which are marked by different labels. Different from the conventional techniques, pixels with small-magnitude/large-magnitude prediction errors are both used to accommodate secret bits in the hierarchical embedding technique, and therefore contribute a high embedding payload. Experiments on two standard datasets are discussed to validate the proposed RDHEI method. The results demonstrate that the proposed RDHEI method outperforms some state-of-the-art RDHEI methods in payload. The average payloads of the proposed RDHEI method are 3.4568 bpp and 3.6823 bpp for BOWS-2 dataset and BOSSbase dataset, respectively.

With the popularity of cloud storage services, people are increasingly accustomed to storing images in the cloud. However, cloud storage services raise privacy concerns, e.g., leakage of images to unauthorized third parties and service providers may exploit image detection technologies to portrait users without permission. Although privacy concerns can be solved by encrypting images before they are uploaded to the cloud, traditional encryption methods significantly affect the usability and user experience, for example, users cannot preview images in the cloud. Recently, Marohnet al.proposed two approximate thumbnail-preserving encryption schemes, called DRPE and TPE-LSB, to balance the privacy and usability of images in the cloud. However, both schemes have defects that either the decryption may fail or the ciphertext images have poor performance in perceived quality and too many noise points after decryption. To this end, we pertinently propose a high-fidelity thumbnail-preserving encryption scheme (HF-TPE). Compared with the previous works, on the one hand, the HF-TPE scheme not only ensures the correct decryption of ciphertext images, but also makes the ciphertext thumbnails more close to the plaintext images perceptually. On the other hand, the decrypted thumbnails have lower noise intensity and upper limit of the number of noises. In addition, simulation experiments further show that the HF-TPE scheme can guarantee users’ usability.

As a branch of reversible data hiding (RDH), lossless data hiding (LDH) technique is important especially. Because LDH can not only reconstruct the cover image losslessly but also keep the visual quality of the marked image no degradation. This article proposes a new LDH scheme for JPEG images by general variable length code (VLC) mapping. In this scheme, the run size values are first reordered. Then a feasible solution space is generated. A simulated embedding model is established to find the optimal solution from the feasible solution space. The optimal mapping relationship is constructed according to the optimal solution. According to the optimal GVM relationship, the Huffman table in the file header is modified and then the additional data can be embedded by replacing the used VLC with the VLCs in the same mapping set. Experimental results demonstrate that most of the JPEG images using the proposed scheme cause less file size increments than previous RDH schemes while keeping the marked JPEG image with no distortion. Furthermore, the proposed scheme can obtain high embedding capacity.

In recent decades, a large number of perceptual image hashing schemes have been designed to secure the authenticity and integrity of digital images. However, the feasible criterion to evaluate the performances of hashing schemes has not been developed yet. To this end, a unified performance evaluation method for perceptual image hashing schemes is proposed in this paper. The proposed evaluation method contains six modules: robustness, discrimination, tampering detection, security, computational efficiency and hash length. The order relationship analysis (ORA) is employed to assign the score proportion of each module in accordance with the relative importance of performance, which allows the customizability of user. The real scores of modules and the outputted final score can reflect the performances of perceptual image hashing schemes intuitively and convincingly. Experimental results demonstrate that the proposed evaluation method is practical and effective for the complete and comprehensive evaluation of perceptual image hashing schemes.

Multi-view clustering aims at simultaneously obtaining a consensus underlying subspace across multiple views and conducting clustering on the learned consensus subspace, which has gained a variety of interest in image processing. In this paper, we propose the Semi-supervised Structured Subspace Learning algorithm for clustering data points from Multiple sources (SSSL-M). We explicitly extend the traditional multi-view clustering with a semi-supervised manner and then build an anti-block-diagonal indicator matrix with small amount of supervisory information to pursue the block-diagonal structure of the shared affinity matrix. SSSL-M regularizes multiple view-specific affinity matrices into a shared affinity matrix based on reconstruction through a unified framework consisting of backward encoding networks and the self-expressive mapping. The shared affinity matrix is comprehensive and can flexibly encode complementary information from multiple view-specific affinity matrices. An enhanced structural consistency of affinity matrices from different views can be achieved and the intrinsic relationships among affinity matrices from multiple views can be effectively reflected in this manner. Technically, we formulate the proposed model as an optimization problem, which can be solved by an alternating optimization scheme. Experimental results over seven different benchmark datasets demonstrate that better clustering results can be obtained by our method compared with the state-of-the-art approaches.

Generating falsified faces by artificial intelligence, widely known as DeepFake, has attracted attention worldwide since 2017. Given the potential threat brought by this novel technique, forensics researchers dedicated themselves to detect the video forgery. Except for exposing falsified faces, there could be extended research directions for DeepFake such as anti-forensics. It can disclose the vulnerability of current DeepFake forensics methods. Besides, it could also enable DeepFake videos as tactical weapons if the falsified faces are more subtle to be detected. In this paper, we propose a GAN model to behave as an anti-forensics tool. It features a novel architecture with additional supervising modules for enhancing image visual quality. Besides, a loss function is designed to improve the efficiency of the proposed model. After experimental evaluations, we show that the DeepFake forensics detectors are susceptible to attacks launched by the proposed method. Besides, the proposed method can efficiently produce anti-forensics videos in satisfying visual quality without noticeable artifacts. Compared with the other anti-forensics approaches, this is tremendous progress achieved for DeepFake anti-forensics. The attack launched by our proposed method can be truly regarded as DeepFake anti-forensics as it can fool detecting algorithms and human eyes simultaneously.

Most computer vision algorithms require parameter adjustment according to the image noise level. Conventionally, the additive white Gaussian noise (AWGN) model is widely used in most noise estimation algorithms; however, this assumption does not hold in the real world where the noise from cameras is more complex, and it is more appropriate to assume the signal-dependent noise (SDN) model. In this paper, we focus on the SDN model while considering the nonlinear radiometric calibration inside an actual camera, and propose an algorithm to efficiently estimate the noise level function (NLF), which is defined as the noise standard deviation with respect to image intensity. First, the input image is divided into overlapping patches, and noise samples are estimated in the linear transform domain. The confidence levels of the noise samples and the prior of the camera response function are then employed as constraints for the recovery of the NLF. Finally, the noise samples and constraints are represented in a convex optimization problem. The experimental results using both real and synthetic noisy images demonstrate the superiority of the proposed method. In addition, the estimated NLFs are incorporated into two well-known denoising schemes, non-local means and BM3D, and shows significant improvements in denoising SDN-polluted images.

Neural style transfer has been developed in recent years, where both performance and efficiency have been greatly improved. However, most existing methods do not transfer the brushstrokes information of style images well. In this article, we address this issue by training a multi-granularity brushstrokes network based on a parallel coding structure. Specifically, we first adopt the content parsing module to obtain the spatial distribution of content image and the smoothness of different regions. Then, different brushstrokes features are transformed by a multi-granularity style-swap module guided by the region content map. Finally, the stylized features of the two branches are fused to enhance the stylized results. The multi-granularity brushstrokes network is jointly supervised by a new multi-layer brushstroke loss and pre-existing loss. The proposed method is close to the artistic drawing process. In addition, we can control whether the color of the stylized results tend to be the style image or the content image. Experimental results demonstrate the advantage of our proposed method compare with the existing schemes.

Adversarial attacks slightly perturb the original image to fool deep neural networks (DNN). Various schemes have been proposed to generate uncompressed adversarial images, which are usually ineffective after being compressed during the transmission. In this paper, we propose to generate JPEG adversarial images directly from the DNN. Two adversarial rounding schemes, including fast rounding and iterative rounding, are proposed to produce quantized DCT coefficients of JPEG adversarial images. Both schemes use the gradients of adversarial images in the DCT domain to guide the rounding. In fast rounding, we propose a novel indicator to evaluate the importance of the DCT coefficients for adversarial attacks, where only those with high importance are adversarially rounded to reduce the distortion. In iterative rounding, we additionally incorporate a loss function to mea-sure the distortion caused by adversarial rounding. The experiments show that our schemes can obtain effective JPEG adversarial images with low distortion.

In this paper, we propose a novel reversible face privacy-preserving scheme. Before uploading facial images onto the cloud, we first cover the facial region with mosaic and train an encoder to generate protected images with original facial information embedded. We train another classifier with protected images for facial expression recognition and a decoder for recovering original facial images. On the cloud service, protected images provide little identity information to malicious attackers. For low-privileged users, they can use the provided classifier to do computer vision tasks with protected images. For authorized users, after content recovery, the nor-mal usage of the facial images will not be affected. Experimental results show that the proposed method is effective in facial images recovery. In addition, the protected images can maintain similar accuracy on typical computer vision tasks compared to the original images.

Recent works have demonstrated that neural networks are vulnerable to adversarial examples. Although existing methods have achieved satisfactory attack success rates, most adversarial examples can be detected by statistical analysis and further removed. In previous methods, adversarial perturbations are added using adversarial loss and distance metrics, in which the positions of modified pixels are not considered. In this paper, we elaborate a microscopical regularization that introduces adversarial perturbations onto rich texture regions. The microscopical regularization is used to evaluate pixel-level differences between a normal image and its adversarial version. We further propose a novel optimization strategy of modification probability matrices to minimize the loss function that satisfies the restriction of L∞. Through extensive experiments, we show that our method can resist statistical analysis by a large margin and achieve better visual quality than others. The proposed microscopical regularization can also be combined with existing approaches to enhance the undetectability and robustness.

Face anti-spoofing is an important step for secure face recognition. One of the main challenges is how to learn and build a general classifier that is able to resist various presentation attacks. Recently, the patch-based face anti-spoofing schemes are shown to be able to improve the robustness of the classifier. These schemes extract subtle liveness cues from small local patches independently, which do not fully exploit the correlations among the patches. In this paper, we propose a Patch-based Compact Graph Network (PCGN) to diffuse the subtle liveness cues from all the patches. Firstly, the image is encoded into a compact graph by connecting each node with its backward neighbors. We then propose an asymmetrical updating strategy to update the compact graph. Such a strategy aggregates the node based on whether it is a sender or receiver, which leads to better message-passing. The updated graph is eventually decoded for making the final decision. We conduct the experiments on four public databases with four intra-database protocols and eight cross-database protocols, the results of which demonstrate the effectiveness of our PCGN for face anti-spoofing.

We introduce Imuge, an image tamper resilient generative scheme for image self-recovery. The traditional manner of concealing image content within the image are inflexible and fragile to diverse digital attack, i.e. image cropping and JPEG compression. To address this issue, we jointly train a U-Net backboned encoder, a tamper localization network and a decoder for image recovery. Given an original image, the encoder produces a visually indistinguishable immunized image. At the recipient's side, the verifying network localizes the malicious modifications, and the original content can be approximately recovered by the decoder, despite the presence of the attacks. Several strategies are proposed to boost the training efficiency. We demonstrate that our method can recover the details of the tampered regions with a high quality despite the presence of various kinds of attacks. Comprehensive ablation studies are conducted to validate our network designs.

With the rapid development of deep learning-based techniques, the general public can use a lot of "machine learning as a service" (MLaaS), which provides end-to-end machine learning solutions. Taking the image classification task as an example, users only need to update their dataset and labels to MLaaS without requiring the specific knowledge of machine learning or a concrete structure of the classifier. Afterward, MLaaS returns a well-trained classifier to them. In this paper, we explore a potential novel task named "deep neural network retrieval" and its application which helps MLaaS to save computation resources. MLaaS usually owns a huge amount of well-trained models for various tasks and datasets. If a user requires a task that is similar to the one having been finished previously, MLaaS can quickly retrieve a model rather than training from scratch. We propose a pragmatic solution and two different approaches to extract the semantic feature of DNN representing the function of DNN, which is analogous to the usage of word2vec in natural language processing. The semantic feature of DNN can be expressed as a vector by feeding some well-designed litmus images into the DNN or as a matrix by reversely constructing the most desired input of DNN. Both methods can consider the topological information and parameters of the DNN simultaneously. Extensive experiments, including multiple datasets and networks, also demonstrate the efficiency of our method and show the high accuracy of deep neural network retrieval.

Abstract Animated emoji is a kind of GIF image, which is widely used in online social networks (OSN) for its efficiency in transmitting vivid and personalized information. Aiming at realizing covert communication in animated emoji, this paper proposes an improved steganography framework in animated emoji. We propose a self-reference algorithm to improve the steganography security. Meanwhile, the relations between adjacent frames of the cover GIF image are considered to further improve the distortion function. After that we embed the secret message into the GIF image using the popular framework of Syndrome Trellis Coding (STC). Experimental results show that the proposed method can provide better security performances than state-of-the-art works.

QR and LU factorizations are two basic mathematical methods for decomposition and dimensionality reduction of large-scale matrices. However, they are too complicated to be executed for a limited client because of big data. Outsourcing computation allows a client to delegate the tasks to a cloud server with powerful resources and therefore greatly reduces the client’s computation cost. However, the previous methods of QR and LU outsourcing factorizations need multiple interactions between the client and cloud server or have low accuracy and efficiency in large-scale matrix applications. In this paper, we propose a noninteractive and efficient outsourcing algorithm of large-scale QR and LU factorizations. The proposed scheme is based on the specific perturbation method including a series of consecutive and sparse matrices, which can be used to protect the original matrix and obtain the results of factorizations. The generation and inversion of sparse matrix has small workloads on the client’s side, and the communication cost is also small since the client does not need to interact with the cloud server in the outsourcing algorithms. Moreover, the client can verify the outsourcing result with a probability of approximated to 1. The experimental results manifest that as for the client, the proposed algorithms reduce the computational overhead of direct computation successfully, and it is most efficient compare with the previous ones.

Universal Adversarial Perturbations (UAPs), which is type of image-agnostic adversarial attack, has been deeply investigated for Convolutional Neural Networks due to its high efficiency. On the other hand, as an architecture based on self-attention mechanism, Vision Transformers (ViTs) have boomed and been widely applied to solve various computer vision problems since most recent years. In this letter, we delve into the robustness of ViTs against universal adversarial attack and propose an inheritance attention matrix-based UAPs (IAM-UAP). Specifically, we introduce the inheritance attention weight matrix (IAM), which represents the integration of global information of the input patch sequence. Further, we propose a perturbation optimization objective based on IAM to confuse the global information integration of ViTs. The empirical results confirm the attacking capability of IAM-UAP on ViTs with a moderate attacking rate. In addition, we also disclose that the patch size of ViTs is an latent factor influencing the robustness against the universal attack.

Content-adaptive steganography embeds information into the cover image adaptively under the guidance of embedding probabilities (also known as selection channel) of the image elements, which can also be obtained by the steganalyzer. Therefore, some adaptive steganalysis schemes with selection channel have been proposed to detect content-adaptive steganography. Existing selection-channel-aware CNN-based steganalyzers usually incorporate the embedding probability into the first convolutional layer. They may fail to make full use of embedding probability information because this information incorporated into the first layer may disappear when it propagates to deep convolutional layers. To address this issue, we propose embedding probability guided module to adaptively enhance the features from different levels of network. Moreover, these embedding probability guided features from different levels are progressively integrated to jointly make final decisions. Experimental results prove that our approach can outperform existing selection-channel-aware approaches in both the spatial domain and JPEG domain.

Convolutional neural networks (CNNs) are widely used in many aspects and achieve excellent results. Due to the authorization from different users, we need to consider the right management caused by multi-user. This paper proposes a novel concept of hierarchical authorization of CNNs, and it can help owners control the output results according to accesses. To realize this idea, we refer to differential privacy and use the Laplace mechanism to perturb the output of the model to vary degrees. In experiments, we run on CIFAR-10 and MNIST datasets using ResNet and VGG, and the results show our method has significant grading effects.

As the deep hashing technique has been widely used in large-scale image retrieval, the corresponding security issue is getting more and more attention. Recent studies have found that deep image classifiers are vulnerable to adversarial example attacks and produce misleading classifications. Therefore, in order to study the robustness of deep hashing based retrieval system to adversarial example, in this letter, we propose a novel adversarial example generation algorithm, non-targeted deep hashing attack (NDHA), which uses the anchor-moving strategy to continuously modify anchor image to cross the search correlation boundary and maximize Hamming distance between the hash codes of adversarial example and query image. The generated adversarial example can make the retrieved result semantically irrelevant to query image. Extensive experiments show that the proposed NDHA can efficiently produce imperceptible perturbation, which is effective for attacking deep hashing based retrieval systems.

Recent linguistic steganalysis methods model texts as sequences and use deep learning models to extract discriminative features for detecting the presence of secret information in texts. However, natural language has a complex syntactic structure and sequences have limited representation ability for text modeling. Moreover, previous methods tend to extract features from local continuous word sequences, which cannot effectively model global characteristics. In this paper, we present a linguistic steganalysis method with graph neural network. In the proposed method, texts are translated as directed graphs with the associated information, where nodes denote words and edges show associations between the words. By training a graph convolutional network for feature extraction, each node of a graph can collect contextual information to update self-expression, accordingly effectively solving the problem of poor representation of polysemous words. Meanwhile, we adopt a globally-shared matrix to record correlation strengths between words so that each text can effectively utilize the global information to obtain the better self-representation. Experimental results have shown that the proposed work achieves the state-of-the-art performance comparing with the previous works.

Currently,mainstream 3D steganographic algorithms embed data through geometric modifications. To enhance the anti-steganalysis ability of such algorithms,we propose an additive Gaussian noise model for 3D mesh steganography. Our work starts with a theoretical analysis for correlations of vertex coordinate components. Based on this analysis,the whole embedding operation is decomposed into three independent tasks that target three vertex coordinate components,respectively. To obtain vertex-changing probabilities,we construct a payload-limited sender (PLS) problem aimed at minimizing the Kullback-Leibler divergence between the cover and stego mesh distributions for a given payload. Next,vertex coordinates are quantified so that the PLS problem can be solved in practice. Finally,a ternary embedding scheme is taken as a typical steganographic case. Although the proposed Gaussian model is simple and idealized,the experimental results demonstrate that our algorithm possesses the adaptivity and can achieve better anti-steganalysis performance at low payloads than most modern high-capacity 3D mesh steganography based on the geometric modification.

Outsourcing computation allows an outsourcer with limited resource to delegate the computation load to a powerful server without the exposure of true inputs and outputs. It is well known that modular exponentiation is one of the most expensive operations in public key cryptosystems. Currently, most of outsourcing algorithms for modular exponentiation are based on two untrusted servers or have small checkability with single server. In this paper, we first propose an efficient outsourcing algorithm of modular exponentiation based on two untrusted servers, where the outsourcer can detect the error based on Euler theorem with a probability of 1 if one of the servers misbehaves. We then present an outsourcing algorithm of modular exponentiation with single server, and the outsourcer can also check the failure with a probability of 1. Therefore, the proposed algorithm with single server improves efficiency and checkability simultaneously compare with the previous ones. Finally, we provide the experimental evaluations to demonstrate that the proposed two algorithms are the most efficient ones in all of the outsourcing algorithms for an outsourcer.

In this paper, a novel perceptual image hashing scheme based on convolutional neural network (CNN) with multiple constraints is proposed, in which our deep hashing network learns the process of features extraction automatically according to the training target and then generates the final hash sequence. The combination of convolutional and pooling layers is to reduce the size of input image while deepening the channels. Then, we construct two pairs of constraints and integrate them into an overall constraint function through a strategy of weight allocation. In order to guarantee the robustness and discrimination of deep hashing network simultaneously, a new training method is developed to adjust the training set structure dynamically according to the changes of constraint values. Experimental results show that the proposed deep hashing network can achieve a satisfactory balance between perceptual robustnzess and discrimination while maintaining security. Based on the large-scale test set, receiver operating characteristic (ROC) curves,${F}_{1}$scores and equal error rate (EER) demonstrate the superiority of our scheme in terms of content authentication compared with some state-of-the-art schemes.

This paper proposes a new framework of lossless data hiding (LDH) in JPEG images. The proposed framework contains two algorithms, i.e., the optimized basic LDH and the relay transfer based extension. In the basic algorithm, we aim to preserve the filesize after data embedding. The data hiding process is optimized by variable-length-code (VLC) mapping, combination and permutation. In the extended algorithm, we focus on embedding more bits into the bitstream with a condition that the filesize increment is allowed. To decrease the filesize increment, we propose a relay transfer based algorithm to preprocess the JPEG bitstream. Subsequently, we embed data into the processed bitstream using the basic LDH. Both algorithms provide better performances than previous arts. After lossless data hiding, the marked JPEG bitstream is compliant to common JPEG decoders. Since all operations are implemented on VLCs and the Huffman codes, no distortion is generated on the image pixels. Experimental results demonstrate that the proposed approach outperforms previous methods.

Watermarking neural networks is a quite important means to protect the intellectual property (IP) of neural networks. In this paper, we introduce a novel digital watermarking framework suitable for deep neural networks that output images as the results, in which any image outputted from a watermarked neural network must contain a certain watermark. Here, the host neural network to be protected and a watermark-extraction network are trained together, so that, by optimizing a combined loss function, the trained neural network can accomplish the original task while embedding a watermark into the outputted images. This work is totally different from previous schemes carrying a watermark by network weights or classification labels of the trigger set. By detecting watermarks in the outputted images, this technique can be adopted to identify the ownership of the host network and find whether an image is generated from a certain neural network or not. We demonstrate that this technique is effective and robust on a variety of image processing tasks, including image colorization, super-resolution, image editing, semantic segmentation and so on.

Most current reversible data hiding (RDH) techniques are designed for uncompressed images. However, JPEG images are more commonly used in our daily lives. Up to now, several RDH methods for JPEG images have been proposed, yet few of them investigated the adaptive data embedding as the lack of accurate measurement for the embedding distortion. To realize adaptive embedding and optimize the embedding performance, in this article, a novel RDH scheme for JPEG images based on multiple histogram modification (MHM) and rate-distortion optimization is proposed. Firstly, with selected coefficients, the RDH for JPEG images is generalized into a MHM embedding framework. Then, by estimating the embedding distortion, the rate-distortion model is formulated, so that the expansion bins can be adaptively determined for different histograms and images. Finally, to optimize the embedding performance in real time, a greedy algorithm with low computation complexity is proposed to derive the nearly optimal embedding efficiently. Experiments show that the proposed method can yield better embedding performance compared with state-of-the-art methods in terms of both visual quality and file size preservation.

Because of the importance of digital images and their extensive application to digital watermarking, block chain, access control, identity authentication, distributive storage in the cloud and so on, image secret sharing (ISS) is attracting ever-increasing attention. Share authentication is an important issue in its practical application. However, most ISS schemes with share authentication ability require a dealer to participate in the authentication (namely, dealer participatory authentication). In this paper, we design an ISS for a$(k,n)$-threshold with separate share authentication abilities of both dealer participatory authentication and dealer nonparticipatory authentication. The advantages of polynomial-based ISS and visual secret sharing (VSS) are skillfully fused to achieve these two authentication abilities without sending a share by using a screening operation. In addition, the designed scheme has the characteristics of low decryption (authentication) complexity, lossless decryption and no pixel expansion. Experiments and theoretical analyses are performed to show the effectiveness of the designed scheme.

Batch steganography is a technique that hides information into multiple covers. To achieve a better performance on the security of data hiding, we propose a novel strategy of batch steganography using a generative network. In this method, the approaches of cover selection, payload allocation, and distortion evaluation are considered in the round. We define a quality metric to evaluate the distortion between the cover image and the stego. When training the generation function, we define an objective function containing two parts: the entropy loss and the steganalytic loss. While the entropy loss is used to represent the gap between the payload inside stego images and the entire embedding capacity, the steganalytic loss is used to assess the data embedding impact using the proposed quality metric. With back-propagation, we minimize the objective function to obtain an optimal solution. Accordingly, different payloads can be allocated to different images, and the ± 1 modification probability for pixels in each cover can be calculated. Finally, we embed information into the selected images by STC. Experimental results show that the proposed method achieves a better undetectability against modern steganalytic tools.

Face anti-spoofing is an important step for secure face recognition. In this paper, we target on building a general classifier to detect the face images with spoofing medium contours (termed as SMCs for simplicity). To this end, we consider the task of face anti-spoofing as the detection of SMCs from the image. We propose and train a Contour Enhanced Mask R-CNN (CEM-RCNN) model for the detection. This model detects the existence of the SMCs by incorporating the contour objectness which measures how likely an object contains the SMCs. The experimental results demonstrate the generality of the CEM-RCNN for identifying the face images with SMCs, which performs significantly better than the state-of-the-art on the cross-database scenario.

Deep neural networks (DNNs) have been proven vulnerable to backdoor attacks, where hidden features (patterns) trained to a normal model, which is only activated by some specific input (called triggers), trick the model into producing unexpected behavior. In this article, we create covert and scattered triggers for backdoor attacks, invisible backdoors, where triggers can fool both DNN models and human inspection. We apply our invisible backdoors through two state-of-the-art methods of embedding triggers for backdoor attacks. The first approach on Badnets embeds the trigger into DNNs through steganography. The second approach of a trojan attack uses two types of additional regularization terms to generate the triggers with irregular shape and size. We use the Attack Success Rate and Functionality to measure the performance of our attacks. We introduce two novel definitions of invisibility for human perception; one is conceptualized by the Perceptual Adversarial Similarity Score (PASS) and the other is Learned Perceptual Image Patch Similarity (LPIPS). We show that the proposed invisible backdoors can be fairly effective across various DNN models as well as four datasets MNIST, CIFAR-10, CIFAR-100, and GTSRB, by measuring their attack success rates for the adversary, functionality for the normal users, and invisibility scores for the administrators. We finally argue that the proposed invisible backdoor attacks can effectively thwart the state-of-the-art trojan backdoor detection approaches.

Criminal sketching aims to draw an approximation portrait of the criminal suspect by details of the criminal suspect that the observer can remember. However, even for a professional artist, it would need much time to complete sketching and draw a good portrait. It therefore motivates us to study forensic sketching with a generative adversarial network based architecture, which allows us to synthesize a real-like portrait of the criminal suspect described by an eyewitness. The proposed work contains two steps: sketch generation and portrait generation. For the former, a facial outline is sketched based on the descriptive details. For the latter, the facial details are completed to generate a portrait. To make the portrait more realistic, we use a portrait discriminator, which can not only learn the discriminative features between the faces synthesized by the generator and the real faces, but also recognize the face attributes. Experiments have shown that this work achieves promising performance for criminal sketching.

With the rise of cryptocurrencies, blockchain, which is the underlying technology of them, has gained more attention and been used in the Internet of Things (IoT) and other fields. However, there are bottlenecks that hinder its application, such as the storage capacity. Due to the large number of IoT devices which always act as data generators in many systems, the transactions will be generated at a high rate. The storage problem will be more serious in IoT. In this article, to expand the capacity of blockchain, for each peer, we select old blocks which are created previously and less likely to be queried and store them in the cloud. Based on this idea, we develop objective functions related to query probability, storage cost, and local space occupancy, which naturally narrows down the problem to block selection. The results can be obtained by solving a multiobjective optimization problem. We design a nondominated sorting genetic algorithm with clustering (NSGA-C), which changes the method of selecting individuals from the critical dominance layer by adding clustering to ensure diversity. A suitable solution can be selected from the Pareto set to fulfil the requirements of different users. We then compare the algorithm with the improved NSGA-II and NSGA-III, which both add integer constraints to the decision variables. The results show that our method is better than NSGA-II and NSGA-III in terms of local space occupancy in the blockchain application. In addition, it can also effectively avoid the risk of block overflow.

This letter focus on a practical scenario of cover selection for steganography, in which a part of the available images of the sender have been processed to improve visual quality, e.g., contrast enhancement, image denoising. In this case, not only the embedding distortion (caused by steganography), but also the processing distortion (caused by processing) should be considered when selecting cover image. We propose a cover selection method to combine the two kinds of distortion together to measure the suitability for steganography of the available images. To calculate the processing distortion, a classifier is trained to distinguish the processed images with the original ones. The classifier is then used to measure the possibility of the existence of processing. High possibility means high processing distortion. In addition, the current distortion minimization framework designed for steganography is employed to calculate the embedding distortion. Finally, both kinds of distortion are combined to form the total distortion, and the image with the minimal total distortion is selected as cover. Using the selected image for embedding, high undetectability can be achieved.

Steganography plays an important role in information hiding. With the development of steganalysis, traditional steganography faces more detection threat. It is necessary to improve security of current steganographic methods. One effective way is to generate suitable covers for steganography, which can be achieved by adversarial learning. In this letter, we propose a new approach for quickly constructing high-quality adversarial images. Compared with original images, the generative adversarial images are more suitable for carrying secret information. According to the characteristics of steganography, we design a new loss function in adversarial attacks, which makes the adversarial images obtain the similar classification results before and after steganography. In addition, to further improve security of the adversarial images, we also make use of the zero-sum idea of generative adversarial networks. Experimental results show that the proposed method can significantly enhance security of steganography.

High-dimensional feature extraction based on co-occurrence matrix improves the detection performance of steganalysis, but it is difficult to be realized for massive image data by an analyzer with limited computational ability. We solve this problem by verifiable outsourcing computation, which allows a computationally weak client to outsource the evaluation of a function to a powerful but untrusted server. In this paper, we propose a verifiable outsourcing scheme of feature extraction based on co-occurrence matrix with single untrusted cloud server. The original images are protected from the server by using a projection of one to many with trapdoor, which can be realized by a symmetric probabilistic encryption scheme we present. The analyzer can obtain true results of feature extraction and detect any failure with a probability of 1 if the server misbehaves. Finally, we provide the simulations on the outsourcing of extracting ccJRM features in cloud computing. The theory analysis and experiment result also show that the proposed outsourcing scheme could greatly decrease the computation cost of the analyzer without exposure of the original images and extraction results.

Steganalysis is a technique for detecting the existence of secret information hidden in digital media. In this paper, we propose a novel scheme for JPEG steganalysis. In this scheme, we first design the diverse base filters which are able to obtain the image residuals from various directions. Then, we propose a cascade filter generation strategy to construct a set of high order cascade filters from the base filters. We further select the cascade filters with the maximum diversity. The selected filters are convolved with the decompressed JPEG image to obtain residuals which capture the subtle embedding traces. The residuals, termed as the maximum diversity cascade filter residual, are eventually used to extract features to train an ensemble classifier for classification. The experiments are carried out on the detection of stego-images generated using common JPEG steganographic schemes, the results of which demonstrate the effectiveness of the proposed scheme for JPEG steganalysis.

With the widespread use of biometrics recognition systems, it is of paramount importance to protect the privacy of biometrics. In this paper, we propose to protect the fingerprint privacy by the artificial fingerprint, which is generated based on three pieces of information, i) the original minutiae positions; ii) the artificial fingerprint orientation; and iii) the artificial minutiae polarities. To make it real-look alike and diverse, we propose to generate the artificial fingerprint orientation by a model taking both the global and local fingerprint orientation into account. Its parameters can be easily guided by an user specific key with simple constraints. The artificial minutiae polarities are generated from the same key, where a block based and a function based approach are proposed for the minutiae polarities generation. These information are properly integrated to form a real-look alike artificial fingerprint. It is difficult for the attacker to distinguish such a fingerprint from the real fingerprints. If it is stolen, the complete fingerprint minutiae feature will not be compromised, and we can generate a different artificial fingerprint using another key. Experimental results show that the artificial fingerprint can be recognized accurately.

In the presence of several critical issues during data acquisition in industrial-informatics-based applications, like Internet of Things (IoT) and smart grid, this article proposes a novel framework based on compressive sensing (CS) and a cascade chaotic system (CCS). This framework can ensure low overhead, confidentiality, and authentication. Based on CS and the CCS, three technologies, including CCS-driven CS, CCS-driven local perturbation, and authentication mechanism, are introduced in the proposed data acquisition framework in this article. CCS-driven CS generates the measurement matrix with chaotic initial conditions and avoids the transmission of a large-size measurement matrix. CCS-driven local perturbation only perturbs a small number of elements in the original measurement matrix for each sampling and avoids the regeneration of the large-size measurement matrix. The authentication mechanism employs the authentication password and the access password to deal with the passive tampering attack and the active tampering attack, respectively. Moreover, the permutation-diffusion structure is used to encrypt the obtained measurements to enhance the security. Both theoretical and experimental analyses validate low overhead, confidentiality, and effective authentication of the proposed data acquisition framework for a number of industrial-informatics-based applications, such as IoT.

With the development of cloud storage and privacy protection, reversible data hiding in encrypted images (RDHEI) has attracted increasing attention as a technology that can: embed additional data in the image encryption domain, ensure that the embedded data can be extracted error-free, and the original image can be restored losslessly. In this paper, a high-capacity RDHEI algorithm based on multi-MSB (most significant bit) prediction and Huffman coding is proposed. At first, multi-MSB of each pixel was predicted adaptively and marked by Huffman coding in the original image. Then, the image was encrypted by a stream cipher method. At last, the vacated space can be used to embed additional data by multi-MSB substitution. Experimental results show that our method achieved higher embedding capacity while comparing with the state-of-the-art methods.

This paper proposes a new steganography method for hiding data into dynamic GIF (Graphics Interchange Format) images. When using the STC framework, we propose a new algorithm of cost assignment according to the characteristics of dynamic GIF images, including the image palette and the correlation of interframes. We also propose a payload allocation algorithm for different frames. First, we reorder the palette of GIF images to reduce the modifications on pixel values when modifying the index values. As the different modifications on index values would result in different impacts on pixel values, we assign the elements with less impact on pixel values with small embedding costs. Meanwhile, small embedding costs are also assigned for the elements in the regions that the interframe changes are large enough. Finally, we calculate an appropriate payload for each frame using the embedding probability obtained from the proposed distortion function. Experimental results show that the proposed method has a better security performance than state-of-the-art works.

Currently many important advances in digital media field have been achieved through the ensemble method. In image steganalysis, the application of classifiers has evolved from the early single classifier to the ensemble classifiers. The performance of the ensemble classifier is better than that of a single classifier, but the classifiers may have a certain degree of redundancy. Therefore, it is of great significance to study how to reduce the number of the ensemble classifiers under the premise of ensuring the classification performance. In this letter, we propose a selective ensemble method in image steganalysis based on deep Q network, which combines reinforcement learning with convolutional neural network and are seldom seen in ensemble pruning. This method improves the generalization performance of the model, and reduces the size of ensemble as well. The experimental results show that the proposed method has a certain degree of effect on the ensemble classification optimization of image steganalysis in both spatial and frequency domains.

This paper proposes a novel framework of reversible data hiding in encrypted JPEG bitstream. We first provide a JPEG encryption algorithm to encipher a JPEG image to a smaller size and keep the format compliant to JPEG decoders. After an image owner uploads the encrypted JPEG bitstreams to cloud storage, the server embeds additional messages into the ciphertext to construct a marked encrypted JPEG bitstream. During data hiding, we propose a combined embedding algorithm including two stages, the Huffman code mapping and the ordered histogram shifting. The embedding procedure is reversible. When an authorized user requires a downloading operation, the server extracts additional messages from the marked encrypted JPEG bitstream and recovers the original encrypted bitstream losslessly. After downloading, the user obtains the original JPEG bitstream by a direct decryption. The proposed framework outperforms previous works on reversible data hiding in encrypted images. First, since the tasks of data embedding/extraction and bitstream recovery are all accomplished by the server, the image owner and the authorized user are required to implement no extra operations except JPEG encryption or decryption. Second, the embedding payload is larger than state-of-the-art works.

In this paper, a novel lossy compression scheme for encrypted image based on image inpainting is proposed. In order to maintain confidentiality, the content owner encrypts the original image through a modulo-256 addition encryption and block permutation to mask image content. Then, the third party, such as a cloud server, can compress the selective encrypted image before transmitting to the receiver. During compression, encrypted blocks are categorized into four sets corresponding to different complexity degrees in plaintext domain without the loss of security. By allocating various bit rates to the encrypted blocks from different sets, flexible compression can be achieved with difference quantization. After parsing and decoding the compressed bit stream, the receiver first recovers partial encrypted pixels and then decrypts them. The other missing pixels are further recovered with the assistance of image inpainting based on a total variation model, and the final reconstructed image can be produced. Experimental results demonstrate that the proposed scheme achieves better rate-distortion performance than some of the state-of-the-art schemes.

Posting images on social network platforms is happening everywhere and every single second. Thus, the communication channels offered by various social networks have a great potential for covert communication. However, images transmitted through such channels will usually be JPEG compressed, which fails most of the existing steganographic schemes. In this paper, we propose a novel image steganography framework that is robust for such channels. In particular, we first obtain the channel compressed version (i.e., the channel output) of the original image. Secret data is embedded into the channel compressed original image by using any of the existing JPEG steganographic schemes, which produces the stego-image after the channel transmission. To generate the corresponding image before the channel transmission (termed the intermediate image), we propose a coefficient adjustment scheme to slightly modify the original image based on the stego-image. The adjustment is done such that the channel compressed version of the intermediate image is exactly the same as the stego-image. Therefore, after the channel transmission, secret data can be extracted from the stego-image with 100% accuracy. Various experiments are conducted to show the effectiveness of the proposed framework for image steganography robust to JPEG compression.

Data hiding usually involves the alteration of a cover signal for embedding a secret message. In this paper, we propose a construction based data hiding technique which transforms a secret message into a fingerprint image directly. Unlike the conventional data hiding techniques, this scheme does not need any cover signals to participate. Instead, it generates the fingerprint image based on a piece of hologram phase constructed from the secret message. The hologram phase consists of the spiral phase and the continuous phase. Firstly, we propose to map the secret message to a polynomial and encode it into a set of points with different polarities, from which the spiral phase is computed and constructed. Then, we construct the continuous phase by decomposing a fingerprint image synthetically generated. The spiral phase and the continuous phase are combined to form the hologram phase. This is eventually used to construct a fingerprint image in a common form such as a grayscale fingerprint image, a binary fingerprint image, or a thinned fingerprint image. The secret message can be extracted by detecting the encoded points in the constructed fingerprint. We conduct the experiments by constructing fingerprint images with ordinary sizes, the results show that the secret message can be extracted accurately. It is also difficult to detect the existence of secret message from the constructed fingerprint images.

This paper proposes a novel image retrieval scheme over encrypted cloud data, which achieves high efficiency and confidentiality. For the purpose of improving search efficiency, an index tree is often deployed in the image retrieval scheme. Meanwhile, the confidentiality of the sensitive cloud data, such as outsourced images, index tree, and query request, is also a key issue. Firstly, a balanced binary clustering algorithm is exploited over the integrated image features composed of basic features, such as HSV histogram and DCT histogram, yielding a balanced binary tree (BBT). In particular, due to the adoption of a balanced index tree, our scheme can achieve logarithmic search time. Secondly, the secure inner product is employed to encrypt the index vector and query feature. Finally, to resist the statistical attack of the frequency distribution of the retrieved results, we copy the database and merge the subtree of encrypted BBT to blind the search results. Security analysis and experimental results show that the proposed scheme is secure and efficient.

International audience

This letter proposes a batch steganographic method, which combines cover-selection and payload-allocation by steganographic distortion optimization. We first proved that with the value of payload increasing, the first-order derivative of steganographic distortion of a single cover is monotonically increasing. Then, we deduced that the first-order derivative of steganographic distortion of covers that selected from a given set should be equal if the total steganographic distortion of the corresponding selected covers is minimal. Finally, an algorithm was designed to combine cover-selection and payload-allocation, so that the optimal stego-covers can be obtained. Experiment results show that the undetectability is obviously improved when using the proposed steganographic method.

While most techniques of reversible data hiding in encrypted images (RDH-EI) are developed for uncompressed images, this paper provides a separable reversible data hiding protocol for encrypted JPEG bitstreams. We first propose a JPEG encryption algorithm, which enciphers an image to a smaller size and keeps the format compliant to JPEG decoder. After a content owner uploads the encrypted JPEG bitstream to a remote server, a data hider embeds an additional message into the encrypted copy without changing the bitstream size. On the recipient side, the original bitstream can be reconstructed losslessly using an iterative recovery algorithm based on the blocking artifact. Since message extraction and image recovery are separable, anyone who has the embedding key can extract the message from the marked encrypted copy. Experimental results show that the proposed method outperforms a previous work in terms of separation capability, embedding capacity and security.

Similar to conventional compression with the original, unencrypted image as the input, the recently emerged compression on encrypted images generally exploits statistical correlation of natural images to improve compression efficiency. Most of these compression schemes in the literature leverage statistical correlation at the content-owner or service-provider side, which would either increase the computational burden on the content-owner or disclose statistical distributions to the service-provider and thus probably hinder their practical applications. Through analysis on properties of the compression system for encrypted data, we believe that it is more preferable to exploit statistical correlation of natural images at the receiver side with both encryption key and sufficient computational capability, which in turn would improve compression efficiency while achieving low computational complexity and sufficient security for the content owner and the service provider. In light of this, we use the Markov random field (MRF) to characterize binary images in the spatial domain and represent it with a factor graph. The constructed MRF representation of the binary image in the factor graph is then integrated seamlessly with the factor graph for low-density parity check (LDPC)-based decompression, yielding a joint factor graph for binary image reconstruction. By deriving message update equations for the joint factor graph, we develop a new lossless compression scheme for encrypted binary images, which involves stream-cipher-based encryption, LDPC-based compression, and factor-graph-based image reconstruction. Preferable parameters for the proposed scheme are first determined numerically on a specific binary image and then applied to other binary images. Extensive simulations show that significant improvements in terms of compression bit rate over the state of the art are achieved, demonstrating the feasibility and effectiveness of the proposed scheme.

The problem of securely outsourcing computation has received widespread attention due to the development of cloud computing and mobile devices. In this paper, we first propose a secure verifiable outsourcing algorithm of single modular exponentiation based on the one-malicious model of two untrusted servers. The outsourcer could detect any failure with probability 1 if one of the servers misbehaves. We also present the other verifiable outsourcing algorithm for multiple modular exponentiations based on the same model. Compared with the state-of-the-art algorithms, the proposed algorithms improve both checkability and efficiency for the outsourcer. Finally, we utilize the proposed algorithms as two subroutines to achieve outsource-secure polynomial evaluation and ciphertext-policy attributed-based encryption (CP-ABE) scheme with verifiable outsourced encryption and decryption.

Since there is good potential for practical applications such as encrypted image authentication, content owner identification and privacy protection, reversible data hiding in encrypted image (RDHEI) has attracted increasing attention in recent years. In this paper, we propose and evaluate a new separable RDHEI framework. Additional data can be embedded into a cipher image previously encrypted using Josephus traversal and a stream cipher. A block histogram shifting (BHS) approach using self-hidden peak pixels is adopted to perform reversible data embedding. Depending on the keys held, legal receivers can extract only the embedded data with the data hiding key, or, they can decrypt an image very similar to the original with the decryption key. They can extract both the embedded data and recover the original image error-free if both keys are available. The results demonstrate that higher embedding payload, better quality of decrypted-marked image and error-free image recovery are achieved.

The existing quaternion-type moments (QTMs) are based on the quaternion representation (QR) of color images. However, this representation creates redundancy when using four-dimensional quaternions to represent color images with three components. In this paper, for RGB-D images, the QR is improved by combining both color and depth information, which is invariant to lighting and color variations. The improved QR fully utilizes the four-dimensional quaternion domain. The new QTMs (NQTMs) are defined using the improved QR. They are combined with the quaternion back-propagation neural network (QBPNN) for RGB-D object recognition. The experimental results demonstrate that the NQTMs outperform our previous QTMs considering only color information.

In an identity-based encryption (IBE) scheme, how to revoke users from the system is a difficult problem when their private keys are compromised. The private key generator (PKG) updates the private keys for all unrevoked users and has high computation load when a large number of users are included. We propose an IBE scheme with verifiable outsourced revocation based on the one-malicious model of two servers. In the proposed scheme, PKG delegates the key update operations to the two servers for all unrevoked users. The PKG can detect the failure with probability 1 if one of the servers misbehaves. Our scheme is proven fully secure and verifiable against chosen-plaintext attack (CPA) without random oracles. The servers cannot execute the key update operations for any revoked user even if they collude. The experiment shows the time cost for PKG in the outsourcing algorithm is much smaller than that for directly updating the private keys for all unrevoked users.

This paper develops a retrieval scheme for encrypted JPEG images based on a Markov process. In our scheme, the stream cipher and permutation encryption are combined to encrypt discrete cosine transform (DCT) coefficients for protecting JPEG image content’s confidentiality. And thus, it is easy for the content owner to achieve the encrypted JPEG images uploaded to a database server. In the image retrieval stage, although the server does not know the plaintext content of a given encrypted query image, he can still extract image feature calculated from the transition probability matrices related to DCT coefficients, which indicate the intra-block, inter-block, and inter-component dependencies among DCT coefficients. And these three types of dependencies are modeled by the Markov process. After that, with the multi-class support vector machine (SVM), the feature of the encrypted query image can be converted into a vector with low dimensionality determined by the number of image categories. The encrypted database images are conducted similarly. After low-dimensional vector representation, the similarity between the encrypted query image and database image may be evaluated by calculating the distance of their corresponding feature vectors. At the client side, the returned encrypted images similar to the query image can be decrypted to the plaintext images with the help of the encryption key.

This work proposes a spatial steganalysis scheme based on local textural features and double dimensionality reduction. First, an image is filtered by multiple filters to obtain a number of residual images. Local textural patterns are obtained by comparing the pixel values with the neighbors' value in each residual image. By combining all local textural patterns, a high-dimensional textural feature set is formed. Then, principal component analysis is used to perform double dimensionality reduction for high-dimensional textural features. In the first dimensionality reduction stage, the correlation from the same filter is eliminated, while the correlation from different filters can be also eliminated in the second dimensionality reduction stage. Finally, a textural feature set with low dimensionality is proposed and can be effectively used in steganalysis. Experimental results show that proposed textural feature set can efficiently detect adaptive steganographic schemes in spatial domain. Copyright © 2014 John Wiley & Sons, Ltd.

This paper proposes a method of reversible data hiding in encrypted images (RDH-EI) based on progressive recovery. Three parties are involved in the framework, including the content owner, the data-hider, and the recipient. The content owner encrypts the original image using a stream cipher algorithm and uploads a ciphertext to the server. The data-hider on the server divides the encrypted image into three channels and, respectively, embeds different amount of additional bits into each one to generate a marked encrypted image. On the recipient side, additional message can be extracted from the marked encrypted image, and the original image can be recovered without any errors. While most of the traditional methods use one criterion to recover the whole image, we propose to do the recovery by a progressive mechanism. Rate-distortion of the proposed method outperforms state-of-the-art RDH-EI methods.

This letter proposes a novel scheme for spatial steganalysis based on contrast of residuals (CoR). After selecting complex blocks from an uncompressed image by a fluctuation function, the residuals are calculated from the selected blocks and the whole image after applying diverse filters. The CoR is represented as an angle and the norm of residuals is considered as the corresponding weight of angle, which is used as the new steganalysis feature. In the proposed scheme, no quantization and truncation is required and the effective information of long-range dependencies among pixels is kept properly. Also, the dimensionality of feature is linear with the number of residuals. The accuracy of proposed scheme is evaluated on HUGO and WOW algorithms, and the experimental results show that the proposed CoR feature has superior performance at low embedding rate with lower dimensionality.

This paper proposes a novel scheme of reversible data hiding in encrypted images using distributed source coding. After the original image is encrypted by the content owner using a stream cipher, the data-hider compresses a series of selected bits taken from the encrypted image to make room for the secret data. The selected bit series is Slepian-Wolf encoded using low-density parity check codes. On the receiver side, the secret bits can be extracted if the image receiver has the embedding key only. In case the receiver has the encryption key only, he/she can recover the original image approximately with high quality using an image estimation algorithm. If the receiver has both the embedding and encryption keys, he/she can extract the secret data and perfectly recover the original image using the distributed source decoding. The proposed method outperforms the previously published ones.

This paper proposes lossless, reversible, and combined data hiding schemes for ciphertext images encrypted by public-key cryptosystems with probabilistic and homomorphic properties. In the lossless scheme, the ciphertext pixels are replaced with new values to embed the additional data into several least significant bit planes of ciphertext pixels by multilayer wet paper coding. Then, the embedded data can be directly extracted from the encrypted domain, and the data-embedding operation does not affect the decryption of original plaintext image. In the reversible scheme, a preprocessing is employed to shrink the image histogram before image encryption, so that the modification on encrypted images for data embedding will not cause any pixel oversaturation in plaintext domain. Although a slight distortion is introduced, the embedded data can be extracted and the original image can be recovered from the directly decrypted image. Due to the compatibility between the lossless and reversible schemes, the data-embedding operations in the two manners can be simultaneously performed in an encrypted image. With the combined technique, a receiver may extract a part of embedded data before decryption, and extract another part of embedded data and recover the original plaintext image after decryption.

This work presents a retrieval scheme for encrypted JPEG images based on Markov process. In our scheme, the stream cipher and permutation encryption are combined to encrypt JPEG images, which are then uploaded to a database server. After that, the server without knowing the original content can extract features from the transition probability matrices of the AC coefficients of encrypted query image, in which those coefficients are modeled by Markov process. With the multi-class support vector machine (SVM), the features of encrypted query image can be converted into a vector with low dimensionality determined by the number of image categories. The encrypted database images are conducted similarly. After low-dimensional vector representation, the similarity between encrypted query image and database image may be measured by calculating the distance of their corresponding vectors. At the client side, the encrypted images returned by the server are decrypted to the plaintext images using encryption key. The proposed scheme can preserve file compliance and file size for encrypted JPEG images, while providing privacy-preserving image retrieval.

Extreme learning machine (ELM), proposed by Huang et al., was developed for generalized single hidden layer feedforward networks with a wide variety of hidden nodes. ELMs have been proved very fast and effective especially for solving function approximation problems with a predetermined network structure. However, it may contain insignificant hidden nodes. In this paper, we propose dynamic adjustment ELM (DA-ELM) that can further tune the input parameters of insignificant hidden nodes in order to reduce the residual error. It is proved in this paper that the energy error can be effectively reduced by applying recursive expectation-minimization theorem. In DA-ELM, the input parameters of insignificant hidden node are updated in the decreasing direction of the energy error in each step. The detailed theoretical foundation of DA-ELM is presented in this paper. Experimental results show that the proposed DA-ELM is more efficient than the state-of-art algorithms such as Bayesian ELM, optimally-pruned ELM, two-stage ELM, Levenberg-Marquardt, sensitivity-based linear learning method as well as the preliminary ELM.

This correspondence proposes a framework of reversible data hiding (RDH) in an encrypted JPEG bitstream. Unlike existing RDH methods for encrypted spatial-domain images, the proposed method aims at encrypting a JPEG bitstream into a properly organized structure, and embedding a secret message into the encrypted bitstream by slightly modifying the JPEG stream. We identify usable bits suitable for data hiding so that the encrypted bitstream carrying secret data can be correctly decoded. The secret message bits are encoded with error correction codes to achieve a perfect data extraction and image recovery. The encryption and embedding are controlled by encryption and embedding keys respectively. If a receiver has both keys, the secret bits can be extracted by analyzing the blocking artifacts of the neighboring blocks, and the original bitstream perfectly recovered. In case the receiver only has the encryption key, he/she can still decode the bitstream to obtain the image with good quality without extracting the hidden data.

This paper proposes a novel scheme of compressing encrypted images with auxiliary information. The content owner encrypts the original uncompressed images and also generates some auxiliary information, which will be used for data compression and image reconstruction. Then, the channel provider who cannot access the original content may compress the encrypted data by a quantization method with optimal parameters that are derived from a part of auxiliary information and a compression ratio-distortion criteria, and transmit the compressed data, which include an encrypted sub-image, the quantized data, the quantization parameters and another part of auxiliary information. At receiver side, the principal image content can be reconstructed using the compressed encrypted data and the secret key. Experimental result shows the ratio-distortion performance of the proposed scheme is better than that of previous techniques.

Histogram-based watermarking schemes are invariant against pixel permutations and can be combined with permutation-based ciphers. However, typical histogram-based watermarking schemes based on comparison of histogram bins are prone to de-synchronization attacks, where the whole histogram is shifted by a certain amount. In this paper we investigate the possibility of avoiding this kind of attacks by synchronizing the embedding and detection processes, using the mean of the histogram as a calibration point. The resulting watermarking scheme is resistant to three common types of shifts of the histogram, while the advantages of previous histogram-based schemes, especially commutativity of watermarking and permutation-based encryption, are preserved.

ABSTRACT This work proposes a novel scheme of commutative reversible data hiding and encryption. In encryption part, the gray values of two neighboring pixels are masked by same pseudo‐random bits. In data‐hiding part, the additional data are embedded into various bit planes with a reversible manner, and a parameter optimization method based on a capacity–distortion criterion is used to ensure a good performance. Because the data space used for accommodating the additional data is not affected by the encryption operation, the data embedded in plain/encrypted domain can be extracted from encrypted/plain domain, and the way of insertion/extraction of additional data in plain domain is same as that in encrypted domain. Furthermore, the original image can be recovered without any error from an image containing additional data. Copyright © 2013 John Wiley & Sons, Ltd.

This work proposes a JPEG steganalytic scheme based on high-dimensional features and Bayesian ensemble classifier. The proposed scheme employs 15700 dimension features calculated from the co-occurrence matrices of DCT coefficients and coefficient differences, which indicate the intra-block and inter-block dependencies of image content. Furthermore, a number of sub-classifiers trained on the features are integrated as an ensemble classifier with a Bayesian mechanism, which is used to give optimal decisions for suspicious images. Experimental results show that both the high-dimensional features and the Bayesian mechanism contribute to the extended scheme, and the performance of the extended scheme is better than those of previous schemes.

A robust hashing method is developed for detecting image forgery including removal, insertion, and replacement of objects, and abnormal color modification, and for locating the forged area. Both global and local features are used in forming the hash sequence. The global features are based on Zernike moments representing luminance and chrominance characteristics of the image as a whole. The local features include position and texture information of salient regions in the image. Secret keys are introduced in feature extraction and hash construction. While being robust against content-preserving image processing, the hash is sensitive to malicious tampering and, therefore, applicable to image authentication. The hash of a test image is compared with that of a reference image. When the hash distance is greater than a threshold τ1and less than τ2, the received image is judged as a fake. By decomposing the hashes, the type of image forgery and location of forged areas can be determined. Probability of collision between hashes of different images approaches zero. Experimental results are presented to show effectiveness of the method.

The emerging high efficiency video coding standard (HEVC) adopts the quadtree-structured coding unit (CU). Each CU allows recursive splitting into four equal sub-CUs. At each depth level (CU size), the test model of HEVC (HM) performs motion estimation (ME) with different sizes including 2N × 2N, 2N × N, N × 2N and N × N. ME process in HM is performed using all the possible depth levels and prediction modes to find the one with the least rate distortion (RD) cost using Lagrange multiplier. This achieves the highest coding efficiency but requires a very high computational complexity. In this paper, we propose a fast CU size decision algorithm for HM. Since the optimal depth level is highly content-dependent, it is not efficient to use all levels. We can determine CU depth range (including the minimum depth level and the maximum depth level) and skip some specific depth levels rarely used in the previous frame and neighboring CUs. Besides, the proposed algorithm also introduces early termination methods based on motion homogeneity checking, RD cost checking and SKIP mode checking to skip ME on unnecessary CU sizes. Experimental results demonstrate that the proposed algorithm can significantly reduce computational complexity while maintaining almost the same RD performance as the original HEVC encoder.

In reversible data hiding techniques, the values of host data are modified according to some particular rules and the original host content can be perfectly restored after extraction of the hidden data on receiver side. In this paper, the optimal rule of value modification under a payload-distortion criterion is found by using an iterative procedure, and a practical reversible data hiding scheme is proposed. The secret data, as well as the auxiliary information used for content recovery, are carried by the differences between the original pixel-values and the corresponding values estimated from the neighbors. Here, the estimation errors are modified according to the optimal value transfer rule. Also, the host image is divided into a number of pixel subsets and the auxiliary information of a subset is always embedded into the estimation errors in the next subset. A receiver can successfully extract the embedded secret data and recover the original content in the subsets with an inverse order. This way, a good reversible data hiding performance is achieved.

In visual perception, distant objects appear smaller than those close to the observer. To insert an object into an image, properly size a foreign object is difficult, especially when there is no reference object in the same distance. To detect this type of image forgery, we present a perspective-constraint based method, with which the height ratio of two objects in an image can be determined without any knowledge of the camera parameters. Assuming that the camera is held leveled and with negligible tilt, the height ratio can be found merely by a vanishing line of the plane on which both objects of interest is situated. Once the estimated ratio exceeds a tolerable interval, a forged region is identified. Experimental results show efficacy of the method even if the images to be tested have been down-sampled or compressed with a low quality factor.

This work proposes a novel scheme for separable reversible data hiding in encrypted images. In the first phase, a content owner encrypts the original uncompressed image using an encryption key. Then, a data-hider may compress the least significant bits of the encrypted image using a data-hiding key to create a sparse space to accommodate some additional data. With an encrypted image containing additional data, if a receiver has the data-hiding key, he can extract the additional data though he does not know the image content. If the receiver has the encryption key, he can decrypt the received data to obtain an image similar to the original one, but cannot extract the additional data. If the receiver has both the data-hiding key and the encryption key, he can extract the additional data and recover the original content without any error by exploiting the spatial correlation in natural image when the amount of additional data is not too large.

This paper proposes a novel scheme of scalable coding for encrypted images. In the encryption phase, the original pixel values are masked by a modulo-256 addition with pseudorandom numbers that are derived from a secret key. After decomposing the encrypted data into a downsampled subimage and several data sets with a multiple-resolution construction, an encoder quantizes the subimage and the Hadamard coefficients of each data set to reduce the data amount. Then, the data of quantized subimage and coefficients are regarded as a set of bitstreams. At the receiver side, while a subimage is decrypted to provide the rough information of the original content, the quantized coefficients can be used to reconstruct the detailed content with an iteratively updating procedure. Because of the hierarchical coding mechanism, the principal original content with higher resolution can be reconstructed when more bitstreams are received.

Structural image features are exploited to construct perceptual image hashes in this work. The image is first preprocessed and divided into overlapped blocks. Correlation between each image block and a reference pattern is calculated. The intermediate hash is obtained from the correlation coefficients. These coefficients are finally mapped to the interval [0, 100], and scrambled to generate the hash sequence. A key component of the hashing method is a specially defined similarity metric to measure the “distance” between hashes. This similarity metric is sensitive to visually unacceptable alterations in small regions of the image, enabling the detection of small area tampering in the image. The hash is robust against content-preserving processing such as JPEG compression, moderate noise contamination, watermark embedding, re-scaling, brightness and contrast adjustment, and low-pass filtering. It has very low collision probability. Experiments are conducted to show performance of the proposed method.

Region duplication is a common type of digital image tampering. This paper presents a log-polar based approach to detect such forgery even if the copied area has been rotated and/or scaled. We compute log-polar fast Fourier transform (LPFFT) on image blocks to approximate the log-polar Fourier transform (LPFT). LPFFT is based on a nearly log-polar system where conversion to log-polar coordinates only involves 1-D Fourier transform and interpolation operations. In addition to rotation and scaling invariance, computation complexity of LPFFT isO(n2logn) , much lower thanO(n4) of LPFT whennis large. Similarity of the LPFFT results between different blocks provides indication of image tampering. Experimental results show efficacy of the proposed method.

This work proposes a novel reversible data hiding scheme for encrypted image. After encrypting the entire data of an uncompressed image by a stream cipher, the additional data can be embedded into the image by modifying a small proportion of encrypted data. With an encrypted image containing additional data, one may firstly decrypt it using the encryption key, and the decrypted version is similar to the original image. According to the data-hiding key, with the aid of spatial correlation in natural image, the embedded data can be successfully extracted and the original image can be perfectly recovered.

This work proposes a novel scheme for lossy compression of an encrypted image with flexible compression ratio. A pseudorandom permutation is used to encrypt an original image, and the encrypted data are efficiently compressed by discarding the excessively rough and fine information of coefficients generated from orthogonal transform. After receiving the compressed data, with the aid of spatial correlation in natural image, a receiver can reconstruct the principal content of the original image by iteratively updating the values of coefficients. This way, the higher the compression ratio and the smoother the original image, the better the quality of the reconstructed image.

This paper proposes a novel watermarking scheme with flexible self-recovery quality. The embedded watermark data for content recovery are calculated from the original discrete cosine transform (DCT) coefficients of host image and do not contain any additional redundancy. When a part of a watermarked image is tampered, the watermark data in the area without any modification still can be extracted. If the amount of extracted data is large, we can reconstruct the original coefficients in the tampered area according to the constraints given by the extracted data. Otherwise, we may employ a compressive sensing technique to retrieve the coefficients by exploiting the sparseness in the DCT domain. This way, all the extracted watermark data contribute to the content recovery. The smaller the tampered area, the more available watermark data will result in a better quality of recovered content. It is also shown that the proposed scheme outperforms previous techniques in general.

This paper proposes two novel self-embedding watermarking schemes based upon a reference sharing mechanism, in which the watermark to be embedded is a reference derived from the original principal content in different regions and shared by these regions for content restoration. After identifying tampered blocks, both the reference data and the original content in the reserved area are used to recover the principal content in the tampered area. By using the first scheme, the original data in five most significant bit layers of a cover image can be recovered and the original watermarked image can also be retrieved when the content replacement is not too extensive. In the second scheme, the host content is decomposed into three levels, and the reference sharing methods with different restoration capabilities are employed to protect the data at different levels. Therefore, the lower the tampering rate, the more levels of content data are recovered, and the better the quality of restored results.

In steganographic applications, the data-hiders always pursue good rate-distortion performance. A novel steganographic scheme with the allowable modifications {-2, -1, 0, +1, +2 } is proposed, in which the secret data are embedded into the least significant bits (LSB), second LSB and third LSB of cover samples using a triple-layered construction. When embedding secret data into the LSB, the cover samples that should be modified by one are located. In the second LSB embedding, adding one or subtracting one for the located samples are determined, and the samples that should be modified by two are chosen. With data-embedding in the third LSB, the selections of addition or subtraction of two at the suitable samples are made. This way, a family of data-hiding methods can be generated, and their rate-distortion performance approaches the theoretical upper bound.

Motivated by the image rescaling estimation method proposed by Gallagher (2nd Canadian Conf. Computer & Robot Vision, 2005: 65-72), we develop an image rotation angle estimator based on the relations between the rotation angle and the frequencies at which peaks due to interpolation occur in the spectrum of the image's edge map. We then use rescaling/rotation detection and parameter estimation to detect fake objects inserted into images. When a forged image contains areas from different sources, or from another part of the same image, rescaling and/or rotation are often involved. In these geometric operations, interpolation is a necessary step. By dividing the image into blocks, detecting traces of rescaling and rotation in each block, and estimating the parameters, we can effectively reveal the forged areas in an image that have been rescaled and/or rotated. If multiple geometrical operations are involved, different processing sequences, i.e., repeated zooming, repeated rotation, rotation-zooming, or zooming-rotation, may be determined from different behaviors of the peaks due to rescaling and rotation. This may also provide a useful clue to image authentication.

High-performance steganography requires large embedding rate and small distortion, i.e., high embedding efficiency. Steganographic codes (stego-codes) derived from covering codes can improve embedding efficiency. In this paper, a new method is proposed to construct binary stego-codes for LSB embedding in gray-scale signals, which shows that not just one but a family of stego-codes can be generated from a covering code by combining Hamming codes and wet paper codes. This method can greatly expand the set of embedding schemes as applied to steganography. Performances of stego-code families (SCF) of structured codes and random codes are analyzed. SCFs of random codes can approach the rate-distortion bound on LSB embedding for any chosen embedding rate. Furthermore, SCFs are modified for applications in±1embedding, and a treble layered embedding method for±2embedding is obtained. By combining the modified SCFs and the treble layered method, a near-optimal scheme for±2embedding is presented.