# CNN Based Adversarial Embedding with Minimum Alteration for Image Steganography

arXiv: https://arxiv.org/abs/1803.09043 · HTML: https://mlsanity.com/paper/1803.09043/

## Key facts

- Cited by 22 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 24 Mar 2018.

## Built on by (most cited first, 22 of 22)

- [EditGuard: Versatile Image Watermarking for Tamper Localization and Copyright Protection](https://mlsanity.com/paper/2312.08883/) (2023)
- [CRoSS: Diffusion Model Makes Controllable, Robust and Secure Image Steganography](https://mlsanity.com/paper/2305.16936/) (2023)
- [Data Hiding with Deep Learning: A Survey Unifying Digital Watermarking and Steganography](https://mlsanity.com/paper/2107.09287/) (2021)
- [G2Face: High-Fidelity Reversible Face Anonymization via Generative and Geometric Priors](https://mlsanity.com/paper/2408.09458/) (2024)
- [Deep Learning for Steganalysis of Diverse Data Types: A review of methods, taxonomy, challenges and future directions](https://mlsanity.com/paper/2308.04522/) (2023)
- [THInImg: Cross-modal Steganography for Presenting Talking Heads in Images](https://mlsanity.com/paper/2311.17177/) (2023)
- [Robust Message Embedding via Attention Flow-Based Steganography](https://mlsanity.com/paper/2405.16414/) (2024)
- [StableGuard: Towards Unified Copyright Protection and Tamper Localization in Latent Diffusion Models](https://mlsanity.com/paper/2509.17993/) (2025)
- [Diffusion-Based Hierarchical Image Steganography](https://mlsanity.com/paper/2405.11523/) (2024)
- [On the Detection of Adaptive Adversarial Attacks in Speaker Verification Systems](https://mlsanity.com/paper/2202.05725/) (2022)
- [VisGuard: Securing Visualization Dissemination through Tamper-Resistant Data Retrieval](https://mlsanity.com/paper/2507.14459/) (2025)
- [Improving Cost Learning for JPEG Steganography by Exploiting JPEG Domain Knowledge](https://mlsanity.com/paper/2105.03867/) (2021)
- [Deep Learning for Predictive Analytics in Reversible Steganography](https://mlsanity.com/paper/2106.06924/) (2021)
- [Exploiting Fine-Grained DCT Representations for Hiding Image-Level Messages within JPEG Images](https://mlsanity.com/paper/2305.06582/) (2023)
- [SMILENet: Unleashing Extra-Large Capacity Image Steganography via a Synergistic Mosaic InvertibLE Hiding Network](https://mlsanity.com/paper/2503.05118/) (2025)
- [SteganoBackdoor: Evading Data-Poisoning Defenses via Steganographic Backdoors](https://mlsanity.com/paper/2511.14301/) (2025)
- [Image Steganography based on Iteratively Adversarial Samples of A Synchronized-directions Sub-image](https://mlsanity.com/paper/2101.05209/) (2021)
- [Pixel-Stega: Generative Image Steganography Based on Autoregressive Models](https://mlsanity.com/paper/2112.10945/) (2021)
- [STD-NET: Search of Image Steganalytic Deep-learning Architecture via Hierarchical Tensor Decomposition](https://mlsanity.com/paper/2206.05651/) (2022)
- [Natias: Neuron Attribution based Transferable Image Adversarial Steganography](https://mlsanity.com/paper/2409.04968/) (2024)
- [Exploring AI in Steganography and Steganalysis: Trends, Clusters, and Sustainable Development Potential](https://mlsanity.com/paper/2511.12052/) (2025)
- [Robust Image Self-Recovery against Tampering using Watermark Generation with Pixel Shuffling](https://mlsanity.com/paper/2511.22936/) (2025)

## Abstract (arXiv)

Historically, steganographic schemes were designed in a way to preserve image statistics or steganalytic features. Since most of the state-of-the-art steganalytic methods employ a machine learning (ML) based classifier, it is reasonable to consider countering steganalysis by trying to fool the ML classifiers. However, simply applying perturbations on stego images as adversarial examples may lead to the failure of data extraction and introduce unexpected artefacts detectable by other classifiers. In this paper, we present a steganographic scheme with a novel operation called adversarial embedding, which achieves the goal of hiding a stego message while at the same time fooling a convolutional neural network (CNN) based steganalyzer. The proposed method works under the conventional framework of distortion minimization. Adversarial embedding is achieved by adjusting the costs of image element modifications according to the gradients backpropagated from the CNN classifier targeted by the attack. Therefore, modification direction has a higher probability to be the same as the sign of the gradient. In this way, the so called adversarial stego images are generated. Experiments demonstrate that the proposed steganographic scheme is secure against the targeted adversary-unaware steganalyzer. In addition, it deteriorates the performance of other adversary-aware steganalyzers opening the way to a new class of modern steganographic schemes capable to overcome powerful CNN-based steganalysis.