Decoupled framework for non-additive adversarial image steganography

Adversarial image steganography aims to introduce a small amount of perturbations during the data embedding to improve security performance, while existing works are typically based on additive model under the framework of distortion minimization. Different from additive model, non-additive model assumes that the modification of adjacent elements will interact with each other. If adversarial perturbations are introduced on this basis, the performance of adversarial stegos against re-trained steganalyzers will be further improved. In this paper, we point out the reasons why the existing coupled framework causes the actual embedding structure to fail to fully meet the constraints of the non-additive embedding structure. Then, we decouple the two methods according to their roles, making them independent in structure and more flexible in combination. However, since non-additive adversarial image steganography have to follow the constraints, if the steganographer still aims to successfully attack the target model, excessive perturbations will be occurred. To avoid this phenomenon, we propose a mechanism based on the difference in the attack threshold between the two methods. Extensive experimental results show that if the steganographer uses the decoupled framework to reconstruct the methods, an adversarial stego that satisfies the non-additive constraints can be generated, and the security performance against re-trained steganalyzers in the spatial domain is improved by about 1% ~3% compared with the additive model-based method.