Member, IEEE Vahid Sedighi
email: vsedigh1@binghamton.edu.

Member, IEEE Rémi Cogranne
email: remi.cogranne@utt.fr.

Jessica Fridrich
email: fridrich@binghamton.edu.

Content-Adaptive Steganography by Minimizing Statistical Detectability

Keywords: Adaptive Steganography by Minimizing Statistical Detectability Adaptive steganography and steganalysis, hypothesis testing theory, information hiding, multivariate Gaussian, optimal detection. I

published or not. The documents may come

changed pixels. Efficient coding methods [START_REF] Filler | Minimizing additive distortion in steganography using syndrome-trellis codes[END_REF] can embed the desired payload with an expected distortion near the minimal possible value prescribed by the corresponding rate-distortion bound.

Although this paradigm based on the concepts of pixel costs and distortion gave birth to a multitude of content-adaptive data hiding techniques with markedly improved security [START_REF] Pevný | Using high-dimensional image models to perform highly undetectable steganography[END_REF], [START_REF] Holub | Designing steganographic distortion using directional filters[END_REF], [START_REF] Holub | Universal distortion design for steganography in an arbitrary domain[END_REF], [START_REF] Li | A new cost function for spatial image steganography[END_REF], [START_REF] Li | Investigation on cost assignment in spatial image steganography[END_REF], the entire design is rather unsettling because there is no formal connection between distortion and statistical detectability. As argued in [START_REF] Böhme | Advanced Statistical Steganalysis[END_REF], this connection may never be found as empirical cover sources, such as digital media, are fundamentally incognizable. Steganography designers thus primarily rely on empirical evidence to support the claims concerning the security of their embedding schemes.

The design of distortion functions that measure statistical detectability rather than distortion was identified as one of the most important open problems in the recent motivational review article [START_REF] Ker | Moving steganography and steganalysis from the laboratory into the real world[END_REF]. 1 As far as the authors of the current manuscript are aware, there are only a few examples of distortion functions that consider cover models in their design. The first is the distortion function of HUGO [START_REF] Pevný | Using high-dimensional image models to perform highly undetectable steganography[END_REF] that prefers changing pixels with the smallest impact on the empirical statistical distribution of pixel groups represented in the SPAM feature space [START_REF] Pevný | Steganalysis by subtractive pixel adjacency matrix[END_REF]. In [START_REF] Filler | Design of adaptive steganographic schemes for digital images[END_REF], the distortion function is first parametrized and then optimized to minimize the empirical detectability in terms of the margin between cover and stego images represented using low-dimensional features. These approaches are limited to empirical "models" that need to be learned from a database of images. Such embedding schemes may become "overoptimized" to the feature space and cover source and become highly detectable should the Warden choose a different feature representation [START_REF] Kodovský | On dangers of overtraining steganography to incomplete cover model[END_REF].

The first attempt to design the distortion as a quantity related to statistical detectability appeared in [START_REF] Fridrich | Multivariate Gaussian model for designing additive distortion for steganography[END_REF]. The authors proposed to use the Kullback-Leibler divergence between the statistical distributions of cover and stego images when modeling the cover pixels as a sequence of independent Gaussian random variables with unequal variances (multivariate Gaussian or MVG). Using a rather simple pixel variance estimator, the authors showed that the empirical security of their embedding method was roughly comparable to HUGO but subpar with respect to state-of-the-art steganographic methods [START_REF] Holub | Designing steganographic distortion using directional filters[END_REF], [START_REF] Holub | Universal distortion design for steganography in an arbitrary domain[END_REF], [START_REF] Li | A new cost function for spatial image steganography[END_REF]. In [START_REF] Sedighi | Content-adaptive pentary steganography using the multivariate generalized Gaussian cover model[END_REF], this approach was extended by utilizing a better variance estimator and replacing the Gaussian model with the generalized Gaussian. The authors focused on whether it is possible to further improve the security by allowing a pentary embedding operation with a thicker-tail model.

While the current paper builds upon this existing art, it addresses numerous novel issues not investigated elsewhere. To clarify the main contribution of this paper, the closed-form expression for the detectability within the chosen model is used to obtain the following fundamental insight regarding the limits of empirical steganalysis detectors built as classifiers: 1) For the first time empirical detectors can be compared with optimal detectors and evaluated w.r.t. the performance bound valid within the chosen cover model.

In particular, when forcing the heteroscedastic model of sensor acquisition noise to an artificial image with simple content, we observed that the difference in performance between the optimal likelihood-ratio detector and empirical detectors built as classifiers using rich media models is rather small. This indicates that in this source, current empirical steganalysis is near optimal. 2) We introduce a novel type of the so-called "detectabilitylimited sender" that adjusts the payload size for each image to not exceed a prescribed level of statistical detectability within the chosen model. On a database of real images, we contrast the theoretical security of this detectability-limited sender dictated by the model with the one obtained empirically using classifiers employing rich models. Despite the fact that the empirical detector can capture more complex dependencies between pixels than our MVG model, its detection power is much smaller. We attribute this suboptimality primarily to the difficulty of empirical detectors to deal with content heterogeneity of real images.

3) The availability of a closed-form expression for the power of the optimal detector allows us to compute the size of the secure payload for a given image and a chosen detectability (risk) level. We compare it with the secure payload size estimated using empirical detectors and draw several interesting and important facts about the interplay between theoretical and empirical detectors.

We now discuss in more detail the relationship between the method introduced in this paper and the prior art [START_REF] Fridrich | Multivariate Gaussian model for designing additive distortion for steganography[END_REF], [START_REF] Sedighi | Content-adaptive pentary steganography using the multivariate generalized Gaussian cover model[END_REF].

The embedding method of [START_REF] Fridrich | Multivariate Gaussian model for designing additive distortion for steganography[END_REF] equipped with the enhanced variance estimator described in this paper and the ternary method of [START_REF] Sedighi | Content-adaptive pentary steganography using the multivariate generalized Gaussian cover model[END_REF] with a Gaussian cover model coincide in practice with the method studied in this paper. However, the approaches are methodologically different. The methods of [START_REF] Fridrich | Multivariate Gaussian model for designing additive distortion for steganography[END_REF], [START_REF] Sedighi | Content-adaptive pentary steganography using the multivariate generalized Gaussian cover model[END_REF] minimize the KL divergence between cover and stego distributions in the asymptotic limit of a small payload, while the current paper minimizes the power of the most powerful detector instead of the KL divergence, which is achieved without the additional assumption of a small payload. This is why we coin a new acronym MiPOD standing for

Minimizing the Power of Optimal Detector. Moreover, the framework introduced in this paper allows us to consider various types of Warden, which was not possible within the prior art. Finally, in contrast with [START_REF] Sedighi | Content-adaptive pentary steganography using the multivariate generalized Gaussian cover model[END_REF] we investigate the effect of the parameters of the variance estimator on content adaptivity and security of MiPOD and identify a setting that gives it the the smallest empirical detectability.

In Sections II-III, we review the MiPOD algorithm by first introducing the statistical model of cover images, the multivariate Gaussian (MVG), deriving the stego image model for content-adaptive Least Significant Bit (LSB) matching, and analytically establishing the asymptotic properties of the optimal Likelihood Ratio Test (LRT) for MiPOD. We also introduce two types of Warden depending on the available information about the selection channel (content adaptivity). In Section IV, we describe the embedding algorithm of MiPOD based on minimizing the power of the optimal detector. Section V contains a detailed description of the cover model variance estimator and studies the effect of its parameters on MiPOD's adaptivity (selection channel). The main contribution of this paper appears in Section VI, which presents all numerical results divided into the following main parts. After describing the common core of all experiments, in Section VI-B we compare MiPOD with prior art on a standard image source using detectors implemented as classifiers using state-of-the-art feature sets. In Section VI-C, we use an artificial image source in which we force a heteroscedastic cover noise model to show the tightness of the asymptotic LRT and to demonstrate that the optimal detector and empirical detectors built as classifiers with rich image models achieve a very similar level of detectability. A novel detectabilitylimited sender is introduced and investigated on a database of real images in Section VI-D. Finally, in Section VI-E by contrasting the secure payload size computed from the model and using empirical detectors, we discover several interesting and important facts about the interplay between theoretical and empirical detectors.

The following common notational conventions are used throughout the paper. Matrices and vectors will be typeset in boldface, sets in calligraphic font, while capital letters are reserved for random variables. The transpose of matrix A will be denoted A T , and x is reserved for the L 2 norm of vector x. A probability measure is denoted with P. The symbol Z stands for the set of all integers. We also use the notation [P ] for the Iverson bracket [P ] = 1 when P is true and [P ] = 0 when P is false.

II. IMAGE MODEL

In this section, we describe the cover model and the embedding algorithm used by Alice and derive the statistical model for stego images.

A. Cover image model

We only consider images represented in the spatial domain. Ignoring for simplicity the effects of spatial filtering and demosaicking, the pixel values in a digital image acquired with an imaging sensor are typically corrupted by an independent Gaussian noise with variance dependent on the pixel light intensity (the shot noise), temperature and exposure (dark current), and readout and electronic noise. This common noise model [START_REF] Janesick | Scientific Charge-Coupled Devices[END_REF], [START_REF] Foi | Practical Poissonian-Gaussian noise modeling and fitting for single-image rawdata[END_REF], [START_REF] Healey | Radiometric CCD camera calibration and noise estimation[END_REF] was previously applied in digital forensics [START_REF] Thai | Camera model identification based on the heteroscedastic noise model[END_REF] as well as in steganalysis of LSB replacement [START_REF] Cogranne | A cover image model for reliable steganalysis[END_REF], [START_REF] Zitzmann | Statistical decision methods in hidden information detection[END_REF] and LSB matching [START_REF] Cogranne | An asymptotically uniformly most powerful test for LSB Matching detection[END_REF], [START_REF] Cogranne | Application of hypothesis testing theory for optimal detection of LSB matching data hiding[END_REF].

The local pixel mean (the content) can be estimated with local pixel predictors as is currently commonly done when forming steganalysis features [START_REF] Fridrich | Rich models for steganalysis of digital images[END_REF]. However, this estimation is never perfect, which is true especially in highly textured regions. In this paper, we include the difference between the pixel value and its estimated value (the modeling error) into the noise term, which we still model as a Gaussian.

Formally, we consider the cover pixels as an N -dimensional vector z = (z 1 , . . . , z N ) of independent realizations of N Gaussian random variables Z n ∼ N (µ n , ω 2 n ), n = 1, . . . , N , quantized to discrete points k , k ∈ Z (for simplicity and without loss on generality, we set = 1). Here, µ n is the noise-free content and ω 2 n is the variance of the Gaussian acquisition noise. Let μn ∈ Z be an estimate of the mean of the nth pixel. The differences x n = z n -μn will thus contain both the acquisition noise as well as the modeling error. We model x n as independent Gaussian random variables X n ∼ N (0, σ 2 n ), where σ 2 n ≥ ω 2 n because of the inclusion of the modeling error.

Assuming the fine quantization limit, σ n for all n, the probability mass function (pmf) of the nth pixel is given by P σn = (p σn (k)) k∈Z with

p σn (k) = P(x n = k) ∝ 1 σ n √ 2π exp - k 2 2σ 2 n . (1)
Note that it is assumed that the pixels are quantized using an unbounded number of levels (bits). This assumption is adopted for the sake of simplifying the subsequent theoretical exposition. For practical embedding schemes, the finite dynamic range of pixels must be taken into account, for example by forbidding embedding changes that would lead to cover values outside of the dynamic range. The fine quantization limit does not hold in saturated (overexposed) image regions, which however does not pose a problem as any content-adaptive embedding should avoid them. This can be arranged in practice by assigning very small embedding change probabilities to pixels from such regions. Additional discussion regarding the feasibility of the fine quantization assumption appears at the end of Section V.

B. Stego image model

A widely adopted and well-studied model of data hiding is the Mutually Independent (MI) embedding in which the embedding changes Alice makes at each pixel are independent of each other. In particular, we adopt one of the simplest possible setups when the pixel values are changed by at most ±1 (the so-called LSB matching or LSBM) while noting that the framework is easily extensible to any MI embedding. Given a cover image represented with x = (x 1 , . . . , x N ), the stego image y = (y 1 , . . . , y N ) is obtained by independently applying the following probabilistic rules:

P(y n = x n + 1) = β n , P(y n = x n -1) = β n , (2)
P(y n = x n ) = 1 -2β n ,
with change rates 0 ≤ β n ≤ 1/3. The pmf of the stego pixels is thus given by Q σn,βn = (q σn,βn (k)) k∈Z with q σn,βn (k

) = P(y n = k) = (1 -2β n )p σn (k) + β n p σn (k + 1) + β n p σn (k -1). (3)

C. Embedding in practice

In theory, if Alice used an optimal embedding scheme, she could embed a payload of R nats:

R(β) = N n=1 H(β n ), (4)
where

H(x) = -2x log x -(1 -2x) log(1 -2x)
is the ternary entropy function expressed in nats ("log" is the natural log).

In practice, Alice needs to use some coding method, such as the syndrome-trellis codes (STCs) [START_REF] Filler | Minimizing additive distortion in steganography using syndrome-trellis codes[END_REF] while minimizing the following additive distortion function

D(x, y) = N n=1 ρ n [x n = y n ], (5)
where ρ n ≥ 0 is the cost of changing pixel x n tied to β n via

β n = e -λρn 1 + 2e -λρn . ( 6
)
with λ > 0 determined from the payload constraint (4). Using a specific coding scheme instead of optimal coding will introduce a small suboptimality in terms of embedding a slightly smaller payload than R for a given value of the distortion. This coding loss, however, can be made arbitrarily small at the expense of computational complexity. Therefore, in the current paper we disregard the coding loss and simulate all embedding changes using simulators that execute the embedding changes with the probabilities β n .

III. OPTIMAL LR TEST AND ITS STATISTICAL

PERFORMANCE

The main result of this section is a closed-form expression for the deflection coefficient of Warden's detector under the assumption that both Alice and the Warden know the standard deviations σ = (σ 1 , . . . , σ N ). Without any loss of generality, we will assume that the Warden uses the change rates γ = (γ 1 , . . . , γ N ) that might, or might not, coincide with β = (β 1 , . . . , β N ). In this case, when analyzing the image x = (x 1 , . . . , x N ), the Warden's goal is to decide between the following two simple hypotheses: ∀n ∈ {1, . . . , N }:

H 0 = x n ∼ P σn , ∀σ n > 0 , H 1 = x n ∼ Q σn,γn , ∀σ n > 0 . ( 7
)
The Warden is especially interested in identifying a test, a mapping δ : Z N → {H 0 , H 1 }, with the best possible performance. In this paper, we will use the Neyman-Pearson criterion of optimality, that is for a given false-alarm probability α 0 = P(δ(x) = H 1 |H 0 ) we seek a test that maximizes the power function π = P(δ(x) = H 1 |H 1 ), the correct detection probability (see [START_REF] Lehmann | Testing Statistical Hypotheses[END_REF] for details about statistical hypothesis testing).

The Neyman-Pearson Lemma ([23, Theorem 3.2.1]) states that the most powerful (MP) test (the one maximizing the power function for a prescribed false-alarm probability) is the Likelihood Ratio Test (LRT), which in our case is

Λ(x, σ) = N n=1 Λ n = N n=1 log q σn,γn (x n ) p σn (x n ) H1 ≷ H0 τ, (8)
by the statistical independence of pixels. 2Under the fine quantization limit, σ n for all n, it is shown in Appendix A that, as the number of pixels N → ∞, the Lindeberg's version of the Central Limit Theorem implies

Λ (x, σ) = N n=1 Λ n -E H0 [Λ n ] N n=1 V ar H0 [Λ n ] N (0, 1) under H 0 N ( , 1) under H 1 , (9)
where denotes the convergence in distribution and

= N n=1 (E H1 [Λ n ] -E H0 [Λ n ]) N n=1 V ar H0 [Λ n ] = √ 2 N n=1 σ -4 n β n γ n N n=1 σ -4 n γ 2 n ( 10
)
is the deflection coefficient, which completely characterizes the statistical detectability. We note that, under the fine quantization limit, I n = 2/σ 4 n is the Fisher information of LSBM in quantized N (0, σ 2 n ) with respect to the change rate β n (see [START_REF] Fridrich | Multivariate Gaussian model for designing additive distortion for steganography[END_REF] for details).

A. Impact of Warden knowledge on detectability

In this paper, we will consider two types of Warden: an omniscient Warden, who knows the change rates β n used by Alice and uses γ n = β n for all n, and an indifferent Warden who is completely ignorant about Alice's actions and uses the least informative (non-adaptive) change rates γ n = γ for all n. The case of the omniscient Warden represents the worst (conservative) scenario for Alice motivated by the Kerckhoffs' principle and is frequently made in steganography design. The indifferent Warden was introduced to see how the detection is affected when the Warden does not utilize the knowledge of the selection channel -the change rates β n . In empirical steganalysis, the indifferent Warden essentially corresponds to steganalysis that does not use the knowledge of the change rates, such as a classifier equipped with the SRM [START_REF] Fridrich | Rich models for steganalysis of digital images[END_REF].

For the omniscient Warden, the deflection coefficient of the optimal LR (10) simplifies to:

= √ 2 N n=1 σ -4 n β 2 n N n=1 σ -4 n β 2 n = 2 N n=1 σ -4 n β 2 n , (11)
while for the indifferent Warden, the LR becomes:

= √ 2 N n=1 σ -4 n β n N n=1 σ -4 n . (12)
The Cauchy-Schwartz inequality implies that ≥ , which means that the indifferent Warden's detector will always be suboptimal w.r.t. the omniscient Warden.

Formally, the statistical properties of the LRT based on Λ (x, σ) are given in the following proposition.

Proposition 1. It follows from the limiting distribution of the LR under H 0 (9) that for any α 0 ∈ (0, 1) the decision threshold τ given by:

τ = Φ -1 (1 -α 0 ), (13)
where Φ and Φ -1 denote the cumulative distribution function (cdf) of the standard Gaussian distribution and its inverse, asymptotically as N → ∞, guarantees that the false-alarm probability of the LRT does not exceed α 0 . It also follows from the limiting distribution (9) that the power π = π( ) of the LRT is given by:

π( ) = 1-Φ (τ -) = 1-Φ Φ -1 (1 -α 0 ) - . (14)
Proof: Immediately follows from ( 9) and the properties of Gaussian random variables.

B. Detectability-limited sender

A detectability-related distortion allows us to introduce a novel "detectability-limited sender" which adapts the payload for a given cover so that the embedding does not exceed a prescribed detectability level. One frequently used measure of security in practical steganalysis is the total probability or error under equal priors P E = min α0 (α 0 + 1 -π 0 (α 0 ))/2. Since the optimal LR test is essentially a test between two shifted Gaussian distributions, it is immediate that

P E = 1 -Φ ( /2) . ( 15
)
The steganographers can adjust the embedding to guarantee that a Warden who uses the optimal test will always have her P E ≤ P E for any given 0 < P E ≤ 1/2 by making sure that the deflection coefficient [START_REF] Kodovský | On dangers of overtraining steganography to incomplete cover model[END_REF] satisfies:3

≤ 2 • Φ -1 (1 -P E ) . (16)
Of course, this detectability guarantee is only valid within the chosen model. In particular, if the Warden uses a more accurate cover model than the steganographers, e.g., by considering higher-order dependencies among pixels, the bounds ( 15) and ( 16) may not be satisfied.

IV. STEGANOGRAPHY BY MINIMIZING THE PERFORMANCE OF OPTIMAL DETECTOR (MIPOD)

In this section, we study steganography design based on the MVG cover model under the omniscient Warden who uses the optimal LRT since it will provide her with the highest possible power within the model. We also describe the embedding process using a pseudo-code to explain how to implement MiPOD in practice.

To present the theoretical foundation of the proposed approach, we will assume for now that Alice knows exactly the variance of each pixel, σ 2 n . In reality the variance will have to be estimated using the variance estimator described in Section (V). Hence, maximizing the security under the omniscient Warden means that Alice should select change rates β n that minimize the deflection coefficient [START_REF] Kodovský | On dangers of overtraining steganography to incomplete cover model[END_REF] or, equivalently, its square:

2 = 2 N n=1 σ -4 n β 2 n ( 17
)
under the payload constraint (4). This can be easily established using the method of Lagrange multipliers. The change rates β n and the Lagrange multiplier λ > 0 that minimize (17) must satisfy the following N + 1 non-linear equations for N + 1 unknowns, which are λ and the change rates β 1 , . . . , β N :

β n σ -4 n = 1 2λ ln 1 -2β n β n , n = 1, . . . , N, (18)
R = N n=1 H(β n ), (19)
with the last equation being the payload constraint with R expressed in nats. This system can easily be solved numerically. Details of the solution can be found in the prior art [START_REF] Fridrich | Multivariate Gaussian model for designing additive distortion for steganography[END_REF]. Once the change rates are computed, they need to be converted to costs so that the actual message embedding can be executed with the well established framework of syndrometrellis codes. The costs can be obtained by inverting the relationship between β n and ρ n (6):

ρ n = ln(1/β n -2). ( 20
)
To further clarify the embedding procedure, in Algorithm (1) we provide a pseudo-code that describes the individual phases of the embedding scheme.

Note that the change rates (and costs for practical embedding) of MiPOD are determined by minimizing the impact of embedding on the cover model. In contrast, all current content-adaptive steganographic schemes (with the exception of our prior work [START_REF] Fridrich | Multivariate Gaussian model for designing additive distortion for steganography[END_REF], [START_REF] Sedighi | Content-adaptive pentary steganography using the multivariate generalized Gaussian cover model[END_REF]) use pixel cost computed in some heuristic manner by quantifying the impact of an embedding change on the local pixel neighborhood (see Figure 1 and[3], [START_REF] Holub | Universal distortion design for steganography in an arbitrary domain[END_REF], [START_REF] Li | A new cost function for spatial image steganography[END_REF]). Also notice that MiPOD costs [START_REF] Cogranne | An asymptotically uniformly most powerful test for LSB Matching detection[END_REF] depend on the payload.

Finally, we wish to point out that in practice nothing prevents the Warden from selecting a more accurate model of pixels and improve the detection beyond that of the LRT, which is optimal only within the MVG cover model. Naturally, this possibility will always be available to the Warden and this is also what drives the current research in steganography.

V. ESTIMATING PIXEL VARIANCE

The question of which variance estimator will lead to the most secure embedding scheme when evaluating security using empirical detectors is far from being simple and needs to be considered within the context of the entire steganographic channel. If the Warden was able to completely reject the content and isolate only the indeterministic acquisition noise, Alice's best choice would be to use the best possible denoising filter to estimate the pixels' variance. However, current stateof-the-art steganalyzers for adaptive LSB matching [START_REF] Fridrich | Rich models for steganalysis of digital images[END_REF], [START_REF] Chen | A novel mapping scheme for steganalysis[END_REF], [START_REF] Tang | Adaptive steganalysis against WOW embedding algorithm[END_REF], [START_REF] Denemark | Selection-channel-aware rich model for steganalysis of digital images[END_REF] use feature representations of images based on joint distributions of quantized noise residuals computed using local pixel predictors. As long as the Warden stays within this established framework, Alice's "best" variance estimator should avoid rejecting the content too much or too little. In this paper, we give the variance estimator a modular structure that can be adjusted to minimize the detection using current best empirical detectors.

In particular, we use a variance estimator that consists of two steps. Assuming the cover image is an 8-bit grayscale with the original pixel values z = (z 1 , . . . , z N ), z n ∈ {0, . . . , 255}, we first suppress the image content using a denoising filter F : r = z -F (z). This can be interpreted as subtracting from each pixel its estimated expectation. The residual r will still contain some remnants of the content around edges and in complex textures. To further remove the content, and to give the estimator a modular structure that can be optimized for a given source and detector in practice, as the second step we fit a local parametric model to the neighbors of each residual value to obtain the final variance estimate. At this Algorithm 1 Pseudo-code for MiPOD embedder.

1: Estimate pixel residual variances σ 2 n using the estimator described in Section V. 2: Numerically solve Eqs. ( 18) and [START_REF] Zitzmann | Statistical decision methods in hidden information detection[END_REF] and determine the change rates β n , n = 1, . . . , N and the Lagrange multiplier λ. 3: Convert the change rates β n to costs ρ n using Eq. ( 20). 4: Embed the desired payload R using STCs with pixel costs ρ n determined in the previous step.

point, we openly acknowledge that this is certainly not the only or the best approach one can adopt. There likely exist other estimator designs that can produce comparable or even better security. We opted for the current approach because of its modularity and because it gave us the best results out of all estimators we experimented with. This estimator can also be efficiently implemented and it produced respectable results in steganalysis [START_REF] Cogranne | A cover image model for reliable steganalysis[END_REF], [START_REF] Cogranne | An asymptotically uniformly most powerful test for LSB Matching detection[END_REF] and in image processing in general [START_REF] Cogranne | Statistical detection of defects in radiographic images using an adaptive parametric model[END_REF], [START_REF] Katkovnik | Local Approximation Techniques in Signal and Image Processing[END_REF].

Formally, this second step of the estimator design is a blockwise Maximum Likelihood Estimation (MLE) of pixel variance using a local parametric linear model [START_REF] Katkovnik | Local Approximation Techniques in Signal and Image Processing[END_REF]. We model the remaining pixel expectation within small p × p blocks as follows:

r n = Ga n + ξ n . ( 21
)
Here r n represents the values of the residual r inside the p × p block surrounding the nth residual put into a column vector of size p 2 × 1, G is a matrix of size p 2 × q that defines the parametric model of remaining expectations, a n is a vector of q × 1 of parameters, and ξ n is the signal whose variance we are trying to estimate. We note that ξ n is a mixture of the acquisition noise as well as the modeling error.

It is well known that for a linear model corrupted by Gaussian noise, the MLE of the parameter a n from the residuals r n is given by:

a n = G T G -1 G T r n , (22)
which also coincides with the ordinary least squares estimator by the Gauss-Markov theorem. Hence, the estimated expectation of the residuals r n is given by:

r n = G a n = G G T G -1 G T r n . ( 23
)
Finally, assuming that the pixels within the n-th block have the same or similar variances, from [START_REF] Lehmann | Testing Statistical Hypotheses[END_REF] of the central pixel variance in the n-th block is:

σ 2 n = r n -r n 2 p 2 -q = P ⊥ G r n 2 p 2 -q , ( 24
)
where

P ⊥ G = I n -G G T G -1 G T represents the orthogonal
projection onto the p 2 -q dimensional subspace spanned by the left null space of G (I n is the n × n unity matrix).

We would like to stress that this method of variance estimation is applied "pixelwise" instead of blockwise, which means that the estimated value of the variance is attributed only to the central pixel of the considered block. To obtain the variance, e.g., for the right neighbor, the block is translated by one pixel to the right, etc. Mirror padding is applied at the image boundaries to obtain the variance estimates for all pixels.

The proposed variance estimator can attain many different forms based on the employed denoising filter and the local parametric model. After experimenting with polynomial and DCT parametric models as well as numerous denoising filters, we determined that a good trade-off between complexity and empirical security was obtained with a simple two-dimensional Wiener filter implemented in Matlab as wiener2(X,[w w]), where w > 1 is an integer, and a parametric model with two-dimensional (discrete) trigonometric polynomial functions similar to those used in the two-dimensional DCT:

G = 1, cos(u), cos(v), cos(u) • cos(v), cos(2u), cos (2v)
In [START_REF] Tang | Adaptive steganalysis against WOW embedding algorithm[END_REF], the dot stands for the element-wise product, 1 ∈ R p 2 is a column vector of ones, and the vectors

u ∈ R p 2 (v ∈ R p 2
) are obtained by unfolding the matrix

U U =          π 2p 3π 2p • • • π(2p-3) 2p π(2p-1) 2p π 2p 3π 2p • • • π(2p-3) 2p π(2p-1) 2p π 2p 3π 2p • • • π(2p-3) 2p π(2p-1) 2p . . . . . . . . . . . . . . . π 2p 3π 2p • • • π(2p-3) 2p π(2p-1) 2p          (26)
(V = U T ) into a column vector [START_REF] Cogranne | A cover image model for reliable steganalysis[END_REF], [START_REF] Cogranne | An asymptotically uniformly most powerful test for LSB Matching detection[END_REF], [START_REF] Cogranne | Statistical detection of defects in radiographic images using an adaptive parametric model[END_REF]. Thus, our parametric model has q = l(l+1)/2 parameters, where l is the degree of the two-dimensional cosine polynomial. The adaptivity of MiPOD can be adjusted by selecting different values for the parameters w, p, and l. We determined experimentally that it is advantageous to use a larger block size p but keep the Wiener filter width w small. In this paper, we fixed the value to w = 2. The profound effect of p and l on the embedding adaptivity is shown in Figure 2 contrasting the change rates of HILL and S-UNIWARD with those of MiPOD with three parameter configurations: 1) small blocks with p = 3 and l = 3 (q = 6), 2) medium blocks with p = 9 and l = 9 (q = 45), and large blocks with p = 17 and l = 12 (q = 78). Finally, we wish to make an additional comment on the fine quantization assumption. It is true that at pixels whose estimated variance is small, the fine quantization limit is not satisfied. However, since Eq. ( 18) implies that -β n ln β n ≤ σ 4 n /(2λ) , we have β n → 0 as σ n → 0 for any fixed payload (λ). Thus, even though the change rate obtained by solving (18) will be imprecise when the fine quantization is violated, the change rate will be too small to have any effect on security. Indeed, pixels with σ2 n ≈ 0 lie in a smooth image region and should have a small probability of change anyway. In practice, for numerical stability, we introduce a finite floor for the estimated variance:

σ2 n ← max{0.01, σ2 n }. (27)

VI. EXPERIMENTS AND COMPARISON TO PRIOR ART

A. Common core of all experiments

Unless mentioned otherwise, our experiments are carried out on BOSSbase 1.01 [START_REF] Bas | Break our steganographic systemthe ins and outs of organizing BOSS[END_REF] containing 10,000 grayscale 512×512 images. The detectors were trained as binary classifiers implemented using the FLD ensemble [START_REF] Kodovský | Ensemble classifiers for steganalysis of digital media[END_REF] with default settings. We note, however, that in most experiments, the ensemble classifier was used within the framework of hypothesis testing as proposed in [START_REF] Cogranne | Theoretical model of the FLD ensemble classifier based on hypothesis testing theory[END_REF], [START_REF] Cogranne | Modeling and extending the ensemble classifier for steganalysis of digital images using hypothesis testing theory[END_REF] because this implementation of the FLD ensemble permits obtaining the LR values instead of binary outputs, which is crucial in order to measure the detection power for a given level of the false-alarm rate to plot Receiver Operating Characteristic (ROC) curves.

The two feature sets used are the Spatial Rich Model (SRM) [START_REF] Fridrich | Rich models for steganalysis of digital images[END_REF] and its recent selection-channel-aware version called the maxSRMd2 [START_REF] Denemark | Selection-channel-aware rich model for steganalysis of digital images[END_REF], which is particularly interesting in the context of this paper as it uses the knowledge of change rates. All tested embedding algorithms are simulated at their corresponding payload-distortion bound for payloads R ∈ {0.05, 0.1, 0.2, 0.3, 0.4, 0.5} bpp (bits per pixel). The statistical detectability is empirically evaluated using the original version of the FLD ensemble [START_REF] Kodovský | Ensemble classifiers for steganalysis of digital media[END_REF] using the minimal total probability of error under equal priors P E averaged over ten 5000/5000 database splits, denoted as P E .

We selected four content-adaptive steganographic techniques that appear to be the state of the art as of writing this paper (April 2015): WOW [START_REF] Holub | Designing steganographic distortion using directional filters[END_REF], S-UNIWARD implemented with the stabilizing constant σ = 1 as described in [START_REF] Holub | Universal distortion design for steganography in an arbitrary domain[END_REF], HUGO-BD [START_REF] Pevný | Using high-dimensional image models to perform highly undetectable steganography[END_REF] implemented using the Gibbs construction with bounding distortion [START_REF] Filler | Gibbs construction in steganography[END_REF], and the HIgh-Low-Low embedding method called HILL [START_REF] Li | A new cost function for spatial image steganography[END_REF]. For HILL, we used the KB highpass filter and the 3 × 3 and 15 × 15 low-pass averaging filters for L 1 and L 2 as this setting provided the best security as reported in [START_REF] Li | A new cost function for spatial image steganography[END_REF]. Finally, we also included the steganographic technique proposed in [START_REF] Fridrich | Multivariate Gaussian model for designing additive distortion for steganography[END_REF], which inspired the present work and which is also based on minimizing detectability for a multivariate Gaussian (MG) cover model, to show the rather dramatic improvement of this scheme when using the variance estimator described in Section V.

B. Comparison to prior art

We first tested MiPOD implemented with the three settings described in Section V to see the influence of the variance estimator. Table I shows the average total probability of error P E and its standard deviation for a range of payloads for all MiPOD versions and also for four steganographic schemes described in the previous section. Note that, among the three MiPOD versions, the one using the medium block size offers the best security. It also outperforms HUGO-BD, WOW, as well as S-UNIWARD with both feature sets. In the rest of this paper, we always use MiPOD with the medium block size.

Figure 3 is a graphical representation of the table with MiPOD's medium block variance estimator. Note the lower detection errors when steganalyzing with the selection-channelaware maxSRMd2 feature set in comparison to errors obtained with the SRM. With the more advanced detector, HILL and MiPOD have comparable security with HILL being slightly better for large payloads. At this point, we note that the security of MiPOD can be increased above that of HILL by applying a step similar to what was proposed in [START_REF] Li | Investigation on cost assignment in spatial image steganography[END_REF], [START_REF] Li | A new cost function for spatial image steganography[END_REF] by smoothing the Fisher information I n = 2/σ 4 n in MiPOD. In order not to disrupt the flow of this paper, we postpone this to Section VI-F. Finally, we would like to point out a very significant improvement of MiPOD over the MG scheme, which is also based on the multivariate Gaussian cover model but uses a rather simple variance estimator.

C. Experiment on artificial image source

In this section, we justify using the asymptotic approximation of the LR (9) instead of the LR (8) for detection. To this I. end, we executed an experiment using Monte Carlo simulation on an artificial image source for which the assumptions of our framework are better satisfied. We started with the image shown in Figure 4 (left) and then superimposed a nonstationary Gaussian noise to it to obtain a source whose noise is known.

The noise variance was selected to be scene dependent based on the heteroscedastic sensor noise model [START_REF] Foi | Practical Poissonian-Gaussian noise modeling and fitting for single-image rawdata[END_REF], [START_REF] Thai | Camera model identification based on the heteroscedastic noise model[END_REF] σ 2 n = a • z n + b, where z n ∈ {0, . . . , 255} is the nth pixel grayscale value and a = 6/255, b = 2 are constants. According to [START_REF] Foi | Practical Poissonian-Gaussian noise modeling and fitting for single-image rawdata[END_REF], [START_REF] Thai | Camera model identification based on the heteroscedastic noise model[END_REF], these values are fairly typical for a variety of imaging sensors at ISO 200. In other words, in this experiment we made the MVG noise component mimic just the sensor acquisition noise. This was repeated 10,000 times each time with a different realization of the noise to obtain 10,000 cover and the same number of stego images embedded with a fixed payload of 0.2 bpp. Knowing the pixel variances allowed us to compute the ROC curve of the asymptotic LRT [START_REF] Pevný | Steganalysis by subtractive pixel adjacency matrix[END_REF]. Having 10,000 images, we could also sample the LR under both hypotheses and obtain the ROC curve for the sampled LRT [START_REF] Ker | Moving steganography and steganalysis from the laboratory into the real world[END_REF]. We did this for both the omniscient and indifferent wardens.

Figure 5 shows the results when giving the knowledge of the variances to both the sender and the LRT. The close match between the ROC curve of the asymptotic LRT [START_REF] Pevný | Steganalysis by subtractive pixel adjacency matrix[END_REF] and the sampled LR (8) testifies about the sharpness of our asymptotic analysis. Also observe that the difference in ROC curves between the omniscient and indifferent Warden ( ( 14) vs. ( 12)) is not significant. In other words, the knowledge of the selection channel does not provide a substantial advantage to the Warden for the tested MiPOD. This is mainly because in our artificial image source MiPOD adapts only to the superimposed heteroscedastic noise as there is almost no modeling error. This makes the embedding only weakly adaptive because 2 ≤ σ 2 n ≤ 8. Finally, to see how the optimal LRT compares with empirical detectors, we applied the FLD ensemble with the SRM feature set 4 to the database of 10,000 cover and stego images and drew the ROC curve, also shown in the figure .  Remarkably, the empirical detector achieves virtually the same performance as the optimal LR test! This is not obvious at all because both detectors are built very differently. It indicates that, at least in sources with simple content and the Fig. 6. ROC curves for the detectability-limited MiPOD for = 2 (asymptotic LRT, omniscient Warden) and two empirical detectors -the FLD ensemble with SRM and maxSRMd2 feature sets. For comparison, we also show the ROCs for the payload-limited sender (PLS) with payload fixed at the average payload of the DLS (0.2562 bpp). heteroscedastic noise model, empirical steganalysis detectors are near optimal.

D. Detectability-limited sender

In this section, we investigate MiPOD's security on BOSSbase for the detectability-limited sender implemented with = 2 as the security level. When embedding, the payload size was iteratively adjusted for each BOSSbase image so that MiPOD induced the prescribed value of . Both the LRT and MiPOD used the same variance estimator (Section V) with the medium block size. Figure 6 shows the ROC curves for the optimal LRT that knows the embedding change rates β n (the omniscient Warden) and when steganalyzing using the FLD ensemble classifier as described in [START_REF] Cogranne | Theoretical model of the FLD ensemble classifier based on hypothesis testing theory[END_REF] using SRM and maxSRMd2. In contrast with the results of Figure 5 obtained for a homogeneous source, the SRM now performs significantly worse than the optimal LRT because it has to deal with content diversity across images. The fact that the ROC of the optimal LRT bounds those obtained using empirical detectors indicates that the proposed variance estimators are conservative. In general, however, one cannot claim that the LRT will bound the empirical detectors because the considered MVG cover model is only an approximation.

The DLS could be used for batch steganography [START_REF] Ker | Batch steganography and pooled steganalysis[END_REF] to spread the payload among multiple covers to minimize the overall detectability. To see the gain of the DLS over a payload-limited sender (PLS), in the same figure we added the ROCs for the FLD ensemble with the SRM and maxSRMd2 features for a PLS that embeds the same payload in each image so that the average payload per image is the same as for the DLS. When comparing the corresponding ROCs for both senders, one can see a markedly lower detectability of the DLS the PLS.

E. Determining the secure payload size

Having the distortion related to detectability gives us one more rather interesting possibility to determine, for each image, the size of the secure payload of MiPOD for a given level of risk. Here, we adopt the approach introduced by Ker [START_REF] Ker | A capacity result for batch steganography[END_REF], who proposed to measure the risk by a pair of falsealarm and correct-detection probabilities, α 0 , π 0 , of the Warden's detector. The steganographers are at (α 0 , π 0 )-risk if the Warden's detector can simultaneously satisfy α War 0 < α 0 and π 0 < π War 0 . Using the analytic expression for the performance of the optimal LRT [START_REF] Janesick | Scientific Charge-Coupled Devices[END_REF], it immediately follows that:

Φ -1 (1 -π 0 ) = Φ -1 (1 -α 0 ) - ⇔ = Φ -1 (1 -α 0 ) -Φ -1 (1 -π 0 ) ⇔ = Φ -1 (π 0 ) -Φ -1 (α 0 ). (28)
Hence, the steganographers are not at (α 0 , π 0 )-risk if the deflection coefficient [START_REF] Kodovský | On dangers of overtraining steganography to incomplete cover model[END_REF] satisfies:

≤ Φ -1 (π 0 ) -Φ -1 (α 0 ). (29)
We define the secure payload that corresponds to risk (α 0 , π 0 ) as the largest payload for which the inequality ( 29) is satisfied. In this paper, we use two types of fundamentally different detectors -optimal detectors in the form of the likelihood ratio and empirical detectors constructed as classifiers trained on cover and stego features. We first describe how to determine the secure payload for LR tests and then for an empirical detector.

Once the pixels' variances are known (estimated), the performance of the LRT for a single image can be captured using its ROC curve, which can drawn by first computing the deflection coefficient using either [START_REF] Kodovský | On dangers of overtraining steganography to incomplete cover model[END_REF] or [START_REF] Fridrich | Multivariate Gaussian model for designing additive distortion for steganography[END_REF], depending on the Warden type, and then drawing the ROC using formula [START_REF] Janesick | Scientific Charge-Coupled Devices[END_REF]. To estimate the size of the secure payload for a given risk, (α 0 , π 0 ), the payload size can be iteratively adjusted so that the LRT's ROC curve goes through the pair (α 0 , π 0 ).

To estimate the secure payload for a specific image using empirical detectors, we create a database of 10,000 images by denoising the image and then superimposing to the denoised image 10,000 different realizations of MVG noise with the estimated variances σ2 n . Given a payload R, one can create a database of 10,000 stego images embedded with payload R, train an empirical detector for the given cover and stego sources, and draw its ROC curve. The secure payload for a given risk (α 0 , π 0 ) is again determined iteratively by adjusting R to force the empirical ROC curve to go through the pair (α 0 , π 0 ).

In order to proclaim the secure payload determined from our model as an accurate estimate for an image acquired using an imaging sensor rather than an artificial image, we need a close match between our adopted model and the reality. Because BOSSbase images were processed using demosaicking (which is a form of content-driven filtering) and resizing, they are too complex to closely follow our model. Consequently, secure payload estimates obtained using our simplified model would most likely be inaccurate. Thus, for the experiments in this section we used two raw BOSSbase images, sampled them only at the red color filter (the red channel), and then centrally cropped to 512 × 512 pixels. The processing was executed using the 'convert' linux script from ImageMagick (version 6.7.7-10), for resizing and extracting the red color channel, and using ufraw version 0.18, which uses dcraw version 9.06, for conversion from RAW to the PPM format, see [START_REF] Goljan | Rich model for steganalysis of color images[END_REF] for more details. Thus, in these images the pixel values were processed using only point-wise operations, which included gain and gamma adjustment. 5 Because the images were not resized (in contrast to BOSSbase images), their content is much smoother (Figure 4 middle and right). The noise variance is thus mostly affected by the acquisition noise, which follows the MVG model but not the heteroscedastic model because of the gamma correction. In all experiments below, the variances σ 2 n were estimated using MiPOD's variance estimator with the medium block size. They were given to the LR detectors of both the omniscient and indifferent Wardens as well as to MiPOD.

In order to see how the image content affects the secure payload estimate, we carried out experiments on two images from BOSSbase shown in Figure 4 middle and right. Figure 7 shows the secure payload on the y axis as a function of π 0 for selected values of α 0 (different risks) for BOSSbase images '1310.pgm' and '1289.pgm'. As expected, if the steganographers desire perfect security by setting α 0 = π 0 , the secure payload tends to zero. On the other hand, if the steganographers do not set any constraints on the security by choosing π 0 = 1, the secure payload tends to 1.

Notice that the secure payload estimates are higher for image '1289.pgm' because it has more complex content and larger differences in pixel intensity. The estimates using the sampled and asymptotic LR are close for both images and both Wardens. Because the omniscient Warden can detect embedding more reliably than the indifferent one, the secure payload determined using the omniscient Warden is under- 5 These operations are in fact performed on the CMOS sensor. standably always smaller than the one obtained with the indifferent Warden. This difference is slightly larger for the busier image. Because of the lower detection power of the empirical detector with SRM features, its secure payload size is always overestimated. For the smoother image, however, the empirical estimates and the ones obtained using the indifferent Warden are quite close, which again validates our model. As our final note, we point out that the secure payload size for the maxSRMd2 feature set is not shown in the figures because it is similar to that of the SRM.

F. Improving MiPOD's security by smoothing the Fisher information

Recently, it has been shown that the empirical security of steganographic schemes can be improved by smoothing the embedding costs using a low-pass filter [START_REF] Li | A new cost function for spatial image steganography[END_REF], [START_REF] Li | Investigation on cost assignment in spatial image steganography[END_REF]. This can be explained intuitively by observing that the smoothing spreads high costs of pixels into their neighborhood making the embedding more conservative. Moreover, and most importantly, it evens out the costs and thus increases the entropy of embedding changes (the payload) in highly textured regions where empirically built detectors fail to detect embedding because the changes affect mostly the marginal bins in cooccurrences of SRM noise residuals [START_REF] Fridrich | Rich models for steganalysis of digital images[END_REF].

In MiPOD, the linear parametric model is applied pixelwise, which makes variance estimations of neighboring pixels (and the associated pixel costs) strongly correlated. Therefore, the smoothing is at least partially an inherent property of MiPOD rather than artificially forced. Note in Figure 2 that the embedding change probability for the medium-size-block MiPOD is much smoother than that of S-UNIWARD. On the other hand, it is not as smooth as for HILL. Thus, we decided to investigate whether additional smoothing might further boost MiPOD's security. Since in MiPOD we do not natively work with the concept of a pixel cost (we only need to revert to it when implementing an actual embedding scheme using codes), we decided to apply the smoothing to the Fisher information, I n = 2/σ 4 n . Because the pixel cost of MiPOD ( 20) is positively correlated with I n , smoothing I n will have a similar effect as smoothing the costs. The result will, however, be different because the relationship between I n and the cost is non-linear (see Eqs. ( 18)-( 20)).

We performed a search over the size of a simple square averaging kernel applied to I n and determined that, in our image source, the 7 × 7 support gave the overall best results, boosting the detection error P E by up to 2.4% when detecting with the maxSRMd2 feature set. We summarize the results in Table II andFigure II.

VII. CONCLUSIONS

Model based steganography has been around for almost fifteen years since the introduction of OutGuess. What makes our approach different is the dimensionality of the parameter space, which allows us to capture the non-stationary character of images, as well as the fact that we do not attempt to preserve the model but rather minimize the impact of embedding. We model the image noise residual as a sequence of independent quantized Gaussian variables with varying variances. By working with the residual, besides the acquisition noise we managed to include in the model the content-dependent modeling error, which has a strong effect on steganalysis. On the other hand, the assumption of independence and the simplicity of the Gaussian distribution allowed us to derive a closed-form expression for the power of the most powerful detector of content-adaptive LSB matching within the selected model. This allows us to achieve the following novel insights into both steganography design and steganalysis.

First, we use our approach to design steganography that minimizes the power of the optimal detector rather than a heuristically assembled distortion. By adjusting the parameters of the model variance estimator, our embedding scheme called MiPOD rivals the security of the most advanced steganographic schemes today. Further improvement is likely possible by optimizing the local variance estimator. Here, we point out a caveat that such an optimization will necessarily be limited to a given image source and empirical detector (classifier choice and the feature space).

Second, we used the closed-form expression for the theoretical detectability to reveal new fundamental insight into the complex interplay between empirical detectors constructed as classifiers and detectors derived as optimal within the chosen model. In particular, when the cover noise model was forced onto an artificial image with simple content, we observed that empirical detectors built as classifiers in rich feature spaces closely matched the detection performance of optimal detectors, despite their extremely different nature. On real image sources, however, the empirical detectors were markedly suboptimal with respect to the theoretically optimal detectors. We attributed this to the difficulty of empirical detectors to deal with the heterogeneity of natural images.

Third, we also performed experiments aimed at estimating the size of the secure payload with respect to a given level of risk as defined by Ker. Here, we used the red channel of a raw image acquired by an imaging sensor quantized to 8 bits that has undergone only gain and gamma adjustment. Because such images closely follow our model, one can compute their secure payload from the deflection coefficient of the asymptotic likelihood ratio once the variances are estimated. Such estimate was contrasted with the secure payload determined using empirical detectors (FLD classifiers) trained on a database of 10,000 cover images (and the corresponding stego images) obtained by denoising the image and superimposing 10,000 realizations of multivariate Gaussian noise estimated from the original image. For images with simple content, both estimates appear quite close while for images with more complex content the empirical detector overestimates the payload due to its lower detection power.

We intend to pursue several extensions of this work. On the steganography side, we plan to investigate models that capture dependencies among spatially adjacent pixels, e. g., by considering pairs of neighboring pixels as jointly Gaussian random variables. This may lead to schemes that adjust the direction of the embedding change based on the changes made to adjacent pixels. The detectability-limited sender and the asymptotic LRT could both be used to further investigate the difficult and open problem of batch steganography and pooled steganalysis.

Limit Theorem, we have under H 0 from the moments of the log-LR (37)-( 38

Fig. 1 .

 1 Fig. 1. Simplified flowchart of a typical prior-art adaptive embedding scheme (left) and the proposed MiPOD (right).

= 3 6 Fig. 2 .

 362 Fig. 2. First row, left to right: A 128 × 128 crop of '1013.pgm' from BOSSbase 1.01 and the embedding probability for payload 0.4 bpp using HILL and S-UNIWARD. Second row, left to right: MiPOD with three different settings showing an extreme, medium, and low content adaptivity obtained by changing the parameters of the variance estimator. See the text for more details.

  , cos(2u)•cos(2v), . . . , cos(lu), cos(lv) .

Fig. 3 .

 3 Fig.3. Detection error for different embedding schemes when steganalyzing with SRM[START_REF] Fridrich | Rich models for steganalysis of digital images[END_REF] (left) and the selection-channel-aware maxSRMd2[START_REF] Denemark | Selection-channel-aware rich model for steganalysis of digital images[END_REF] (right) which uses the knowledge of change rates. the plot correspond to the results given in TableI.

Fig. 4 .

 4 Fig. 4. Artificial image (left) and two test images used in the experiment in Section VI-E.

Fig. 5 .

 5 Fig. 5. Comparison between the theoretical and empirical detection for a single artificial image (α = 0.2 bpp). In this case, both MiPOD and the LR tests know the exact variance of each pixel.

Fig. 7 .

 7 Fig.7. Secure payload determined from the asymptotic and sampled LR for both Wardens and an empirical detector implemented with FLD ensemble and SRM. The secure payload is shown for various risk levels as a function of π 0 for α 0 = {0.05; 0.25; 0.5; 0.75; 0.95} for BOSSbase image '1310.pgm' (left) and '1289.pgm' (right) with superimposed MVG noise with the variance of each pixel computed using the estimator described in Section V. Note the different y-axis scales between the figures.

  8.

Fig. 8 .

 8 Fig. 8. The effect of smoothing the Fisher information on MiPOD's security w.r.t. the maxSRMd2 feature set. The plot corresponds to the results given in TableII.

  in distribution. Similarly, under the alternative hypothesis H 1 one immediately gets from the moments of the log-LR (41)-(42):

TABLE I DETECTABILITY

 I IN TERMS OF P E VERSUS EMBEDDED PAYLOAD SIZE IN BITS PER PIXEL (BPP) FOR THREE VERSIONS OF MIPOD AND PRIOR ART ON BOSSBASE 1.01 USING THE FLD ENSEMBLE CLASSIFIER WITH TWO FEATURE SETS. .0026 .4026 ± .0028 .3210 ± .0038 .2553 ± .0028 .2060 ± .0022 .1683 ± .0023 S-UNIWARD .4533 ± .0026 .4024 ± .0019 .3199 ± .0027 .2571 ± .0016 .2037 ± .0032 .1640 ± .0024 HUGO-BD .4255 ± .0016 .3716 ± .0013 .2871 ± .0016 .2255 ± .0015 .1796 ± .0014 .1450 ± ..0028 .3747 ± .0014 .3030 ± .0019 .2481 ± .0027 .2038 ± .0039 .1678 ± .0038 MiPOD, Large Blocks .4195 ± .0029 .3657 ± .0026 .2962 ± .0029 .2390 ± .0036 .1948 ± .0022 .1634 ± .0030 MG .2315 ± .0027 .1653 ± .0019 .1161 ± .0016 .0936 ± .0015 .0813 ± .0018 .0715 ± .0018

	Feature	Embedding Method	0.05	0.1	0.2	0.3	0.4	0.5
		WOW	.4572 ± 0010
	SRM	HILL	.4691 ± .0017	.4364 ± .0034 .3611 ± .0024 .2996 ± .0022 .2482 ± .0030 .2055 ± .0024
		MiPOD, Small Blocks	.4204 ± .0039	.3477 ± .0023 .2484 ± .0018 .1879 ± .0020 .1420 ± .0025 .1105 ± .0025
		MiPOD, Medium Blocks	.4513 ± .0021 .4065 ± .0043 .3300 ± .0036 .2698 ± .0018 .2210 ± .0022 .1833 ± .0028
		MiPOD, Large Blocks	.4416 ± .0023 .3888 ± .0025 .3105 ± .0039 .2534 ± .0026 .2071 ± .0018 .1719 ± .0034
		MG	.3689 ± .0019 .2953 ± .0026 .2146 ± .0028 .1658 ± .0024 .1357 ± .0030 .1119 ± .0029
		WOW	.3539 ± .0024 .2997 ± .0023 .2339 ± .0041 .1886 ± .0036 .1543 ± .0036 .1306 ± .0021
		S-UNIWARD	.4180 ± .0025 .3660 ± .0040 .2886 ± .0025 .2360 ± .0022 .1908 ± .0025 .1551 ± .0019
		HUGO-BD	.3652 ± .0023 .3130 ± .0025 .2431 ± .0018 .2020 ± .0015 .1635 ± .0014 .1326 ± .0007
	maxSRMd2	HILL	.4232 ± .0029	.3771 ± .0019 .3091 ± .0018 .2573 ± .0033 .2184 ± .0037 .1814 ± .0030
		MiPOD, Small Blocks	.3826 ± .0014	.3105 ± .0023 .2220 ± .0018 .1651 ± .0019 .1303 ± .0038 .1022 ± .0028
		MiPOD, Medium Blocks	.4300 ±

TABLE II MIPOD

 II 'S DETECTABILITY P E WHEN SMOOTHING THE FISHER INFORMATION (BOSSBASE 1.01, MAXSRMD2).

	Payload	HILL	MiPOD Medium Blocks	MiPOD Medium Blocks Smooth FI
	0.05	.4232 ± .0029	.4300 ± .0028	.4380 ± .0012
	0.1	.3771 ± .0019	.3747 ± .0014	.3939 ± .0022
	0.2	.3091 ± .0018	.3030 ± .0019	.3237 ± .0021
	0.3	.2573 ± .0033	.2481 ± .0027	.2717 ± .0045
	0.4	.2184 ± .0037	.2038 ± .0039	.2243 ± .0055
	0.5	.1814 ± .0030	.1678 ± .0038	.1845 ± .0030

See Open Problems no.

and 9.

Note the false-alarm probability α 0 is not specified as it does not change the LRT up to the decision threshold τ .

Note that since the LR test remains the same for any prescribed falsealarm probability α 0 , up to the decision threshold, this LR test also has the lowest achievable P E .

The ROC curve for the maxSRMd2 features is not shown for better readability because its performance is almost identical to that of SRM because MiPOD is only weakly adaptive due to the properties of the added noise. The detection gain when using the selection-channel-aware maxSRMd2 is thus correspondingly smaller.

ACKNOWLEDGEMENTS

The code for all steganographic methods, feature extractors, and classifiers used in this paper is available from http://dde. binghamton.edu/download/.

The work on this paper was supported by the Air Force Office of Scientific Research under the research grant FA9550-09-1-0147. The U.S. Government is authorized to reproduce and distribute reprints for Governmental purposes notwithstanding any copyright notation there on. The views and conclusions contained herein are those of the authors and should not be interpreted as necessarily representing the official policies, either expressed or implied of AFOSR or the U.S. Government. This work has also been partially funded by the conseil régional de Champagne-Ardenne within program for scholar mobility, projects STEG-DETECT and IDENT.

APPENDIX

In this appendix, without loss of generality, we analytically establish the performance of the Generalized Likelihood Ratio Test (GLRT) for the case in which the sender changes each pixel with probabilities β = (β 1 , . . . , β N ) while the Warden uses estimated change rates γ = (γ 1 , . . . , γ N ). Note also that we use the term GLRT for convenience here as generally γ n may not be MLE estimates.

This appendix is divided into two parts, first, the GLRT is presented and a simple asymptotic expression is obtained under the fine quantization limit and for a large number of pixels. Then, the statistical performance of this GLRT is analytically established.

A. Asymptotic expression for the GLRT

Using the corresponding expressions for p σn (k) (1) and q σn,βn (k) (3), the LR (8) for one observation Λ n can be written as

which can be simplified as follows:

Under the fine quantization assumption, σ 2 n 1, we can further simplify using the second-order Taylor expansion around σ -2 n = 0:

Using the fine quantization assumption again, we replace the log-LR, log Λ n , with its first-order Taylor approximation:

Since the term involving 1/4 can be removed from the test statistic (it stays the same under both hypotheses) the log-LR can be further simplified:

B. Analytic expression of GLRT performance

We now compute the mean and variance of the log-LR (36) under both hypotheses. Because under H 0 , xn σn ∼ N (0, 1), we have

, and because

Finally, it follows from the expression for the log-LR ( 36) that

Under hypothesis H 1 , the calculation of the log-LR's moments is slightly more complex because the pmf of stego pixels is a mixture of three different cases: s n = x n , s n = x n + 1, and s n = x n -1. In particular,

As for the variance, we use fact that Var[X] = E[X 2 ] -E[X] 2 for any random variable X and that

After some simple arithmetic and keeping only the leading term:

Therefore, the final result under the alternative hypothesis is

We are now ready to compute the detectability of LSBM. To this end, we study the properties of the log-LR of all pixels, which, from the statistical independence of pixels, is given by Λ(x) =