7 Practical steganographic methods

The definition of steganographic security given in the previous chapter should be

a guiding design principle for constructing steganographic schemes. The goal is
clear – to preserve the statistical distribution of cover images. Unfortunately, dig-
ital images are quite complicated objects that do not allow accurate description
using simple statistical models. The biggest problem is their non-stationarity and
heterogeneity. While it is possible to obtain simple models of individual small flat
segments in the image, more complicated textures often present an insurmount-
able challenge for modeling because of a lack of data to fit an accurate local
model. Moreover, and most importantly, as already hinted in Chapter 3, digital
images acquired using sensors exhibit many complicated local dependences that
the embedding changes may disturb and leave statistically detectable artifacts.
Consequently, the lack of good image models gives space to heuristic methods.
In this chapter, we discuss four major guidelines for construction of practical
steganographic schemes:

r Preserve a model of the cover source (Section 7.1);

r Make the embedding resemble some natural process (Section 7.2);
r Design the steganography to resist known steganalysis attacks (Section 7.3);
r Minimize the impact of embedding (Section 7.4).

Steganographic schemes from the first class are based on a simplified model of
the cover source. The schemes are designed to preserve the model and are thus
undetectable within this model. The remaining three design principles are heuris-
tic. The goal of the second principle is to masquerade the embedding as some
natural process, such as noise superposition during image acquisition. The third
principle uses known steganalysis attacks as guidance for the design. Finally,
the fourth principle first assigns a cost of making an embedding change at each
element of the cover and then embeds the secret message while minimizing the
total cost (impact) of embedding. It is also possible and, in fact, advisable, to
take into consideration all four principles.
We now describe each design philosophy in more detail and give examples of
specific embedding schemes.
108 Chapter 7. Practical steganographic methods

7.1 Model-preserving steganography

This principle follows directly from the definition of steganographic security.

The designer first chooses a model of cover images and then makes the stegano-
graphic scheme preserve this model. This will guarantee that the stego scheme
will be undetectable as long as the chosen model completely describes the cov-
ers. Arguably, the simplest model is formed by a sequence of independent and
identically distributed (iid) random variables. In this model, the cover is com-
pletely described by the probability distribution function. This means that for
a given cover image, we need to preserve its first-order statistics or histogram.
Note that this will lead to undetectable stegosystems for both homogeneous and
heterogeneous cover sources (Section 6.2.2).
There exist many approaches that one could take to design a histogram-
preserving steganographic scheme [64, 75, 110, 183, 218, 232]. The approach
that we explain next is based on the general idea of statistical restoration in
which a portion of the image is reserved and not used during embedding so that
it can be utilized later to guarantee preservation of the first-order statistics.

7.1.1 Statistical restoration

We choose to illustrate the principle of statistical restoration on the example of
the steganographic algorithm OutGuess originally introduced by Provos [198].
OutGuess embeds messages into a JPEG image by slightly modifying the quan-
tized DCT coefficients. It also preserves the histogram of all DCT coefficients.
The iid model can be heuristically justified by the argument that DCT coef-
ficients in an individual 8 × 8 block are largely decorrelated and the fact that
inter-block dependences among DCT coefficients are much weaker than depen-
dences among neighboring pixels in the spatial domain.
Steganographic methods based on statistical restoration, such as OutGuess,
are two-pass procedures. In the first (embedding) pass, a stego key is used to
select a pseudo-random subset, De , of all DCT coefficients (both luminance and
chrominance coefficients) that will be used for embedding. Similar to the first
JPEG steganographic algorithm Jsteg (Section 5.1.2), OutGuess embeds the
message bits using simple LSB embedding (Section 5.1) into the coefficients
from De while skipping over all coefficients equal to 0 or 1 to avoid introducing
disturbing artifacts. In the second pass, corrections are made to the DCT coeffi-
cients outside of the set De to match the histogram of the stego image with the
cover-image histogram.
Before embedding starts, OutGuess calculates the maximum length of a ran-
domly spread message (the maximal correctable payload) that can be embedded
in the cover image during the first pass, while making sure that there will be
enough coefficients for the correction phase to adjust the histogram to its original
values. The reader is encouraged to verify that the maximal correctable payload
 Practical steganographic methods 109

is determined by the most imbalanced LSB pair, which is the pair {2k, 2k + 1}
with the largest ratio
max{h[2k], h[2k + 1]}
. (7.1)
min{h[2k], h[2k + 1]}
Because the histogram of DCT coefficients in a single-compressed JPEG image
has a spike at zero (see the discussions in Chapter 2) and because the LSB pair
{0, 1} is skipped during embedding, the most imbalanced LSB pair is {−2, −1}.
Because h[−2] < h[−1] in typical cover images, after embedding the maximum
correctable payload all remaining coefficients with value −2 will have to be
modified to −1 in the correction phase.
Writing n01 for the number of all DCT coefficients not equal to 0 or 1, the
maximal correctable payload will be αmax n01 , 0 ≤ αmax ≤ 1. Because all αmax n01
coefficients are selected pseudo-randomly in the embedding phase, the number
of unused DCT coefficients with value −2 after embedding is (1 − αmax )h[−2].
In order to restore the number of −1s in the stego image, this value must be
larger than or equal to the expected decrease in the number of coefficients with
value −1, which is (αmax /2)h[−1] − (αmax /2)h[−2]. This is because, assuming a
random message is embedded, the probability that a message bit will match the
LSB of −1 is 12 and thus on average (αmax /2)h[−1] coefficients with value −1 will
be unchanged by embedding and the same number of them will be modified to
−2. The second term, (αmax /2)h[−2] is the expected number of coefficients with
value −2 that will be modified to −1 during embedding. Because h[−2] < h[−1],
the expected drop in the number of coefficients with value −1 is the difference
(αmax /2)h[−1] − (αmax /2)h[−2]. Thus, we obtain the following inequality and
eventually an upper bound on the maximum correctable payload αmax :
αmax αmax
(1 − αmax )h[−2] ≥ h[−1] − h[−2], (7.2)
2 2

2h[−2]
αmax ≤ . (7.3)
h[−1] + h[−2]
This condition guarantees that at the end of the embedding phase on average
there will be enough unused coefficients with magnitude −2 that can be flipped
back to −1 to make sure that the occurrences of the LSB pair {−2, −1} are pre-
served after embedding. As this is the most imbalanced LSB pair, the occurrences
of virtually all other LSB pairs can be preserved using the same correction step,
as well. We note that some very sparsely populated histogram bins in the tails
of the DCT histogram may not be restored correctly during the second phase,
but, since their numbers are statistically insignificant, the impact on statistical
detectability is negligible. The average capacity αmax of OutGuess for typical
natural images is around 0.2 bpnc (bits per non-zero DCT coefficient).
Steganographic schemes that embed messages in the spatial domain require
more complex models because neighboring pixels are more correlated than DCT
coefficients in a JPEG file. These correlations cannot be captured using first-
110 Chapter 7. Practical steganographic methods

order statistics. Instead, one can use the joint statistics of neighboring pixel
pairs [75], statistics of differences between neighboring pixels (see Section 11.1.3
on structural steganalysis), or Markov chains.

7.1.2 Model-based steganography

Steganography based on statistical restoration chooses the sample statistics (e.g.,
the histogram) as the model to preserve. In contrast, model-based steganogra-
phy [204] fits a parametric model through the sample data and preserves this
data-driven model and does so without the need for a correction step. The cover
image is modeled as a random variable that can be divided into two components,
x = (xinv , xemb ), where xinv is invariant with respect to embedding and xemb may
be modified during embedding. We denote the range of each random variable as
Xinv and Xemb . For example, we can think of LSB embedding in 8-bit grayscale
images where xinv ∈ {0, 1}7 = Xinv are the 7 most significant bits (or the index
of the LSB pair) and xemb ∈ {0, 1} = Xemb , the LSB of x.
The cover model is formed by the conditional probabilities Pr{xemb |xinv }.
These probabilities will be needed to extract the message and thus must be
known to the recipient. This can be arranged by making Pr{xemb |xinv } depend
only on the invariant component xinv .
First, the set of all cover elements (pixels or DCT coefficients) is written as a
union of disjoint subsets

C(xinv ), (7.4)
xinv ∈Xinv

where C(xinv ) is the set of cover elements whose invariant part is xinv . The
embedding algorithm embeds a portion of the message in each C(xinv ) in the fol-
lowing manner. First, the message bits are encoded using symbols from Xemb
and then the symbols are prebiased so that they appear with probabilities
Pr{xemb |xinv = xinv }. This is achieved by running the message symbols through
an entropy decompressor, for a compression scheme designed to compress symbols
from Xemb distributed according to the same conditional probabilities.1 When
the decompressor is fed with xemb distributed uniformly in Xemb , it will output
symbols with probabilities Pr{xemb |xinv = xinv }. Thus, when xemb of all cover el-
ements from C(xinv ) are replaced with the transformed symbols, xemb , the stego
image elements will follow the cover-image model as desired.
The fraction of bits that can be embedded in each element of C(xinv ) is the
entropy of Pr{xemb |xinv = xinv } or

H (Pr{xemb |xinv = xinv }) =


− Pxemb |xinv (xemb |xinv ) log2 Pxemb |xinv (xemb |xinv ), (7.5)
xemb

1 In practice, one can use, for example, arithmetic compression.

 Practical steganographic methods 111

Cover x Model Message m

xinv xemb Pxemb |xinv =xinv

xinv xemb Entropy decoder

Stego y

Figure 7.1 Model-based steganography (embedding).

Model Stego y

Pxemb |xinv =xinv xinv xemb

Entropy decoder

Message m

Figure 7.2 Model-based steganography (extraction).

where we denoted for brevity

Pxemb |xinv (xemb |xinv ) = Pr{xemb = xemb |xinv = xinv }. (7.6)

Thus, the total embedding capacity is


|C(xinv )|H (Pr{xemb |xinv = xinv }) , (7.7)
xinv

where |C(xinv )| is the cardinality of C(xinv ).

To illustrate the model-based approach, we describe a specific realization for
steganography in JPEG images [204]. Similar to OutGuess or Jsteg, DCT coef-
ficients equal to 0 or 1 are not used for embedding and the embedding mecha-
nism is LSB flipping. Also, Xinv = {0, 1}7 and Xemb = {0, 1}. The model-based-
steganography paradigm is applied to each DCT mode separately. Thus, at the
beginning the cover JPEG file is decomposed into 64 subsets corresponding to 64
DCT modes (spatial frequencies). Let h[i] be the histogram of DCT coefficients
for one fixed mode. Because the sums h[2i] + h[2i + 1] are invariant under LSB
112 Chapter 7. Practical steganographic methods

embedding for all i, we can use this invariant and fit a parametric model, h(x),
through the points ((2i + 2i + 1)/2, (h[2i] + h[2i + 1])/2). For example, we can
model the DCT coefficients using the generalized Cauchy model with pdf (see
Appendix A)
−p
p−1 |x|
h(x) = 1+ (7.8)
2s s
and determine the parameters using maximum-likelihood estimation (see Exam-
ple D.8). Denoting the 7 most significant bits of an integer a as MSB7 (a), we
define the model using the conditional probabilities
h(2i)
Pr{xemb = 0|xinv = MSB7 (2i)} = , (7.9)
h(2i) + h(2i + 1)
h(2i + 1)
Pr{xemb = 1|xinv = MSB7 (2i)} = . (7.10)
h(2i) + h(2i + 1)
The sender continues with the embedding process by selecting all h[2i] +
h[2i + 1] DCT coefficients at the chosen DCT mode that are equal to 2i or
2i + 1. Their LSBs are replaced with a segment of the message that was de-
compressed using an arithmetic decompressor to the length h[2i] + h[2i + 1].
The decompressor is designed to transform a sequence of uniformly distributed
message bits to a biased sequence with 0s and 1s occurring with probabilities
(7.9)–(7.10). Because we are replacing a bit sequence with another bit sequence
with the same distribution, the model (7.9)–(7.10) will be preserved.
The recipient first constructs the model and computes the probabilities given
by (7.9)–(7.10). This can be achieved because h[2i] + h[2i + 1] is invariant with
respect to embedding changes! Individual message segments are extracted by
feeding the LSBs for each DCT mode and each LSB pair {2i, 2i + 1} into the
arithmetic compressor and concatenating them.
This specific example of model-based steganography is designed to preserve the
model of the histograms of all individual DCT modes. This is in contrast with
OutGuess that preserves the sample histogram of all DCT coefficients and not
necessarily the histograms of the DCT modes. For 80% quality JPEG images, the
average embedding capacity of this algorithm is approximately 0.8 bpnc, which
is remarkably large considering the scope of the model and four times larger than
for OutGuess.
We now calculate the embedding efficiency of this algorithm defined as the
average number of bits embedded per unit distortion. In order to simplify the
notation, we set

p0 = Pr{xemb = 0|xinv = MSB7 (2i)}. (7.11)

The average number of bits embedded in one DCT coefficient equal to 2i or

2i + 1 for one fixed DCT mode is

H(p0 ) = −p0 log2 p0 − (1 − p0 ) log2 (1 − p0 ). (7.12)

 Practical steganographic methods 113

An embedding change is performed when the coefficient’s LSB does not match the
prebiased message bit. Because the probability that the prebiased message bit is 0
is the same as the probability that the LSB of the coefficient is 0, which is p0 , the
embedding needs to change the LSB with probability p0 (1 − p0 ) + (1 − p0 )p0 =
2p0 (1 − p0 ). Therefore, the embedding efficiency is

−p0 log2 p0 − (1 − p0 ) log2 (1 − p0 )

e(p0 ) = . (7.13)
2p0 (1 − p0 )
Note that e(p0 ) is always greater than or equal to 2 (follow Figure 7.3). Sur-
prisingly, this is higher than the embedding efficiency of simple LSB embedding,
which is 2 because in LSB embedding every other LSB is modified, on average.
To summarize, this specific example of model-based steganography preserves
the models of histograms of all 64 DCT modes and does so while providing
embedding efficiency larger than 2. This is quite an improvement over the naive
Jsteg described in Chapter 5.

4.5
Embedding efficiency e(p0 )

3.5

2.5

2
0 0.2 0.4 0.6 0.8 1
p0

Figure 7.3 Embedding efficiency of Model-Based Steganography for JPEG images.

There exists a more advanced version of this algorithm [205] that attempts
to preserve one higher-order statistic called “blockiness” defined as the sum of
discontinuities along the boundaries of 8 × 8 pixel blocks in the spatial domain
(see (12.9) in Chapter 12). This is achieved using the idea of statistical restoration
by making additional modifications to unused DCT coefficients in an iterative
manner to adjust the blockiness to its original value in the cover image.2 In
Chapter 12, the original version of Model-Based Steganography is abbreviated
MBS1, while the more advanced version with deblocking is denoted as MBS2.

2 These additional changes, however, make this version of Model-Based Steganography more
detectable (see Chapter 12 and [190, 210]).