When using advanced steganographic methods (like F5) what is the approximate maximum embedding rate when advanced Steganalysis (like a machine learning approach) can no longer reliably detect it?

I have searched for papers dealing with this topic but have been unable to find any. Does anyone here know anything about this topic or any research papers dealing with this issue?

  • $\begingroup$ Afaik my answer weren't perfect, see the comments... sorry. $\endgroup$
    – peterh
    Sep 19 '15 at 16:05
  • 1
    $\begingroup$ Are you interested in scenarios when the detector may alter, corrupt, or delete part of the carrier (requiring redundancy and error correction, thus reducing embedding rate) or just the simplest case with a passive detector? $\endgroup$
    – Thomas
    Sep 20 '15 at 1:08

It is an interesting question, let me clarify some points before.

Nowadays F5 can not be considered an advanced steganographic method. There are algorithms as for example HUGO[1] or WOW[2] that are much harder to detect. Usually these algorithms hide information in the bitmap. Therefore, let's assume that we are using one of these modern algorithms.

Almost every research in modern steganalysis is based on machine learning. The common framework can be found in [3] and uses a feature extractor called Rich Models and Ensemble Classifiers. Using this framework (or reading this paper and other papers dealing with the same issues) you can find a first answer. An example result could be about 80% of accuracy using HUGO with bitrate 0.40. Maybe HUGO with a bitrate around 0.20 or 0.10 can be acceptable for you.

There are a lot of similar papers with different techniques and different results, getting better in recent papers. But there exist an important problem in steganalysis: the Cover Source Mismatch (CSM). It is, in fact, a problem of machine learning called "domain adaptation" with a new name [4,5]. It refers to the problem of using the classifier with images from a different source from those with which it has been trained. Unfortunately, we never known the source or domain of the steganographer, so we always have the CSM problem. And this worsens the results.

If you take into account the CSM problem you will see that the results presented in some papers may be a little bit confusing. So, if you see something similar to my previous example (HUGO 0.40 with 80% of accuracy) you can not consider that HUGO 0.40 is insecure because if you have no access to the camera used by the steganographer, you can not train your classifier properly. Currently the CSM problems is an active area of research.

At this point, reading the referenced papers, we have the optimistic answer (it will be for example 0.20/0.40 using HUGO) because the CSM problem and the cautious answer (it will be for example HUGO 0.10 or lower).

[1] Pevný, T., Filler, T., Bas, P., 2010b. Using High-Dimensional Image Models to Perform Highly Undetectable Steganography. In: Information Hiding - 12th International Conference. pp. 161–177.

[2] Holub, V., Fridrich, J. J., 2012. Designing Steganographic Distortion Using Directional Filters. In: International Workshop on Information Forensics and Security (WIFS). IEEE, pp. 234–239.

[3] Fridrich, J., Kodovský, J., 2012. Rich Models for Steganalysis of Digital Images. IEEE Trans. Information Forensics and Security 7 (3), 868–882.

[4] Cancelli, G., Dorr, G., Barni, M., Cox, I. J., 2008. A Comparative Study of ±1 Steganalyzers. In: Multimedia Signal Processing, 2008 IEEE 10th Workshop on. pp. 791–796

[5] Ker, A. D., Bas, P., Böhme, R., Cogranne, R., Craver, S., Filler, T., Fridrich, J., Pevný, T., 2013. Moving Steganography and Steganalysis from the Laboratory into the Real World. In: Proceedings of the First ACM Workshop on Information Hiding and Multimedia Security. ACM, pp. 45–58.


At the moment (2021) the best algorithm for JPEG images is J-UNIWARD [6], while the best algorithm for bitmap images is HILL [7]. Although, there are modified versions of both that improve their undetectability by a few percentage points. Stegoanalysis is performed with Deep Learning [8], achieving extremely precise results. However, the CSM problem is not solved yet. In scenarios without CSM we can obtain an accuracy > 80% for J-UNIWARD and > 95% for HILL (payload in the range 0.10 -0.40). However, there are scenarios with CSM in which the classifiers would not work well, reaching 50% accuracy. For these cases, there are techniques that allow us to know if we are in a CSM scenario [9]. Therefore, the recommended payload would be below 0.05, being hard to detect in scenarios without CSM, and practically impossible in scenarios with a high CSM.

[6] A New Cost Function for Spatial Image Steganography by Bin Li, Ming Wang, Jiwu Huang and Xiaolong Li.

[7] Universal Distortion Function for Steganography in an Arbitrary Domain by Vojtěch Holub, Jessica Fridrich and Tomáš Denemark.

[8] Improving EfficientNet for JPEG Steganalysis by Yassine Yousfi, Jan Butora, Jessica Fridrich and Clément Fuji Tsang.

[9] Detection of Classifier Inconsistencies in Image Steganalysis by Daniel Lerch-Hostalot and David Megías.

  • $\begingroup$ If I understand well, HUGO and WOW can't be used for JPEGs. If so, it makes them almost useless for any practical application, since sending or storing for example photos in PNGs is itself a very suspicious sort of action. $\endgroup$
    – Quark
    Jul 13 '16 at 17:13

It is because there is none.

It doesn't matter, how low is the bitrate you encode, a detection algorithm specified against yours, will find it. And, for any detection algorithm, there is a such low bitrate (or steganography algorithm) which will remain below the radar.

What is a more interesting question, which is the maximal bitrate / optimal algorithm against different detectors. But it depends on the detector.

Related question here.

Extension: It isn't completely true, see comments below. If you replace the noise part of data with encrypted data looking noise, it will be undetectable. The important question is, how to separate the noise from the data stream optimally.

  • $\begingroup$ Do you know of any paper talking about this? $\endgroup$ Sep 19 '15 at 13:15
  • $\begingroup$ @user3120921 No, it is too obvious for that. If you think it is not, here is an opinion similar to mine. It is a sword & shield thing, similar to the spam filters: every spam can be formulated on a way which cheats a specific spamfilter, while every spamfilter can be configured to find a specific spam. Of course there are papers from the possibilities of the spam detection, but the essence of the answer still the same. $\endgroup$
    – peterh
    Sep 19 '15 at 13:34
  • 5
    $\begingroup$ I'm not an expert on steganography, but I don't consider the claim "obvious". For example when I consider raw images, they'll contain noise in the least significant bits. When done carefully, with knowledge of the camera's noise properties, replacing these with steganografic data that looks like noise should be possible. $\endgroup$ Sep 19 '15 at 15:59
  • $\begingroup$ @CodesInChaos And data can be made looking like noise, for example by compressing it and then encrypting. Well, it seems true. $\endgroup$
    – peterh
    Sep 19 '15 at 16:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.