Towards Imperceptible JPEG Image Hiding: Multi-range Representations-driven Adversarial Stego Generation

Jianhua Yang; Junxue Yang; Weixuan Tang; Xin Liao; Zheng Qin

REVIEW 3 major objections 5 minor 35 references

Towards Imperceptible JPEG Image Hiding: Multi-range Representations-driven Adversarial Stego Generation

T0 review · 3 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper proposes MRAG, a multi-range adversarial stego generation framework that hides a full color image inside a color JPEG cover while keeping detection accuracy near random-guess level and secret recovery above 40 dB PSNR.

desk verdict Strong hiding architecture and excellent restorability, but the steganalysis-imperceptibility claim is not yet supported because the evaluators are trained on HRJS stegos, not MRAG's own output; needs an adaptive evaluation. read the letter →

arxiv 2507.08343 v2 pith:2LIXNGTU submitted 2025-07-11 cs.CV

Junxue Yang , Xin Liao , Weixuan Tang , Jianhua Yang , Zheng Qin This is my paper · ORCID

classification cs.CV

keywords imagehidingJPEGsteganographysteganalysisimperceptibilityadversarialstegogenerationinvertibleneuralnetworksfeaturesangle-normdisentanglementmulti-rangerepresentationcovertcommunication

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes MRAG, a framework for hiding one full color image inside another color JPEG image so that the resulting stego looks normal to both people and automated steganalyzers. It claims that by blending local and global image features and attacking the steganalyzer's internal feature space, MRAG achieves secret recovery above 40 dB PSNR on a standard dataset, visual quality on par with the strongest prior JPEG hiding method, and steganalysis detection accuracy close to 50 percent across three steganalyzers. If true, this would make image-level covert communication practical over JPEG, the world's most common lossy image format, rather than only over lossless spatial images.

What carries the argument

The central mechanism is the features angle-norm disentanglement loss applied to the surrogate steganalyzer's classified features, the activations before its final fully connected layer. The loss maximizes cosine similarity between cover and stego feature vectors while minimizing their mean-squared-error difference, so the perturbation shifts features along the direction the steganalyzer associates with intra-class variation rather than with class difference. This is paired with a multi-range architecture: a convolution-based invertible local branch, a transformer-based invertible global branch, and an adaptive fusion module, which together place the hidden secret in both local and global frequency representations. Coarse-grained and fine-grained frequency decompositions feed the two branches, and the whole pipeline is invertible so the same forward and backward passes hide and reveal.

What would settle it

Train a fresh steganalyzer on cover–stego pairs generated by MRAG itself and measure its detection accuracy; accuracy well above 50 percent, say above 80 percent, would contradict the steganalysis-imperceptibility claim. Re-running the paper's t-SNE feature-distribution experiment with that adaptive detector would show whether cover and stego features remain intermingled.

Watch

Extended reading notes

Core claim

The paper's central claim is that steganalysis imperceptibility and high-capacity image hiding are compatible in JPEG covers when the hidden message is placed not as bit-level noise but as an adversarial perturbation shaped by both local and global statistics. MRAG uses an invertible local branch built from convolutions and an invertible global branch built from transformers to encode cover and secret into the JPEG frequency domain, then an adaptive fusion module produces the stego. A features angle-norm disentanglement loss pulls the angles of the surrogate steganalyzer's pre-classification features for cover and stego together while holding their norms fixed, which the paper argues encodes the secret into perturbations the steganalyzer treats as irrelevant. The reported result is that restored secrets reach over 40 dB PSNR, visual quality matches the best available prior method, and detection accuracy of three steganalyzers falls to roughly 50 percent, i.e., random guessing.

Load-bearing premise

The steganalysis claim rests on the assumption that detectors trained on stego images from a different bit-level JPEG method are a fair test of MRAG, because no detector in the paper is ever trained on MRAG's own stego images.

Editorial extensions

If this is right

Color JPEG covers become usable for image hiding without sacrificing secret fidelity: restored secrets surpass 40 dB PSNR, well above the previous JPEG-hiding method's level.
Detection accuracy near 50 percent across three steganalyzers means a detector trained on conventional bit-level JPEG stego statistics cannot separate MRAG stegos from covers.
Training only on one dataset and testing on others keeps restored-secret quality high, indicating the learned hiding is not tied to a single image distribution.
Because the pipeline is invertible, hiding and revealing are handled by the same forward and backward computation, avoiding a separate learned extractor.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The paper evaluates steganalysis resistance with detectors trained on stego images from HRJS, a bit-level JPEG steganography method, not on MRAG's own stegos; a steganalyzer trained on MRAG-generated stegos is the decisive test left open, and its accuracy could be far from 50 percent.
The same adversarial angle-norm mechanism may transfer to other transform-coded image formats such as WebP or AVIF, since it acts on frequency-domain features rather than JPEG-specific DCT layout.
If independent replication confirms the numbers, image hiding in JPEG covers would offer a 24 bits-per-pixel payload channel, a capacity far beyond classic bit-level steganography, with practical implications for covert communication and watermarking.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Two things you should know about arXiv:2507.08343. First, the architecture is genuinely new: a two-branch invertible network that combines convolutional local features and transformer global features, with a feature-level adversarial loss that pulls cover and stego classified features together in angle and norm. Second, the secret-restorability numbers are the real story — PSNR over 40 dB on COCO, about 6 dB better than EFDR, and visual quality matches EFDR. If that holds up, it's a solid step forward for JPEG image hiding.

What the paper does well: it tackles a practical format (color JPEG), uses a sensible invertible design with reversible frequency transforms, and the ablations show both branches matter. The t-SNE visualizations are convincing within the tested setup.

The soft spots are real and they are in the steganalysis evaluation. The steganalyzers — both the surrogate for the adversarial loss and the evaluators in Table 3 — are trained on cover-stego pairs where the stego images come from HRJS, a bit-level JPEG method. None are trained on MRAG stegos. So the near-50% detection rates show that MRAG stegos are not caught by steganalyzers built for a different embedding algorithm. That is a weak form of undetectability. A steganalyzer trained on MRAG's actual stego distribution could plausibly detect them, especially with a full RGB secret packed into a JPEG cover. The paper should include that adaptive attack, or at least clearly state the claim is limited to non-adaptive settings. This is the main issue.

There are two smaller issues worth mentioning. The norm-changeless loss is described as keeping the feature norms unchanged, but the Ln term in Eq. 3 is an MSE between feature vectors, which by definition penalizes norm differences. The loss pushes the vectors together in Euclidean space; the 'norm-changeless' rationale is not what the math does. And Table 4 selects the number of fusion layers on the test set, which is overfitting the architecture to the benchmark. No error bars either, which matters for values like 50.00.

Overall: this is a serious piece of work, not a desk-reject. It needs a re-run of the steganalysis evaluation with same-algorithm trained steganalyzers, a corrected description of the loss, and a cleaner hyperparameter selection. I'd send it to peer review, but I'd tell the authors the adaptive steganalysis experiment is required rather than optional.

Referee Report

3 major / 5 minor

Summary. The paper proposes MRAG, an invertible-neural-network framework for hiding a spatial RGB secret image inside a color JPEG cover and recovering it from the resulting JPEG stego. The architecture combines a local-range convolutional branch, a global-range transformer branch, an adaptive fusion module, and a frozen surrogate JPEG steganalyzer. A feature-level adversarial loss, called the angle-norm disentanglement loss, is applied to the classified features of the surrogate steganalyzer so that cover and stego features are pulled together in angle while their norm values are claimed to be preserved. Experiments on COCO, ImageNet, and BOSSBase report state-of-the-art secret restorability (PSNR above 40 dB), visual imperceptibility comparable to EFDR, and steganalysis detection accuracies approaching 50% against UCNet, EWNet, and DBS2Net.

Significance. If the central claims are substantiated, this would be a meaningful advance: MRAG appears to be the first color-JPEG image-hiding method that simultaneously achieves high secret restorability, visual imperceptibility, and steganalysis resistance. The architectural motivation from local- and global-range steganalysis features is sensible, and the reported secret restorability and visual-quality improvements over EFDR are large and consistent across three datasets. The paper also includes useful ablations of the range branches and fusion depth. However, the headline steganalysis-imperceptibility claim currently rests on evaluations against steganalyzers trained on HRJS stegos rather than on MRAG stegos, so the paper's most important conclusion is not yet adequately supported.

major comments (3)

[Experimental Settings; Table 3] The central steganalysis-imperceptibility claim is not supported by the current evaluation protocol. In 'Experimental Settings', all steganalyzers used both as surrogates and as evaluators are trained on cover-stego pairs whose stego images are generated by HRJS, a bit-level JPEG steganographic method, not by MRAG. Table 3 therefore shows only that MRAG stegos evade detectors whose training distribution is blind to the specific embedding traces that MRAG introduces. Because adversarial training optimizes against exactly these detector families, near-50% accuracies are expected even if MRAG stegos are statistically distinguishable from covers by a detector trained on MRAG's own stego distribution. The authors should retrain UCNet, EWNet, and DBS2Net on MRAG-generated cover-stego pairs (and ideally include a steganalyzer architecture not used as a surrogate) and report detection accuracies in that adaptive setting. Without such experiments, the headline claim of 'steganalysis imperceptibility' is unsupported.
[Equation (3); Loss Function] The description of the angle-norm disentanglement loss is internally inconsistent. The text states that the loss 'keep[s] the norm values of S2(Ci) and S2(So) changeless,' but Ln = MSE(S2(Ci), S2(So)) in Eq. (3) is a mean-squared error between the full feature vectors. This loss penalizes all component-wise differences and thus changes both the angles and the norms of the feature vectors; it does not constrain the norm values to remain changeless, nor does it implement a genuine disentanglement of angle and norm. A norm-only loss such as (||S2(Ci)|| - ||S2(So)||)^2, or an explicit normalization step before computing cosine similarity, would be needed to realize the stated mechanism. As written, the paper's explanation of why the adversarial perturbation is confined to the angular space is not supported by the actual objective.
[Table 4; Ablation Study] The number of affine coupling layers in the adaptive fusion module is selected on the test set. Table 4 reports that steganalysis imperceptibility is 'optimal when the number of layers is 3' and that this value is used in the final model, but the comparison is made across the same COCO test set used for the headline results in Tables 1-3. Selecting hyperparameters on the test set can inflate reported steganalysis resistance and invalidate the comparison with baselines that did not enjoy the same selection procedure. The authors should either use a separate validation split for this ablation or report results averaged over multiple random splits.

minor comments (5)

[Abstract] There are formatting artifacts in the abstract, including 'm ulti-range r epresentations-driven' and 'M SEis'; these should be cleaned before submission.
[Table 3] The notation 'A U, A E, and A D' in Table 3 is introduced without a clear definition of the subscripts; please define these consistently in the text or caption.
[Comparison Results] The phrase 'MRAG can supply at least 2.95 dB PSNR advancement' is awkward; consider 'MRAG improves PSNR by at least 2.95 dB over EFDR.'
[Related Works; Baselines] The baselines include only ISN+, RIIS, and EFDR; a brief discussion of why steganalysis-resistant spatial-domain methods such as USAP and DIH-OAIN are not compared, even qualitatively, would help position the contribution.
[Experimental Settings] The statement 'The code will be open-sourced on GitHub upon acceptance' means the experiments are currently not reproducible from the manuscript; consider releasing code or providing more implementation details in the supplementary material.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation; steganalysis claim suffers from a non-adaptive evaluation gap, not from a circular reduction.

full rationale

MRAG's derivation chain is not circular. The architecture (invertible local/global branches, adaptive fusion) and losses (MSE hiding/revealing losses plus the feature cosine/MSE adversarial loss) are built from standard components and external references; no claimed result is defined in terms of the target result. Secret restorability and visual imperceptibility are benchmarked against external methods (ISN+, RIIS, EFDR) on COCO, ImageNet, and BOSSBase, so those claims are self-contained and independently checkable. Steganalysis imperceptibility is the only questionable claim: the surrogate steganalyzer used in the adversarial loss and the evaluation steganalyzers are all trained on HRJS-generated cover-stego pairs, and no steganalyzer is trained on MRAG-generated stegos. The near-50% accuracies in Table 3 therefore demonstrate transfer to the HRJS-trained detector family rather than general undetectability by adaptive steganalyzers. This is a real validity limitation of the evaluation protocol, but it is not circularity: the loss does not formally force the reported accuracy values, and the evaluation detector is a separate instantiation rather than the exact fitted parameter. The internal inconsistency that Eq. 3's Ln = MSE(S2(Ci), S2(So)) actually changes norms, despite the text claiming norm values are kept changeless, is also a correctness issue, not a circular step. Self-citations (e.g., EFDR) are present but not load-bearing for the derivation. Accordingly, no circular step meets the quoted-reduction bar, and the circularity score is 0.

Assumptions & free parameters 1 free parameters · 3 assumptions · 0 invented entities

The central method is built on standard invertible-network math and prior empirical findings about classifier features. The load-bearing domain assumptions are that the surrogate feature space is the right target for imperceptibility and that matching it generalizes to unseen steganalyzers. No new physical or conceptual entities are introduced.

free parameters (1)

Number of affine coupling layers in adaptive fusion module = 3
Selected in the ablation study (Table 4) as the value giving the lowest average steganalysis detection accuracy on the COCO test set; this is a hyperparameter chosen on the evaluation data.

assumptions (3)

standard math Invertible neural networks preserve information and allow exact inversion (from NICE/RealNVP literature)
Referred to in the 'Backbone structure' paragraph as giving 'theoretical information lossless characteristic'.
domain assumption Features before the last fully connected layer can be disentangled into angle and norm components reflecting inter-class semantics and intra-class confidence
Invoked in Section 'Features Angle-Norm Disentanglement', based on prior work (Liu et al. 2018; Chen et al. 2020).
domain assumption A surrogate steganalyzer's classified features are a meaningful and sufficient target for achieving steganalysis imperceptibility
The entire adversarial loss uses the surrogate's features; the paper does not justify why matching these features should fool steganalyzers not trained on MRAG stegos.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Towards Imperceptible JPEG Image Hiding: Multi-range Representations-driven Adversarial Stego Generation." pith.science (2026). https://pith.science/paper/2LIXNGTU

@misc{pith2026250708343,
  author       = {Pith},
  title        = {Pith review of: Towards Imperceptible JPEG Image Hiding: Multi-range Representations-driven Adversarial Stego Generation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2LIXNGTU}},
  note         = {Machine review of arXiv:2507.08343}
}

read the original abstract

Image hiding fully explores the hidden potential of deep learning-based models, aiming to conceal image-level messages within cover images and reveal them from stego images to achieve covert communication. Existing hiding schemes are easily detected by the naked eyes or steganalyzers due to the cover type confined to the spatial domain, single-range feature extraction and attacks, and insufficient loss constraints. To address these issues, we propose a multi-range representations-driven adversarial stego generation framework called MRAG for JPEG image hiding. This design stems from the fact that steganalyzers typically combine local-range and global-range information to better capture hidden traces. Specifically, MRAG integrates the local-range characteristic of the convolution and the global-range modeling of the transformer. Meanwhile, a features angle-norm disentanglement loss is designed to launch multi-range representations-driven feature-level adversarial attacks. It computes the adversarial loss between covers and stegos based on the surrogate steganalyzer's classified features, i.e., the features before the last fully connected layer. Under the dual constraints of features angle and norm, MRAG can delicately encode the concatenation of cover and secret into subtle adversarial perturbations from local and global ranges relevant to steganalysis. Therefore, the resulting stego can achieve visual and steganalysis imperceptibility. Moreover, coarse-grained and fine-grained frequency decomposition operations are devised to transform the input, introducing multi-grained information. Extensive experiments demonstrate that MRAG can achieve state-of-the-art performance.

Figures

Figures reproduced from arXiv: 2507.08343 by the authors.

**Figure 2.** Overall architecture. To reduce information loss, we utilize invertible neural networks, the mainstream learning [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 3.** Secret restorability visualization comparisons. Se [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗

Figures from the paper (1 more)

**Figure 5.** Figure 5: The t-SNE visualization comparisons of the distribution of the classified features learned by three steganalyzers. [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

35 extracted references · 31 canonical work pages

[1]

, " * write output.state after.block = add.period write newline

ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...
[2]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...
[3]

Baluja, S. 2017. Hiding images in plain sight: Deep steganography . In Proceedings of Advances in Neural Information Processing Systems , volume 30

work page 2017
[4]

Baluja, S. 2020. Hiding images within images. IEEE Transactions on Pattern Analysis and Machine Intelligence, 42(7): 1685--1697

work page 2020
[5]

Bas, P.; Filler, T.; and Pevn \'y , T. 2011. ``Break our steganographic system'': The ins and outs of organizing BOSS. In Proceedings of Information Hiding, 59--70

work page 2011
[6]

Chen, B.; Liu, W.; Yu, Z.; Kautz, J.; Shrivastava, A.; Garg, A.; and Anandkumar, A. 2020. Angular visual hardness. In Proceedings of the 37th International Conference on Machine Learning, volume 119, 1637--1648

work page 2020
[7]

Dinh, L.; Krueger, D.; and Bengio, Y. 2014. Nice: Non-linear independent components estimation. arXiv:1410.8516

arXiv 2014
[8]

Dinh, L.; Sohl-Dickstein, J.; and Bengio, S. 2017. Density estimation using Real NVP. In Proceedings of the International Conference on Learning Representations

work page 2017

Show all 35 references

[9]

Dosovitskiy, A.; Beyer, L.; Kolesnikov, A.; Weissenborn, D.; Minderer, M.; Heigold, G.; Gelly, S.; Uszkoreit, J.; and Houlsby, N. 2021. An image is worth 16 16 words: Transformers for image recognition at scale. In Proceedings of International Conference on Learning Representations

2021
[10]

C.; Zhang, Y.; Lee, K.; Zhang, Y.; and Lee, H

Gilbert, A. C.; Zhang, Y.; Lee, K.; Zhang, Y.; and Lee, H. 2017. Towards understanding the invertibility of convolutional neural networks. In Proceedings of the 26th International Joint Conference on Artificial Intelligence, 1703–1710

2017
[11]

Guan, Z.; Jing, J.; Deng, X.; Xu, M.; Jiang, L.; Zhang, Z.; and Li, Y. 2023. DeepMIH: Deep invertible network for multiple image hiding. IEEE Transactions on Pattern Analysis and Machine Intelligence, 45(1): 372--390

2023
[12]

Hu, M.; and Wang, H. 2024. Lightweight JPEG image steganalysis using dilated blind-spot network. Journal of Visual Communication and Image Representation, 101: 104182

2024
[13]

Hu, X.; Fu, Z.; Zhang, X.; and Chen, Y. 2024. Invisible and steganalysis-resistant deep image hiding based on one-way adversarial invertible networks. IEEE Transactions on Circuits and Systems for Video Technology, 34(7): 6128--6143

2024
[14]

Huang, G.; Liu, Z.; van der Maaten, L.; and Weinberger, K. Q. 2017. Densely connected convolutional networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

2017
[15]

Jing, J.; Deng, X.; Xu, M.; Wang, J.; and Guan, Z. 2021. HiNet: Deep image hiding by invertible network. In Proceedings of the IEEE/CVF International Conference on Computer Vision, 4733--4742

2021
[16]

Krizhevsky, A.; Sutskever, I.; and Hinton, G. E. 2012. ImageNet classification with deep convolutional neural networks. In Proceedings of Advances in Neural Information Processing Systems, volume 25

2012
[17]

Lin, T.-Y.; Maire, M.; Belongie, S.; Hays, J.; Perona, P.; Ramanan, D.; Doll \'a r, P.; and Zitnick, C. L. 2014. Microsoft COCO: Common objects in context. In Proceedings of European Conference on Computer Vision, 740--755

2014
[18]

M.; and Song, L

Liu, W.; Liu, Z.; Yu, Z.; Dai, B.; Lin, R.; Wang, Y.; Rehg, J. M.; and Song, L. 2018. Decoupled networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

2018
[19]

Lu, S.-P.; Wang, R.; Zhong, T.; and Rosin, P. L. 2021. Large-capacity image steganography based on invertible neural networks . In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 10816--10825

2021
[20]

Pevn \'y , T.; and Fridrich, J. 2008. Benchmarking for steganography. In Proceedings of Information Hiding, 251--267

2008
[21]

Provos, N.; and Honeyman, P. 2003. Hide and seek: An introduction to steganography. IEEE Security & Privacy, 1(3): 32--44

2003
[22]

C.; and Li, F.-F

Russakovsky, O.; Deng, J.; Su, H.; Krause, J.; Satheesh, S.; Ma, S.; Huang, Z.; Karpathy, A.; Khosla, A.; Bernstein, M.; Berg, A. C.; and Li, F.-F. 2015. ImageNet large scale Visual recognition challenge. International Journal of Computer Vision, 115(3): 211--252

2015
[23]

Su, A.; Zhao, X.; and He, X. 2021. Arbitrary-sized JPEG steganalysis based on fully convolutional network. In Proceedings of International Workshop on Digital Watermarking, 197--221

2021
[24]

Tan, J.; Liao, X.; Liu, J.; Cao, Y.; and Jiang, H. 2022. Channel attention image steganography with generative adversarial networks. IEEE Transactions on Network Science and Engineering, 9(2): 888--903

2022
[25]

Wang, Z.; Bovik, A.; Sheikh, H.; and Simoncelli, E. 2004. Image quality assessment: From error visibility to structural similarity. IEEE Transactions on Image Processing, 13(4): 600--612

2004
[26]

Wei, K.; Luo, W.; and Huang, J. 2024. Color image steganalysis based on pixel difference convolution and enhanced transformer with selective pooling. IEEE Transactions on Information Forensics and Security, 19: 9970--9983

2024
[27]

Wei, K.; Luo, W.; Tan, S.; and Huang, J. 2022. Universal deep network for steganalysis of color image based on channel representation. IEEE Transactions on Information Forensics and Security, 17: 3022--3036

2022
[28]

Xiao, M.; Zheng, S.; Liu, C.; Wang, Y.; He, D.; Ke, G.; Bian, J.; Lin, Z.; and Liu, T.-Y. 2020. Invertible image rescaling. In Proceedings of European Conference on Computer Vision, 126--144

2020
[29]

Xu, Y.; Mou, C.; Hu, Y.; Xie, J.; and Zhang, J. 2022. Robust invertible image steganography. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 7875--7884

2022
[30]

Yang, J.; and Liao, X. 2023. Exploiting fine-grained DCT representations for hiding image-level messages within JPEG images. In Proceedings of the 31st ACM International Conference on Multimedia, 7373--7382

2023
[31]

Yang, J.; Shang, F.; Liao, Y.; and Chen, Y. 2023. Toward high capacity and robust JPEG steganography based on adversarial training. Security and Communication Networks

2023
[32]

Zhang, C.; Benz, P.; Karjauv, A.; and Kweon, I. S. 2021. Universal adversarial perturbations through the lens of deep steganography: Towards a fourier perspective. In Proceedings of the AAAI conference on artificial intelligence, volume 35, 3296--3304

2021
[33]

Zhang, C.; Benz, P.; Karjauv, A.; Sun, G.; and Kweon, I. S. 2020. UDH: Universal deep hiding for steganography, watermarking, and light field messaging. In Proceedings of Advances in Neural Information Processing Systems , volume 33, 10223--10234

2020
[34]

A.; Shechtman, E.; and Wang, O

Zhang, R.; Isola, P.; Efros, A. A.; Shechtman, E.; and Wang, O. 2018. The unreasonable effectiveness of deep features as a perceptual metric. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 586--595

2018
[35]

Zheng, Z.; Hu, Y.; Bin, Y.; Xu, X.; Yang, Y.; and Shen, H. T. 2023. Composition-aware image steganography through adversarial self-generated supervision. IEEE Transactions on Neural Networks and Learning Systems, 34(11): 9451--9465

2023

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

, " * write output.state after.block = add.period write newline

ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...

[2] [2]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

[3] [3]

Baluja, S. 2017. Hiding images in plain sight: Deep steganography . In Proceedings of Advances in Neural Information Processing Systems , volume 30

work page 2017

[4] [4]

Baluja, S. 2020. Hiding images within images. IEEE Transactions on Pattern Analysis and Machine Intelligence, 42(7): 1685--1697

work page 2020

[5] [5]

Bas, P.; Filler, T.; and Pevn \'y , T. 2011. ``Break our steganographic system'': The ins and outs of organizing BOSS. In Proceedings of Information Hiding, 59--70

work page 2011

[6] [6]

Chen, B.; Liu, W.; Yu, Z.; Kautz, J.; Shrivastava, A.; Garg, A.; and Anandkumar, A. 2020. Angular visual hardness. In Proceedings of the 37th International Conference on Machine Learning, volume 119, 1637--1648

work page 2020

[7] [7]

Dinh, L.; Krueger, D.; and Bengio, Y. 2014. Nice: Non-linear independent components estimation. arXiv:1410.8516

arXiv 2014

[8] [8]

Dinh, L.; Sohl-Dickstein, J.; and Bengio, S. 2017. Density estimation using Real NVP. In Proceedings of the International Conference on Learning Representations

work page 2017