Cover Estimation and Payload Location using Markov Random Fields Tu-Thach Quach Sandia National Laboratories, Albuquerque, NM, USA ABSTRACT Payload location is an approach to find the message bits hidden in steganographic images, but not necessarily their logical order. Its success relies primarily on the accuracy of the underlying cover estimators and can be improved if more estimators are used. This paper presents an approach based on Markov random field to estimate the cover image given a stego image. It uses pairwise constraints to capture the natural two-dimensional statistics of cover images and forms a basis for more sophisticated models. Experimental results show that it is competitive against current state-of-the-art estimators and can locate payload embedded by simple LSB steganography and group-parity steganography. Furthermore, when combined with existing estimators, payload location accuracy improves significantly. Keywords: S teganalysis, Cover Estimation, Payload Location, Markov Random Fields

1. INTRODUCTION In digital image steganography, a cover image is used to hide a payload through the use of an embedding algorithm. Popular algorithms include simple least significant bit (LSB) replacement and matching, group-parity steganography, and matrix embedding. To embed the payload, some pixels in the cover image must be modified by some operation so that the resulting stego image conveys the message bits. Two popular operations are LSB replacement and LSB matching. Note the distinction between embedding algorithm and operation as it will be important in our discussion. The latter refers to how pixels are modified and is used in all algorithms. If these modifications can be detected reliably, the payload can be located with high accuracy provided that a large number of stego images are available and the payload is determined by the same pixels. This could happen if the naive steganographer reuses the embedding key. Payload location is a steganographic forensic technique that aims at finding the message bits, but not necessarily their logical order. Payload location is much simpler if the cover images are also available. In simple LSB steganography, each payload bit is determined by a single pixel. Payload location is straightforward and involves finding which pixels have been modified. A payload of m bits, on average, can be located with approximately log2 m image pairs (cover and stego).1 In group-parity steganography, each payload bit is determined by a group of k pixels. Specifically, each payload bit is determined by the modulo-2 addition of the LSBs of the k pixels in that group. A payload of m bits requires km pixels. The task of payload location is no longer just to find these km pixels, but also to group them into the correct m groups of k pixels each. The approach consists of constructing and partitioning a weighted complete graph with pixels as nodes. A payload of km bits, on average, can be located with approximately 8k 2 log(km) image pairs.2 In practice, cover images might not be readily available and information about the cover images must be obtained by other means. For simple LSB steganography, it may still be sufficient to locate the payload using simple linear filters.3, 4 A more general approach is to estimate the cover images. An existing class of cover estimators finds the most likely cover image via maximum a posteriori (MAP) decoding.1, 5 These algorithms are efficient (linear time) and produce optimal estimates. They work by decoding each row, column, and diagonal Further author information: T. Quach: E-mail: [email protected] Sandia National Laboratories is a multi-program laboratory managed and operated by Sandia Corporation, a wholly owned subsidiary of Lockheed Martin Corporation, for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-AC04-94AL85000.

independently as a one-dimensional sequence. Payload location using these estimators has shown promising results, outperforming linear filter techniques. The success of payload location depends on the accuracy of the cover estimators. A perfect estimator would be ideal, but is not likely to exist. Fortunately, our previous work showed that it is possible to estimate the cover image with vanishing error rate by using a large (infinite) number of estimators.6 In practice, payload location accuracy can be improved when estimates from multiple estimators are combined. This work presents a new approach to estimate cover images using Markov random fields (MRF). Unlike the MAP estimators, this approach takes into account the inherent two-dimensional nature of images. It is simple, using only pairwise constraints to capture cover image statistics and forms a basis for more sophisticated models. For stego images that have been modified by LSB replacement, the estimates are guaranteed to be partially optimal, e.g., some pixels may not be determined, and in most cases are optimal, as shown in our experiments. For LSB matching stego images, the estimates can still be used to locate the payload with high accuracy. In Section 2, we provide a brief overview of MRF, outlining areas that are relevant to our cover estimation approach, which is presented in Section 3. Experimental results using our MRF estimator to locate payload embedded by simple LSB steganography and group-parity steganography are shown in Section 4. Concluding thoughts are provided in Section 5.

2. MARKOV RANDOM FIELD Markov random field is an approach that models the joint probability of context-dependent random variables in the form of a Gibbs distribution: p(y|x; w) =

1 −E(y|x;w) e , Z

(1)

where x is the input, y are the output labels, w are the model parameters (or weights), Z is the normalization term, and E is an energy function that captures the relationships among the variables that naturally occur in many applications such as images, where neighboring pixels tend to have similar intensities. These relationships are defined by a graph of nodes V (individual pixels) and edges E (neighboring pixel pairs). A simple and popular energy function uses unary (fi ) and pairwise (fij ) features in the form X X E(y|x; w) = w1 fi (yi |x) + w2 fij (yi , yj |x). (2) i∈V

ij∈E

More compactly, E(y|x; w) = wT f (y|x). The resulting MRF model is log-linear. Given x and w, MAP inferencing is y∗ = arg maxy p(y|x; w), or equivalently, y∗ = arg miny E(y|x; w). In general, MAP inferencing is NP-hard. For the above pairwise model, however, if y is a binary vector and every fij is submodular so that fij (0, 0|x) + fij (1, 1|x) ≤ fij (0, 1|x) + fij (1, 0|x),

(3)

then a global minimum of E can be found in polynomial time using graph cut techniques.7 For non-submodular pairwise functions, a partial solution can still be found using quadratic pseudo-binary optimization (QPBO).8, 9 QPBO solves a relaxation of the original problem by introducing complementary variables so that the new problem is submodular. The QPBO solution is no longer binary, but yi ∈ {0, 1, ∅}. The solution, however, is partially optimal in the sense that there exists a global minimum y∗ such that yi = yi∗ for all i where yi ∈ {0, 1}. If the output label space has more than two elements, an approximate solution can be obtained using the α-expansion method,10 which reduces the problem to solving a series of binary problems. The algorithm works as follows. Let the label of node i at iteration j be yi (j). To determine the labels at iteration j + 1, we pick a label α from the output label space and solve the corresponding binary problem where the output label space of node i is {yi (j), α}. This process is repeated until convergence or the maximum number of iterations is reached. The initial labels can be fixed or randomly assigned.

To completely specify a MRF model, its parameters must be defined. Hand-tuned parameters can work well in many applications. The parameters, however, can also be learned via training. Estimating the parameters using maximum likelihood is a natural choice. Let xi and yi be the ith sample in a collection of N training samples. The log-likelihood function to maximize is L(w) =

N X

log p(yi |xi ; w) =

N X

−E(yi |xi ; w) − log Z.

(4)

i=1

i=1

The presence of the normalization term, Z, is problematic as it cannot be efficiently computed in general. Although it can be approximated with Monte Carlo sampling or message passing, an alternative is to learn the parameters using maximum margin principles or structural support vector machine (SVM).11, 12 In structural SVM, the objective function is minimize w,ξ

subject to

N λ X 1 kwk22 + ξi 2 N i=1

E(y|xi ; w) − E(yi |xi ; w) ≥ 4(yi , y) − ξi , ∀y 6= yi , ∀i, ξ ≥ 0,

(5)

where λ is a constant that controls the trade-off between training errors and margin maximization, ξ are the slack variables, and 4(yi , y) is a loss function that quantifies the difference between the ground truth yi and the competing y. An example loss function is the Hamming loss function (the number of positions where yji 6= yj ). This quadratic program can be solved via cutting plane methods.12–14

3. COVER ESTIMATION AND PAYLOAD LOCATION We present an MRF approach to estimate the cover image given a stego image. If the embedding operation is LSB replacement, estimating the cover image is equivalent to identifying the modified pixels, which is a binary labeling problem suitable for the presented MRF framework. Let s = (s1 , . . . , sn ) be a stego image. Our goal is to find the most likely binary labels y where yi = 1 indicates that pixel i has been modified. It should be clear that the corresponding cover estimate can be obtained from y and s. To solve this problem, we use the pairwise MRF model (2) whose energy function is now X X E(y|s; w) = w1 fi (yi |s) + w2 fij (yi , yj |s). i∈V

(6)

ij∈E

The image grid forms a natural graph with pixels as nodes and neighboring pixels as edges. In a four-connected grid, each pixel is connected to its four neighbors: top, bottom, left, and right. We are, however, not restricted to this configuration and other grids, such as eight-connected and beyond, can also be used. In our experiments, we use the four-connected grid. Assuming that the proportion of modified pixels, ρ, is known or can be estimated using available techniques,15–18 our unary feature fi is defined as  − log(1 − ρ) if yi = 0, (7) fi (yi |s) = − log(ρ) if yi = 1. This is analogous to the likelihood probabilities used in the MAP estimators and it expresses the tendency of a pixel to be modified independent of other pixels. Denote by e s the LSB flipped version of s.     fij (yi , yj |s) =   

Pairwise feature fij is defined as − log p(si , sj ) − log p(si , sej ) − log p(sei , sj ) − log p(sei , sej )

if yi if yi if yi if yi

=0 =0 =1 =1

and and and and

yj yj yj yj

= 0, = 1, = 0, = 1.

(8)

The joint probabilities, p, are learned from known cover images. This is analogous to the prior probabilities in the MAP estimators and it captures the statistical properties of cover images to smooth out the payload noise. These characteristics are further controlled by the model parameters. If w2  w1 , the contributions of the unary terms become negligible resulting in over smooth estimates. Since fij is based on empirical probabilities, it is not guaranteed to be submodular. The inferred labels are only partially optimal using QPBO. As we will show in our experiments, however, optimal results are obtained in most cases and unlabeled pixels (yi = ∅) can be set to 0 with negligible impact. If the embedding operation is LSB matching, the output space is no longer binary, but is {−1, 0, 1}. We use the α-expansion algorithm to find y and estimate the cover image as s + y. Unary feature fi is now  − log(1 − ρ) if yi = 0,    if 1 ≤ si + yi ≤ 254 and yi 6= 0, − log( ρ2 ) fi (yi |s) = (9) − log(ρ) if (si = 1 and yi = −1) or (si = 254 and yi = 1),    ∞ otherwise. Similarly, pairwise feature fij is now  − log p(si + yi , sj + yj ) fij (yi , yj |s) = ∞

if 0 ≤ si + yi ≤ 255 and 0 ≤ sj + yj ≤ 255, otherwise.

(10)

Given a collection of N stego images, s1 , . . . , sN , each of length n, if the payload in each image is determined by the same set of pixels, we can infer the corresponding labels, y1 , . . . , yN , and use these to locate the payload. In simple P LSB steganography, each payload bit is determined by a single pixel. The mean residual of pixel i is ri = N1 l |yil |. The payload can be located by selecting the 2ρn pixels with the largest mean residuals.

In group-parity steganography, a payload of m bits is determined by m disjoint groups of k pixels. Payload location involves constructing a weighted complete graph with the km pixels as nodes. The weight of edge ij PN (also ji), i 6= j, is l=1 |yil ||yjl |. The graph is then partitioned into m groups of k pixels so that the sum of the removed edges is maximal. The partitioned pixel groups correspond to the payload.2

4. EXPERIMENTS We use images from the BOSSbase 0.92 database, which consists of 9074 grayscale cover images of size 512×512 in the raw PGM format.19 We divide these images into two disjoint sets: training set A consists of 8074 images and the remaining 1000 images form test set B.

4.1 Training The training set is further divided into 2 sets: A1 and A2 . The first set, A1 , has 7074 images and is used to learn the joint probabilities used by the pairwise features (8). The second set, A2 , consists of the remaining 1000 images and is used to learn the MRF model parameters. It is not necessary to use large images during training. Small images are sufficient and make training more efficient. Each image in A2 is divided into 64 images of size 64×64 resulting in a total of 64000 images. Out of these, we randomly pick 20000 images for training. For each image, we embed a random payload of 0.5 bits per pixel (bpp) to generate 20000 stego images using simple LSB replacement. With these 20000 cover-stego image pairs, we use structural SVM with the Hamming loss function and λ = 1 to learn the model parameters resulting in w1 = 0.9986 and w2 = 0.5413. These parameters are intuitive. Since the unary features are the actual proportion of modified pixels, ρ, and the pairwise features are based on joint probabilities of adjacent pixel intensities, which tend to over smooth the resulting image, w2 is made smaller than w1 to compensate for this undesirable smoothing. At this point, our MRF model is complete. We note that the optimal parameters might be different for LSB matching images, but as we will soon see, payload location accuracy is robust to a wide range of parameter values. As a consequence, using the same parameters for LSB matching images still results in high accuracy.

Table 1. Payload location accuracy as a function of the number of stego images, N , using MRF (column 2), MAP (→) (column 3), and the combination of MAP (→ ↓ & .) and MRF (column 4). Each stego image carries a payload of 0.5 bpp (131072 bits) embedded by simple LSB replacement steganography.

N 1 10 100 200 300 400 500 1000

MRF 66165 (50.48%) 96516 (73.64%) 120744 (92.12%) 125997 (96.13%) 128584 (98.10%) 129895 (99.10%) 130516 (99.58%) 131007 (99.95%)

MAP 65750 (50.16%) 93978 (71.70%) 118066 (90.08%) 122567 (93.51%) 125193 (95.51%) 126846 (96.78%) 128062 (97.70%) 129595 (98.87%)

MAP + MRF 66325 (50.60%) 102046 (77.85%) 123858 (94.50%) 127047 (96.93%) 128502 (98.04%) 129521 (98.82%) 130161 (99.30%) 130783 (99.78%)

5

1.35

x 10

1.3 1.25

Located payload

1.2 1.15 1.1 1.05 1 0.95 0.9

0

200

400 600 800 Number of stego images

1000

1200

Figure 1. The mean (dot), minimum (lower bar), and maximum (upper bar) numbers of located payload as a function of the number of stego images with w1 = 1 and w2 ranging from 0.3 through 0.7 in increments of 0.01. Payload location accuracy is robust to various w2 .

4.2 Simple LSB Replacement Steganography For each cover image in test set B, we embed a fixed payload of 0.5 bpp using LSB replacement with the same key. We then estimate the cover images, or the modified pixels to be precise, using our MRF estimator with ρ = 0.25. Out of 1000 images, only 208 instances have pixels that are unlabeled, e.g., yi = ∅. Of these, on average, only 6.34 pixels are unlabeled. Therefore most of the pixel estimates are optimal (according to the model). Using these estimates, we select the 131072 pixels with the largest mean residuals as payload pixels. We show the number of correctly identified payload pixels as a function of the number of stego images in column 2 of Table 1. Payload location accuracy increases with more stego images: 92% accuracy with 100 images and 99% with 400 images. For comparison, we also show the results using the second-order MAP (→) estimator in column 3 of Table 1. The accuracies of the MRF and MAP estimators are competitive. In our previous work,6 we showed that by combining independent cover estimates, we can locate modified pixels with vanishing error rate. In practice, this translates to improved payload location accuracy if estimates from multiple estimators are combined as evident in our results shown in column 4 of Table 1. The accuracy of the cover estimates, and hence the located payload, is not sensitive to the model parameters and good results can be obtained with various values. To show this, we set w1 = 1 and vary w2 from 0.3 through 0.7 in increments of 0.01. For each value of w2 , we estimate the cover images and locate the payload. We plot the mean, minimum, and maximum numbers of located payload as a function of the number of stego images in Figure 1. The plot confirms that payload location accuracy is robust to various w2 and increases with more stego images. The fact that we scale w1 to 1 is not important as constant scaling of the parameters does not change the solution. We could use the original w1 and change the range of w2 appropriately to obtain the same plot. The choice of w1 = 1 is merely for simplicity.

0.25

0.3

0.35

0.4 0.45 0.5 Mean residuals

0.55

0.6

0.65

(a)

(b)

Figure 2. Histogram (a) and heat map at the top left corner 20x20 region (b) of the mean residuals computed using the pairwise-only (w1 = 0) MRF estimates of 1000 stego images. Each stego image carries a payload of 0.5 bpp (131072 bits) embedded by simple LSB replacement steganography. Ground truth payload pixels are indicated by a white dot. Table 2. Accuracy of payload location as a function of the number of stego images, N , using the pairwise-only MRF estimates. Each stego image carries a payload of 0.5 bpp (131072 bits) embedded by simple LSB replacement steganography.

N 1 10 100 200 300 400 500 1000

True Positives 65312 (49.83%) 80784 (61.63%) 112909 (86.14%) 125847 (96.01%) 128826 (98.29%) 130050 (99.22%) 130601 (99.64%) 131044 (99.98%)

False 62032 31514 18031 17532 12250 8042 5352 1253

Positives (47.33%) (24.04%) (13.76%) (13.38%) (9.35%) (6.14%) (4.08%) (0.96%)

It is not necessary to require ρ to be known or estimated with high precision. We can simply remove this requirement by setting w1 = 0. This further eliminates the need for training as w2 can be set to 1. If the pairwise features can still provide reasonable estimates, the payload can be located with high precision. Figure 2 shows the histogram and heat map at the top left corner 20×20 region of the mean residuals computed using our pairwise-only MRF estimator over 1000 stego images. Ground truth payload pixels are indicated by a white dot. The histogram shows the two peaks corresponding to non-payload and payload pixels. It is also interesting to note that the second peak is at 0.5 suggesting that modified pixels are identified with high accuracy. The evidence from the histogram and the heat map shows that locations with large mean residuals are indeed loadcarrying pixels. To identify payload pixels, we need to threshold the mean residuals so that pixel i is a payload pixel if ri ≥ t, where t is the threshold. This can be viewed as binarizing the residual image and standard image processing techniques can be used. One method to accomplish this is to find a t that maximizes the betweenclass variance.20 The results are shown in Table 2. It should be clear that the payload can be located with high accuracy: true positive rate → 1 while false positive rate → 0 as N increases. We note that this relaxation also applies to the MAP estimators by setting the likelihood probabilities to 1.

4.3 Simple LSB Matching Steganography We repeat the above experiment using LSB matching instead of LSB replacement. We use the α-expansion algorithm to estimate the cover images. We set the maximum number of iterations to 300. All images converge without reaching this threshold. Out of 1000 images, the average number of iterations is 13.38. The results using MRF, MAP, and their combinations are shown in Table 3. Payload location accuracy increases with more stego images: 85% accuracy with 100 images and 94% with 500 images. The MRF estimator slightly outperforms the

Table 3. Payload location accuracy as a function of the number of stego images, N , using MRF (column 2), MAP (→) (column 3), and the combination of MAP (→ ↓ & .) and MRF (column 4). Each stego image carries a payload of 0.5 bpp (131072 bits) embedded by simple LSB matching steganography.

N 1 10 100 200 300 400 500 1000

MRF 65598 (50.05%) 91333 (69.68%) 112181 (85.59%) 115848 (88.39%) 118943 (90.75%) 121250 (92.51%) 123428 (94.17%) 126850 (96.78%)

MAP 65552 (50.01%) 92652 (70.69%) 108105 (82.48%) 110681 (84.44%) 112667 (85.96%) 114431 (87.30%) 116296 (88.73%) 118931 (90.74%)

MAP + MRF 65602 (50.05%) 96623 (73.72%) 115361 (88.01%) 117677 (89.78%) 118197 (90.18%) 120278 (91.76%) 121634 (92.80%) 124316 (94.85%)

MAP estimator and their combination leads to better accuracy, especially when the number of stego images is small. Contrasting these results to those using LSB replacement, it is clear that it is easier to estimate LSB replacement images than LSB matching images. This is a common theme and may be due to the symmetry of LSB matching. Upon further inspection, we find that the pixels along the image boundary tend to have low mean residuals. This is due to the fact that these pixels only have 2 or 3 neighboring pixels, whereas non-boundary pixels have 4 neighboring pixels. For a pixel to be declared as modified, e.g., yi ∈ {−1, 1}, the increase in unary cost must be offset by the decrease in pairwise cost. Boundary pixels may not have enough neighbors to make this transition. Reflecting the stego image a few pixels at the boundary, a trick used by other estimators, does not improve the results significantly. In fact, the boundary pixels now tend to have higher mean residuals than non-boundary pixels. Another option to address this problem is to use a different set of weights for boundary pixels. This problem should be further investigated. We note that this boundary problem is less noticeable in LSB replacement images (see the heat map in Figure 2(b)). This may be due to the significant increase in unary cost in LSB matching images compared to LSB replacement images, e.g., − log( ρ2 ) vs. − log(ρ).

4.4 LSB Replacement Group-Parity Steganography For group-parity steganography, each image in test set B is divided into 64 images of size 64×64. We randomly select 16000 out of 64000 images for testing. With k = 2, we embed (using LSB replacement operation) a payload of 2048 random bits (0.5 bpp) into each image to generate 16000 stego images. The same key is used so that the payload is determined by the same pixel groups across all images. Recall that payload location for group-parity steganography consists of constructing and partitioning a weighted complete graph. With 512×512 images, the number of nodes is 262144 and the number of edges is over 34 billion. Solving large graphs like this is only practical on supercomputers. To make the experiments accessible on desktops, we use small images. The results are shown in Table 4. For comparison, we also show the results using the second-order MAP (→) estimator as well as the combination of the MAP (→ ↓ & .) and MRF estimators. In all cases, payload location accuracy increases with more stego images. The MRF estimator noticeably outperforms the MAP estimator for small N . With N = 3000, the accuracy of the MRF estimator is 18% while the MAP estimator is only 4%. The significance of combining different cover estimators is best seen in these results. When MAP and MRF estimates are combined, payload location accuracy increases considerably: 40% with 3000 images (compared to 4% and 18%), 93% with 9000 images (compared to 41% and 48%).

5. DISCUSSION AND CONCLUSION Payload location is an important tool in steganographic forensic analysis. The located payload provides clues that may lead to the eventual recovery of the embedding key or the hidden messages. The success of payload location depends on having good cover estimators. Perhaps just as important as having good cover estimators is having many of them. By leveraging all of them, it may be possible to identify modified pixels with vanishing error rate. This, in turn, leads to increased payload location accuracy. This work presented an approach to estimate cover images using Markov random field. Our model is simple, capturing only adjacent pixel pair dependencies. The results are competitive to current state-of-the-art estimators. In some cases, the improvements are significant.

Table 4. Accuracy of payload location as a function of the number of stego images, N , using MRF (column 2), MAP (→) (column 3), and the combination of MAP (→ ↓ & .) and MRF (column 4). Each stego image carries a payload of 0.5 bpp (2048 bits) embedded by LSB replacement group-parity steganography.

N 1000 2000 3000 4000 5000 6000 7000 8000 9000 10000 11000 12000 13000 14000 15000 16000

50 121 378 391 442 590 800 812 984 995 1122 1219 1275 1374 1555 1630

MRF (2.44%) (5.91%) (18.46%) (19.09%) (21.58%) (28.81%) (39.06%) (39.65%) (48.05%) (48.58%) (54.79%) (59.52%) (62.26%) (67.09%) (75.93%) (79.59%)

11 27 81 141 245 372 506 657 833 958 1052 1198 1342 1418 1518 1604

MAP (0.54%) (1.32%) (3.96%) (6.88%) (11.96%) (18.16%) (24.71%) (32.08%) (40.67%) (46.78%) (51.37%) (58.50%) (65.53%) (69.24%) (74.12%) (78.32%)

MAP 114 335 820 1202 1406 1581 1765 1813 1909 1944 1953 1996 1997 2010 2017 2029

+ MRF (5.57%) (16.36%) (40.04%) (58.69%) (68.65%) (77.20%) (86.18%) (88.53%) (93.21%) (94.92%) (95.36%) (97.46%) (97.51%) (98.14%) (98.49%) (99.07%)

The presented approach is not limited to digital images and can be used in any medium where dependencies among the variables are meaningful. A natural extension of this work is to build more sophisticated MRF models that incorporate dependencies beyond adjacent pixel pairs. Another alternative might be to use different feature functions not based on joint probabilities. An example feature function could be the absolute intensity difference between two pixels. As mentioned earlier, we need to address the boundary problem as well. It is important to recognize that payload location is just one application of cover estimation. The ability to estimate the cover image may also be useful for steganalysis detectors. Finally, an interesting extension of this work is steganography. That is, we use an MRF to embed hidden messages into cover images. Unary feature functions capture single-letter distortion costs, while higher-order feature functions can be used to capture costs that reflect local embedding dependencies. As an example, it should be clear that the 3-pixel, 2-bit matrix embedding scheme can be implemented with the presented MRF model. We postpone investigating these problems to our future work.

REFERENCES [1] Quach, T.-T., “Optimal cover estimation methods and steganographic payload location,” IEEE Trans. Inf. Forensics Security 6(4), 1214–1222 (2011). [2] Quach, T.-T., “Locating payload embedded by group-parity steganography,” Digital Investigation 9(2), 160–166 (2012). [3] Ker, A. D., “Locating steganographic payload via WS residuals,” in 10th ACM Workshop on Multimedia and Security , 27–32, ACM (2008). [4] Ker, A. D. and Lubenko, I., “Feature reduction and payload location with WAM steganalysis,” in Media Forensics and Security , Proc. SPIE 7254, 72540A (2009). [5] Quach, T.-T., “On locating steganographic payload using residuals,” in Media Watermarking, Security, and Forensics III , Proc. SPIE 7880, 78800J (2011). [6] Quach, T.-T., “Locatability of modified pixels in steganographic images,” in Media Watermarking, Security, and Forensics 2012 , Proc. SPIE 8303, 83030Q (2012). [7] Kolmogorov, V. and Zabih, R., “What energy functions can be minimized via graph cuts?,” IEEE Trans. Pattern Anal. Mach. Intell. 26(2), 147–159 (2004). [8] Hammer, P. L., Hansen, P., and Simeone, B., “Roof duality, complementation and persistency in quadratic 0-1 optimization,” Mathematical Programming 28(2), 121–155 (1984).

[9] Kolmogorov, V. and Rother, C., “Minimizing nonsubmodular functions with graph cuts-a review,” IEEE Trans. Pattern Anal. Mach. Intell. 29(7), 1274–1279 (2007). [10] Boykov, Y., Veksler, O., and Zabih, R., “Fast approximate energy minimization via graph cuts,” IEEE Trans. Pattern Anal. Mach. Intell. 20(12), 1222–1239 (2001). [11] Taskar, B., Guestrin, C., and Koller, D., “Max-margin Markov networks,” in Advances in Neural Information Processing Systems , (2003). [12] Tsochantaridis, I., Hofmann, T., Joachims, T., and Altun, Y., “Support vector machine learning for interdependent and structured output spaces,” in International Conference on Machine Learning , (2004). [13] Szummer, M., Kohli, P., and Hoiem, D., “Learning CRFs using graph cuts,” in European Conference on Computer Vision , 582–595 (2008). [14] Joachims, T., Finley, T., and Yu, C.-N., “Cutting-plane training of structural SVMs,” Machine Learning 77(1), 27–59 (2009). [15] Fridrich, J. and Goljan, M., “On estimation of secret message length in LSB steganography in spatial domain,” in Security, Steganography, and Watermarking of Multimedia Contents VI , Proc. SPIE 5306, 23–34 (2004). [16] Ker, A. D. and B¨ ohme, R., “Revisiting weighted stego-image steganalysis,” in Security, Forensics, Steganography, and Watermarking of Multimedia Contents X , Proc. SPIE 6819, 681905 (2008). [17] Pevn´ y, T., Fridrich, J., and Ker, A. D., “From blind to quantitative steganalysis,” in Media Forensics and Security , Proc. SPIE 7254, 72540C (2009). [18] Kodovsk´ y, J. and Fridrich, J., “Quantitative steganalysis using rich models,” in Media Watermarking, Security, and Forensics 2013 , Proc. SPIE 8665, 86650O (2013). [19] Filler, T., Pevn´ y, T., and Bas, P., “Break our steganography system,” (July 2010). http://boss.gipsalab.grenoble-inp.fr. [20] Otsu, N., “A threshold selection method from gray-level histograms,” IEEE Trans. Syst., Man, Cybern. 9(1), 62–66 (1979).