  Historically, steganographic schemes were designed in a way to preserve image
statistics or steganalytic features. Since most of the state-of-the-art
steganalytic methods employ a machine learning (ML) based classifier, it is
reasonable to consider countering steganalysis by trying to fool the ML
classifiers. However, simply applying perturbations on stego images as
adversarial examples may lead to the failure of data extraction and introduce
unexpected artefacts detectable by other classifiers. In this paper, we present
a steganographic scheme with a novel operation called adversarial embedding,
which achieves the goal of hiding a stego message while at the same time
fooling a convolutional neural network (CNN) based steganalyzer. The proposed
method works under the conventional framework of distortion minimization.
Adversarial embedding is achieved by adjusting the costs of image element
modifications according to the gradients backpropagated from the CNN classifier
targeted by the attack. Therefore, modification direction has a higher
probability to be the same as the sign of the gradient. In this way, the so
called adversarial stego images are generated. Experiments demonstrate that the
proposed steganographic scheme is secure against the targeted adversary-unaware
steganalyzer. In addition, it deteriorates the performance of other
adversary-aware steganalyzers opening the way to a new class of modern
steganographic schemes capable to overcome powerful CNN-based steganalysis.
