Securing LSB embedding against structural steganalysis

Brian A. Powell

Home/Archive/arXiv

arXiv · 2003.03658

Securing LSB embedding against structural steganalysis

Brian A. Powell

View original source ↗Read source document ↗Export metadata ↓

Abstract

This work explores the extent to which LSB embedding can be made secure against structural steganalysis through a modification of cover image statistics prior to message embedding. Natural images possess symmetries that are expressed through approximately equal cardinalities of certain sets of $k$-tuples of consecutive pixels. LSB embedding disturbs this balance and a $k^{\rm th}$-order structural attack infers the presence of a hidden message with a length in proportion to the size of the imbalance amongst sets of $k$-tuples. To protect against $k^{\rm th}$-order structural attacks, cover modifications involve the redistribution of $k$-tuples among the different sets so that symmetries of the cover image are broken, then repaired through the act of LSB embedding so that the stego image bears the statistics of the original cover. To protect against all orders up to some order $k$, the statistics of $n$-tuples must be preserved where $n$ is the least common multiple of all orders $\leq k$. We find that this is only feasible for securing against up to $3^{\rm rd}$-order attacks (Sample Pairs and Triples analyses) since higher-order protections result in virtually zero embedding capacities. Securing up to $3^{\rm rd}$-order requires redistribution of sextuplets: rather than perform these $6^{\rm th}$-order cover modifications, which result in tiny embedding capacities, we reduce the problem to the redistribution of triplets in a manner that also preserves the statistics of pairs. This is done by embedding into only certain pixels of each sextuplet, constraining the maximum embedding rate to be $\leq 2/3$ bits per channel. Testing on a variety of image formats, we report best performance for JPEG-compressed images with a mean maximum embedding rate undetectable by $2^{\rm nd}$- and $3^{\rm rd}$-order attacks of 0.21 bits per channel.

Explore related subjects

cs.CR

Keep this discovery

Explore connections, maps & timelines

BibTeX RIS

Brian A. Powell. 2021-10-05. Securing LSB embedding against structural steganalysis. https://arxiv.org/abs/2003.03658

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

Spoofing Missed-Detection Bounds for PRF GNSS Ranging Authentication Under AWGN Models

Pseudorandom-function (PRF) ranging codes, such as those used in Galileo's encrypted E6-C under the Signal Authentication Service (SAS), enable a receiver to authenticate pseudoranges once the PRF secret is revealed. This work bounds how much authentication security the receiver obtains under Additive White Gaussian Noise (AWGN) assumptions. Against a spoofer that does not estimate the code before submitting its forgery, PRF security makes the forged correlation zero-mean up to the security of the underlying PRF, allowing integration time and C/N$_0$ to mostly determine probability of missed detection (PMD) and probability of false alarm (PFA). Against such a spoofer at a conservative 30 dB-Hz, 400 ms of E6-C aggregation certifies a PMD below $2^{-128}$ (plus any PRF advantage). For a spoofer that estimates chips before submitting a forgery, I derive the receiving-antenna gain at which authentication security breaks, which is about 12 dB for E6-C for the adversaries modeled. This work can be used to design a PRF GNSS ranging code protocol and a receiver capable of correctly asserting PRF ranging security assuming an AWGN model.

cs.CR↗

arXiv2026

First Attack, Final Offensive: The Dark Forest on an Open Roster

The Dark Forest argument holds that a civilization that detects another should strike it at once. Existing formal models make the detected civilization the object of the strike and play it on a roster the attacker knows to be complete. This paper changes both choices. The object of hostility is remaining uncontrolled capacity to retaliate or to warn someone who can, and the roster is open: no attacker ever knows it has met everyone. A first strike is then rational only if the timing benefit of what it removes now rather than later is at least the disclosure loss from every survivor that learns of it. A survivor that can bring about the attacker's destruction enters that loss as a lump, not a per-unit rate, and the actors the attacker has never found may be such a survivor, one that no strike removes. Their capacity cannot be estimated, but what they can do is capped at the attacker's destruction, so the test against them asks one answerable question: a first strike is rational only if the attacker accepts that the strike may be its last attack. The Dark Forest premises, read as hypotheses, fix what a general attacker cannot estimate: hidden hunters exist, a hunter that verifies a hostile acts against it with probability at least $q$, and a hider is rarely found, so a believer's first strike is rational only if what it removes is worth a $q$-share of its survival, the whole of it as $q$ approaches one. With survival as the payoff, the profile in which every hunter strikes what it finds is not a Nash equilibrium whenever a strike is more visible to unfound hunters than a hider is findable, while the profile in which every hunter hides is. That visibility comparison is the decisive physical question; an attacker that treats its strike as unseen has assumed the roster closed.

cs.CR↗

arXiv2026

From Capability to Assurance in Autonomous Penetration-Testing Harnesses: A Framework and Reference Implementation

Research on large language model agents for penetration testing is evaluated almost entirely by capability: whether the agent captures a flag or reproduces a proof of concept. That metric suits a benchmark but is silent on the properties that decide whether an autonomous agent can be used in an authorized engagement: whether a reported finding is true, whether the agent stayed inside its authorized scope, and whether an operator can audit what it did. We call these assurance properties and argue that they belong to the harness, the runtime wrapping the model, and can be enforced in code. This paper makes three contributions. First, we define a framework of five assurance properties (evidence grounding, non destructive claim reduction, computed severity, enforced authorization, and tamper evident accountability), each with a formal model and an explicit acceptance test, connected to prior work in capability based security, tamper evident logging, and software provenance. Second, we position representative systems (PentestGPT, the Cochise reference harness, MAPTA, and the trajectory judge PentestJudge) within the framework using published coding criteria, and identify a consistent assurance gap. Third, we study one open source implementation, NeuroSploit, pinned to an exact commit, reporting its architecture, its complexity cost, and a content addressed artifact bundle from a run against a public deliberately vulnerable target. We execute the deterministic authorization and audit acceptance tests directly and find and report a real enforcement gap, which we reflect by scoring both properties as partial. We therefore claim an initial existence argument that the properties are realizable together, not a comparative performance result, and we specify the multi target, ablation, and adversarial evaluation protocol required to turn the framework obligations into measurements.

cs.CR↗