exploiting adversarial embeddings for better steganography

HAL Id: hal-02177259https://hal.archives-ouvertes.fr/hal-02177259

Submitted on 8 Jul 2019

HAL is a multi-disciplinary open accessarchive for the deposit and dissemination of sci-entific research documents, whether they are pub-lished or not. The documents may come fromteaching and research institutions in France orabroad, or from public or private research centers.

L’archive ouverte pluridisciplinaire HAL, estdestinée au dépôt et à la diffusion de documentsscientifiques de niveau recherche, publiés ou non,émanant des établissements d’enseignement et derecherche français ou étrangers, des laboratoirespublics ou privés.

Exploiting Adversarial Embeddings for BetterSteganography

Solène Bernard, Tomáš Pevný, Patrick Bas, John Klein

To cite this version:Solène Bernard, Tomáš Pevný, Patrick Bas, John Klein. Exploiting Adversarial Embeddings for BetterSteganography. IH-MMSec, Jul 2019, Paris, France. �10.1145/3335203.3335737�. �hal-02177259�

https://hal.archives-ouvertes.fr/hal-02177259

https://hal.archives-ouvertes.fr

Exploiting Adversarial Embeddings for Better SteganographySolène Bernard

Univ. Lille, CNRS, Centrale Lille, UMR 9189, CRIStAL

Lille, France

[email protected]

Tomáš Pevný

FEL CTU Prague

Prague, Czech Republic

[email protected]

Patrick Bas


Lille, France

[email protected]

John Klein


Lille, France

[email protected]

ABSTRACTThis work proposes a protocol to iteratively build a distortion func-

tion for adaptive steganography while increasing its practical se-

curity after each iteration. It relies on prior art on targeted attacks

and iterative design of steganalysis schemes. It combines targeted

attacks on a given detector with aminmax strategy, which dynami-

cally selects the most difficult stego content associated with the best

classifier at each iteration. We theoretically prove the convergence,

which is confirmed by the practical results. Applied on J-Uniward

this new protocol increases Perr from 7% to 20% estimated by Xu-

Net, and from 10% to 23% for a non-targeted steganalysis by a linear

classifier with GFR features.

CCS CONCEPTS• Security and privacy → Domain-specific security and privacyarchitectures;

KEYWORDSsteganography, adversarial attacks, security, game-theory

ACM Reference Format:Solène Bernard, Tomáš Pevný, Patrick Bas, and John Klein. 2019. Exploiting

Adversarial Embeddings for Better Steganography. In ACM InformationHiding and Multimedia Security Workshop (IH&MMSec ’19), July 3–5, 2019,TROYES, France. ACM, New York, NY, USA, 6 pages. https://doi.org/10.1145/

3335203.3335737

1 INTRODUCTIONMost of steganographic methods are based on the distortion mini-

mization principle, first demonstrated in Hugo algorithm [13] and

later used in Uniward [11], MiPod [17], etc. Each pixel in the image

is assigned to an additive cost related to its value and its neighbor-

hood. During embedding, the Steganographer changes the content

such that the detectability (the total cost induced by all changes)

is minimized subject to the message being communicated. This is

typically done using Syndrome Trellis Codes (STC) [7], which are

very efficient for a class of additive distortion functions.

Because the Steganographer has to face a Detector (its adversary)

in order to benchmark the practical security of the embedding

IH&MMSec ’19, July 3–5, 2019, TROYES, France© 2019 Copyright held by the owner/author(s). Publication rights licensed to Associa-

tion for Computing Machinery.

ACM ISBN 978-1-4503-6821-6/19/06. . . $15.00

https://doi.org/10.1145/3335203.3335737

scheme, steganography is adversarial by design. In the literature

however, this adversarial constraint is only considered by a specific

generation of embedding schemeswhich usually offer high practical

security. We can distinguish two classes of adversarial schemes.

(1) The first class explicitly considers an adversary (the detector)

to design the embedding scheme which attacks the detector.

For example contribution [21] proposes to optimize basic

cost functions with respect to the output of SVM classifiers or

Maximum Mean Discrepancy for a given database. However

the pioneering scheme belonging to this class is ASO [12]

(see also section 2.1) which modifies specifically the embed-

ding costs for each image with respect to outputs of a set

of classifiers. Recently ADV-EMB [19] (see also section 2.2)

modifies embedding costs computed by J-Uniward to attack

a deep learning classifier. Other embedding schemes based

on Generative Adversarial Networks (GANs) [20] iteratively

generate a cost function in such a way that the associated

embedding is less and less detectable by the adversary. In

this case, the steganographer and the classifier are both con-

volutional networks and a global cost function, considering

both the payload constraint and the constraint on practical

detectability, is minimized.

(2) The second class of embedding schemes implicitly considers

the cost function as a proxy of the steganalyzer output, and

the embedding is tailored in order to minimize the statis-

tical discrepancy between Cover and Stego contents. This

class is associated with the concept of model-based embed-

ding which was first proposed by Sallee [16] and had been

used by different schemes such as Gibbs construction [6],

Dynamic programming based Syndrome Trellis Codes (Dy-

namic STC) [14], modeling image residuals in MiPod [17] or

mimicking the sensor noise [2].

The proposed work shares common ideas with designing tar-

geted attacks on steganalysis schemes as proposed by ASO or ADV-

EMB, but also uses iterative embedding procedure as GANs do.

Its main originality relies in the fact that it combines adversarial

embedding and game-theory in order to design a cost function

(and consequently an embedding scheme) which is more and more

secure w.r.t. an increasing set of classifiers, but also as presented in

section 4, w.r.t. other steganalysis schemes.

More specifically, this work investigates if a set of Detectors F

can be used to assign costs for changing values of image compo-

nents (e.g. pixels or DCT coefficients). The proposed scheme embeds

https://doi.org/10.1145/3335203.3335737

https://doi.org/10.1145/3335203.3335737

https://doi.org/10.1145/3335203.3335737

IH&MMSec ’19, July 3–5, 2019, TROYES, France Bernard, Pevný, Bas & Klein

the message such that the stego image is the least detectable image

by all f ∈ F . Since the set of Detector F should be theoretically

infinite, an iterative scheme associated to a minmax strategy is

proposed to make F finite and small.

NotationsIn the following, letters in bold are used to represent vectors. The

corresponding non bold letters are used for vector elements. The

caligraphic letters are used for sets. Cover and stego contents are

respectively denoted as x = (xi )H×W

and y = (yi )H×W

where HandW are the height and width of the image. We use z = (zi )

H×W

to denote the proposed adversarial stego contents. Note that z isa special type of y. The corresponding sets are denoted as X, Y

andZ respectively. ω ∈ {0, 1} will denote the class of a content xwhich is cover (ω = 0) or stego (ω = 1). N is the number of contents

in the data base.

2 ADAPTING COST FUNCTIONS AGAINSTDETECTORS: PREVIOUS WORKS

The most successful contemporary steganographic schemes are

based on the distortion minimization principle, where costs are as-signed to a change of each element of cover object. During embed-

ding, a cover object is modified to communicate a message while

minimizing the total distortion measured by the sum of costs of

changing individual elements, specifically

D(x, y) =H×W∑i=1

ρ+i δ1(yi − xi ) + ρ−i δ−1(yi − xi ). (1)

There is no single strategy as to how to assign costs ρi , which gives

rise to different steganographic schemes. Below, we review two

schemes adjusting costs ρi to evade directly a particular detector f .While both schemes have a very different background, they share a

similar strategy: to adjust cost according to the gradient of f with

respect to embedding changes.

2.1 Adaptive Steganography by OracleASO [12] derives embedding costs from an ensemble of Fisher

Linear Discriminants (FLD). In the notation of this paper, the set of

all possible FLDs corresponds to F and the set of FLDs extracted

from a trained ensemble corresponds toˆF k , where it is assumed

that all f ∈ F are already normalized according to [12, equations

(9) and (10)]. ASO then defines embedding cost for changing a pixel

xi as

ρ+i =1

| ˆF k |

∑f ∈ ˆFk

(f (x+i ) − f (x)),

ρ−i =1

| ˆF k |

∑f ∈ ˆFk

(f (x−i ) − f (x)),

where x+i and x−i denote the version of an image x with pixel (i)

increased or decreased by one. Note that f (x+i ) − f (x) and f (x−i ) −

f (x) are numerical estimates of the partial derivative∂f∂xi. The

assignment of costs therefore assumes that each classifier f ∈ ˆF k

contributes equally to the detectability of the image. In contrast,

the proposed protocol detailed in Section 3 assumes the worst

case, where the detector always picks his best classifier for a given

content.

2.2 ADV-EMB steganographyADV-EMBmethod [19] modifies costs ρ+i and ρ−i for increasing and

decreasing the (i)-pixel obtained by some prior function to evade

detection by classifier f as

q+i =

ρ+i /α if −

∂f∂xi> 0,

ρ+i if −∂f∂xi= 0,

ρ+i α if −∂f∂xi< 0,

(2)

where∂f∂xi

is the partial derivative of f with respect to the value

of the (i)-pixel at its current value xi and α is a parameter that

authors recommend to set to 2. Costs q−i are adjusted in a similar

way with reversed inequalities.

The proposed attack first calculates cost of pixel changes using

the standard J-Uniward. Then, all DCT coefficients are divided

into two disjoint groups: a common group Lc containing (1 − β)fraction of DCT coefficients and an adjustable group La containing

the remaining β fraction of DCT coefficients. To embed a message

m of length ℓ, the algorithm first embeds ℓ(1 − β) bits into the

common group using the initial embedding costs ρi . Costs in the

adjustable group are modified according to Equation (2), and the

rest of the message is embedded into adjustable DCT coefficients

La , producing the final stego content carrying the whole message.

The same work also suggests an iterative scheme, where the

classifier is retrained on a mixture of stego images obtained by

attacking the classifier trained in the previous iteration in the aim

of training a more robust detector. In contrast, the goal of this

paper is to create a more secure steganographic algorithm by using

minmax strategy.

3 EXPLOITING ADVERSARIAL ATTACKSUnder uniform class distribution, the error Perr(f |PX , PY ) of a

classifier1 f : X 7→ R on cover and stego contents with distribution

PX and PY is

Perr(f |PX , PY ) = P (sign (f ) , ω)

=1

2

EPX [I { f > 0}] +1

2

EPY [I { f < 0}], (3)

where I denotes the indicator function. Should the steganographer

be maximally undetectable with respect to the class of detectors F ,

the steganographer should choose the embedding function hemb

maximizing the error of the best classifier the detector can possess,

i.e.

max

hemb

min

f ∈FPerr(f |PX , PY (h

emb)), (4)

where PY (hemb

) denotes the probability distribution of stego im-

ages created by embedding function hemb

from cover images with

distribution PX . This is of course not trivial, since F can contain

1Without loss of generality it is assumed the output of a detector f to be positive /

negative if content x is classified as stego / cover. Also, for improved readability, we

call f a classifier while it is the discriminant function which must be compared to

threshold zero to obtain a content class label.

Exploiting Adversarial Embeddings for Better Steganography IH&MMSec ’19, July 3–5, 2019, TROYES, France

virtually any function f . In practice F consists of a set of fixed

functions parameterized by θ ∈ Θ. These functions are for example

steganographic features coupled by a machine learning based clas-

sifier, where θ are parameters of the classifier. Alternatively, they

can be convolutional neural networks in which case θ corresponds

to weights and other parameters of neural networks.

Assuming the set of functions F to be finite, in order to find a

solution of Equation (4), we can use methods [6, 14, 19] to embed

messagem into content x to create a stego contenty by, minimizing

the detectability of the most sensitive detector f ∈ F instead of

maximizing Perr, i.emin

ymax

f ∈Ff (y). (5)

In (5) it is assumed that the output of the detector f is calibrated,

i.e. for example it outputs the probability that the content will

be classified as stego. This calibration can be achieved either by

passing the output through a logistic function, or by using empirical

probability distribution functions.

Equation (5) converts the problem of distortion function design

to the problem of finding a set of functions F , that would be suf-

ficiently rich to detect all types of steganographic distortions and

small enough such that the minimization will be possible. In the

rest of this section, an iterative protocol to construct such a set F

of classifiers for a fixed or a small set of architecture(s) of neural

networks is presented.

3.1 MinMax distortion functionThe protocol to build a small but representative set of classifiers

relies on the ability of the steganographer to use any function

f : X → R to derive a distortion function for embedding [6, 14, 19].

It further assumes that the steganograher possesses a reasonably

large set of cover contents X and some steganographic algorithm

hemb

to initiate the protocol.

The protocol starts by creating a set of stego-contents Y0using

the initial steganographic algorithm hemb. Then, a classifier f 0 is

trained to classify contents from X and Y0and is added to the set

of available classifiersˆF0 = { f 0}. To simplify notations, we also

define Z0 = Y0.

In the next iteration, the steganographer creates a set of stego

contentsZ1by attacking f 0. Then fromZ0

andZ1the steganogra-

pher generates a new set of stego contents,Y1, by always selecting

the most difficult version with respect to the set of available classi-

fiersˆF 0

(which at the moment contains only f 0) as

Y1 =

z��z = argmin

z∈{z0i ,z1

i }

max

f ∈ ˆF0

f (z) , 1 ≤ i ≤ n

, (6)

where z·i denotes a stego content from Z ·created from a cover

content xi ∈ X.We recall here that the output of a detector f to be

respectively positive / negative if content x is respectively classifiedas stego / cover. It is why the steganographer aims at minimizing

the output of f . The steganographer then continues by creating

a new classifier f 1 classifying X and Y1and adding it to

ˆF 0. His

new set of classifiers isˆF 1 = ˆF 0 ∪ { f 1}.

At the kth iteration of the protocol, the steganographer creates

a set of contentsZkattacking the classifier trained in the previous

iteration f k−1. ContentsZ0,Z1, . . . ,Zkare then used to create a

f1<latexit sha1_base64="dbC3JNoiOdvoUnqwXZ+pJMrx9Ec=">AAACx3icjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl0o7sK9gH1QTKdtkPzIpkUS3HhD7jVPxP/QP/CO+MU1CI6IcmZc+85M/dePwlEJh3ntWDNzS8sLhWXSyura+sb5c2tZhbnKeMNFgdx2va9jAci4g0pZMDbScq90A94yx+eqnhrxNNMxNGlHCf8OvT6kegJ5klF9W7c0m254lQdvexZ4BpQgVn1uPyCK3QRgyFHCI4IknAADxk9HbhwkBB3jQlxKSGh4xz3KJE2pyxOGR6xQ/r2adcxbER75ZlpNaNTAnpTUtrYI01MeSlhdZqt47l2Vuxv3hPtqe42pr9vvEJiJQbE/qWbZv5Xp2qR6OFY1yCopkQzqjpmXHLdFXVz+0tVkhwS4hTuUjwlzLRy2mdbazJdu+qtp+NvOlOxas9Mbo53dUsasPtznLOgeVB1nap7cVipnZhRF7GDXezTPI9QwxnqaJD3AI94wrN1bsXWyLr7TLUKRrONb8t6+AAfP5Ai</latexit><latexit sha1_base64="dbC3JNoiOdvoUnqwXZ+pJMrx9Ec=">AAACx3icjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl0o7sK9gH1QTKdtkPzIpkUS3HhD7jVPxP/QP/CO+MU1CI6IcmZc+85M/dePwlEJh3ntWDNzS8sLhWXSyura+sb5c2tZhbnKeMNFgdx2va9jAci4g0pZMDbScq90A94yx+eqnhrxNNMxNGlHCf8OvT6kegJ5klF9W7c0m254lQdvexZ4BpQgVn1uPyCK3QRgyFHCI4IknAADxk9HbhwkBB3jQlxKSGh4xz3KJE2pyxOGR6xQ/r2adcxbER75ZlpNaNTAnpTUtrYI01MeSlhdZqt47l2Vuxv3hPtqe42pr9vvEJiJQbE/qWbZv5Xp2qR6OFY1yCopkQzqjpmXHLdFXVz+0tVkhwS4hTuUjwlzLRy2mdbazJdu+qtp+NvOlOxas9Mbo53dUsasPtznLOgeVB1nap7cVipnZhRF7GDXezTPI9QwxnqaJD3AI94wrN1bsXWyLr7TLUKRrONb8t6+AAfP5Ai</latexit><latexit sha1_base64="dbC3JNoiOdvoUnqwXZ+pJMrx9Ec=">AAACx3icjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl0o7sK9gH1QTKdtkPzIpkUS3HhD7jVPxP/QP/CO+MU1CI6IcmZc+85M/dePwlEJh3ntWDNzS8sLhWXSyura+sb5c2tZhbnKeMNFgdx2va9jAci4g0pZMDbScq90A94yx+eqnhrxNNMxNGlHCf8OvT6kegJ5klF9W7c0m254lQdvexZ4BpQgVn1uPyCK3QRgyFHCI4IknAADxk9HbhwkBB3jQlxKSGh4xz3KJE2pyxOGR6xQ/r2adcxbER75ZlpNaNTAnpTUtrYI01MeSlhdZqt47l2Vuxv3hPtqe42pr9vvEJiJQbE/qWbZv5Xp2qR6OFY1yCopkQzqjpmXHLdFXVz+0tVkhwS4hTuUjwlzLRy2mdbazJdu+qtp+NvOlOxas9Mbo53dUsasPtznLOgeVB1nap7cVipnZhRF7GDXezTPI9QwxnqaJD3AI94wrN1bsXWyLr7TLUKRrONb8t6+AAfP5Ai</latexit><latexit sha1_base64="dbC3JNoiOdvoUnqwXZ+pJMrx9Ec=">AAACx3icjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl0o7sK9gH1QTKdtkPzIpkUS3HhD7jVPxP/QP/CO+MU1CI6IcmZc+85M/dePwlEJh3ntWDNzS8sLhWXSyura+sb5c2tZhbnKeMNFgdx2va9jAci4g0pZMDbScq90A94yx+eqnhrxNNMxNGlHCf8OvT6kegJ5klF9W7c0m254lQdvexZ4BpQgVn1uPyCK3QRgyFHCI4IknAADxk9HbhwkBB3jQlxKSGh4xz3KJE2pyxOGR6xQ/r2adcxbER75ZlpNaNTAnpTUtrYI01MeSlhdZqt47l2Vuxv3hPtqe42pr9vvEJiJQbE/qWbZv5Xp2qR6OFY1yCopkQzqjpmXHLdFXVz+0tVkhwS4hTuUjwlzLRy2mdbazJdu+qtp+NvOlOxas9Mbo53dUsasPtznLOgeVB1nap7cVipnZhRF7GDXezTPI9QwxnqaJD3AI94wrN1bsXWyLr7TLUKRrONb8t6+AAfP5Ai</latexit>

f0<latexit sha1_base64="9GQK29HUBVE4F+jA7jHiFHoFl6E=">AAACxnicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl002VF+4BaJZlO69C8mEyUUgR/wK1+mvgH+hfeGVNQi+iEJGfOvefM3Hv9JBCpcpzXgjU3v7C4VFwurayurW+UN7daaZxJxpssDmLZ8b2UByLiTSVUwDuJ5F7oB7ztj051vH3LZSri6EKNE94LvWEkBoJ5iqjzwZVzXa44Vccsexa4OaggX424/IJL9BGDIUMIjgiKcAAPKT1duHCQENfDhDhJSJg4xz1KpM0oi1OGR+yIvkPadXM2or32TI2a0SkBvZKUNvZIE1OeJKxPs008M86a/c17Yjz13cb093OvkFiFG2L/0k0z/6vTtSgMcGxqEFRTYhhdHctdMtMVfXP7S1WKHBLiNO5TXBJmRjnts200qald99Yz8TeTqVm9Z3luhnd9Sxqw+3Ocs6B1UHWdqnt2WKmd5KMuYge72Kd5HqGGOhpokvcQj3jCs1W3Iiuz7j5TrUKu2ca3ZT18AN5XkA0=</latexit><latexit sha1_base64="9GQK29HUBVE4F+jA7jHiFHoFl6E=">AAACxnicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl002VF+4BaJZlO69C8mEyUUgR/wK1+mvgH+hfeGVNQi+iEJGfOvefM3Hv9JBCpcpzXgjU3v7C4VFwurayurW+UN7daaZxJxpssDmLZ8b2UByLiTSVUwDuJ5F7oB7ztj051vH3LZSri6EKNE94LvWEkBoJ5iqjzwZVzXa44Vccsexa4OaggX424/IJL9BGDIUMIjgiKcAAPKT1duHCQENfDhDhJSJg4xz1KpM0oi1OGR+yIvkPadXM2or32TI2a0SkBvZKUNvZIE1OeJKxPs008M86a/c17Yjz13cb093OvkFiFG2L/0k0z/6vTtSgMcGxqEFRTYhhdHctdMtMVfXP7S1WKHBLiNO5TXBJmRjnts200qald99Yz8TeTqVm9Z3luhnd9Sxqw+3Ocs6B1UHWdqnt2WKmd5KMuYge72Kd5HqGGOhpokvcQj3jCs1W3Iiuz7j5TrUKu2ca3ZT18AN5XkA0=</latexit><latexit sha1_base64="9GQK29HUBVE4F+jA7jHiFHoFl6E=">AAACxnicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl002VF+4BaJZlO69C8mEyUUgR/wK1+mvgH+hfeGVNQi+iEJGfOvefM3Hv9JBCpcpzXgjU3v7C4VFwurayurW+UN7daaZxJxpssDmLZ8b2UByLiTSVUwDuJ5F7oB7ztj051vH3LZSri6EKNE94LvWEkBoJ5iqjzwZVzXa44Vccsexa4OaggX424/IJL9BGDIUMIjgiKcAAPKT1duHCQENfDhDhJSJg4xz1KpM0oi1OGR+yIvkPadXM2or32TI2a0SkBvZKUNvZIE1OeJKxPs008M86a/c17Yjz13cb093OvkFiFG2L/0k0z/6vTtSgMcGxqEFRTYhhdHctdMtMVfXP7S1WKHBLiNO5TXBJmRjnts200qald99Yz8TeTqVm9Z3luhnd9Sxqw+3Ocs6B1UHWdqnt2WKmd5KMuYge72Kd5HqGGOhpokvcQj3jCs1W3Iiuz7j5TrUKu2ca3ZT18AN5XkA0=</latexit><latexit sha1_base64="9GQK29HUBVE4F+jA7jHiFHoFl6E=">AAACxnicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl002VF+4BaJZlO69C8mEyUUgR/wK1+mvgH+hfeGVNQi+iEJGfOvefM3Hv9JBCpcpzXgjU3v7C4VFwurayurW+UN7daaZxJxpssDmLZ8b2UByLiTSVUwDuJ5F7oB7ztj051vH3LZSri6EKNE94LvWEkBoJ5iqjzwZVzXa44Vccsexa4OaggX424/IJL9BGDIUMIjgiKcAAPKT1duHCQENfDhDhJSJg4xz1KpM0oi1OGR+yIvkPadXM2or32TI2a0SkBvZKUNvZIE1OeJKxPs008M86a/c17Yjz13cb093OvkFiFG2L/0k0z/6vTtSgMcGxqEFRTYhhdHctdMtMVfXP7S1WKHBLiNO5TXBJmRjnts200qald99Yz8TeTqVm9Z3luhnd9Sxqw+3Ocs6B1UHWdqnt2WKmd5KMuYge72Kd5HqGGOhpokvcQj3jCs1W3Iiuz7j5TrUKu2ca3ZT18AN5XkA0=</latexit>

f2<latexit sha1_base64="iUfY306fKxM0cuI2B/z0uLUUTiI=">AAACxnicjVHLSsNAFD2Nr1pfVZdugkVwVZIi6LLopsuK9gG1SjKd1tC8mEwUKYI/4FY/TfwD/QvvjFNQi+iEJGfOvefM3Hv9NAwy6TivBWtufmFxqbhcWlldW98ob261syQXjLdYEiai63sZD4OYt2QgQ95NBfciP+Qdf3yi4p0bLrIgic/lXcr7kTeKg2HAPEnU2fCydlWuOFVHL3sWuAZUYFYzKb/gAgMkYMgRgSOGJBzCQ0ZPDy4cpMT1MSFOEAp0nOMeJdLmlMUpwyN2TN8R7XqGjWmvPDOtZnRKSK8gpY090iSUJwir02wdz7WzYn/znmhPdbc7+vvGKyJW4prYv3TTzP/qVC0SQxzpGgKqKdWMqo4Zl1x3Rd3c/lKVJIeUOIUHFBeEmVZO+2xrTaZrV731dPxNZypW7ZnJzfGubkkDdn+Ocxa0a1XXqbqnB5X6sRl1ETvYxT7N8xB1NNBEi7xHeMQTnq2GFVu5dfuZahWMZhvflvXwAeMXkA8=</latexit><latexit sha1_base64="iUfY306fKxM0cuI2B/z0uLUUTiI=">AAACxnicjVHLSsNAFD2Nr1pfVZdugkVwVZIi6LLopsuK9gG1SjKd1tC8mEwUKYI/4FY/TfwD/QvvjFNQi+iEJGfOvefM3Hv9NAwy6TivBWtufmFxqbhcWlldW98ob261syQXjLdYEiai63sZD4OYt2QgQ95NBfciP+Qdf3yi4p0bLrIgic/lXcr7kTeKg2HAPEnU2fCydlWuOFVHL3sWuAZUYFYzKb/gAgMkYMgRgSOGJBzCQ0ZPDy4cpMT1MSFOEAp0nOMeJdLmlMUpwyN2TN8R7XqGjWmvPDOtZnRKSK8gpY090iSUJwir02wdz7WzYn/znmhPdbc7+vvGKyJW4prYv3TTzP/qVC0SQxzpGgKqKdWMqo4Zl1x3Rd3c/lKVJIeUOIUHFBeEmVZO+2xrTaZrV731dPxNZypW7ZnJzfGubkkDdn+Ocxa0a1XXqbqnB5X6sRl1ETvYxT7N8xB1NNBEi7xHeMQTnq2GFVu5dfuZahWMZhvflvXwAeMXkA8=</latexit><latexit sha1_base64="iUfY306fKxM0cuI2B/z0uLUUTiI=">AAACxnicjVHLSsNAFD2Nr1pfVZdugkVwVZIi6LLopsuK9gG1SjKd1tC8mEwUKYI/4FY/TfwD/QvvjFNQi+iEJGfOvefM3Hv9NAwy6TivBWtufmFxqbhcWlldW98ob261syQXjLdYEiai63sZD4OYt2QgQ95NBfciP+Qdf3yi4p0bLrIgic/lXcr7kTeKg2HAPEnU2fCydlWuOFVHL3sWuAZUYFYzKb/gAgMkYMgRgSOGJBzCQ0ZPDy4cpMT1MSFOEAp0nOMeJdLmlMUpwyN2TN8R7XqGjWmvPDOtZnRKSK8gpY090iSUJwir02wdz7WzYn/znmhPdbc7+vvGKyJW4prYv3TTzP/qVC0SQxzpGgKqKdWMqo4Zl1x3Rd3c/lKVJIeUOIUHFBeEmVZO+2xrTaZrV731dPxNZypW7ZnJzfGubkkDdn+Ocxa0a1XXqbqnB5X6sRl1ETvYxT7N8xB1NNBEi7xHeMQTnq2GFVu5dfuZahWMZhvflvXwAeMXkA8=</latexit><latexit sha1_base64="iUfY306fKxM0cuI2B/z0uLUUTiI=">AAACxnicjVHLSsNAFD2Nr1pfVZdugkVwVZIi6LLopsuK9gG1SjKd1tC8mEwUKYI/4FY/TfwD/QvvjFNQi+iEJGfOvefM3Hv9NAwy6TivBWtufmFxqbhcWlldW98ob261syQXjLdYEiai63sZD4OYt2QgQ95NBfciP+Qdf3yi4p0bLrIgic/lXcr7kTeKg2HAPEnU2fCydlWuOFVHL3sWuAZUYFYzKb/gAgMkYMgRgSOGJBzCQ0ZPDy4cpMT1MSFOEAp0nOMeJdLmlMUpwyN2TN8R7XqGjWmvPDOtZnRKSK8gpY090iSUJwir02wdz7WzYn/znmhPdbc7+vvGKyJW4prYv3TTzP/qVC0SQxzpGgKqKdWMqo4Zl1x3Rd3c/lKVJIeUOIUHFBeEmVZO+2xrTaZrV731dPxNZypW7ZnJzfGubkkDdn+Ocxa0a1XXqbqnB5X6sRl1ETvYxT7N8xB1NNBEi7xHeMQTnq2GFVu5dfuZahWMZhvflvXwAeMXkA8=</latexit>

X<latexit sha1_base64="Mai5bsDED0rJsSW3ZyD51RcQ+d8=">AAACznicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047KCfUAtMplO29C8SCaFUopbf8Ctfpb4B/oX3hmnoBbRCUnOnHvOnbn3ekngZ9JxXgvW0vLK6lpxvbSxubW9U97da2ZxnnLR4HEQp22PZSLwI9GQvgxEO0kFC71AtLzRpYq3xiLN/Di6kZNEdEM2iPy+z5kkqnMbMjnkLJi2Z3flilN19LIXgWtABWbV4/ILbtFDDI4cIQQiSMIBGDJ6OnDhICGuiylxKSFfxwVmKJE3J5UgBSN2RN8B7TqGjWivcmbazemUgN6UnDaOyBOTLiWsTrN1PNeZFftb7qnOqe42ob9ncoXESgyJ/cs3V/7Xp2qR6ONc1+BTTYlmVHXcZMl1V9TN7S9VScqQEKdwj+IpYa6d8z7b2pPp2lVvmY6/aaVi1Z4bbY53dUsasPtznIugeVJ1nap7fVqpXZhRF3GAQxzTPM9QwxXqaOiOP+IJz1bdGlsz6/5TahWMZx/flvXwAZzxk+8=</latexit><latexit sha1_base64="Mai5bsDED0rJsSW3ZyD51RcQ+d8=">AAACznicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047KCfUAtMplO29C8SCaFUopbf8Ctfpb4B/oX3hmnoBbRCUnOnHvOnbn3ekngZ9JxXgvW0vLK6lpxvbSxubW9U97da2ZxnnLR4HEQp22PZSLwI9GQvgxEO0kFC71AtLzRpYq3xiLN/Di6kZNEdEM2iPy+z5kkqnMbMjnkLJi2Z3flilN19LIXgWtABWbV4/ILbtFDDI4cIQQiSMIBGDJ6OnDhICGuiylxKSFfxwVmKJE3J5UgBSN2RN8B7TqGjWivcmbazemUgN6UnDaOyBOTLiWsTrN1PNeZFftb7qnOqe42ob9ncoXESgyJ/cs3V/7Xp2qR6ONc1+BTTYlmVHXcZMl1V9TN7S9VScqQEKdwj+IpYa6d8z7b2pPp2lVvmY6/aaVi1Z4bbY53dUsasPtznIugeVJ1nap7fVqpXZhRF3GAQxzTPM9QwxXqaOiOP+IJz1bdGlsz6/5TahWMZx/flvXwAZzxk+8=</latexit><latexit sha1_base64="Mai5bsDED0rJsSW3ZyD51RcQ+d8=">AAACznicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047KCfUAtMplO29C8SCaFUopbf8Ctfpb4B/oX3hmnoBbRCUnOnHvOnbn3ekngZ9JxXgvW0vLK6lpxvbSxubW9U97da2ZxnnLR4HEQp22PZSLwI9GQvgxEO0kFC71AtLzRpYq3xiLN/Di6kZNEdEM2iPy+z5kkqnMbMjnkLJi2Z3flilN19LIXgWtABWbV4/ILbtFDDI4cIQQiSMIBGDJ6OnDhICGuiylxKSFfxwVmKJE3J5UgBSN2RN8B7TqGjWivcmbazemUgN6UnDaOyBOTLiWsTrN1PNeZFftb7qnOqe42ob9ncoXESgyJ/cs3V/7Xp2qR6ONc1+BTTYlmVHXcZMl1V9TN7S9VScqQEKdwj+IpYa6d8z7b2pPp2lVvmY6/aaVi1Z4bbY53dUsasPtznIugeVJ1nap7fVqpXZhRF3GAQxzTPM9QwxXqaOiOP+IJz1bdGlsz6/5TahWMZx/flvXwAZzxk+8=</latexit><latexit sha1_base64="Mai5bsDED0rJsSW3ZyD51RcQ+d8=">AAACznicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047KCfUAtMplO29C8SCaFUopbf8Ctfpb4B/oX3hmnoBbRCUnOnHvOnbn3ekngZ9JxXgvW0vLK6lpxvbSxubW9U97da2ZxnnLR4HEQp22PZSLwI9GQvgxEO0kFC71AtLzRpYq3xiLN/Di6kZNEdEM2iPy+z5kkqnMbMjnkLJi2Z3flilN19LIXgWtABWbV4/ILbtFDDI4cIQQiSMIBGDJ6OnDhICGuiylxKSFfxwVmKJE3J5UgBSN2RN8B7TqGjWivcmbazemUgN6UnDaOyBOTLiWsTrN1PNeZFftb7qnOqe42ob9ncoXESgyJ/cs3V/7Xp2qR6ONc1+BTTYlmVHXcZMl1V9TN7S9VScqQEKdwj+IpYa6d8z7b2pPp2lVvmY6/aaVi1Z4bbY53dUsasPtznIugeVJ1nap7fVqpXZhRF3GAQxzTPM9QwxXqaOiOP+IJz1bdGlsz6/5TahWMZx/flvXwAZzxk+8=</latexit>

z3<latexit sha1_base64="S6u7DhWCTEMEQGs5cBkKlBqt71s=">AAAC0HicjVHLSsNAFD2Nr1pfVZdugkVwVRIVdCm6cVnFPqCtMkmnbTAvk4mopYhbf8CtfpX4B/oX3hmnoBbRCUnOnHvPmbn3OrHvpcKyXnPGxOTU9Ex+tjA3v7C4VFxeqaVRlri86kZ+lDQclnLfC3lVeMLnjTjhLHB8XncuDmW8fsWT1IvCU3ET83bAeqHX9VwmiGq3Aib6TndwOzzbLpwXS1bZUsscB7YGJehViYovaKGDCC4yBOAIIQj7YEjpacKGhZi4NgbEJYQ8FecYokDajLI4ZTBiL+jbo11TsyHtpWeq1C6d4tObkNLEBmkiyksIy9NMFc+Us2R/8x4oT3m3G/o72isgVqBP7F+6UeZ/dbIWgS72VA0e1RQrRlbnapdMdUXe3PxSlSCHmDiJOxRPCLtKOeqzqTSpql32lqn4m8qUrNy7OjfDu7wlDdj+Oc5xUNsq21bZPt4p7R/oUeexhnVs0jx3sY8jVFAl70s84gnPxolxbdwZ95+pRk5rVvFtGQ8fvFiUWA==</latexit><latexit sha1_base64="S6u7DhWCTEMEQGs5cBkKlBqt71s=">AAAC0HicjVHLSsNAFD2Nr1pfVZdugkVwVRIVdCm6cVnFPqCtMkmnbTAvk4mopYhbf8CtfpX4B/oX3hmnoBbRCUnOnHvPmbn3OrHvpcKyXnPGxOTU9Ex+tjA3v7C4VFxeqaVRlri86kZ+lDQclnLfC3lVeMLnjTjhLHB8XncuDmW8fsWT1IvCU3ET83bAeqHX9VwmiGq3Aib6TndwOzzbLpwXS1bZUsscB7YGJehViYovaKGDCC4yBOAIIQj7YEjpacKGhZi4NgbEJYQ8FecYokDajLI4ZTBiL+jbo11TsyHtpWeq1C6d4tObkNLEBmkiyksIy9NMFc+Us2R/8x4oT3m3G/o72isgVqBP7F+6UeZ/dbIWgS72VA0e1RQrRlbnapdMdUXe3PxSlSCHmDiJOxRPCLtKOeqzqTSpql32lqn4m8qUrNy7OjfDu7wlDdj+Oc5xUNsq21bZPt4p7R/oUeexhnVs0jx3sY8jVFAl70s84gnPxolxbdwZ95+pRk5rVvFtGQ8fvFiUWA==</latexit><latexit sha1_base64="S6u7DhWCTEMEQGs5cBkKlBqt71s=">AAAC0HicjVHLSsNAFD2Nr1pfVZdugkVwVRIVdCm6cVnFPqCtMkmnbTAvk4mopYhbf8CtfpX4B/oX3hmnoBbRCUnOnHvPmbn3OrHvpcKyXnPGxOTU9Ex+tjA3v7C4VFxeqaVRlri86kZ+lDQclnLfC3lVeMLnjTjhLHB8XncuDmW8fsWT1IvCU3ET83bAeqHX9VwmiGq3Aib6TndwOzzbLpwXS1bZUsscB7YGJehViYovaKGDCC4yBOAIIQj7YEjpacKGhZi4NgbEJYQ8FecYokDajLI4ZTBiL+jbo11TsyHtpWeq1C6d4tObkNLEBmkiyksIy9NMFc+Us2R/8x4oT3m3G/o72isgVqBP7F+6UeZ/dbIWgS72VA0e1RQrRlbnapdMdUXe3PxSlSCHmDiJOxRPCLtKOeqzqTSpql32lqn4m8qUrNy7OjfDu7wlDdj+Oc5xUNsq21bZPt4p7R/oUeexhnVs0jx3sY8jVFAl70s84gnPxolxbdwZ95+pRk5rVvFtGQ8fvFiUWA==</latexit><latexit sha1_base64="S6u7DhWCTEMEQGs5cBkKlBqt71s=">AAAC0HicjVHLSsNAFD2Nr1pfVZdugkVwVRIVdCm6cVnFPqCtMkmnbTAvk4mopYhbf8CtfpX4B/oX3hmnoBbRCUnOnHvPmbn3OrHvpcKyXnPGxOTU9Ex+tjA3v7C4VFxeqaVRlri86kZ+lDQclnLfC3lVeMLnjTjhLHB8XncuDmW8fsWT1IvCU3ET83bAeqHX9VwmiGq3Aib6TndwOzzbLpwXS1bZUsscB7YGJehViYovaKGDCC4yBOAIIQj7YEjpacKGhZi4NgbEJYQ8FecYokDajLI4ZTBiL+jbo11TsyHtpWeq1C6d4tObkNLEBmkiyksIy9NMFc+Us2R/8x4oT3m3G/o72isgVqBP7F+6UeZ/dbIWgS72VA0e1RQrRlbnapdMdUXe3PxSlSCHmDiJOxRPCLtKOeqzqTSpql32lqn4m8qUrNy7OjfDu7wlDdj+Oc5xUNsq21bZPt4p7R/oUeexhnVs0jx3sY8jVFAl70s84gnPxolxbdwZ95+pRk5rVvFtGQ8fvFiUWA==</latexit> y3 = z0

<latexit sha1_base64="sLHkNqLR2WjTYwLPvDVzhCACY5g=">AAAC4XicjVHLSsQwFD3W1/iuutRFcRBcDa0KuhEG3bhUcFTwRRozWuyLNBXGYTbu3Ilbf8Ct/oz4B/oX3sQM+EA0pe25595zkpsb5nFUKN9/6XF6+/oHBitDwyOjY+MT7uTUbpGVkosGz+JM7oesEHGUioaKVCz2cylYEsZiL7zY0Pm9SyGLKEt3VCsXRwk7S6NmxJki6sSdPUyYOg+b7VbneMlb87rhVefY907cql/zzfJ+gsCCKuzaytxnHOIUGThKJBBIoQjHYCjoOUAAHzlxR2gTJwlFJi/QwTBpS6oSVMGIvaDvGUUHlk0p1p6FUXPaJaZXktLDPGkyqpOE9W6eyZfGWbO/ebeNpz5bi/6h9UqIVTgn9i9dt/K/Ot2LQhOrpoeIesoNo7vj1qU0t6JP7n3qSpFDTpzGp5SXhLlRdu/ZM5rC9K7vlpn8q6nUrI65rS3xpk9JAw6+j/Mn2F2sBX4t2F6u1tftqCuYwRwWaJ4rqGMTW2iQ9zUe8Ignhzs3zq1z91Hq9FjNNL4s5/4dvJGafw==</latexit><latexit sha1_base64="sLHkNqLR2WjTYwLPvDVzhCACY5g=">AAAC4XicjVHLSsQwFD3W1/iuutRFcRBcDa0KuhEG3bhUcFTwRRozWuyLNBXGYTbu3Ilbf8Ct/oz4B/oX3sQM+EA0pe25595zkpsb5nFUKN9/6XF6+/oHBitDwyOjY+MT7uTUbpGVkosGz+JM7oesEHGUioaKVCz2cylYEsZiL7zY0Pm9SyGLKEt3VCsXRwk7S6NmxJki6sSdPUyYOg+b7VbneMlb87rhVefY907cql/zzfJ+gsCCKuzaytxnHOIUGThKJBBIoQjHYCjoOUAAHzlxR2gTJwlFJi/QwTBpS6oSVMGIvaDvGUUHlk0p1p6FUXPaJaZXktLDPGkyqpOE9W6eyZfGWbO/ebeNpz5bi/6h9UqIVTgn9i9dt/K/Ot2LQhOrpoeIesoNo7vj1qU0t6JP7n3qSpFDTpzGp5SXhLlRdu/ZM5rC9K7vlpn8q6nUrI65rS3xpk9JAw6+j/Mn2F2sBX4t2F6u1tftqCuYwRwWaJ4rqGMTW2iQ9zUe8Ignhzs3zq1z91Hq9FjNNL4s5/4dvJGafw==</latexit><latexit sha1_base64="sLHkNqLR2WjTYwLPvDVzhCACY5g=">AAAC4XicjVHLSsQwFD3W1/iuutRFcRBcDa0KuhEG3bhUcFTwRRozWuyLNBXGYTbu3Ilbf8Ct/oz4B/oX3sQM+EA0pe25595zkpsb5nFUKN9/6XF6+/oHBitDwyOjY+MT7uTUbpGVkosGz+JM7oesEHGUioaKVCz2cylYEsZiL7zY0Pm9SyGLKEt3VCsXRwk7S6NmxJki6sSdPUyYOg+b7VbneMlb87rhVefY907cql/zzfJ+gsCCKuzaytxnHOIUGThKJBBIoQjHYCjoOUAAHzlxR2gTJwlFJi/QwTBpS6oSVMGIvaDvGUUHlk0p1p6FUXPaJaZXktLDPGkyqpOE9W6eyZfGWbO/ebeNpz5bi/6h9UqIVTgn9i9dt/K/Ot2LQhOrpoeIesoNo7vj1qU0t6JP7n3qSpFDTpzGp5SXhLlRdu/ZM5rC9K7vlpn8q6nUrI65rS3xpk9JAw6+j/Mn2F2sBX4t2F6u1tftqCuYwRwWaJ4rqGMTW2iQ9zUe8Ignhzs3zq1z91Hq9FjNNL4s5/4dvJGafw==</latexit><latexit sha1_base64="sLHkNqLR2WjTYwLPvDVzhCACY5g=">AAAC4XicjVHLSsQwFD3W1/iuutRFcRBcDa0KuhEG3bhUcFTwRRozWuyLNBXGYTbu3Ilbf8Ct/oz4B/oX3sQM+EA0pe25595zkpsb5nFUKN9/6XF6+/oHBitDwyOjY+MT7uTUbpGVkosGz+JM7oesEHGUioaKVCz2cylYEsZiL7zY0Pm9SyGLKEt3VCsXRwk7S6NmxJki6sSdPUyYOg+b7VbneMlb87rhVefY907cql/zzfJ+gsCCKuzaytxnHOIUGThKJBBIoQjHYCjoOUAAHzlxR2gTJwlFJi/QwTBpS6oSVMGIvaDvGUUHlk0p1p6FUXPaJaZXktLDPGkyqpOE9W6eyZfGWbO/ebeNpz5bi/6h9UqIVTgn9i9dt/K/Ot2LQhOrpoeIesoNo7vj1qU0t6JP7n3qSpFDTpzGp5SXhLlRdu/ZM5rC9K7vlpn8q6nUrI65rS3xpk9JAw6+j/Mn2F2sBX4t2F6u1tftqCuYwRwWaJ4rqGMTW2iQ9zUe8Ignhzs3zq1z91Hq9FjNNL4s5/4dvJGafw==</latexit>

z2<latexit sha1_base64="B4cxcQxPjTt1K215yjubiHzKY6E=">AAACz3icjVHLSsNAFD2Nr1pfVZdugkVwVZIi6FJ047IF+4C2SjKdtkPzIpkoWipu/QG3+lfiH+hfeGdMQS2iE5KcOfeeM3PvdSNPJNKyXnPG3PzC4lJ+ubCyura+UdzcaiRhGjNeZ6EXxi3XSbgnAl6XQnq8FcXc8V2PN93RqYo3r3iciDA4lzcR7/rOIBB9wRxJVKfjO3Lo9se3k4vKZbFklS29zFlgZ6CEbFXD4gs66CEEQwofHAEkYQ8OEnrasGEhIq6LMXExIaHjHBMUSJtSFqcMh9gRfQe0a2dsQHvlmWg1o1M8emNSmtgjTUh5MWF1mqnjqXZW7G/eY+2p7nZDfzfz8omVGBL7l26a+V+dqkWijyNdg6CaIs2o6ljmkuquqJubX6qS5BARp3CP4jFhppXTPptak+jaVW8dHX/TmYpVe5blpnhXt6QB2z/HOQsalbJtle3aQen4JBt1HjvYxT7N8xDHOEMVdfKO8IgnPBs149q4M+4/U41cptnGt2U8fAB3kZRD</latexit><latexit sha1_base64="B4cxcQxPjTt1K215yjubiHzKY6E=">AAACz3icjVHLSsNAFD2Nr1pfVZdugkVwVZIi6FJ047IF+4C2SjKdtkPzIpkoWipu/QG3+lfiH+hfeGdMQS2iE5KcOfeeM3PvdSNPJNKyXnPG3PzC4lJ+ubCyura+UdzcaiRhGjNeZ6EXxi3XSbgnAl6XQnq8FcXc8V2PN93RqYo3r3iciDA4lzcR7/rOIBB9wRxJVKfjO3Lo9se3k4vKZbFklS29zFlgZ6CEbFXD4gs66CEEQwofHAEkYQ8OEnrasGEhIq6LMXExIaHjHBMUSJtSFqcMh9gRfQe0a2dsQHvlmWg1o1M8emNSmtgjTUh5MWF1mqnjqXZW7G/eY+2p7nZDfzfz8omVGBL7l26a+V+dqkWijyNdg6CaIs2o6ljmkuquqJubX6qS5BARp3CP4jFhppXTPptak+jaVW8dHX/TmYpVe5blpnhXt6QB2z/HOQsalbJtle3aQen4JBt1HjvYxT7N8xDHOEMVdfKO8IgnPBs149q4M+4/U41cptnGt2U8fAB3kZRD</latexit><latexit sha1_base64="B4cxcQxPjTt1K215yjubiHzKY6E=">AAACz3icjVHLSsNAFD2Nr1pfVZdugkVwVZIi6FJ047IF+4C2SjKdtkPzIpkoWipu/QG3+lfiH+hfeGdMQS2iE5KcOfeeM3PvdSNPJNKyXnPG3PzC4lJ+ubCyura+UdzcaiRhGjNeZ6EXxi3XSbgnAl6XQnq8FcXc8V2PN93RqYo3r3iciDA4lzcR7/rOIBB9wRxJVKfjO3Lo9se3k4vKZbFklS29zFlgZ6CEbFXD4gs66CEEQwofHAEkYQ8OEnrasGEhIq6LMXExIaHjHBMUSJtSFqcMh9gRfQe0a2dsQHvlmWg1o1M8emNSmtgjTUh5MWF1mqnjqXZW7G/eY+2p7nZDfzfz8omVGBL7l26a+V+dqkWijyNdg6CaIs2o6ljmkuquqJubX6qS5BARp3CP4jFhppXTPptak+jaVW8dHX/TmYpVe5blpnhXt6QB2z/HOQsalbJtle3aQen4JBt1HjvYxT7N8xDHOEMVdfKO8IgnPBs149q4M+4/U41cptnGt2U8fAB3kZRD</latexit><latexit sha1_base64="B4cxcQxPjTt1K215yjubiHzKY6E=">AAACz3icjVHLSsNAFD2Nr1pfVZdugkVwVZIi6FJ047IF+4C2SjKdtkPzIpkoWipu/QG3+lfiH+hfeGdMQS2iE5KcOfeeM3PvdSNPJNKyXnPG3PzC4lJ+ubCyura+UdzcaiRhGjNeZ6EXxi3XSbgnAl6XQnq8FcXc8V2PN93RqYo3r3iciDA4lzcR7/rOIBB9wRxJVKfjO3Lo9se3k4vKZbFklS29zFlgZ6CEbFXD4gs66CEEQwofHAEkYQ8OEnrasGEhIq6LMXExIaHjHBMUSJtSFqcMh9gRfQe0a2dsQHvlmWg1o1M8emNSmtgjTUh5MWF1mqnjqXZW7G/eY+2p7nZDfzfz8omVGBL7l26a+V+dqkWijyNdg6CaIs2o6ljmkuquqJubX6qS5BARp3CP4jFhppXTPptak+jaVW8dHX/TmYpVe5blpnhXt6QB2z/HOQsalbJtle3aQen4JBt1HjvYxT7N8xDHOEMVdfKO8IgnPBs149q4M+4/U41cptnGt2U8fAB3kZRD</latexit>

z1<latexit sha1_base64="IT56pLCrAY6UzCnHNlWRUsojFZ4=">AAACz3icjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047IF+4C2SpJO28G8SCZKLRW3/oBb/SvxD/QvvDNOQS2iE5KcOfeeM3PvdWOfp8KyXnPG3PzC4lJ+ubCyura+UdzcaqRRlnis7kV+lLRcJ2U+D1ldcOGzVpwwJ3B91nSvTmW8ec2SlEfhuRjFrBs4g5D3uecIojqdwBFDtz++nVzYl8WSVbbUMmeBrUEJelWj4gs66CGChwwBGEIIwj4cpPS0YcNCTFwXY+ISQlzFGSYokDajLEYZDrFX9B3Qrq3ZkPbSM1Vqj07x6U1IaWKPNBHlJYTlaaaKZ8pZsr95j5WnvNuI/q72CogVGBL7l26a+V+drEWgj2NVA6eaYsXI6jztkqmuyJubX6oS5BATJ3GP4glhTymnfTaVJlW1y946Kv6mMiUr957OzfAub0kDtn+OcxY0Dsq2VbZrh6XKiR51HjvYxT7N8wgVnKGKOnnHeMQTno2acWPcGfefqUZOa7bxbRkPH3UxlEI=</latexit><latexit sha1_base64="IT56pLCrAY6UzCnHNlWRUsojFZ4=">AAACz3icjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047IF+4C2SpJO28G8SCZKLRW3/oBb/SvxD/QvvDNOQS2iE5KcOfeeM3PvdWOfp8KyXnPG3PzC4lJ+ubCyura+UdzcaqRRlnis7kV+lLRcJ2U+D1ldcOGzVpwwJ3B91nSvTmW8ec2SlEfhuRjFrBs4g5D3uecIojqdwBFDtz++nVzYl8WSVbbUMmeBrUEJelWj4gs66CGChwwBGEIIwj4cpPS0YcNCTFwXY+ISQlzFGSYokDajLEYZDrFX9B3Qrq3ZkPbSM1Vqj07x6U1IaWKPNBHlJYTlaaaKZ8pZsr95j5WnvNuI/q72CogVGBL7l26a+V+drEWgj2NVA6eaYsXI6jztkqmuyJubX6oS5BATJ3GP4glhTymnfTaVJlW1y946Kv6mMiUr957OzfAub0kDtn+OcxY0Dsq2VbZrh6XKiR51HjvYxT7N8wgVnKGKOnnHeMQTno2acWPcGfefqUZOa7bxbRkPH3UxlEI=</latexit><latexit sha1_base64="IT56pLCrAY6UzCnHNlWRUsojFZ4=">AAACz3icjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047IF+4C2SpJO28G8SCZKLRW3/oBb/SvxD/QvvDNOQS2iE5KcOfeeM3PvdWOfp8KyXnPG3PzC4lJ+ubCyura+UdzcaqRRlnis7kV+lLRcJ2U+D1ldcOGzVpwwJ3B91nSvTmW8ec2SlEfhuRjFrBs4g5D3uecIojqdwBFDtz++nVzYl8WSVbbUMmeBrUEJelWj4gs66CGChwwBGEIIwj4cpPS0YcNCTFwXY+ISQlzFGSYokDajLEYZDrFX9B3Qrq3ZkPbSM1Vqj07x6U1IaWKPNBHlJYTlaaaKZ8pZsr95j5WnvNuI/q72CogVGBL7l26a+V+drEWgj2NVA6eaYsXI6jztkqmuyJubX6oS5BATJ3GP4glhTymnfTaVJlW1y946Kv6mMiUr957OzfAub0kDtn+OcxY0Dsq2VbZrh6XKiR51HjvYxT7N8wgVnKGKOnnHeMQTno2acWPcGfefqUZOa7bxbRkPH3UxlEI=</latexit><latexit sha1_base64="IT56pLCrAY6UzCnHNlWRUsojFZ4=">AAACz3icjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047IF+4C2SpJO28G8SCZKLRW3/oBb/SvxD/QvvDNOQS2iE5KcOfeeM3PvdWOfp8KyXnPG3PzC4lJ+ubCyura+UdzcaqRRlnis7kV+lLRcJ2U+D1ldcOGzVpwwJ3B91nSvTmW8ec2SlEfhuRjFrBs4g5D3uecIojqdwBFDtz++nVzYl8WSVbbUMmeBrUEJelWj4gs66CGChwwBGEIIwj4cpPS0YcNCTFwXY+ISQlzFGSYokDajLEYZDrFX9B3Qrq3ZkPbSM1Vqj07x6U1IaWKPNBHlJYTlaaaKZ8pZsr95j5WnvNuI/q72CogVGBL7l26a+V+drEWgj2NVA6eaYsXI6jztkqmuyJubX6oS5BATJ3GP4glhTymnfTaVJlW1y946Kv6mMiUr957OzfAub0kDtn+OcxY0Dsq2VbZrh6XKiR51HjvYxT7N8wgVnKGKOnnHeMQTno2acWPcGfefqUZOa7bxbRkPH3UxlEI=</latexit>

Figure 1: Illustration of a creation of a stego image y3 at itera-tion k = 3 by theminmax strategy using {z0, z1, z2, z3}.We as-sume linear classifiers and the function f i (zj ) is the algebricdistance w.r.t. the separation plane. Dashed lines are for pos-itive distances, dotted lines for negative ones, and bold linesare maxi f

i (zj ). Here the minmax strategy outputs y3 = z0.Note that the adversarial embedding fails for z2 here.

fk�1<latexit sha1_base64="q5cPi1hqyM9fy1og3PknyYNyYso=">AAACynicjVHLSsNAFD2Nr1pfVZdugkVwY0lE0GXRjQsXFewDapVkOq2haRImE6GE7vwBt/ph4h/oX3hnnIJaRCckOXPuOXfm3usnYZBKx3ktWHPzC4tLxeXSyura+kZ5c6uZxplgvMHiMBZt30t5GES8IQMZ8nYiuDfyQ97yh2cq3rrnIg3i6EqOE94deYMo6AfMk0S1+jf58MCd3JYrTtXRy54FrgEVmFWPyy+4Rg8xGDKMwBFBEg7hIaWnAxcOEuK6yIkThAId55igRN6MVJwUHrFD+g5o1zFsRHuVM9VuRqeE9Apy2tgjT0w6QVidZut4pjMr9rfcuc6p7jamv29yjYiVuCP2L99U+V+fqkWijxNdQ0A1JZpR1TGTJdNdUTe3v1QlKUNCnMI9igvCTDunfba1J9W1q956Ov6mlYpVe2a0Gd7VLWnA7s9xzoLmYdV1qu7lUaV2akZdxA52sU/zPEYN56ijoat8xBOerQtLWGMr/5RaBePZxrdlPXwANOaRxg==</latexit><latexit sha1_base64="q5cPi1hqyM9fy1og3PknyYNyYso=">AAACynicjVHLSsNAFD2Nr1pfVZdugkVwY0lE0GXRjQsXFewDapVkOq2haRImE6GE7vwBt/ph4h/oX3hnnIJaRCckOXPuOXfm3usnYZBKx3ktWHPzC4tLxeXSyura+kZ5c6uZxplgvMHiMBZt30t5GES8IQMZ8nYiuDfyQ97yh2cq3rrnIg3i6EqOE94deYMo6AfMk0S1+jf58MCd3JYrTtXRy54FrgEVmFWPyy+4Rg8xGDKMwBFBEg7hIaWnAxcOEuK6yIkThAId55igRN6MVJwUHrFD+g5o1zFsRHuVM9VuRqeE9Apy2tgjT0w6QVidZut4pjMr9rfcuc6p7jamv29yjYiVuCP2L99U+V+fqkWijxNdQ0A1JZpR1TGTJdNdUTe3v1QlKUNCnMI9igvCTDunfba1J9W1q956Ov6mlYpVe2a0Gd7VLWnA7s9xzoLmYdV1qu7lUaV2akZdxA52sU/zPEYN56ijoat8xBOerQtLWGMr/5RaBePZxrdlPXwANOaRxg==</latexit><latexit sha1_base64="q5cPi1hqyM9fy1og3PknyYNyYso=">AAACynicjVHLSsNAFD2Nr1pfVZdugkVwY0lE0GXRjQsXFewDapVkOq2haRImE6GE7vwBt/ph4h/oX3hnnIJaRCckOXPuOXfm3usnYZBKx3ktWHPzC4tLxeXSyura+kZ5c6uZxplgvMHiMBZt30t5GES8IQMZ8nYiuDfyQ97yh2cq3rrnIg3i6EqOE94deYMo6AfMk0S1+jf58MCd3JYrTtXRy54FrgEVmFWPyy+4Rg8xGDKMwBFBEg7hIaWnAxcOEuK6yIkThAId55igRN6MVJwUHrFD+g5o1zFsRHuVM9VuRqeE9Apy2tgjT0w6QVidZut4pjMr9rfcuc6p7jamv29yjYiVuCP2L99U+V+fqkWijxNdQ0A1JZpR1TGTJdNdUTe3v1QlKUNCnMI9igvCTDunfba1J9W1q956Ov6mlYpVe2a0Gd7VLWnA7s9xzoLmYdV1qu7lUaV2akZdxA52sU/zPEYN56ijoat8xBOerQtLWGMr/5RaBePZxrdlPXwANOaRxg==</latexit><latexit sha1_base64="q5cPi1hqyM9fy1og3PknyYNyYso=">AAACynicjVHLSsNAFD2Nr1pfVZdugkVwY0lE0GXRjQsXFewDapVkOq2haRImE6GE7vwBt/ph4h/oX3hnnIJaRCckOXPuOXfm3usnYZBKx3ktWHPzC4tLxeXSyura+kZ5c6uZxplgvMHiMBZt30t5GES8IQMZ8nYiuDfyQ97yh2cq3rrnIg3i6EqOE94deYMo6AfMk0S1+jf58MCd3JYrTtXRy54FrgEVmFWPyy+4Rg8xGDKMwBFBEg7hIaWnAxcOEuK6yIkThAId55igRN6MVJwUHrFD+g5o1zFsRHuVM9VuRqeE9Apy2tgjT0w6QVidZut4pjMr9rfcuc6p7jamv29yjYiVuCP2L99U+V+fqkWijxNdQ0A1JZpR1TGTJdNdUTe3v1QlKUNCnMI9igvCTDunfba1J9W1q956Ov6mlYpVe2a0Gd7VLWnA7s9xzoLmYdV1qu7lUaV2akZdxA52sU/zPEYN56ijoat8xBOerQtLWGMr/5RaBePZxrdlPXwANOaRxg==</latexit>

Z0<latexit sha1_base64="c9yQ65+ggjC55QRL3zBMOQBCGHo=">AAAC0HicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047KKfWBbZTKdtsG8TCZiKUXc+gNu9avEP9C/8M4YQS2iE5KcOfeeM3PvdSLPTaRlveSMqemZ2bn8fGFhcWl5pbi6Vk/CNOaixkMvjJsOS4TnBqImXemJZhQL5jueaDiXhyreuBZx4obBqRxGouOzfuD2XM4kUZ22z+SAM290Nj63Loolq2zpZU4COwMlZKsaFp/RRhchOFL4EAggCXtgSOhpwYaFiLgORsTFhFwdFxijQNqUsgRlMGIv6dunXStjA9orz0SrOZ3i0RuT0sQWaULKiwmr00wdT7WzYn/zHmlPdbch/Z3MyydWYkDsX7rPzP/qVC0SPezrGlyqKdKMqo5nLqnuirq5+aUqSQ4RcQp3KR4T5lr52WdTaxJdu+ot0/FXnalYtedZboo3dUsasP1znJOgvlO2rbJ9vFuqHGSjzmMDm9imee6hgiNUUSPvKzzgEU/GiXFj3Bp3H6lGLtOs49sy7t8BSCmUkw==</latexit><latexit sha1_base64="c9yQ65+ggjC55QRL3zBMOQBCGHo=">AAAC0HicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047KKfWBbZTKdtsG8TCZiKUXc+gNu9avEP9C/8M4YQS2iE5KcOfeeM3PvdSLPTaRlveSMqemZ2bn8fGFhcWl5pbi6Vk/CNOaixkMvjJsOS4TnBqImXemJZhQL5jueaDiXhyreuBZx4obBqRxGouOzfuD2XM4kUZ22z+SAM290Nj63Loolq2zpZU4COwMlZKsaFp/RRhchOFL4EAggCXtgSOhpwYaFiLgORsTFhFwdFxijQNqUsgRlMGIv6dunXStjA9orz0SrOZ3i0RuT0sQWaULKiwmr00wdT7WzYn/zHmlPdbch/Z3MyydWYkDsX7rPzP/qVC0SPezrGlyqKdKMqo5nLqnuirq5+aUqSQ4RcQp3KR4T5lr52WdTaxJdu+ot0/FXnalYtedZboo3dUsasP1znJOgvlO2rbJ9vFuqHGSjzmMDm9imee6hgiNUUSPvKzzgEU/GiXFj3Bp3H6lGLtOs49sy7t8BSCmUkw==</latexit><latexit sha1_base64="c9yQ65+ggjC55QRL3zBMOQBCGHo=">AAAC0HicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047KKfWBbZTKdtsG8TCZiKUXc+gNu9avEP9C/8M4YQS2iE5KcOfeeM3PvdSLPTaRlveSMqemZ2bn8fGFhcWl5pbi6Vk/CNOaixkMvjJsOS4TnBqImXemJZhQL5jueaDiXhyreuBZx4obBqRxGouOzfuD2XM4kUZ22z+SAM290Nj63Loolq2zpZU4COwMlZKsaFp/RRhchOFL4EAggCXtgSOhpwYaFiLgORsTFhFwdFxijQNqUsgRlMGIv6dunXStjA9orz0SrOZ3i0RuT0sQWaULKiwmr00wdT7WzYn/zHmlPdbch/Z3MyydWYkDsX7rPzP/qVC0SPezrGlyqKdKMqo5nLqnuirq5+aUqSQ4RcQp3KR4T5lr52WdTaxJdu+ot0/FXnalYtedZboo3dUsasP1znJOgvlO2rbJ9vFuqHGSjzmMDm9imee6hgiNUUSPvKzzgEU/GiXFj3Bp3H6lGLtOs49sy7t8BSCmUkw==</latexit><latexit sha1_base64="c9yQ65+ggjC55QRL3zBMOQBCGHo=">AAAC0HicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047KKfWBbZTKdtsG8TCZiKUXc+gNu9avEP9C/8M4YQS2iE5KcOfeeM3PvdSLPTaRlveSMqemZ2bn8fGFhcWl5pbi6Vk/CNOaixkMvjJsOS4TnBqImXemJZhQL5jueaDiXhyreuBZx4obBqRxGouOzfuD2XM4kUZ22z+SAM290Nj63Loolq2zpZU4COwMlZKsaFp/RRhchOFL4EAggCXtgSOhpwYaFiLgORsTFhFwdFxijQNqUsgRlMGIv6dunXStjA9orz0SrOZ3i0RuT0sQWaULKiwmr00wdT7WzYn/zHmlPdbch/Z3MyydWYkDsX7rPzP/qVC0SPezrGlyqKdKMqo5nLqnuirq5+aUqSQ4RcQp3KR4T5lr52WdTaxJdu+ot0/FXnalYtedZboo3dUsasP1znJOgvlO2rbJ9vFuqHGSjzmMDm9imee6hgiNUUSPvKzzgEU/GiXFj3Bp3H6lGLtOs49sy7t8BSCmUkw==</latexit> Z1

<latexit sha1_base64="+2VRWdXmI9N1PZZUrmL9SoSIiDE=">AAAC0HicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047KKfWBbZTKdtsG8TCZiKUXc+gNu9avEP9C/8M4YQS2iE5KcOfeeM3PvdSLPTaRlveSMqemZ2bn8fGFhcWl5pbi6Vk/CNOaixkMvjJsOS4TnBqImXemJZhQL5jueaDiXhyreuBZx4obBqRxGouOzfuD2XM4kUZ22z+SAM290Nj63L4olq2zpZU4COwMlZKsaFp/RRhchOFL4EAggCXtgSOhpwYaFiLgORsTFhFwdFxijQNqUsgRlMGIv6dunXStjA9orz0SrOZ3i0RuT0sQWaULKiwmr00wdT7WzYn/zHmlPdbch/Z3MyydWYkDsX7rPzP/qVC0SPezrGlyqKdKMqo5nLqnuirq5+aUqSQ4RcQp3KR4T5lr52WdTaxJdu+ot0/FXnalYtedZboo3dUsasP1znJOgvlO2rbJ9vFuqHGSjzmMDm9imee6hgiNUUSPvKzzgEU/GiXFj3Bp3H6lGLtOs49sy7t8BSomUlA==</latexit><latexit sha1_base64="+2VRWdXmI9N1PZZUrmL9SoSIiDE=">AAAC0HicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047KKfWBbZTKdtsG8TCZiKUXc+gNu9avEP9C/8M4YQS2iE5KcOfeeM3PvdSLPTaRlveSMqemZ2bn8fGFhcWl5pbi6Vk/CNOaixkMvjJsOS4TnBqImXemJZhQL5jueaDiXhyreuBZx4obBqRxGouOzfuD2XM4kUZ22z+SAM290Nj63L4olq2zpZU4COwMlZKsaFp/RRhchOFL4EAggCXtgSOhpwYaFiLgORsTFhFwdFxijQNqUsgRlMGIv6dunXStjA9orz0SrOZ3i0RuT0sQWaULKiwmr00wdT7WzYn/zHmlPdbch/Z3MyydWYkDsX7rPzP/qVC0SPezrGlyqKdKMqo5nLqnuirq5+aUqSQ4RcQp3KR4T5lr52WdTaxJdu+ot0/FXnalYtedZboo3dUsasP1znJOgvlO2rbJ9vFuqHGSjzmMDm9imee6hgiNUUSPvKzzgEU/GiXFj3Bp3H6lGLtOs49sy7t8BSomUlA==</latexit><latexit sha1_base64="+2VRWdXmI9N1PZZUrmL9SoSIiDE=">AAAC0HicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047KKfWBbZTKdtsG8TCZiKUXc+gNu9avEP9C/8M4YQS2iE5KcOfeeM3PvdSLPTaRlveSMqemZ2bn8fGFhcWl5pbi6Vk/CNOaixkMvjJsOS4TnBqImXemJZhQL5jueaDiXhyreuBZx4obBqRxGouOzfuD2XM4kUZ22z+SAM290Nj63L4olq2zpZU4COwMlZKsaFp/RRhchOFL4EAggCXtgSOhpwYaFiLgORsTFhFwdFxijQNqUsgRlMGIv6dunXStjA9orz0SrOZ3i0RuT0sQWaULKiwmr00wdT7WzYn/zHmlPdbch/Z3MyydWYkDsX7rPzP/qVC0SPezrGlyqKdKMqo5nLqnuirq5+aUqSQ4RcQp3KR4T5lr52WdTaxJdu+ot0/FXnalYtedZboo3dUsasP1znJOgvlO2rbJ9vFuqHGSjzmMDm9imee6hgiNUUSPvKzzgEU/GiXFj3Bp3H6lGLtOs49sy7t8BSomUlA==</latexit><latexit sha1_base64="+2VRWdXmI9N1PZZUrmL9SoSIiDE=">AAAC0HicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047KKfWBbZTKdtsG8TCZiKUXc+gNu9avEP9C/8M4YQS2iE5KcOfeeM3PvdSLPTaRlveSMqemZ2bn8fGFhcWl5pbi6Vk/CNOaixkMvjJsOS4TnBqImXemJZhQL5jueaDiXhyreuBZx4obBqRxGouOzfuD2XM4kUZ22z+SAM290Nj63L4olq2zpZU4COwMlZKsaFp/RRhchOFL4EAggCXtgSOhpwYaFiLgORsTFhFwdFxijQNqUsgRlMGIv6dunXStjA9orz0SrOZ3i0RuT0sQWaULKiwmr00wdT7WzYn/zHmlPdbch/Z3MyydWYkDsX7rPzP/qVC0SPezrGlyqKdKMqo5nLqnuirq5+aUqSQ4RcQp3KR4T5lr52WdTaxJdu+ot0/FXnalYtedZboo3dUsasP1znJOgvlO2rbJ9vFuqHGSjzmMDm9imee6hgiNUUSPvKzzgEU/GiXFj3Bp3H6lGLtOs49sy7t8BSomUlA==</latexit> Zk�1<latexit sha1_base64="IYsB8rI3eRiPFflNl0UHfFpY370=">AAAC1nicjVHLSsNAFD2Nr/qOunQTLIIbSyKCLotuXFawD9RaJuNoQ/MimSgS6k7c+gNu9ZPEP9C/8M6YglpEJyQ5c+49Z+be68a+l0rbfi0ZY+MTk1Pl6ZnZufmFRXNpuZlGWcJFg0d+lLRdlgrfC0VDetIX7TgRLHB90XL7+yreuhJJ6kXhkbyJRSdgl6F34XEmieqaS6cBkz3O/Px4cJb3N51B16zYVVsvaxQ4BaigWPXIfMEpzhGBI0MAgRCSsA+GlJ4TOLARE9dBTlxCyNNxgQFmSJtRlqAMRmyfvpe0OynYkPbKM9VqTqf49CaktLBOmojyEsLqNEvHM+2s2N+8c+2p7nZDf7fwCoiV6BH7l26Y+V+dqkXiAru6Bo9qijWjquOFS6a7om5ufalKkkNMnMLnFE8Ic60c9tnSmlTXrnrLdPxNZypW7XmRm+Fd3ZIG7Pwc5yhoblUdu+ocbldqe8Woy1jFGjZonjuo4QB1NMj7Go94wrPRNm6NO+P+M9UoFZoVfFvGwwdCJ5Z9</latexit><latexit sha1_base64="IYsB8rI3eRiPFflNl0UHfFpY370=">AAAC1nicjVHLSsNAFD2Nr/qOunQTLIIbSyKCLotuXFawD9RaJuNoQ/MimSgS6k7c+gNu9ZPEP9C/8M6YglpEJyQ5c+49Z+be68a+l0rbfi0ZY+MTk1Pl6ZnZufmFRXNpuZlGWcJFg0d+lLRdlgrfC0VDetIX7TgRLHB90XL7+yreuhJJ6kXhkbyJRSdgl6F34XEmieqaS6cBkz3O/Px4cJb3N51B16zYVVsvaxQ4BaigWPXIfMEpzhGBI0MAgRCSsA+GlJ4TOLARE9dBTlxCyNNxgQFmSJtRlqAMRmyfvpe0OynYkPbKM9VqTqf49CaktLBOmojyEsLqNEvHM+2s2N+8c+2p7nZDf7fwCoiV6BH7l26Y+V+dqkXiAru6Bo9qijWjquOFS6a7om5ufalKkkNMnMLnFE8Ic60c9tnSmlTXrnrLdPxNZypW7XmRm+Fd3ZIG7Pwc5yhoblUdu+ocbldqe8Woy1jFGjZonjuo4QB1NMj7Go94wrPRNm6NO+P+M9UoFZoVfFvGwwdCJ5Z9</latexit><latexit sha1_base64="IYsB8rI3eRiPFflNl0UHfFpY370=">AAAC1nicjVHLSsNAFD2Nr/qOunQTLIIbSyKCLotuXFawD9RaJuNoQ/MimSgS6k7c+gNu9ZPEP9C/8M6YglpEJyQ5c+49Z+be68a+l0rbfi0ZY+MTk1Pl6ZnZufmFRXNpuZlGWcJFg0d+lLRdlgrfC0VDetIX7TgRLHB90XL7+yreuhJJ6kXhkbyJRSdgl6F34XEmieqaS6cBkz3O/Px4cJb3N51B16zYVVsvaxQ4BaigWPXIfMEpzhGBI0MAgRCSsA+GlJ4TOLARE9dBTlxCyNNxgQFmSJtRlqAMRmyfvpe0OynYkPbKM9VqTqf49CaktLBOmojyEsLqNEvHM+2s2N+8c+2p7nZDf7fwCoiV6BH7l26Y+V+dqkXiAru6Bo9qijWjquOFS6a7om5ufalKkkNMnMLnFE8Ic60c9tnSmlTXrnrLdPxNZypW7XmRm+Fd3ZIG7Pwc5yhoblUdu+ocbldqe8Woy1jFGjZonjuo4QB1NMj7Go94wrPRNm6NO+P+M9UoFZoVfFvGwwdCJ5Z9</latexit><latexit sha1_base64="IYsB8rI3eRiPFflNl0UHfFpY370=">AAAC1nicjVHLSsNAFD2Nr/qOunQTLIIbSyKCLotuXFawD9RaJuNoQ/MimSgS6k7c+gNu9ZPEP9C/8M6YglpEJyQ5c+49Z+be68a+l0rbfi0ZY+MTk1Pl6ZnZufmFRXNpuZlGWcJFg0d+lLRdlgrfC0VDetIX7TgRLHB90XL7+yreuhJJ6kXhkbyJRSdgl6F34XEmieqaS6cBkz3O/Px4cJb3N51B16zYVVsvaxQ4BaigWPXIfMEpzhGBI0MAgRCSsA+GlJ4TOLARE9dBTlxCyNNxgQFmSJtRlqAMRmyfvpe0OynYkPbKM9VqTqf49CaktLBOmojyEsLqNEvHM+2s2N+8c+2p7nZDf7fwCoiV6BH7l26Y+V+dqkXiAru6Bo9qijWjquOFS6a7om5ufalKkkNMnMLnFE8Ic60c9tnSmlTXrnrLdPxNZypW7XmRm+Fd3ZIG7Pwc5yhoblUdu+ocbldqe8Woy1jFGjZonjuo4QB1NMj7Go94wrPRNm6NO+P+M9UoFZoVfFvGwwdCJ5Z9</latexit>

. . .<latexit sha1_base64="Hq3fobEOfZgnGscMFSYZue0ZWjs=">AAACyHicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl0I64qmLZQiyTptA5NMiEzUUpx4w+41S8T/0D/wjtjCmoRnZDkzLn3nJl7b5BGXCrHeS1Zc/MLi0vl5crK6tr6RnVzqyVFnoXMC0Uksk7gSxbxhHmKq4h10oz5cRCxdjA61fH2LcskF8mlGqesF/vDhA946CuivKu+UPK6WnPqjln2LHALUEOxmqL6giv0IRAiRwyGBIpwBB+Sni5cOEiJ62FCXEaImzjDPSqkzSmLUYZP7Ii+Q9p1CzahvfaURh3SKRG9GSlt7JFGUF5GWJ9mm3hunDX7m/fEeOq7jekfFF4xsQo3xP6lm2b+V6drURjg2NTAqabUMLq6sHDJTVf0ze0vVSlySInTuE/xjHBolNM+20YjTe26t76Jv5lMzep9WOTmeNe3pAG7P8c5C1oHddepuxeHtcZJMeoydrCLfZrnERo4QxMeeXM84gnP1rmVWnfW+DPVKhWabXxb1sMH3ZKRQw==</latexit><latexit sha1_base64="Hq3fobEOfZgnGscMFSYZue0ZWjs=">AAACyHicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl0I64qmLZQiyTptA5NMiEzUUpx4w+41S8T/0D/wjtjCmoRnZDkzLn3nJl7b5BGXCrHeS1Zc/MLi0vl5crK6tr6RnVzqyVFnoXMC0Uksk7gSxbxhHmKq4h10oz5cRCxdjA61fH2LcskF8mlGqesF/vDhA946CuivKu+UPK6WnPqjln2LHALUEOxmqL6giv0IRAiRwyGBIpwBB+Sni5cOEiJ62FCXEaImzjDPSqkzSmLUYZP7Ii+Q9p1CzahvfaURh3SKRG9GSlt7JFGUF5GWJ9mm3hunDX7m/fEeOq7jekfFF4xsQo3xP6lm2b+V6drURjg2NTAqabUMLq6sHDJTVf0ze0vVSlySInTuE/xjHBolNM+20YjTe26t76Jv5lMzep9WOTmeNe3pAG7P8c5C1oHddepuxeHtcZJMeoydrCLfZrnERo4QxMeeXM84gnP1rmVWnfW+DPVKhWabXxb1sMH3ZKRQw==</latexit><latexit sha1_base64="Hq3fobEOfZgnGscMFSYZue0ZWjs=">AAACyHicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl0I64qmLZQiyTptA5NMiEzUUpx4w+41S8T/0D/wjtjCmoRnZDkzLn3nJl7b5BGXCrHeS1Zc/MLi0vl5crK6tr6RnVzqyVFnoXMC0Uksk7gSxbxhHmKq4h10oz5cRCxdjA61fH2LcskF8mlGqesF/vDhA946CuivKu+UPK6WnPqjln2LHALUEOxmqL6giv0IRAiRwyGBIpwBB+Sni5cOEiJ62FCXEaImzjDPSqkzSmLUYZP7Ii+Q9p1CzahvfaURh3SKRG9GSlt7JFGUF5GWJ9mm3hunDX7m/fEeOq7jekfFF4xsQo3xP6lm2b+V6drURjg2NTAqabUMLq6sHDJTVf0ze0vVSlySInTuE/xjHBolNM+20YjTe26t76Jv5lMzep9WOTmeNe3pAG7P8c5C1oHddepuxeHtcZJMeoydrCLfZrnERo4QxMeeXM84gnP1rmVWnfW+DPVKhWabXxb1sMH3ZKRQw==</latexit><latexit sha1_base64="Hq3fobEOfZgnGscMFSYZue0ZWjs=">AAACyHicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl0I64qmLZQiyTptA5NMiEzUUpx4w+41S8T/0D/wjtjCmoRnZDkzLn3nJl7b5BGXCrHeS1Zc/MLi0vl5crK6tr6RnVzqyVFnoXMC0Uksk7gSxbxhHmKq4h10oz5cRCxdjA61fH2LcskF8mlGqesF/vDhA946CuivKu+UPK6WnPqjln2LHALUEOxmqL6giv0IRAiRwyGBIpwBB+Sni5cOEiJ62FCXEaImzjDPSqkzSmLUYZP7Ii+Q9p1CzahvfaURh3SKRG9GSlt7JFGUF5GWJ9mm3hunDX7m/fEeOq7jekfFF4xsQo3xP6lm2b+V6drURjg2NTAqabUMLq6sHDJTVf0ze0vVSlySInTuE/xjHBolNM+20YjTe26t76Jv5lMzep9WOTmeNe3pAG7P8c5C1oHddepuxeHtcZJMeoydrCLfZrnERo4QxMeeXM84gnP1rmVWnfW+DPVKhWabXxb1sMH3ZKRQw==</latexit> f0<latexit sha1_base64="sc+EF5vREE9qpZ0OiksTRxWccP4=">AAACx3icjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl0o7sK9gH1QTKdtkPzIpkUS3HhD7jVPxP/QP/CO+MU1CI6IcmZc+85M/dePwlEJh3ntWDNzS8sLhWXSyura+sb5c2tZhbnKeMNFgdx2va9jAci4g0pZMDbScq90A94yx+eqnhrxNNMxNGlHCf8OvT6kegJ5klF9W6c0m254lQdvexZ4BpQgVn1uPyCK3QRgyFHCI4IknAADxk9HbhwkBB3jQlxKSGh4xz3KJE2pyxOGR6xQ/r2adcxbER75ZlpNaNTAnpTUtrYI01MeSlhdZqt47l2Vuxv3hPtqe42pr9vvEJiJQbE/qWbZv5Xp2qR6OFY1yCopkQzqjpmXHLdFXVz+0tVkhwS4hTuUjwlzLRy2mdbazJdu+qtp+NvOlOxas9Mbo53dUsasPtznLOgeVB1nap7cVipnZhRF7GDXezTPI9QwxnqaJD3AI94wrN1bsXWyLr7TLUKRrONb8t6+AAc3pAh</latexit><latexit sha1_base64="sc+EF5vREE9qpZ0OiksTRxWccP4=">AAACx3icjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl0o7sK9gH1QTKdtkPzIpkUS3HhD7jVPxP/QP/CO+MU1CI6IcmZc+85M/dePwlEJh3ntWDNzS8sLhWXSyura+sb5c2tZhbnKeMNFgdx2va9jAci4g0pZMDbScq90A94yx+eqnhrxNNMxNGlHCf8OvT6kegJ5klF9W6c0m254lQdvexZ4BpQgVn1uPyCK3QRgyFHCI4IknAADxk9HbhwkBB3jQlxKSGh4xz3KJE2pyxOGR6xQ/r2adcxbER75ZlpNaNTAnpTUtrYI01MeSlhdZqt47l2Vuxv3hPtqe42pr9vvEJiJQbE/qWbZv5Xp2qR6OFY1yCopkQzqjpmXHLdFXVz+0tVkhwS4hTuUjwlzLRy2mdbazJdu+qtp+NvOlOxas9Mbo53dUsasPtznLOgeVB1nap7cVipnZhRF7GDXezTPI9QwxnqaJD3AI94wrN1bsXWyLr7TLUKRrONb8t6+AAc3pAh</latexit><latexit sha1_base64="sc+EF5vREE9qpZ0OiksTRxWccP4=">AAACx3icjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl0o7sK9gH1QTKdtkPzIpkUS3HhD7jVPxP/QP/CO+MU1CI6IcmZc+85M/dePwlEJh3ntWDNzS8sLhWXSyura+sb5c2tZhbnKeMNFgdx2va9jAci4g0pZMDbScq90A94yx+eqnhrxNNMxNGlHCf8OvT6kegJ5klF9W6c0m254lQdvexZ4BpQgVn1uPyCK3QRgyFHCI4IknAADxk9HbhwkBB3jQlxKSGh4xz3KJE2pyxOGR6xQ/r2adcxbER75ZlpNaNTAnpTUtrYI01MeSlhdZqt47l2Vuxv3hPtqe42pr9vvEJiJQbE/qWbZv5Xp2qR6OFY1yCopkQzqjpmXHLdFXVz+0tVkhwS4hTuUjwlzLRy2mdbazJdu+qtp+NvOlOxas9Mbo53dUsasPtznLOgeVB1nap7cVipnZhRF7GDXezTPI9QwxnqaJD3AI94wrN1bsXWyLr7TLUKRrONb8t6+AAc3pAh</latexit><latexit sha1_base64="sc+EF5vREE9qpZ0OiksTRxWccP4=">AAACx3icjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl0o7sK9gH1QTKdtkPzIpkUS3HhD7jVPxP/QP/CO+MU1CI6IcmZc+85M/dePwlEJh3ntWDNzS8sLhWXSyura+sb5c2tZhbnKeMNFgdx2va9jAci4g0pZMDbScq90A94yx+eqnhrxNNMxNGlHCf8OvT6kegJ5klF9W6c0m254lQdvexZ4BpQgVn1uPyCK3QRgyFHCI4IknAADxk9HbhwkBB3jQlxKSGh4xz3KJE2pyxOGR6xQ/r2adcxbER75ZlpNaNTAnpTUtrYI01MeSlhdZqt47l2Vuxv3hPtqe42pr9vvEJiJQbE/qWbZv5Xp2qR6OFY1yCopkQzqjpmXHLdFXVz+0tVkhwS4hTuUjwlzLRy2mdbazJdu+qtp+NvOlOxas9Mbo53dUsasPtznLOgeVB1nap7cVipnZhRF7GDXezTPI9QwxnqaJD3AI94wrN1bsXWyLr7TLUKRrONb8t6+AAc3pAh</latexit>

f1<latexit sha1_base64="dbC3JNoiOdvoUnqwXZ+pJMrx9Ec=">AAACx3icjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl0o7sK9gH1QTKdtkPzIpkUS3HhD7jVPxP/QP/CO+MU1CI6IcmZc+85M/dePwlEJh3ntWDNzS8sLhWXSyura+sb5c2tZhbnKeMNFgdx2va9jAci4g0pZMDbScq90A94yx+eqnhrxNNMxNGlHCf8OvT6kegJ5klF9W7c0m254lQdvexZ4BpQgVn1uPyCK3QRgyFHCI4IknAADxk9HbhwkBB3jQlxKSGh4xz3KJE2pyxOGR6xQ/r2adcxbER75ZlpNaNTAnpTUtrYI01MeSlhdZqt47l2Vuxv3hPtqe42pr9vvEJiJQbE/qWbZv5Xp2qR6OFY1yCopkQzqjpmXHLdFXVz+0tVkhwS4hTuUjwlzLRy2mdbazJdu+qtp+NvOlOxas9Mbo53dUsasPtznLOgeVB1nap7cVipnZhRF7GDXezTPI9QwxnqaJD3AI94wrN1bsXWyLr7TLUKRrONb8t6+AAfP5Ai</latexit><latexit sha1_base64="dbC3JNoiOdvoUnqwXZ+pJMrx9Ec=">AAACx3icjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl0o7sK9gH1QTKdtkPzIpkUS3HhD7jVPxP/QP/CO+MU1CI6IcmZc+85M/dePwlEJh3ntWDNzS8sLhWXSyura+sb5c2tZhbnKeMNFgdx2va9jAci4g0pZMDbScq90A94yx+eqnhrxNNMxNGlHCf8OvT6kegJ5klF9W7c0m254lQdvexZ4BpQgVn1uPyCK3QRgyFHCI4IknAADxk9HbhwkBB3jQlxKSGh4xz3KJE2pyxOGR6xQ/r2adcxbER75ZlpNaNTAnpTUtrYI01MeSlhdZqt47l2Vuxv3hPtqe42pr9vvEJiJQbE/qWbZv5Xp2qR6OFY1yCopkQzqjpmXHLdFXVz+0tVkhwS4hTuUjwlzLRy2mdbazJdu+qtp+NvOlOxas9Mbo53dUsasPtznLOgeVB1nap7cVipnZhRF7GDXezTPI9QwxnqaJD3AI94wrN1bsXWyLr7TLUKRrONb8t6+AAfP5Ai</latexit><latexit sha1_base64="dbC3JNoiOdvoUnqwXZ+pJMrx9Ec=">AAACx3icjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl0o7sK9gH1QTKdtkPzIpkUS3HhD7jVPxP/QP/CO+MU1CI6IcmZc+85M/dePwlEJh3ntWDNzS8sLhWXSyura+sb5c2tZhbnKeMNFgdx2va9jAci4g0pZMDbScq90A94yx+eqnhrxNNMxNGlHCf8OvT6kegJ5klF9W7c0m254lQdvexZ4BpQgVn1uPyCK3QRgyFHCI4IknAADxk9HbhwkBB3jQlxKSGh4xz3KJE2pyxOGR6xQ/r2adcxbER75ZlpNaNTAnpTUtrYI01MeSlhdZqt47l2Vuxv3hPtqe42pr9vvEJiJQbE/qWbZv5Xp2qR6OFY1yCopkQzqjpmXHLdFXVz+0tVkhwS4hTuUjwlzLRy2mdbazJdu+qtp+NvOlOxas9Mbo53dUsasPtznLOgeVB1nap7cVipnZhRF7GDXezTPI9QwxnqaJD3AI94wrN1bsXWyLr7TLUKRrONb8t6+AAfP5Ai</latexit><latexit sha1_base64="dbC3JNoiOdvoUnqwXZ+pJMrx9Ec=">AAACx3icjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl0o7sK9gH1QTKdtkPzIpkUS3HhD7jVPxP/QP/CO+MU1CI6IcmZc+85M/dePwlEJh3ntWDNzS8sLhWXSyura+sb5c2tZhbnKeMNFgdx2va9jAci4g0pZMDbScq90A94yx+eqnhrxNNMxNGlHCf8OvT6kegJ5klF9W7c0m254lQdvexZ4BpQgVn1uPyCK3QRgyFHCI4IknAADxk9HbhwkBB3jQlxKSGh4xz3KJE2pyxOGR6xQ/r2adcxbER75ZlpNaNTAnpTUtrYI01MeSlhdZqt47l2Vuxv3hPtqe42pr9vvEJiJQbE/qWbZv5Xp2qR6OFY1yCopkQzqjpmXHLdFXVz+0tVkhwS4hTuUjwlzLRy2mdbazJdu+qtp+NvOlOxas9Mbo53dUsasPtznLOgeVB1nap7cVipnZhRF7GDXezTPI9QwxnqaJD3AI94wrN1bsXWyLr7TLUKRrONb8t6+AAfP5Ai</latexit>

. . .<latexit sha1_base64="Hq3fobEOfZgnGscMFSYZue0ZWjs=">AAACyHicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl0I64qmLZQiyTptA5NMiEzUUpx4w+41S8T/0D/wjtjCmoRnZDkzLn3nJl7b5BGXCrHeS1Zc/MLi0vl5crK6tr6RnVzqyVFnoXMC0Uksk7gSxbxhHmKq4h10oz5cRCxdjA61fH2LcskF8mlGqesF/vDhA946CuivKu+UPK6WnPqjln2LHALUEOxmqL6giv0IRAiRwyGBIpwBB+Sni5cOEiJ62FCXEaImzjDPSqkzSmLUYZP7Ii+Q9p1CzahvfaURh3SKRG9GSlt7JFGUF5GWJ9mm3hunDX7m/fEeOq7jekfFF4xsQo3xP6lm2b+V6drURjg2NTAqabUMLq6sHDJTVf0ze0vVSlySInTuE/xjHBolNM+20YjTe26t76Jv5lMzep9WOTmeNe3pAG7P8c5C1oHddepuxeHtcZJMeoydrCLfZrnERo4QxMeeXM84gnP1rmVWnfW+DPVKhWabXxb1sMH3ZKRQw==</latexit><latexit sha1_base64="Hq3fobEOfZgnGscMFSYZue0ZWjs=">AAACyHicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl0I64qmLZQiyTptA5NMiEzUUpx4w+41S8T/0D/wjtjCmoRnZDkzLn3nJl7b5BGXCrHeS1Zc/MLi0vl5crK6tr6RnVzqyVFnoXMC0Uksk7gSxbxhHmKq4h10oz5cRCxdjA61fH2LcskF8mlGqesF/vDhA946CuivKu+UPK6WnPqjln2LHALUEOxmqL6giv0IRAiRwyGBIpwBB+Sni5cOEiJ62FCXEaImzjDPSqkzSmLUYZP7Ii+Q9p1CzahvfaURh3SKRG9GSlt7JFGUF5GWJ9mm3hunDX7m/fEeOq7jekfFF4xsQo3xP6lm2b+V6drURjg2NTAqabUMLq6sHDJTVf0ze0vVSlySInTuE/xjHBolNM+20YjTe26t76Jv5lMzep9WOTmeNe3pAG7P8c5C1oHddepuxeHtcZJMeoydrCLfZrnERo4QxMeeXM84gnP1rmVWnfW+DPVKhWabXxb1sMH3ZKRQw==</latexit><latexit sha1_base64="Hq3fobEOfZgnGscMFSYZue0ZWjs=">AAACyHicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl0I64qmLZQiyTptA5NMiEzUUpx4w+41S8T/0D/wjtjCmoRnZDkzLn3nJl7b5BGXCrHeS1Zc/MLi0vl5crK6tr6RnVzqyVFnoXMC0Uksk7gSxbxhHmKq4h10oz5cRCxdjA61fH2LcskF8mlGqesF/vDhA946CuivKu+UPK6WnPqjln2LHALUEOxmqL6giv0IRAiRwyGBIpwBB+Sni5cOEiJ62FCXEaImzjDPSqkzSmLUYZP7Ii+Q9p1CzahvfaURh3SKRG9GSlt7JFGUF5GWJ9mm3hunDX7m/fEeOq7jekfFF4xsQo3xP6lm2b+V6drURjg2NTAqabUMLq6sHDJTVf0ze0vVSlySInTuE/xjHBolNM+20YjTe26t76Jv5lMzep9WOTmeNe3pAG7P8c5C1oHddepuxeHtcZJMeoydrCLfZrnERo4QxMeeXM84gnP1rmVWnfW+DPVKhWabXxb1sMH3ZKRQw==</latexit><latexit sha1_base64="Hq3fobEOfZgnGscMFSYZue0ZWjs=">AAACyHicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl0I64qmLZQiyTptA5NMiEzUUpx4w+41S8T/0D/wjtjCmoRnZDkzLn3nJl7b5BGXCrHeS1Zc/MLi0vl5crK6tr6RnVzqyVFnoXMC0Uksk7gSxbxhHmKq4h10oz5cRCxdjA61fH2LcskF8mlGqesF/vDhA946CuivKu+UPK6WnPqjln2LHALUEOxmqL6giv0IRAiRwyGBIpwBB+Sni5cOEiJ62FCXEaImzjDPSqkzSmLUYZP7Ii+Q9p1CzahvfaURh3SKRG9GSlt7JFGUF5GWJ9mm3hunDX7m/fEeOq7jekfFF4xsQo3xP6lm2b+V6drURjg2NTAqabUMLq6sHDJTVf0ze0vVSlySInTuE/xjHBolNM+20YjTe26t76Jv5lMzep9WOTmeNe3pAG7P8c5C1oHddepuxeHtcZJMeoydrCLfZrnERo4QxMeeXM84gnP1rmVWnfW+DPVKhWabXxb1sMH3ZKRQw==</latexit>

Zk<latexit sha1_base64="bKWptWp2pHWVOh3YjZew4ADKyNw=">AAAC0HicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047KKfWBbZTKd1tC8TCZiKUXc+gNu9avEP9C/8M4YQS2iE5KcOfeeM3PvdSLPTaRlveSMqemZ2bn8fGFhcWl5pbi6Vk/CNOaixkMvjJsOS4TnBqImXemJZhQL5jueaDiDQxVvXIs4ccPgVA4j0fFZP3B7LmeSqE7bZ/KSM290Nj4fXBRLVtnSy5wEdgZKyFY1LD6jjS5CcKTwIRBAEvbAkNDTgg0LEXEdjIiLCbk6LjBGgbQpZQnKYMQO6NunXStjA9orz0SrOZ3i0RuT0sQWaULKiwmr00wdT7WzYn/zHmlPdbch/Z3MyydW4pLYv3Sfmf/VqVoketjXNbhUU6QZVR3PXFLdFXVz80tVkhwi4hTuUjwmzLXys8+m1iS6dtVbpuOvOlOxas+z3BRv6pY0YPvnOCdBfadsW2X7eLdUOchGnccGNrFN89xDBUeookbeV3jAI56ME+PGuDXuPlKNXKZZx7dl3L8D1EmUzg==</latexit><latexit sha1_base64="bKWptWp2pHWVOh3YjZew4ADKyNw=">AAAC0HicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047KKfWBbZTKd1tC8TCZiKUXc+gNu9avEP9C/8M4YQS2iE5KcOfeeM3PvdSLPTaRlveSMqemZ2bn8fGFhcWl5pbi6Vk/CNOaixkMvjJsOS4TnBqImXemJZhQL5jueaDiDQxVvXIs4ccPgVA4j0fFZP3B7LmeSqE7bZ/KSM290Nj4fXBRLVtnSy5wEdgZKyFY1LD6jjS5CcKTwIRBAEvbAkNDTgg0LEXEdjIiLCbk6LjBGgbQpZQnKYMQO6NunXStjA9orz0SrOZ3i0RuT0sQWaULKiwmr00wdT7WzYn/zHmlPdbch/Z3MyydW4pLYv3Sfmf/VqVoketjXNbhUU6QZVR3PXFLdFXVz80tVkhwi4hTuUjwmzLXys8+m1iS6dtVbpuOvOlOxas+z3BRv6pY0YPvnOCdBfadsW2X7eLdUOchGnccGNrFN89xDBUeookbeV3jAI56ME+PGuDXuPlKNXKZZx7dl3L8D1EmUzg==</latexit><latexit sha1_base64="bKWptWp2pHWVOh3YjZew4ADKyNw=">AAAC0HicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047KKfWBbZTKd1tC8TCZiKUXc+gNu9avEP9C/8M4YQS2iE5KcOfeeM3PvdSLPTaRlveSMqemZ2bn8fGFhcWl5pbi6Vk/CNOaixkMvjJsOS4TnBqImXemJZhQL5jueaDiDQxVvXIs4ccPgVA4j0fFZP3B7LmeSqE7bZ/KSM290Nj4fXBRLVtnSy5wEdgZKyFY1LD6jjS5CcKTwIRBAEvbAkNDTgg0LEXEdjIiLCbk6LjBGgbQpZQnKYMQO6NunXStjA9orz0SrOZ3i0RuT0sQWaULKiwmr00wdT7WzYn/zHmlPdbch/Z3MyydW4pLYv3Sfmf/VqVoketjXNbhUU6QZVR3PXFLdFXVz80tVkhwi4hTuUjwmzLXys8+m1iS6dtVbpuOvOlOxas+z3BRv6pY0YPvnOCdBfadsW2X7eLdUOchGnccGNrFN89xDBUeookbeV3jAI56ME+PGuDXuPlKNXKZZx7dl3L8D1EmUzg==</latexit><latexit sha1_base64="bKWptWp2pHWVOh3YjZew4ADKyNw=">AAAC0HicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047KKfWBbZTKd1tC8TCZiKUXc+gNu9avEP9C/8M4YQS2iE5KcOfeeM3PvdSLPTaRlveSMqemZ2bn8fGFhcWl5pbi6Vk/CNOaixkMvjJsOS4TnBqImXemJZhQL5jueaDiDQxVvXIs4ccPgVA4j0fFZP3B7LmeSqE7bZ/KSM290Nj4fXBRLVtnSy5wEdgZKyFY1LD6jjS5CcKTwIRBAEvbAkNDTgg0LEXEdjIiLCbk6LjBGgbQpZQnKYMQO6NunXStjA9orz0SrOZ3i0RuT0sQWaULKiwmr00wdT7WzYn/zHmlPdbch/Z3MyydW4pLYv3Sfmf/VqVoketjXNbhUU6QZVR3PXFLdFXVz80tVkhwi4hTuUjwmzLXys8+m1iS6dtVbpuOvOlOxas+z3BRv6pY0YPvnOCdBfadsW2X7eLdUOchGnccGNrFN89xDBUeookbeV3jAI56ME+PGuDXuPlKNXKZZx7dl3L8D1EmUzg==</latexit>


Yk<latexit sha1_base64="pAknS31OkSD6ujonPyLHNlUF9kw=">AAAC0HicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047KKfUhbZTKd1tC8TCZiKUXc+gNu9avEP9C/8M4YQS2iE5KcOfeeM3PvdSLPTaRlveSMqemZ2bn8fGFhcWl5pbi6Vk/CNOaixkMvjJsOS4TnBqImXemJZhQL5jueaDiDQxVvXIs4ccPgVA4j0fFZP3B7LmeSqE7bZ/KSM290Nj4fXBRLVtnSy5wEdgZKyFY1LD6jjS5CcKTwIRBAEvbAkNDTgg0LEXEdjIiLCbk6LjBGgbQpZQnKYMQO6NunXStjA9orz0SrOZ3i0RuT0sQWaULKiwmr00wdT7WzYn/zHmlPdbch/Z3MyydW4pLYv3Sfmf/VqVoketjXNbhUU6QZVR3PXFLdFXVz80tVkhwi4hTuUjwmzLXys8+m1iS6dtVbpuOvOlOxas+z3BRv6pY0YPvnOCdBfadsW2X7eLdUOchGnccGNrFN89xDBUeookbeV3jAI56ME+PGuDXuPlKNXKZZx7dl3L8D0eaUzQ==</latexit><latexit sha1_base64="pAknS31OkSD6ujonPyLHNlUF9kw=">AAAC0HicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047KKfUhbZTKd1tC8TCZiKUXc+gNu9avEP9C/8M4YQS2iE5KcOfeeM3PvdSLPTaRlveSMqemZ2bn8fGFhcWl5pbi6Vk/CNOaixkMvjJsOS4TnBqImXemJZhQL5jueaDiDQxVvXIs4ccPgVA4j0fFZP3B7LmeSqE7bZ/KSM290Nj4fXBRLVtnSy5wEdgZKyFY1LD6jjS5CcKTwIRBAEvbAkNDTgg0LEXEdjIiLCbk6LjBGgbQpZQnKYMQO6NunXStjA9orz0SrOZ3i0RuT0sQWaULKiwmr00wdT7WzYn/zHmlPdbch/Z3MyydW4pLYv3Sfmf/VqVoketjXNbhUU6QZVR3PXFLdFXVz80tVkhwi4hTuUjwmzLXys8+m1iS6dtVbpuOvOlOxas+z3BRv6pY0YPvnOCdBfadsW2X7eLdUOchGnccGNrFN89xDBUeookbeV3jAI56ME+PGuDXuPlKNXKZZx7dl3L8D0eaUzQ==</latexit><latexit sha1_base64="pAknS31OkSD6ujonPyLHNlUF9kw=">AAAC0HicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047KKfUhbZTKd1tC8TCZiKUXc+gNu9avEP9C/8M4YQS2iE5KcOfeeM3PvdSLPTaRlveSMqemZ2bn8fGFhcWl5pbi6Vk/CNOaixkMvjJsOS4TnBqImXemJZhQL5jueaDiDQxVvXIs4ccPgVA4j0fFZP3B7LmeSqE7bZ/KSM290Nj4fXBRLVtnSy5wEdgZKyFY1LD6jjS5CcKTwIRBAEvbAkNDTgg0LEXEdjIiLCbk6LjBGgbQpZQnKYMQO6NunXStjA9orz0SrOZ3i0RuT0sQWaULKiwmr00wdT7WzYn/zHmlPdbch/Z3MyydW4pLYv3Sfmf/VqVoketjXNbhUU6QZVR3PXFLdFXVz80tVkhwi4hTuUjwmzLXys8+m1iS6dtVbpuOvOlOxas+z3BRv6pY0YPvnOCdBfadsW2X7eLdUOchGnccGNrFN89xDBUeookbeV3jAI56ME+PGuDXuPlKNXKZZx7dl3L8D0eaUzQ==</latexit><latexit sha1_base64="pAknS31OkSD6ujonPyLHNlUF9kw=">AAAC0HicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047KKfUhbZTKd1tC8TCZiKUXc+gNu9avEP9C/8M4YQS2iE5KcOfeeM3PvdSLPTaRlveSMqemZ2bn8fGFhcWl5pbi6Vk/CNOaixkMvjJsOS4TnBqImXemJZhQL5jueaDiDQxVvXIs4ccPgVA4j0fFZP3B7LmeSqE7bZ/KSM290Nj4fXBRLVtnSy5wEdgZKyFY1LD6jjS5CcKTwIRBAEvbAkNDTgg0LEXEdjIiLCbk6LjBGgbQpZQnKYMQO6NunXStjA9orz0SrOZ3i0RuT0sQWaULKiwmr00wdT7WzYn/zHmlPdbch/Z3MyydW4pLYv3Sfmf/VqVoketjXNbhUU6QZVR3PXFLdFXVz80tVkhwi4hTuUjwmzLXys8+m1iS6dtVbpuOvOlOxas+z3BRv6pY0YPvnOCdBfadsW2X7eLdUOchGnccGNrFN89xDBUeookbeV3jAI56ME+PGuDXuPlKNXKZZx7dl3L8D0eaUzQ==</latexit>

fk<latexit sha1_base64="/GVEWLUUCpuuyTjd1uJtg89cAsc=">AAACxnicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl002VF+4BaJZlOa2heTCZKKYI/4FY/TfwD/QvvjFNQi+iEJGfOvefM3Hv9NAwy6TivBWtufmFxqbhcWlldW98ob261siQXjDdZEiai43sZD4OYN2UgQ95JBfciP+Rtf3Sq4u1bLrIgiS/kOOW9yBvGwSBgniTqfHA1ui5XnKqjlz0LXAMqMKuRlF9wiT4SMOSIwBFDEg7hIaOnCxcOUuJ6mBAnCAU6znGPEmlzyuKU4RE7ou+Qdl3DxrRXnplWMzolpFeQ0sYeaRLKE4TVabaO59pZsb95T7SnutuY/r7xioiVuCH2L9008786VYvEAMe6hoBqSjWjqmPGJdddUTe3v1QlySElTuE+xQVhppXTPttak+naVW89HX/TmYpVe2Zyc7yrW9KA3Z/jnAWtg6rrVN2zw0rtxIy6iB3sYp/meYQa6migSd5DPOIJz1bdiq3cuvtMtQpGs41vy3r4AGqGkEg=</latexit><latexit sha1_base64="/GVEWLUUCpuuyTjd1uJtg89cAsc=">AAACxnicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl002VF+4BaJZlOa2heTCZKKYI/4FY/TfwD/QvvjFNQi+iEJGfOvefM3Hv9NAwy6TivBWtufmFxqbhcWlldW98ob261siQXjDdZEiai43sZD4OYN2UgQ95JBfciP+Rtf3Sq4u1bLrIgiS/kOOW9yBvGwSBgniTqfHA1ui5XnKqjlz0LXAMqMKuRlF9wiT4SMOSIwBFDEg7hIaOnCxcOUuJ6mBAnCAU6znGPEmlzyuKU4RE7ou+Qdl3DxrRXnplWMzolpFeQ0sYeaRLKE4TVabaO59pZsb95T7SnutuY/r7xioiVuCH2L9008786VYvEAMe6hoBqSjWjqmPGJdddUTe3v1QlySElTuE+xQVhppXTPttak+naVW89HX/TmYpVe2Zyc7yrW9KA3Z/jnAWtg6rrVN2zw0rtxIy6iB3sYp/meYQa6migSd5DPOIJz1bdiq3cuvtMtQpGs41vy3r4AGqGkEg=</latexit><latexit sha1_base64="/GVEWLUUCpuuyTjd1uJtg89cAsc=">AAACxnicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl002VF+4BaJZlOa2heTCZKKYI/4FY/TfwD/QvvjFNQi+iEJGfOvefM3Hv9NAwy6TivBWtufmFxqbhcWlldW98ob261siQXjDdZEiai43sZD4OYN2UgQ95JBfciP+Rtf3Sq4u1bLrIgiS/kOOW9yBvGwSBgniTqfHA1ui5XnKqjlz0LXAMqMKuRlF9wiT4SMOSIwBFDEg7hIaOnCxcOUuJ6mBAnCAU6znGPEmlzyuKU4RE7ou+Qdl3DxrRXnplWMzolpFeQ0sYeaRLKE4TVabaO59pZsb95T7SnutuY/r7xioiVuCH2L9008786VYvEAMe6hoBqSjWjqmPGJdddUTe3v1QlySElTuE+xQVhppXTPttak+naVW89HX/TmYpVe2Zyc7yrW9KA3Z/jnAWtg6rrVN2zw0rtxIy6iB3sYp/meYQa6migSd5DPOIJz1bdiq3cuvtMtQpGs41vy3r4AGqGkEg=</latexit><latexit sha1_base64="/GVEWLUUCpuuyTjd1uJtg89cAsc=">AAACxnicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl002VF+4BaJZlOa2heTCZKKYI/4FY/TfwD/QvvjFNQi+iEJGfOvefM3Hv9NAwy6TivBWtufmFxqbhcWlldW98ob261siQXjDdZEiai43sZD4OYN2UgQ95JBfciP+Rtf3Sq4u1bLrIgiS/kOOW9yBvGwSBgniTqfHA1ui5XnKqjlz0LXAMqMKuRlF9wiT4SMOSIwBFDEg7hIaOnCxcOUuJ6mBAnCAU6znGPEmlzyuKU4RE7ou+Qdl3DxrRXnplWMzolpFeQ0sYeaRLKE4TVabaO59pZsb95T7SnutuY/r7xioiVuCH2L9008786VYvEAMe6hoBqSjWjqmPGJdddUTe3v1QlySElTuE+xQVhppXTPttak+naVW89HX/TmYpVe2Zyc7yrW9KA3Z/jnAWtg6rrVN2zw0rtxIy6iB3sYp/meYQa6migSd5DPOIJz1bdiq3cuvtMtQpGs41vy3r4AGqGkEg=</latexit>

Adversarial stego sets Cover set Classifiers

Generation of an adversarial stego set

min max strategy

Train

Stego set

Figure 2: Diagram of the protocol at iteration k .

new set of stego contentsYkby selecting those that are maximally

undetectable by any detector f ∈ ˆF k−1, i .e .

Yk =

z��z = argmin

z∈{z0i ,z1

i , ...,zki }

max

f ∈ ˆFk−1f (z) , 1 ≤ i ≤ n

. (7)

Contents Ykare then used to train a new classifier f k between

coversX andYk ,which is added to the set, i.e. ˆF k = ˆF k−1∪{ f k }.

The creation of Ykby using the minmax protocol is illustrated in

Figure 1. The whole protocol is illustrated in Figure 2.

The following theorem proves that the above protocol converges

under mild conditions on F , albeit it does not prove the solution

to be optimal. Consequently, this protocol avoids pathological be-

havior like periodicity.

Theorem 3.1. Let F = { f : X→ R} be a set of functions and letˆF 1, ˆF 2, . . . , ˆF k , . . . be a sequence of subsets such that ˆF 1 ⊂ ˆF 2 ⊂

. . . ⊂ ˆF k ⊂ . . . ⊂ F . Furthermore let all functions f ∈ F bebounded by some constant c, i.e. (∃c ∈ R)(∀f ∈ F )(∀x ∈ X)(f (x) ≤c).

Then the limit ˆf (x) = limk→∞maxf ∈ ˆFkf (x) exists.


Proof. Let define the function f kmax

(x) = maxf ∈ ˆFkf (x). Then

for every x ∈ X, the sequence f 0max

(x), f 1max

(x), . . . , f kmax

(x), . . . isnondecreasing and because of the boundedness assumption ∀f ∈ F

, f (x) ≤ c , the sequence is bounded by c as well. The monotone

convergence theorem then states that the sequence f kmax

(x) con-verges to some value, which is denoted by

ˆf (x), which proves the

theorem. □

The above theorem implies that, when k is large, the maximiza-

tion w.r.t. f ∈ F k−1is replaced by

ˆf (or a function ϵ-close to

ˆf ).

The protocol defines detectabilityˆf (x) as a limit

ˆf (x) = lim

k→∞max

f ∈ ˆFkf (x).

Note that the security of the resulting steganographic algorithm

depends on two factors: (i) the set of all possible detectors F ; (ii)

the quality attack on the classifier f ∈ F . Thus improving any of

them should improve the quality of the scheme.

Theorem 3.1 assumes functions f ∈ F to be bounded. This con-

dition can be trivially ensured for any function based on machine

learning classifiers, as they are already bounded (e.g. Neural Net-

works), or they can be trivially bounded by applying some scaling or

passing their output through a bounded and monotonous functions

like tanh .

4 EXPERIMENTSTo implement the protocol introduced in the previous section, we

need (i) a suitably general set of classifiers F , and (ii) an embedding

algorithm to embed some message into a cover object while avoid-

ing being detected by f ∈ F . The rest of this section describes the

different ingredients of our protocol, which are later used in this

experimental section.

4.1 Choice of classifiers FSimilarly to [9], we choose to attack Convolutional Neural Net-

works (CNN) since the classification function is differentiable and

consequently it is easy and fast, using GPUs, to evaluate∂f∂x . CNNs

are not detailed here, as their inner functionality is not important

for the paper and for the method. A reader interested in details is

referred to [8] for general introduction and to [15, 23, 24] for their

uses in steganography.

For the purpose of this work, it is sufficient to view neural net-

works as an efficient procedure selecting f from a large class of

functions F such that f minimizes the empirical estimate of the

mis-classification error (3):

P̂err(f ;X,Y) =1

|X|

∑x∈XI { f (x) > 0} +

1

|Y |

∑x∈Y

I { f (x) < 0} .

(8)

An important property of CNNs is their differentiability, which

means that a gradient∂f∂x with respect to their inputs exists for

almost every x and for every f ∈ F .

The set of classifiers F is equal to all convolutional neural net-

works with an architecture known as Xu-Net [22]. We chose this

classifier for its very good performance in JPEG steganalysis, and

because its training requires less memory and is faster than deeper

CNNs such as SRNet [4]. With shortcut connections, the depth of

Xu-Net following the shortest path is only 5, whereas it is 8 for

SRNet.

4.2 Experimental detailsWe detail bellow the implementations that are used to run the

presented protocol, they concern the embedding scheme, the classi-

fier/steganalyzer which is attacked, the attack, the overall strategy

to generate stego contents and the different steganalysis schemes

used to evaluate the presented embedding.

Embedding: The embedding algorithm serving to initialize the

protocol and to calculate default costs for changing elements is J-

Uniward [11]. The experiments use the JPEG version of the popular

BossBase database [3] of size 512 × 512 in grayscale format and

compressed with Quality Factor 75. All images are embedded using

an embedding rate of 0.4 bits per non-zero AC DCT coefficient

(bpnzac) at each iteration of the protocol.

Classification/Steganalysis: The proposed implementation of Xu-

Net uses the TensorFlow [1] library2. In each iteration of the proto-

col, a new steganalyzer f k is trained by classifying cover contents

X and stego contentsYkgiven by (7). This classifier is trained start-

ing with randomly initialized weights (zero mean Gaussian with

standard deviation 0.01) using 2×4000 Cover and Stego contents for

training and using remaining 2 × 6000 to estimate error rates. 290

epochs are used for training using ADAM optimization algorithm

with initial learning rate 0.001 decreased after each 5000 steps to 0.9

times the current value. Remaining parameters of Adam are kept to

default setting. The size of mini-batch is 64 (32 cover-stego pairs)

and the training uses full-size images of 512 × 512 pixels. The con-

figuration achieving the best training accuracy is used as the result

of training. The experiments were run on an Nvidia GPU Quadro

P6000 (24 GB of memory). Training XU-Net takes approximately

30 hours at each iteration k , and the generation of an adversarial

data-base 5 hours multi-threaded on 36 cores.

Attack: The ADV-EMB attack described in Section 2.2 is im-

plemented in order to adjust costs of changing DCT coefficients

according to (2). Note that in order to compute the partial derivative

∂f∂xi

with respect of the ith -DCT coefficient, and because XU-Net

uses a spatial image without rounding as input, IDCT is treated in

an additional layer placed as first layer. The partial derivative is

consequently handled by automatic differentiation using the func-

tion tf.gradient() from the TensorFlow library, and derivating

with respect to the image coded in the JPEG domain.

Note that it is possible that embedding using ADV-EMB fails for

some images, which means that even by modifying all costs ρ+i , ρ−i

of changing DCT coefficients of a cover x (e.g. β = 1,Lc = ∅) w.r.t

the Equation (2), the adversarial stego is classified as stego by the

classifier. As suggested in [19], in this case, the stego content which

is kept is z0, i.e. the stego obtained by J-Uniward embedding with

β = 0.

ADV-EMB generates at each iteration a set of adversarial stego

Zkand a set of stego contents Yk

is created w.r.t the minmax

strategy defined in Equation (7). In order to compute this set, one

2The codes for the experiments will be made available after publication.

Exploiting Adversarial Embeddings for Better Steganography IH&MMSec ’19, July 3–5, 2019, TROYES, France

must compute all the values f (z) for f ∈ ˆF k−1and z ∈ Z0 ∪

Z1 ∪ · · · ∪ Zk. Because f is real-valued, it can be fairly assumed

that, for any cover content xi , there is only one z in {z0i , z1

i , . . . , zki }

minimizing maxf ∈ ˆFk−1f (z).

Other embedding strategies. In the paper [19] are suggested two

different iterative strategies, which are called in the following "Ran-

dom strategy" and "Last iteration strategy" and whose protocols

are illustrated in Figure 3. The random strategy differs from the

minmax strategy by the attack of the steganographer, who chooses

at iteration k , for each cover, randomly and uniformly the embed-

ding scheme fromZ0,Z1, . . . orZk. So the steganalyzer trains the

classifier f k between coversX andYkrandom

= Z0∪Z1∪· · ·∪Zk.

The last iteration strategy derives from the random strategy :Zk

is still computed in order to fool f k−1random

, but the steganographer

sends the attackYklast it

= Zk. So f k

last itis trained betweenX and

Yklast it

. In Table 1, the results of this two strategies are compared

to the minmax strategy for the first six iterations.

Evaluation. In order to benchmark the practical security re-

lated to this new adversarial embedding scheme w.r.t. steganalysis

schemes which are different from the target adversary (here XU-

Net), we also compute DCTR [10] and GFR [18] feature sets. The

training set and the testing set here were constitued of pairs of 5000

Cover and Stego images. The regularized linear classifier [5] was

used to compute Perr, defined as the minimal total classification

error probability under equal priors, Perr = minPrFA

1

2(PrFA+PrMD),

with PrFA and PrMD standing for the false-alarm and missed de-

tection empirical probabilities. We also train SRNet [4] only for the

first and last iteration, because of its computational cost. The size

of images is 512 × 512, size of mini-batch is 16 (8 cover-stego pairs)

and the training lasts 290 epochs.

Z0<latexit sha1_base64="c9yQ65+ggjC55QRL3zBMOQBCGHo=">AAAC0HicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047KKfWBbZTKdtsG8TCZiKUXc+gNu9avEP9C/8M4YQS2iE5KcOfeeM3PvdSLPTaRlveSMqemZ2bn8fGFhcWl5pbi6Vk/CNOaixkMvjJsOS4TnBqImXemJZhQL5jueaDiXhyreuBZx4obBqRxGouOzfuD2XM4kUZ22z+SAM290Nj63Loolq2zpZU4COwMlZKsaFp/RRhchOFL4EAggCXtgSOhpwYaFiLgORsTFhFwdFxijQNqUsgRlMGIv6dunXStjA9orz0SrOZ3i0RuT0sQWaULKiwmr00wdT7WzYn/zHmlPdbch/Z3MyydWYkDsX7rPzP/qVC0SPezrGlyqKdKMqo5nLqnuirq5+aUqSQ4RcQp3KR4T5lr52WdTaxJdu+ot0/FXnalYtedZboo3dUsasP1znJOgvlO2rbJ9vFuqHGSjzmMDm9imee6hgiNUUSPvKzzgEU/GiXFj3Bp3H6lGLtOs49sy7t8BSCmUkw==</latexit><latexit sha1_base64="c9yQ65+ggjC55QRL3zBMOQBCGHo=">AAAC0HicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047KKfWBbZTKdtsG8TCZiKUXc+gNu9avEP9C/8M4YQS2iE5KcOfeeM3PvdSLPTaRlveSMqemZ2bn8fGFhcWl5pbi6Vk/CNOaixkMvjJsOS4TnBqImXemJZhQL5jueaDiXhyreuBZx4obBqRxGouOzfuD2XM4kUZ22z+SAM290Nj63Loolq2zpZU4COwMlZKsaFp/RRhchOFL4EAggCXtgSOhpwYaFiLgORsTFhFwdFxijQNqUsgRlMGIv6dunXStjA9orz0SrOZ3i0RuT0sQWaULKiwmr00wdT7WzYn/zHmlPdbch/Z3MyydWYkDsX7rPzP/qVC0SPezrGlyqKdKMqo5nLqnuirq5+aUqSQ4RcQp3KR4T5lr52WdTaxJdu+ot0/FXnalYtedZboo3dUsasP1znJOgvlO2rbJ9vFuqHGSjzmMDm9imee6hgiNUUSPvKzzgEU/GiXFj3Bp3H6lGLtOs49sy7t8BSCmUkw==</latexit><latexit sha1_base64="c9yQ65+ggjC55QRL3zBMOQBCGHo=">AAAC0HicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047KKfWBbZTKdtsG8TCZiKUXc+gNu9avEP9C/8M4YQS2iE5KcOfeeM3PvdSLPTaRlveSMqemZ2bn8fGFhcWl5pbi6Vk/CNOaixkMvjJsOS4TnBqImXemJZhQL5jueaDiXhyreuBZx4obBqRxGouOzfuD2XM4kUZ22z+SAM290Nj63Loolq2zpZU4COwMlZKsaFp/RRhchOFL4EAggCXtgSOhpwYaFiLgORsTFhFwdFxijQNqUsgRlMGIv6dunXStjA9orz0SrOZ3i0RuT0sQWaULKiwmr00wdT7WzYn/zHmlPdbch/Z3MyydWYkDsX7rPzP/qVC0SPezrGlyqKdKMqo5nLqnuirq5+aUqSQ4RcQp3KR4T5lr52WdTaxJdu+ot0/FXnalYtedZboo3dUsasP1znJOgvlO2rbJ9vFuqHGSjzmMDm9imee6hgiNUUSPvKzzgEU/GiXFj3Bp3H6lGLtOs49sy7t8BSCmUkw==</latexit><latexit sha1_base64="c9yQ65+ggjC55QRL3zBMOQBCGHo=">AAAC0HicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047KKfWBbZTKdtsG8TCZiKUXc+gNu9avEP9C/8M4YQS2iE5KcOfeeM3PvdSLPTaRlveSMqemZ2bn8fGFhcWl5pbi6Vk/CNOaixkMvjJsOS4TnBqImXemJZhQL5jueaDiXhyreuBZx4obBqRxGouOzfuD2XM4kUZ22z+SAM290Nj63Loolq2zpZU4COwMlZKsaFp/RRhchOFL4EAggCXtgSOhpwYaFiLgORsTFhFwdFxijQNqUsgRlMGIv6dunXStjA9orz0SrOZ3i0RuT0sQWaULKiwmr00wdT7WzYn/zHmlPdbch/Z3MyydWYkDsX7rPzP/qVC0SPezrGlyqKdKMqo5nLqnuirq5+aUqSQ4RcQp3KR4T5lr52WdTaxJdu+ot0/FXnalYtedZboo3dUsasP1znJOgvlO2rbJ9vFuqHGSjzmMDm9imee6hgiNUUSPvKzzgEU/GiXFj3Bp3H6lGLtOs49sy7t8BSCmUkw==</latexit> Z1

<latexit sha1_base64="+2VRWdXmI9N1PZZUrmL9SoSIiDE=">AAAC0HicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047KKfWBbZTKdtsG8TCZiKUXc+gNu9avEP9C/8M4YQS2iE5KcOfeeM3PvdSLPTaRlveSMqemZ2bn8fGFhcWl5pbi6Vk/CNOaixkMvjJsOS4TnBqImXemJZhQL5jueaDiXhyreuBZx4obBqRxGouOzfuD2XM4kUZ22z+SAM290Nj63L4olq2zpZU4COwMlZKsaFp/RRhchOFL4EAggCXtgSOhpwYaFiLgORsTFhFwdFxijQNqUsgRlMGIv6dunXStjA9orz0SrOZ3i0RuT0sQWaULKiwmr00wdT7WzYn/zHmlPdbch/Z3MyydWYkDsX7rPzP/qVC0SPezrGlyqKdKMqo5nLqnuirq5+aUqSQ4RcQp3KR4T5lr52WdTaxJdu+ot0/FXnalYtedZboo3dUsasP1znJOgvlO2rbJ9vFuqHGSjzmMDm9imee6hgiNUUSPvKzzgEU/GiXFj3Bp3H6lGLtOs49sy7t8BSomUlA==</latexit><latexit sha1_base64="+2VRWdXmI9N1PZZUrmL9SoSIiDE=">AAAC0HicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047KKfWBbZTKdtsG8TCZiKUXc+gNu9avEP9C/8M4YQS2iE5KcOfeeM3PvdSLPTaRlveSMqemZ2bn8fGFhcWl5pbi6Vk/CNOaixkMvjJsOS4TnBqImXemJZhQL5jueaDiXhyreuBZx4obBqRxGouOzfuD2XM4kUZ22z+SAM290Nj63L4olq2zpZU4COwMlZKsaFp/RRhchOFL4EAggCXtgSOhpwYaFiLgORsTFhFwdFxijQNqUsgRlMGIv6dunXStjA9orz0SrOZ3i0RuT0sQWaULKiwmr00wdT7WzYn/zHmlPdbch/Z3MyydWYkDsX7rPzP/qVC0SPezrGlyqKdKMqo5nLqnuirq5+aUqSQ4RcQp3KR4T5lr52WdTaxJdu+ot0/FXnalYtedZboo3dUsasP1znJOgvlO2rbJ9vFuqHGSjzmMDm9imee6hgiNUUSPvKzzgEU/GiXFj3Bp3H6lGLtOs49sy7t8BSomUlA==</latexit><latexit sha1_base64="+2VRWdXmI9N1PZZUrmL9SoSIiDE=">AAAC0HicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047KKfWBbZTKdtsG8TCZiKUXc+gNu9avEP9C/8M4YQS2iE5KcOfeeM3PvdSLPTaRlveSMqemZ2bn8fGFhcWl5pbi6Vk/CNOaixkMvjJsOS4TnBqImXemJZhQL5jueaDiXhyreuBZx4obBqRxGouOzfuD2XM4kUZ22z+SAM290Nj63L4olq2zpZU4COwMlZKsaFp/RRhchOFL4EAggCXtgSOhpwYaFiLgORsTFhFwdFxijQNqUsgRlMGIv6dunXStjA9orz0SrOZ3i0RuT0sQWaULKiwmr00wdT7WzYn/zHmlPdbch/Z3MyydWYkDsX7rPzP/qVC0SPezrGlyqKdKMqo5nLqnuirq5+aUqSQ4RcQp3KR4T5lr52WdTaxJdu+ot0/FXnalYtedZboo3dUsasP1znJOgvlO2rbJ9vFuqHGSjzmMDm9imee6hgiNUUSPvKzzgEU/GiXFj3Bp3H6lGLtOs49sy7t8BSomUlA==</latexit><latexit sha1_base64="+2VRWdXmI9N1PZZUrmL9SoSIiDE=">AAAC0HicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047KKfWBbZTKdtsG8TCZiKUXc+gNu9avEP9C/8M4YQS2iE5KcOfeeM3PvdSLPTaRlveSMqemZ2bn8fGFhcWl5pbi6Vk/CNOaixkMvjJsOS4TnBqImXemJZhQL5jueaDiXhyreuBZx4obBqRxGouOzfuD2XM4kUZ22z+SAM290Nj63L4olq2zpZU4COwMlZKsaFp/RRhchOFL4EAggCXtgSOhpwYaFiLgORsTFhFwdFxijQNqUsgRlMGIv6dunXStjA9orz0SrOZ3i0RuT0sQWaULKiwmr00wdT7WzYn/zHmlPdbch/Z3MyydWYkDsX7rPzP/qVC0SPezrGlyqKdKMqo5nLqnuirq5+aUqSQ4RcQp3KR4T5lr52WdTaxJdu+ot0/FXnalYtedZboo3dUsasP1znJOgvlO2rbJ9vFuqHGSjzmMDm9imee6hgiNUUSPvKzzgEU/GiXFj3Bp3H6lGLtOs49sy7t8BSomUlA==</latexit> Zk�1<latexit sha1_base64="IYsB8rI3eRiPFflNl0UHfFpY370=">AAAC1nicjVHLSsNAFD2Nr/qOunQTLIIbSyKCLotuXFawD9RaJuNoQ/MimSgS6k7c+gNu9ZPEP9C/8M6YglpEJyQ5c+49Z+be68a+l0rbfi0ZY+MTk1Pl6ZnZufmFRXNpuZlGWcJFg0d+lLRdlgrfC0VDetIX7TgRLHB90XL7+yreuhJJ6kXhkbyJRSdgl6F34XEmieqaS6cBkz3O/Px4cJb3N51B16zYVVsvaxQ4BaigWPXIfMEpzhGBI0MAgRCSsA+GlJ4TOLARE9dBTlxCyNNxgQFmSJtRlqAMRmyfvpe0OynYkPbKM9VqTqf49CaktLBOmojyEsLqNEvHM+2s2N+8c+2p7nZDf7fwCoiV6BH7l26Y+V+dqkXiAru6Bo9qijWjquOFS6a7om5ufalKkkNMnMLnFE8Ic60c9tnSmlTXrnrLdPxNZypW7XmRm+Fd3ZIG7Pwc5yhoblUdu+ocbldqe8Woy1jFGjZonjuo4QB1NMj7Go94wrPRNm6NO+P+M9UoFZoVfFvGwwdCJ5Z9</latexit><latexit sha1_base64="IYsB8rI3eRiPFflNl0UHfFpY370=">AAAC1nicjVHLSsNAFD2Nr/qOunQTLIIbSyKCLotuXFawD9RaJuNoQ/MimSgS6k7c+gNu9ZPEP9C/8M6YglpEJyQ5c+49Z+be68a+l0rbfi0ZY+MTk1Pl6ZnZufmFRXNpuZlGWcJFg0d+lLRdlgrfC0VDetIX7TgRLHB90XL7+yreuhJJ6kXhkbyJRSdgl6F34XEmieqaS6cBkz3O/Px4cJb3N51B16zYVVsvaxQ4BaigWPXIfMEpzhGBI0MAgRCSsA+GlJ4TOLARE9dBTlxCyNNxgQFmSJtRlqAMRmyfvpe0OynYkPbKM9VqTqf49CaktLBOmojyEsLqNEvHM+2s2N+8c+2p7nZDf7fwCoiV6BH7l26Y+V+dqkXiAru6Bo9qijWjquOFS6a7om5ufalKkkNMnMLnFE8Ic60c9tnSmlTXrnrLdPxNZypW7XmRm+Fd3ZIG7Pwc5yhoblUdu+ocbldqe8Woy1jFGjZonjuo4QB1NMj7Go94wrPRNm6NO+P+M9UoFZoVfFvGwwdCJ5Z9</latexit><latexit sha1_base64="IYsB8rI3eRiPFflNl0UHfFpY370=">AAAC1nicjVHLSsNAFD2Nr/qOunQTLIIbSyKCLotuXFawD9RaJuNoQ/MimSgS6k7c+gNu9ZPEP9C/8M6YglpEJyQ5c+49Z+be68a+l0rbfi0ZY+MTk1Pl6ZnZufmFRXNpuZlGWcJFg0d+lLRdlgrfC0VDetIX7TgRLHB90XL7+yreuhJJ6kXhkbyJRSdgl6F34XEmieqaS6cBkz3O/Px4cJb3N51B16zYVVsvaxQ4BaigWPXIfMEpzhGBI0MAgRCSsA+GlJ4TOLARE9dBTlxCyNNxgQFmSJtRlqAMRmyfvpe0OynYkPbKM9VqTqf49CaktLBOmojyEsLqNEvHM+2s2N+8c+2p7nZDf7fwCoiV6BH7l26Y+V+dqkXiAru6Bo9qijWjquOFS6a7om5ufalKkkNMnMLnFE8Ic60c9tnSmlTXrnrLdPxNZypW7XmRm+Fd3ZIG7Pwc5yhoblUdu+ocbldqe8Woy1jFGjZonjuo4QB1NMj7Go94wrPRNm6NO+P+M9UoFZoVfFvGwwdCJ5Z9</latexit><latexit sha1_base64="IYsB8rI3eRiPFflNl0UHfFpY370=">AAAC1nicjVHLSsNAFD2Nr/qOunQTLIIbSyKCLotuXFawD9RaJuNoQ/MimSgS6k7c+gNu9ZPEP9C/8M6YglpEJyQ5c+49Z+be68a+l0rbfi0ZY+MTk1Pl6ZnZufmFRXNpuZlGWcJFg0d+lLRdlgrfC0VDetIX7TgRLHB90XL7+yreuhJJ6kXhkbyJRSdgl6F34XEmieqaS6cBkz3O/Px4cJb3N51B16zYVVsvaxQ4BaigWPXIfMEpzhGBI0MAgRCSsA+GlJ4TOLARE9dBTlxCyNNxgQFmSJtRlqAMRmyfvpe0OynYkPbKM9VqTqf49CaktLBOmojyEsLqNEvHM+2s2N+8c+2p7nZDf7fwCoiV6BH7l26Y+V+dqkXiAru6Bo9qijWjquOFS6a7om5ufalKkkNMnMLnFE8Ic60c9tnSmlTXrnrLdPxNZypW7XmRm+Fd3ZIG7Pwc5yhoblUdu+ocbldqe8Woy1jFGjZonjuo4QB1NMj7Go94wrPRNm6NO+P+M9UoFZoVfFvGwwdCJ5Z9</latexit>

. . .<latexit sha1_base64="Hq3fobEOfZgnGscMFSYZue0ZWjs=">AAACyHicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl0I64qmLZQiyTptA5NMiEzUUpx4w+41S8T/0D/wjtjCmoRnZDkzLn3nJl7b5BGXCrHeS1Zc/MLi0vl5crK6tr6RnVzqyVFnoXMC0Uksk7gSxbxhHmKq4h10oz5cRCxdjA61fH2LcskF8mlGqesF/vDhA946CuivKu+UPK6WnPqjln2LHALUEOxmqL6giv0IRAiRwyGBIpwBB+Sni5cOEiJ62FCXEaImzjDPSqkzSmLUYZP7Ii+Q9p1CzahvfaURh3SKRG9GSlt7JFGUF5GWJ9mm3hunDX7m/fEeOq7jekfFF4xsQo3xP6lm2b+V6drURjg2NTAqabUMLq6sHDJTVf0ze0vVSlySInTuE/xjHBolNM+20YjTe26t76Jv5lMzep9WOTmeNe3pAG7P8c5C1oHddepuxeHtcZJMeoydrCLfZrnERo4QxMeeXM84gnP1rmVWnfW+DPVKhWabXxb1sMH3ZKRQw==</latexit><latexit sha1_base64="Hq3fobEOfZgnGscMFSYZue0ZWjs=">AAACyHicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl0I64qmLZQiyTptA5NMiEzUUpx4w+41S8T/0D/wjtjCmoRnZDkzLn3nJl7b5BGXCrHeS1Zc/MLi0vl5crK6tr6RnVzqyVFnoXMC0Uksk7gSxbxhHmKq4h10oz5cRCxdjA61fH2LcskF8mlGqesF/vDhA946CuivKu+UPK6WnPqjln2LHALUEOxmqL6giv0IRAiRwyGBIpwBB+Sni5cOEiJ62FCXEaImzjDPSqkzSmLUYZP7Ii+Q9p1CzahvfaURh3SKRG9GSlt7JFGUF5GWJ9mm3hunDX7m/fEeOq7jekfFF4xsQo3xP6lm2b+V6drURjg2NTAqabUMLq6sHDJTVf0ze0vVSlySInTuE/xjHBolNM+20YjTe26t76Jv5lMzep9WOTmeNe3pAG7P8c5C1oHddepuxeHtcZJMeoydrCLfZrnERo4QxMeeXM84gnP1rmVWnfW+DPVKhWabXxb1sMH3ZKRQw==</latexit><latexit sha1_base64="Hq3fobEOfZgnGscMFSYZue0ZWjs=">AAACyHicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl0I64qmLZQiyTptA5NMiEzUUpx4w+41S8T/0D/wjtjCmoRnZDkzLn3nJl7b5BGXCrHeS1Zc/MLi0vl5crK6tr6RnVzqyVFnoXMC0Uksk7gSxbxhHmKq4h10oz5cRCxdjA61fH2LcskF8mlGqesF/vDhA946CuivKu+UPK6WnPqjln2LHALUEOxmqL6giv0IRAiRwyGBIpwBB+Sni5cOEiJ62FCXEaImzjDPSqkzSmLUYZP7Ii+Q9p1CzahvfaURh3SKRG9GSlt7JFGUF5GWJ9mm3hunDX7m/fEeOq7jekfFF4xsQo3xP6lm2b+V6drURjg2NTAqabUMLq6sHDJTVf0ze0vVSlySInTuE/xjHBolNM+20YjTe26t76Jv5lMzep9WOTmeNe3pAG7P8c5C1oHddepuxeHtcZJMeoydrCLfZrnERo4QxMeeXM84gnP1rmVWnfW+DPVKhWabXxb1sMH3ZKRQw==</latexit><latexit sha1_base64="Hq3fobEOfZgnGscMFSYZue0ZWjs=">AAACyHicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl0I64qmLZQiyTptA5NMiEzUUpx4w+41S8T/0D/wjtjCmoRnZDkzLn3nJl7b5BGXCrHeS1Zc/MLi0vl5crK6tr6RnVzqyVFnoXMC0Uksk7gSxbxhHmKq4h10oz5cRCxdjA61fH2LcskF8mlGqesF/vDhA946CuivKu+UPK6WnPqjln2LHALUEOxmqL6giv0IRAiRwyGBIpwBB+Sni5cOEiJ62FCXEaImzjDPSqkzSmLUYZP7Ii+Q9p1CzahvfaURh3SKRG9GSlt7JFGUF5GWJ9mm3hunDX7m/fEeOq7jekfFF4xsQo3xP6lm2b+V6drURjg2NTAqabUMLq6sHDJTVf0ze0vVSlySInTuE/xjHBolNM+20YjTe26t76Jv5lMzep9WOTmeNe3pAG7P8c5C1oHddepuxeHtcZJMeoydrCLfZrnERo4QxMeeXM84gnP1rmVWnfW+DPVKhWabXxb1sMH3ZKRQw==</latexit>

Zk<latexit sha1_base64="bKWptWp2pHWVOh3YjZew4ADKyNw=">AAAC0HicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047KKfWBbZTKd1tC8TCZiKUXc+gNu9avEP9C/8M4YQS2iE5KcOfeeM3PvdSLPTaRlveSMqemZ2bn8fGFhcWl5pbi6Vk/CNOaixkMvjJsOS4TnBqImXemJZhQL5jueaDiDQxVvXIs4ccPgVA4j0fFZP3B7LmeSqE7bZ/KSM290Nj4fXBRLVtnSy5wEdgZKyFY1LD6jjS5CcKTwIRBAEvbAkNDTgg0LEXEdjIiLCbk6LjBGgbQpZQnKYMQO6NunXStjA9orz0SrOZ3i0RuT0sQWaULKiwmr00wdT7WzYn/zHmlPdbch/Z3MyydW4pLYv3Sfmf/VqVoketjXNbhUU6QZVR3PXFLdFXVz80tVkhwi4hTuUjwmzLXys8+m1iS6dtVbpuOvOlOxas+z3BRv6pY0YPvnOCdBfadsW2X7eLdUOchGnccGNrFN89xDBUeookbeV3jAI56ME+PGuDXuPlKNXKZZx7dl3L8D1EmUzg==</latexit><latexit sha1_base64="bKWptWp2pHWVOh3YjZew4ADKyNw=">AAAC0HicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047KKfWBbZTKd1tC8TCZiKUXc+gNu9avEP9C/8M4YQS2iE5KcOfeeM3PvdSLPTaRlveSMqemZ2bn8fGFhcWl5pbi6Vk/CNOaixkMvjJsOS4TnBqImXemJZhQL5jueaDiDQxVvXIs4ccPgVA4j0fFZP3B7LmeSqE7bZ/KSM290Nj4fXBRLVtnSy5wEdgZKyFY1LD6jjS5CcKTwIRBAEvbAkNDTgg0LEXEdjIiLCbk6LjBGgbQpZQnKYMQO6NunXStjA9orz0SrOZ3i0RuT0sQWaULKiwmr00wdT7WzYn/zHmlPdbch/Z3MyydW4pLYv3Sfmf/VqVoketjXNbhUU6QZVR3PXFLdFXVz80tVkhwi4hTuUjwmzLXys8+m1iS6dtVbpuOvOlOxas+z3BRv6pY0YPvnOCdBfadsW2X7eLdUOchGnccGNrFN89xDBUeookbeV3jAI56ME+PGuDXuPlKNXKZZx7dl3L8D1EmUzg==</latexit><latexit sha1_base64="bKWptWp2pHWVOh3YjZew4ADKyNw=">AAAC0HicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047KKfWBbZTKd1tC8TCZiKUXc+gNu9avEP9C/8M4YQS2iE5KcOfeeM3PvdSLPTaRlveSMqemZ2bn8fGFhcWl5pbi6Vk/CNOaixkMvjJsOS4TnBqImXemJZhQL5jueaDiDQxVvXIs4ccPgVA4j0fFZP3B7LmeSqE7bZ/KSM290Nj4fXBRLVtnSy5wEdgZKyFY1LD6jjS5CcKTwIRBAEvbAkNDTgg0LEXEdjIiLCbk6LjBGgbQpZQnKYMQO6NunXStjA9orz0SrOZ3i0RuT0sQWaULKiwmr00wdT7WzYn/zHmlPdbch/Z3MyydW4pLYv3Sfmf/VqVoketjXNbhUU6QZVR3PXFLdFXVz80tVkhwi4hTuUjwmzLXys8+m1iS6dtVbpuOvOlOxas+z3BRv6pY0YPvnOCdBfadsW2X7eLdUOchGnccGNrFN89xDBUeookbeV3jAI56ME+PGuDXuPlKNXKZZx7dl3L8D1EmUzg==</latexit><latexit sha1_base64="bKWptWp2pHWVOh3YjZew4ADKyNw=">AAAC0HicjVHLSsNAFD2Nr1pfVZdugkVwVRIRdFl047KKfWBbZTKd1tC8TCZiKUXc+gNu9avEP9C/8M4YQS2iE5KcOfeeM3PvdSLPTaRlveSMqemZ2bn8fGFhcWl5pbi6Vk/CNOaixkMvjJsOS4TnBqImXemJZhQL5jueaDiDQxVvXIs4ccPgVA4j0fFZP3B7LmeSqE7bZ/KSM290Nj4fXBRLVtnSy5wEdgZKyFY1LD6jjS5CcKTwIRBAEvbAkNDTgg0LEXEdjIiLCbk6LjBGgbQpZQnKYMQO6NunXStjA9orz0SrOZ3i0RuT0sQWaULKiwmr00wdT7WzYn/zHmlPdbch/Z3MyydW4pLYv3Sfmf/VqVoketjXNbhUU6QZVR3PXFLdFXVz80tVkhwi4hTuUjwmzLXys8+m1iS6dtVbpuOvOlOxas+z3BRv6pY0YPvnOCdBfadsW2X7eLdUOchGnccGNrFN89xDBUeookbeV3jAI56ME+PGuDXuPlKNXKZZx7dl3L8D1EmUzg==</latexit>


Adversarial stego sets Cover set Classifiers

Generation of an adversarial stego set

train train

fkrandom

<latexit sha1_base64="I8bCrFT36OuHG34heFZm3oin/pQ=">AAAC2HicjVHLSsNAFD2Nr1pf1S7dBIvgqiQi6LLoxmUFW0WrZZJONTTJhMlELKXgTtz6A271i8Q/0L/wzpiCD0QnJDlz7j1n5t7rJWGQKsd5KVgTk1PTM8XZ0tz8wuJSeXmllYpM+rzpi1DIY4+lPAxi3lSBCvlxIjmLvJAfef09HT+64jINRHyoBgk/i9hFHPQCnymiOuVK77zfGbYjT1wPJYu7IhqNOuWqU3PMsn8CNwdV5Kshys9oowsBHxkicMRQhEMwpPScwoWDhLgzDImThAIT5xihRNqMsjhlMGL79L2g3WnOxrTXnqlR+3RKSK8kpY110gjKk4T1abaJZ8ZZs795D42nvtuA/l7uFRGrcEnsX7px5n91uhaFHnZMDQHVlBhGV+fnLpnpir65/akqRQ4JcRp3KS4J+0Y57rNtNKmpXfeWmfirydSs3vt5boY3fUsasPt9nD9Ba7PmOjX3YKta381HXcQq1rBB89xGHftooEneAzzgEU/WiXVj3Vp3H6lWIddU8GVZ9+/5xZf7</latexit><latexit sha1_base64="I8bCrFT36OuHG34heFZm3oin/pQ=">AAAC2HicjVHLSsNAFD2Nr1pf1S7dBIvgqiQi6LLoxmUFW0WrZZJONTTJhMlELKXgTtz6A271i8Q/0L/wzpiCD0QnJDlz7j1n5t7rJWGQKsd5KVgTk1PTM8XZ0tz8wuJSeXmllYpM+rzpi1DIY4+lPAxi3lSBCvlxIjmLvJAfef09HT+64jINRHyoBgk/i9hFHPQCnymiOuVK77zfGbYjT1wPJYu7IhqNOuWqU3PMsn8CNwdV5Kshys9oowsBHxkicMRQhEMwpPScwoWDhLgzDImThAIT5xihRNqMsjhlMGL79L2g3WnOxrTXnqlR+3RKSK8kpY110gjKk4T1abaJZ8ZZs795D42nvtuA/l7uFRGrcEnsX7px5n91uhaFHnZMDQHVlBhGV+fnLpnpir65/akqRQ4JcRp3KS4J+0Y57rNtNKmpXfeWmfirydSs3vt5boY3fUsasPt9nD9Ba7PmOjX3YKta381HXcQq1rBB89xGHftooEneAzzgEU/WiXVj3Vp3H6lWIddU8GVZ9+/5xZf7</latexit><latexit sha1_base64="I8bCrFT36OuHG34heFZm3oin/pQ=">AAAC2HicjVHLSsNAFD2Nr1pf1S7dBIvgqiQi6LLoxmUFW0WrZZJONTTJhMlELKXgTtz6A271i8Q/0L/wzpiCD0QnJDlz7j1n5t7rJWGQKsd5KVgTk1PTM8XZ0tz8wuJSeXmllYpM+rzpi1DIY4+lPAxi3lSBCvlxIjmLvJAfef09HT+64jINRHyoBgk/i9hFHPQCnymiOuVK77zfGbYjT1wPJYu7IhqNOuWqU3PMsn8CNwdV5Kshys9oowsBHxkicMRQhEMwpPScwoWDhLgzDImThAIT5xihRNqMsjhlMGL79L2g3WnOxrTXnqlR+3RKSK8kpY110gjKk4T1abaJZ8ZZs795D42nvtuA/l7uFRGrcEnsX7px5n91uhaFHnZMDQHVlBhGV+fnLpnpir65/akqRQ4JcRp3KS4J+0Y57rNtNKmpXfeWmfirydSs3vt5boY3fUsasPt9nD9Ba7PmOjX3YKta381HXcQq1rBB89xGHftooEneAzzgEU/WiXVj3Vp3H6lWIddU8GVZ9+/5xZf7</latexit><latexit sha1_base64="I8bCrFT36OuHG34heFZm3oin/pQ=">AAAC2HicjVHLSsNAFD2Nr1pf1S7dBIvgqiQi6LLoxmUFW0WrZZJONTTJhMlELKXgTtz6A271i8Q/0L/wzpiCD0QnJDlz7j1n5t7rJWGQKsd5KVgTk1PTM8XZ0tz8wuJSeXmllYpM+rzpi1DIY4+lPAxi3lSBCvlxIjmLvJAfef09HT+64jINRHyoBgk/i9hFHPQCnymiOuVK77zfGbYjT1wPJYu7IhqNOuWqU3PMsn8CNwdV5Kshys9oowsBHxkicMRQhEMwpPScwoWDhLgzDImThAIT5xihRNqMsjhlMGL79L2g3WnOxrTXnqlR+3RKSK8kpY110gjKk4T1abaJZ8ZZs795D42nvtuA/l7uFRGrcEnsX7px5n91uhaFHnZMDQHVlBhGV+fnLpnpir65/akqRQ4JcRp3KS4J+0Y57rNtNKmpXfeWmfirydSs3vt5boY3fUsasPt9nD9Ba7PmOjX3YKta381HXcQq1rBB89xGHftooEneAzzgEU/WiXVj3Vp3H6lWIddU8GVZ9+/5xZf7</latexit>

fklast it

<latexit sha1_base64="tkeU0l5SjCPr0ZqIbUM7dWYf4ws=">AAAC2XicjVHLSsNAFD2Nr1pf8bFzEyyCq5KIoMuiG5cV7APaWpJ0WofmRTIRa+nCnbj1B9zqD4l/oH/hnTEFtYhOSHLm3HvOzL3XiTyeCNN8zWkzs3PzC/nFwtLyyuqavr5RS8I0dlnVDb0wbjh2wjwesKrgwmONKGa273is7gxOZLx+xeKEh8G5GEas7dv9gPe4awuiOvpW72LQGbV8J7weeXYiDC7G445eNEumWsY0sDJQRLYqof6CFroI4SKFD4YAgrAHGwk9TVgwERHXxoi4mBBXcYYxCqRNKYtRhk3sgL592jUzNqC99EyU2qVTPHpjUhrYJU1IeTFheZqh4qlyluxv3iPlKe82pL+TefnEClwS+5dukvlfnaxFoIcjVQOnmiLFyOrczCVVXZE3N75UJcghIk7iLsVjwq5STvpsKE2iape9tVX8TWVKVu7dLDfFu7wlDdj6Oc5pUNsvWWbJOjsolo+zUeexjR3s0TwPUcYpKqiS9w0e8YRnrandanfa/Weqlss0m/i2tIcPmMyYNQ==</latexit><latexit sha1_base64="tkeU0l5SjCPr0ZqIbUM7dWYf4ws=">AAAC2XicjVHLSsNAFD2Nr1pf8bFzEyyCq5KIoMuiG5cV7APaWpJ0WofmRTIRa+nCnbj1B9zqD4l/oH/hnTEFtYhOSHLm3HvOzL3XiTyeCNN8zWkzs3PzC/nFwtLyyuqavr5RS8I0dlnVDb0wbjh2wjwesKrgwmONKGa273is7gxOZLx+xeKEh8G5GEas7dv9gPe4awuiOvpW72LQGbV8J7weeXYiDC7G445eNEumWsY0sDJQRLYqof6CFroI4SKFD4YAgrAHGwk9TVgwERHXxoi4mBBXcYYxCqRNKYtRhk3sgL592jUzNqC99EyU2qVTPHpjUhrYJU1IeTFheZqh4qlyluxv3iPlKe82pL+TefnEClwS+5dukvlfnaxFoIcjVQOnmiLFyOrczCVVXZE3N75UJcghIk7iLsVjwq5STvpsKE2iape9tVX8TWVKVu7dLDfFu7wlDdj6Oc5pUNsvWWbJOjsolo+zUeexjR3s0TwPUcYpKqiS9w0e8YRnrandanfa/Weqlss0m/i2tIcPmMyYNQ==</latexit><latexit sha1_base64="tkeU0l5SjCPr0ZqIbUM7dWYf4ws=">AAAC2XicjVHLSsNAFD2Nr1pf8bFzEyyCq5KIoMuiG5cV7APaWpJ0WofmRTIRa+nCnbj1B9zqD4l/oH/hnTEFtYhOSHLm3HvOzL3XiTyeCNN8zWkzs3PzC/nFwtLyyuqavr5RS8I0dlnVDb0wbjh2wjwesKrgwmONKGa273is7gxOZLx+xeKEh8G5GEas7dv9gPe4awuiOvpW72LQGbV8J7weeXYiDC7G445eNEumWsY0sDJQRLYqof6CFroI4SKFD4YAgrAHGwk9TVgwERHXxoi4mBBXcYYxCqRNKYtRhk3sgL592jUzNqC99EyU2qVTPHpjUhrYJU1IeTFheZqh4qlyluxv3iPlKe82pL+TefnEClwS+5dukvlfnaxFoIcjVQOnmiLFyOrczCVVXZE3N75UJcghIk7iLsVjwq5STvpsKE2iape9tVX8TWVKVu7dLDfFu7wlDdj6Oc5pUNsvWWbJOjsolo+zUeexjR3s0TwPUcYpKqiS9w0e8YRnrandanfa/Weqlss0m/i2tIcPmMyYNQ==</latexit><latexit sha1_base64="tkeU0l5SjCPr0ZqIbUM7dWYf4ws=">AAAC2XicjVHLSsNAFD2Nr1pf8bFzEyyCq5KIoMuiG5cV7APaWpJ0WofmRTIRa+nCnbj1B9zqD4l/oH/hnTEFtYhOSHLm3HvOzL3XiTyeCNN8zWkzs3PzC/nFwtLyyuqavr5RS8I0dlnVDb0wbjh2wjwesKrgwmONKGa273is7gxOZLx+xeKEh8G5GEas7dv9gPe4awuiOvpW72LQGbV8J7weeXYiDC7G445eNEumWsY0sDJQRLYqof6CFroI4SKFD4YAgrAHGwk9TVgwERHXxoi4mBBXcYYxCqRNKYtRhk3sgL592jUzNqC99EyU2qVTPHpjUhrYJU1IeTFheZqh4qlyluxv3iPlKe82pL+TefnEClwS+5dukvlfnaxFoIcjVQOnmiLFyOrczCVVXZE3N75UJcghIk7iLsVjwq5STvpsKE2iape9tVX8TWVKVu7dLDfFu7wlDdj6Oc5pUNsvWWbJOjsolo+zUeexjR3s0TwPUcYpKqiS9w0e8YRnrandanfa/Weqlss0m/i2tIcPmMyYNQ==</latexit>

fk�1

random<latexit sha1_base64="RSCeo8DiClzfF0BXEWrrz0btiNE=">AAAC3HicjVHLSsNAFD3G9zvqwoWbYBHcWBIRdFl041LBWqHakqTTGppkwmQiSsjOnbj1B9zq94h/oH/hnTEFtYhOSHLm3HvO3DvXS8Iglbb9OmKMjo1PTE5Nz8zOzS8smkvLpynPhM/qPg+5OPPclIVBzOoykCE7SwRzIy9kDa9/oOKNKybSgMcn8iZhF5Hbi4Nu4LuSqLa52m3l/S2naOfnkcevc+HGHR4VRdus2FVbL2sYOCWooFxH3HzBOTrg8JEhAkMMSTiEi5SeJhzYSIi7QE6cIBToOEOBGdJmlMUowyW2T98e7ZolG9NeeaZa7dMpIb2ClBY2SMMpTxBWp1k6nmlnxf7mnWtPVdsN/b3SKyJW4pLYv3SDzP/qVC8SXezpHgLqKdGM6s4vXTJ9K6py60tXkhwS4hTuUFwQ9rVycM+W1qS6d3W3ro6/6UzFqr1f5mZ4V1XSgJ2f4xwGp9tVx646xzuV2n456imsYR2bNM9d1HCII9R1/Y94wrPRMm6NO+P+M9UYKTUr+LaMhw/agZl5</latexit><latexit sha1_base64="RSCeo8DiClzfF0BXEWrrz0btiNE=">AAAC3HicjVHLSsNAFD3G9zvqwoWbYBHcWBIRdFl041LBWqHakqTTGppkwmQiSsjOnbj1B9zq94h/oH/hnTEFtYhOSHLm3HvO3DvXS8Iglbb9OmKMjo1PTE5Nz8zOzS8smkvLpynPhM/qPg+5OPPclIVBzOoykCE7SwRzIy9kDa9/oOKNKybSgMcn8iZhF5Hbi4Nu4LuSqLa52m3l/S2naOfnkcevc+HGHR4VRdus2FVbL2sYOCWooFxH3HzBOTrg8JEhAkMMSTiEi5SeJhzYSIi7QE6cIBToOEOBGdJmlMUowyW2T98e7ZolG9NeeaZa7dMpIb2ClBY2SMMpTxBWp1k6nmlnxf7mnWtPVdsN/b3SKyJW4pLYv3SDzP/qVC8SXezpHgLqKdGM6s4vXTJ9K6py60tXkhwS4hTuUFwQ9rVycM+W1qS6d3W3ro6/6UzFqr1f5mZ4V1XSgJ2f4xwGp9tVx646xzuV2n456imsYR2bNM9d1HCII9R1/Y94wrPRMm6NO+P+M9UYKTUr+LaMhw/agZl5</latexit><latexit sha1_base64="RSCeo8DiClzfF0BXEWrrz0btiNE=">AAAC3HicjVHLSsNAFD3G9zvqwoWbYBHcWBIRdFl041LBWqHakqTTGppkwmQiSsjOnbj1B9zq94h/oH/hnTEFtYhOSHLm3HvO3DvXS8Iglbb9OmKMjo1PTE5Nz8zOzS8smkvLpynPhM/qPg+5OPPclIVBzOoykCE7SwRzIy9kDa9/oOKNKybSgMcn8iZhF5Hbi4Nu4LuSqLa52m3l/S2naOfnkcevc+HGHR4VRdus2FVbL2sYOCWooFxH3HzBOTrg8JEhAkMMSTiEi5SeJhzYSIi7QE6cIBToOEOBGdJmlMUowyW2T98e7ZolG9NeeaZa7dMpIb2ClBY2SMMpTxBWp1k6nmlnxf7mnWtPVdsN/b3SKyJW4pLYv3SDzP/qVC8SXezpHgLqKdGM6s4vXTJ9K6py60tXkhwS4hTuUFwQ9rVycM+W1qS6d3W3ro6/6UzFqr1f5mZ4V1XSgJ2f4xwGp9tVx646xzuV2n456imsYR2bNM9d1HCII9R1/Y94wrPRMm6NO+P+M9UYKTUr+LaMhw/agZl5</latexit><latexit sha1_base64="RSCeo8DiClzfF0BXEWrrz0btiNE=">AAAC3HicjVHLSsNAFD3G9zvqwoWbYBHcWBIRdFl041LBWqHakqTTGppkwmQiSsjOnbj1B9zq94h/oH/hnTEFtYhOSHLm3HvO3DvXS8Iglbb9OmKMjo1PTE5Nz8zOzS8smkvLpynPhM/qPg+5OPPclIVBzOoykCE7SwRzIy9kDa9/oOKNKybSgMcn8iZhF5Hbi4Nu4LuSqLa52m3l/S2naOfnkcevc+HGHR4VRdus2FVbL2sYOCWooFxH3HzBOTrg8JEhAkMMSTiEi5SeJhzYSIi7QE6cIBToOEOBGdJmlMUowyW2T98e7ZolG9NeeaZa7dMpIb2ClBY2SMMpTxBWp1k6nmlnxf7mnWtPVdsN/b3SKyJW4pLYv3SDzP/qVC8SXezpHgLqKdGM6s4vXTJ9K6py60tXkhwS4hTuUFwQ9rVycM+W1qS6d3W3ro6/6UzFqr1f5mZ4V1XSgJ2f4xwGp9tVx646xzuV2n456imsYR2bNM9d1HCII9R1/Y94wrPRMm6NO+P+M9UYKTUr+LaMhw/agZl5</latexit>

Figure 3: Diagramof twoother strategies ("random" and "lastiteration") suggested in [19] at iteration k .

4.3 Experimental resultsWe now evaluate the empirical security of the proposed embedding

scheme w.r.t. different steganalysis schemes. We also evaluate the

impact of the iteration parameter k and we compare the proposed

minmax strategy w.r.t. other ones.

Figure 4 shows the evolution of error Perr w.r.t parameter k for

different matched classifiers f k where the term "matched classi-

fiers" means that the classifier is trained to classify cover images

0 2 4 6 8

k

7.5

10.0

12.5

15.0

17.5

20.0

22.5

25.0

Perr

(%) XU-Net

DCTR

GFR

SRNet

Figure 4: Perr of matched classifiers (this means that eachclassifier is trained and evaluated on X and Yk ) for eachiteration k using different classifiers. The algorithm is op-timized with respect to XU-net. Classifiers DCTR and GFRare based on the combination of steganographic features(DCTR [10] and GFR [18]) and regularized Fisher Linear Dis-criminant classifier [5].

X and stego images Ykcommunicated by the steganographer at

the kth-iteration of the protocol. Note also that contents in Yk

are selected such that they are the least detectable by the previous

trained classifier { f 0, f 1, . . . , f k−1},which means that they are not

optimized with respect to the current classifier f k used to bench-

mark our embedding scheme and which is the best classifier the

detector can have since it is optimized with respect to the current

strategy of the steganalyst. This means that this evaluation scenario

obeys Kerckhoffs’ principle as the detector knows the strategy of

the steganographer.

This figure shows also that the error of the matched classifier

steadily increases for the different steganalysis methods, which

means that the resulting steganographic scheme becomes on aver-

age more and more secure after each iteration, even if after k = 6

a plateau is reached. The error rate at iteration 0 corresponds to

the error after J-Uniward steganalysis. Evaluating the quality of

the algorithm by the error Perr facing the XU-Net classifier, the

security has improved from 6.9% to 21.7% after nine iterations of

the algorithm, which is substantial.

We see that Perr is globaly increasing but sometimes it decreases

(see iteration k = 2). It may come from the not certainty to reach

optimization when training a new classifier, and because each clas-

sifier is randomly initialized.

If we now compare the practical security benchmarked by XU-

Net with other steganalysis schemes, we notice that the evolution

for other schemes is similar with increasing and converging unde-

tectability w.r.t. the iteration number. The improvement proposed

by this protocol is consequently not only relevant for the targeted

steganalyzer, but for a broad class of steganalysis schemes.


In Table 1 embedding strategy (7) is compared with the "random"

and "last-iteration" strategies that are suggested in reference [19].

We can see that theminmax strategy offers higher practical security

until iterationk = 4, with a gain of more than 3%w.r.t. the "Random"

strategy at iteration 4 and 5% w.r.t. the "Last iteration" strategy at

iteration 2. The bad behavior of the "Last iteration" strategy can

be explained by the fact that the embedding targets a classifier

different from the one used to benchmark the scheme.3

k 0 1 2 3 4 5 6

minmax 6.9 12.9 15.8 16.2 18.4 20.1 19.5

Random 6.9 12.1 12.4 16.2 15.3 15.4 16.2

Last iteration 6.9 12.1 10.5 16.3 – 16.2 17.3

Table 1: Perr (in %) given by different strategies for thefirst sixiterations: theminmax strategy (each classifier is trained andevaluated onX andYk ), the "random" strategy given in [19](each classifier is trained and evaluated on X andZ0 ∪Z1 ∪

. . . ∪Zk ) and finally the "last iteration" strategy where eachclassifier is trained and evaluated on X andZk .

5 CONCLUSION AND PERSPECTIVESThis paper proposes a steganographic scheme exploiting adversarial

embeddings and based on a minmax strategy. This protocol can

be used to improve classical additive cost-based steganographic

schemes such as J-Uniward, but it can practically be applied on

any schemes that can locally adjust the embedding costs. Our tests

assess both the benefits of (i) iterating in order to generate more

secure stego contents and (ii) using a minmax strategy instead

of randomly selecting stego contents from previous iterations or

selecting stego contents only from the last iteration.

Note also that contrary to other adversarial embedding strategies

based on tailored sampling of the costs such as GANs [20], this

scheme relies on a targeted attack to the classifier, which enables

to speed up the convergence and improves its efficiency.

Future works will be devoted to design better strategies to adjust

costs, and will also consider other strategies to attack the classifier.

ACKNOWLEDGMENTSThis work has been funded in part by the French National Re-

search Agency (ANR-18-ASTR-0009), ALASKA project: https://

alaska.utt.fr, and by the French ANR DEFALS program (ANR-16-

DEFA-0003). The authors acknowledge the support of the OP VVV

project CZ.02.1.01/0.0/0.0/16_019/0000765 "Research Center for In-

formatics" and a support by CzechMinistry of Education 19-29680L.

REFERENCES[1] Martín Abadi, Paul Barham, Jianmin Chen, Zhifeng Chen, Andy Davis, Jeffrey

Dean, Matthieu Devin, Sanjay Ghemawat, Geoffrey Irving, Michael Isard, et al.

2016. Tensorflow: A system for large-scale machine learning. In 12th {USENIX}Symposium on Operating Systems Design and Implementation ({OSDI} 16). 265–283.

3The final version of the paper will present results after more iterations, this was not

possible for this submission due to computational time.

[2] Patrick Bas. 2016. Steganography via Cover-Source Switching. In WIFS. AbuDabi, United Arab Emirates. https://hal.archives-ouvertes.fr/hal-01386190

[3] Patrick Bas, Tomáš Filler, and Tomáš Pevný. 2011. "Break Our Steganographic

System": The Ins and Outs of Organizing BOSS. In International Workshop onInformation Hiding, Vol. 6958, LNCS. Springer Berlin Heidelberg, 59–70.

[4] Mehdi Boroumand, Mo Chen, and Jessica Fridrich. 2019. Deep residual network

for steganalysis of digital images. IEEE Transactions on Information Forensics andSecurity (2019).

[5] Rémi Cogranne, Vahid Sedighi, Jessica Fridrich, and Tomáš Pevný. 2015. Is

ensemble classifier needed for steganalysis in high-dimensional feature spaces?.

In IEEE International Workshop on Information Forensics and Security (WIFS). 1–6.[6] Tomáš Filler and Jessica Fridrich. 2010. Gibbs construction in steganography.

IEEE Transactions on Information Forensics and Security 5, 4 (2010), 705–720.

[7] Tomáš Filler, Jan Judas, and Jessica Fridrich. 2010. Minimizing embedding im-

pact in steganography using trellis-coded quantization. In IS&T/SPIE ElectronicImaging. International Society for Optics and Photonics, 754105–754105.

[8] Ian Goodfellow, Yoshua Bengio, and Aaron Courville. 2016. Deep learning. MIT

press.

[9] Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining and

harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014).[10] Vojtěch Holub and Jessica Fridrich. 2015. Low-complexity features for JPEG

steganalysis using undecimated DCT. IEEE Transactions on Information Forensicsand Security 10, 2 (2015), 219–228.

[11] Vojtěch Holub, Jessica Fridrich, and Tomáš Denemark. 2014. Universal distor-

tion function for steganography in an arbitrary domain. EURASIP Journal onInformation Security 2014, 1 (2014), 1.

[12] Sarra Kouider, Marc Chaumont, and William Puech. 2013. Adaptive steganogra-

phy by oracle (ASO). In IEEE International Conference on Multimedia and Expo(ICME). 1–6.

[13] Tomáš Pevný, Tomáš Filler, and Patrick Bas. 2010. Using high-dimensional image

models to perform highly undetectable steganography. In International Workshopon Information Hiding, Vol. 6387, LNCS. Springer Berlin Heidelberg, 161–177.

[14] Tomáš Pevný and Andrew D Ker. 2018. Exploring Non-Additive Distortion in

Steganography. In Proceedings of the 6th ACM Workshop on Information Hidingand Multimedia Security. ACM, 109–114.

[15] Lionel Pibre, Jérôme Pasquet, Dino Ienco, and Marc Chaumont. 2016. Deep

learning is a good steganalysis tool when embedding key is reused for different

images, even if there is a cover sourcemismatch. Electronic Imaging 2016, 8 (2016),1–11.

[16] Phil Sallee. 2005. Model-based methods for steganography and steganalysis.

International Journal of Image and graphics 5, 01 (2005), 167–189.[17] Vahid Sedighi, Rémi Cogranne, and Jessica Fridrich. 2016. Content-Adaptive

Steganography by Minimizing Statistical Detectability. IEEE Transactions onInformation Forensics and Security 11, 2 (2016), 221–234.

[18] Xiaofeng Song, Fenlin Liu, Chunfang Yang, Xiangyang Luo, and Yi Zhang. 2015.

Steganalysis of adaptive JPEG steganography using 2D Gabor filters. In Proceed-ings of the 3rd ACM workshop on information hiding and multimedia security.ACM, 15–23.

[19] Weixuan Tang, Bin Li, Shunquan Tan, Mauro Barni, and Jiwu Huang. 2019. CNN-

based Adversarial Embedding for Image Steganography. IEEE Transactions onInformation Forensics and Security (2019).

[20] Weixuan Tang, Shunquan Tan, Bin Li, and Jiwu Huang. 2017. Automatic stegano-

graphic distortion learning using a generative adversarial network. IEEE SignalProcessing Letters 24, 10 (2017), 1547–1551.

[21] Jessica Fridrich Tomáš Filler. 2011. Design of adaptive steganographic schemes

for digital images. , 7880 - 7880 - 14 pages.

[22] Guanshuo Xu. 2017. Deep convolutional neural network to detect J-UNIWARD.

In Proceedings of the 5th ACM Workshop on Information Hiding and MultimediaSecurity. ACM, 67–73.

[23] G. Xu, H. Wu, and Y. Shi. 2016. Structural Design of Convolutional Neural

Networks for Steganalysis. IEEE Signal Processing Letters 23, 5 (May 2016), 708–

712.

[24] J. Ye, J. Ni, and Y. Yi. 2017. Deep Learning Hierarchical Representations for Image

Steganalysis. IEEE Transactions on Information Forensics and Security 12, 11 (Nov

2017), 2545–2557.

https://alaska.utt.fr

https://alaska.utt.fr

https://hal.archives-ouvertes.fr/hal-01386190

exploiting adversarial embeddings for better steganography

Documents