1 Informed Stego-schemes in Active Warden Context ...

1

Informed Stego-schemes in Active Warden
Context : Tradeoff between Undetectability,

Capacity and Resistance

Sofiane Braci, Student Member, IEEE, Claude Delpha, Member, IEEE,
Re´my Boyer, Member, IEEE, and Gae¨tan Le Guelvouit

Abstract

The prime goal of steganography is undetectability. It means that the warden of the Simmons
prisoners’ problem cannot decide if the embedded message – sent by Alice to Bob – is present
or not in the stego-content. This problem of evaluating whether the warden is able to detect the presence
of a hidden message or not has been formalized based on the statistics of the stego-signal. In this paper,
we use the 1-dimensional and 2-dimensional relative entropy as the undetectability metric for stego-
systems. The paper context is steganography with active warden i.e. the warden is allowed to act in
order to prevent the receiver to receive the hidden message. We model all warden attacks by an Additive
White Gaussian Noise (AWGN). As result, stego-systems are considered as communication channels
constrained by undetectability and warden attacks.
We provide in this paper a steganographic study of some informed stego-systems: scalar Costa scheme,
trellis-coded quantization and spread transform scalar Costa scheme. Analytical formulations and experi-
mental evaluations demonstrate the advantages and the limits of each scheme in terms of undetectability
and capacity. In addition, we propose a new stego-scheme based on the combination of spread transform
and trellis-coded quantization. The proposed scheme permits a good resistance to the active warden attacks
and allows for a good trade-off between undetectability, capacity and resistance to warden attacks.

Index Terms

Steganography, capacity, resistance, undetectability, relative entropy, Costa scheme, spread transform.

Edics : WAT-STEG, WAT-BINM, WAT-OTHM, WAT-SSPM.

The authors would like to thank the ESTIVALE project from ANR (Agence Nationale de la Recherche) for funding.
Parts of this paper have been presented at ICASSP08 [1] and MMSP08 [2].
S. Braci, C. Delpha and R. Boyer are with LSS (joint lab of CNRS, Suplec and Paris 11), Suplec, plateau du moulon, Gif-
sur-Yvette, France, {sofiane.braci, claude.delpha, remy.boyer}@lss.supelec.fr; G. LeGuelvouit is with ”Orange labs”, Cesson-
Se´vigne´, Rennes, France, [email protected].

November 4, 2008 DRAFT

2

I. INTRODUCTION
Steganography is a very old field, it has been used since the Antiquity [3], [4]. As defined by Cox
et al. [5], steganography denotes “the practice of undetectability altering a work to embed a message.”
In other words, the prime goal of steganography is undetectability. The latter is generally measured by
computing a stego-signal histogram and a variety of higher order statistics. In [6], Cachin considers a
stego-system to be perfectly secure when the probability density function (p.d.f.) of the stego-signal is
the same as the cover-signal. Chandramouli in [7] makes an interesting mathematical analysis of this
specific case of passive warden. In this case and in the paper context, the stego-system is said to be
perfectly undetectable, as in [8].

In prisoners’ problem [9], Alice and Bob are in prison and try to escape. They can exchange documents,
but these documents are controlled by a warden named Wendy. There are three types of warden: passive,
active and malicious [5]. When the warden is passive, she only tests the presence of the cover message
in the communication between Alice and Bob. The warden is called malicious if her action is based on
the particularities of the steganographic scheme and are aimed at catching the prisoners. In the case of
interest, when the warden is active, “she intentionally modifies the content sent by Alice prior to receipt
by Bob. Thus, even though her tests are negative, the warden may alter the content hoping that the
modifications destroy any steganographic message that might be present” [5]. In this work, we take the
same assumption as in [5], where Wendy has a full knowledge of the statistical distribution of all used
cover-works. In addition, we model warden attacks by Additive White Gaussian Noise (AWGN). Also,
we show that the undetectability condition leads to limit the transmitter by a power constraint. Hence,
we determine the stego-capacity in the same way as in the case of an AWGN channel. The average
probability of error (evaluated by the bit error rate) is used in order to check if the warden attacks
destroy the message and if the channel capacity is achieved.

Our study is based on informed data hiding schemes as the Scalar Costa Scheme (SCS) [10]. One
of the major works already proposed on these type of scheme [11] found experimentally that SCS is
statistically detectable due to artifacts in the p.d.f. of the stego-signal, since “the presence of statistical
anomalies is assumed to be indicative of illegitimate use and may therefore be used by the adversary
to decide that a cover communication is present or at least examine the stego-work in more detail” [5].
The way proposed to make it undetectable is the use of a specific compressor on the signal, which

November 4, 2008 DRAFT

3

Active warden PS = PX ?
PS

PX

Source S Encoder X Attack Y Decoder m
Message m
Secret key k

Fig. 1. Communication-theoretic view of steganography in active warden context.

leads to a loss on flexibility, as explained on [12] . Le Guelvouit [12] proposed to use Trellis-Coded
Quantization (TCQ) [13] in order to hide the message: the author shows experimentally that the p.d.f.
of the stego-signal is not affected by the embedded message. We fully complete this study and also
theoretically demonstrate this result. Moreover, this work evaluates steganographic performance of the
Spread Transform Scalar Costa Scheme (ST-SCS) [10] in an active warden context, which is often used
for robust watermarking. We demonstrate with experiments and analytical formulations the good statistical
undetectability level of this system. However, the undetectability obtained thanks to the spread transform
could be lost and become at the same level as the SCS if the projection vector is public or the warden
performs his attack according to the embedding direction. Hence, we propose a new stego-scheme, which
is some combination of spread transform and TCQ. We also demonstrate experimentally and analytically
the good statistical properties of this system. In addition, we compare the capacity and the resistance of
these schemes for different warden attacks strength and for different transmitter distortion constraints.

Let us first list some notational conventions used in this paper. Vectors are noted in bold font and sets
in black board font. Data are written in small letters, and random variables in capital letters; s[i] is the
ith component of vector s. The probability density function of a random variable S is denoted by pS(.).

II. WORK CONTEXT
In this work, the warden is active and the attack is modeled by AWGN. In order to make a detailed
analysis of candidate schemes, let us define the basic properties of steganographic systems:
• Undetectability. this is the prime goal of steganography, Cox [5] defines the undetectability as

the “impossibility to detect the presence of embedded steganographic message in a work”, i.e. the

November 4, 2008 DRAFT

4

warden cannot make the difference between the stego-work and an innocuous work. In [8], the

perfect undetectbility constraint is given by pS = pX , where pS is the p.d.f. of the cover-signal s
and pX is the p.d.f. of the stego-signal x. Since it is difficult to obtain perfect undetectability and in
order to compare the undetectability performance of stego-systems, we measure the undetectability

level by the relative entropy D(pS || pX ). Hence, our objective will be the minimization of this
distance, i.e. the stego-signal x must respect the following condition:

D(PS||PX ) = +∞ pS (z ) dz ≤ , (1)
pX (z)
pS(z) ln

−∞

where ln(.) is the neperian logarithm and is a small positive real value.

• Transparency (fidelity). In [8], authors define the transparency (also called imperceptibility) as

“closeness of the cover-text and stego-text under an appropriate distortion (fidelity) metric.” The

metric taken in this work is the embedding distortion with a fixed host signal strength and for the

experiments on real images the Peak Signal-to-Noise ratio (PSNR) is used. Note that subjective

criteria are not used in this work, since it uses a complex Human Visual System (HVS) model [14],

– for images and video –, or the Human Auditory System (HAS) [15] models for audio signals.

Contrary to robust watermarking, fidelity is not important in steganography. Alice is free to choose

the cover-text, since the cover-work is of no value in the steganography context. However, is it true

to say that there is no correlation between fidelity and undetectability? Let us determine the relative

entropy D(PS||PX ) between the Gaussian cover-signal s of variance σS2 and the stego-signal x, also
assumed to be Gaussian of variance σX2 = σS2 + σE2 , where σE2 is the variance of the embedding
noise. The relative entropy is given by the following formulation (see Appendix I):

Dtheo(PS || PX ) = − 1 1+ 1 − ln 1 + σE2 /σS2 , (2)
2 σS2 /σE2

such as ∂Dtheo(PS || PX ) 1 σE2
∂σE2 2 + σS2 )2
= (σE2 > 0. (3)

Hence, Dtheo(PS || PX ) is a strictly increasing function with respect to the embedding strength.

Since the embedding strength directly affects the fidelity, thus, undetectability and embedding

distortion are theoretically proportional. If Dstat is the maximum embedding distortion which leads
to undetectability meeting Eqn. (1), thus, any embedding noise with an embedding strength less than

Dstat is undetectable. Let us take

D1 = max(Dstat, Dfid), (4)

November 4, 2008 DRAFT

5

where Dfid is the maximum embedding strength ensuring imperceptibility. Thus, if the embedding

strength σE2 verifies

σE2 ≤ D1, (5)

thus, the embedding process respects both undetectability and fidelity constraints.

• Capacity. In the context of steganography with passive warden when the only constraint is
undetectability, Cox defines the capacity as “the maximum number of bits that can be hidden in a

given cover work, such that the probability of detection by an adversary is negligible.” In this work,

the undetectability constraint is met if σE2 ≤ Dstat. However, in order to improve the stego-system
performance, a stronger constraint is taken, given by Eqn. (5). Thus, we respect both fidelity and

undetectability constraints. The context of this work is steganography with active warden. In other

words, there is an additional constraint: the active warden attack. Our stego-system is depicted in

Fig. 1. The cover-signal is modeled as a set of sequences : S = {S1, . . . , SN } of i.i.d. samples drawn
from a p.d.f. {pS(s), s ∈ S}. A message m ∈ M is to be embedded in s. The encoder produces
a stego-signal x, in an attempt to transmit the message m to the decoder. The warden observes x
and tests whether x is drawn i.i.d from pS. If not, the warden terminates the transmission. When x
is deemed innocuous, the warden produced a corrupted signal y by passing x through some attack
channel: pY |X (y|x). In other words, if the undetectability constraint is met, the stego-signal is always
attacked by the warden.

Assume that the p.d.f. of the output depends only on the input at that time (memoryless system).

Thus, we can consider the active warden as a discrete channel. thus, as in [16], we define the capacity

in the active warden context as:

C = max I(X; Y ), (6)

pX (x)

where the maximum is taken over all possible input distributions pX (x). In [8], the authors define

the steganographic capacity Cstego(D1, D2) as the supremum of all achievable rates, i.e., the rate R

is achievable if |M| ≥ 2NR and suppY |X pe → 0 as N → 0. Thus, the steganographic capacity is
given by:

Cstego = lim max min I(U ; Y ) − I(U ; S), (7)
L→∞ pXU|S ∈Q(L,pS ,D1) pY |X ∈A(pX ,D2)

where :

– L is an arbitrarily large integer, defining an alphabet U = 1, 2, . . . , L for the auxiliary random

variable U in the stego-system with side information,

November 4, 2008 DRAFT

6

– PXU|S(x, u|s) is the steganographic channel subject to distortion D1 whose conditional marginal
PX|S belongs to

Q1stego(pS , D1) = {pX|S : pX|S(x|s)pS(s)d(s, x) ≤ D1,

s,x

pX (x) = pX|S(x|s)pS(s) = pS(x), ∀x ∈ S}, (8)

s

thus, Qstego(L, pS, D1) is the set of steganographic channels subject to distortion D1.

– We denote by:

A(pX , D2) = pY |X : pY |X (y|x)pX (x)d(x, y) ≤ D2 ,

x,y

the set of all such feasible discrete memoryless channel attacks.

In the other hand, the context of this work is the active warden context. All her attacks are modeled
by an AWGN attack, such as the noise strength is equal to D2 = σV2 , where σV2 is the additive noise
variance. thus, we fix the conditional p.d.f. PY |X and the maximization over all feasible discrete
memoryless channel in Eqn. (7) is not necessary. In addition, we suppose that the stego-signal meets

the constraint given by Eqn. (5). Therefore, the stego-capacity in our case becomes :

C = max {I(U ; Y ) − I(U ; S)}, (9)

pX,U |S

where U is an auxiliary variable. The schemes of interest in this work are based on Costa’s work,

and, as in [10], the capacity is given by:

Cstego = C = max I(Y ; M ), (10)

α

where α is the Costa’s parameter. This represents the maximum number of bits that can be hidden

in a given cover-work, when the embedding noise strength is smaller than constraint D1 and under
an AWGN attack, with power D2.
• Robustness (resistance). In [8], the authors define the robustness in the context of steganography

with active warden as “quantifying decoding reliability in presence of channel noise.”. Obviously,

the noise here is added by the active warden since the stego-channel is considered noiseless. thus, the

robustness in our context is an evaluation of the effectiveness of the warden attacks, since the goal of

Wendy by performing this blind attack is to enhance the error probability of the transmitted message

(even if it is not detected!) when Bob receives it. Thus, we evaluate this robustness (effectiveness

of the active warden blind attacks) by computing the BER given by the stego-system.

November 4, 2008 DRAFT

7

In the sequel, we provide an analysis of some informed stego-schemes. In addition, when the variable
parameter is the embedding strength, the ratio between the document and th1e embedding strength is
always in the interval [0, 40] dB. If the variable parameter is the active warden attack strength, thus the
ratio between the embedding noise strength and the warden attack power is in the interval [−20, 15] dB.
This interval is close to the real conditions and it permits a comparison with previous works on data
hiding robustness [10]. In this work, the study is performed for a stego-scheme based on Costa’s idea,
since they are known to be efficient in terms of capacity.

III. ANALYSIS OF THE SCALAR COSTA SCHEME (SCS)

The SCS [10] is a system based on scalar quantization of the cover-signal. This scheme follows from
Costa’s work on channel coding with side information [17]. Consider a binary message m to be embedded
and a cover-signal s. In the SCS stego-system, two codebooks are defined using two dithered uniform
scalar quantizers:

U0[i] = {n∆ + k[i], n ∈ Z} and

U1[i] = {n∆ + k[i] + ∆ , n ∈ Z }, (11)
2

where ∆ is a quantization step and k represents a secret key1. According to the bit m[i] to be embedded,

one of the two codebooks is selected (i.e. U0[i] if m[i] = 0, and U1[i] otherwise), where the nearest
codeword u [i] to s[i] is chosen. The stego-signal is given by the following expression:

x[i] = s[i] + α (u [i] − s[i]) ,

where α ∈]0, 1] is the optimization parameter of the Costa scheme. At the decoder, we choose the nearest
codeword in the union of the two codebooks (i.e. in the binary case U0[i] ∪ U1[i]) to the received sample
r[i]. In this work, we take the SCS as the reference stego-system, since all the systems concerned in this
work are based on this one. In addition, Eggers has shown in [10] that the SCS capacity and robustness
against the attacks are better than with the spread spectrum watermarking [18].

A. Probability Density Function of the stego-signal
In this section, for convenience u [i], m[i] and x[i] are denoted by u, m and x.

1Without the knowledge of this parameter, it is very hard to find the codebook, and thus to extract the hidden message.

November 4, 2008 DRAFT

8

0.16 0.16 0.16
PDFtheo SCS :!=0.3 PDFtheo SCS: !=0.5 PDFtheo SCS : !=0.7

0.14 PDFpract SCS :!=0.3 0.14 PDFpract SCS :!=0.5 0.14 PDFpract SCS : !=0.7
Original PDF Original PDF Original PDF

0.12 0.12 0.12

0.1 0.1 0.1

0.08 0.08 0.08

0.06 0.06 0.06

0.04 0.04 0.04

0.02 0.02 0.02

0 0 0
−25 −20 −15 −10 −5 0 5 10 15 20 25 −25 −20 −15 −10 −5 0 5 10 15 20 25 −25 −20 −15 −10 −5 0 5 10 15 20 25

(a) (b) (c)

Fig. 2. Probability density functions of the cover and stego-signal using the SCS stego-system for D1 = 1 with different value
of the parameter α: (a) α = 0.3, (b) α = 0.5 and (c) α = 0.7.

Theorem 1: For a cover-signal s, an embedding message m and a corresponding codeword u, the p.d.f.

of the stego-signal x obtained after an SCS embedding is given by the following formulation:

pX (x) = 1 1[ ]u− × pS x − αu , (12)
2(1 − α) (1−α)∆ ,u+ (1−α)∆ 1−α
2 2
u,m

where 1[.] represents a unit indicator function, α is Costa’s parameter and ∆ is the step of the scalar

quantizer used in the SCS stego-system.

Proof: See appendix II.

In this case, the distance between reconstruction points of the two quantizers is equal to ∆/2, and thus

any window function recovers the nearest ones if (1 − α)∆/2 > ∆/4 (which is equivalent to α < 1/2);

and for α > 1/2 the indicator functions are disjoint. This explains the aliasing and holes in the p.d.f. of

the cover-signal in Fig. 2(a) and 2(c).

For α = 1/2, there are no holes and no aliasing but we obtain a continuous p.d.f. only if pS(u/2) =
pS(u/2 + ∆/4). The last equality is satisfied if the p.d.f. is uniform. For a Gaussian p.d.f., many
discontinuities appear on the linking point, as shown in Fig. 2(b). The observed discontinuities increase

the detectability level, thus the SCS is not a good stego-system and it cannot be used in the context of

steganography. In what follows, we first study an improved scheme based on the SCS proposed in [11].

B. Improvement of the Scalar Costa Scheme: Guillon et al. scheme
Based on Anderson and Petitcolas’s work [19], Guillon et al. [11] proposed a practical scheme of

steganography. Fig. 3 summarizes the two parts of this scheme. In the initialization part, a private key

November 4, 2008 DRAFT

9

Randomizer
Temp. key k

Source s Initialization Permanent Stego-signal x

Message m
Symmetric stego-scheme

Fig. 3. Asymmetric steganography scheme: the permanent phase is initialized with a temporary private key k.

k is generated with a pseudo-random generator and is encrypted with an asymmetric cypher algorithm.
The key C(k, kpub) – where kpub is a public key known by all users – is embedded on the cover-signal.
The permanent phase uses the transmitted key k and the SCS to embed and transmit message m.

In the permanent phase, the undetectability of the SCS stego-system is mainly ensured by the private
key [11]. However, the initialization phase requires transmitting public information without distorting
the host signal. Guillon et al. proposed to use the SCS with α = 1/2 in order to hide an undetectable
message, but it is only valid for a cover-signal with a uniform p.d.f.; thus they proposed to use a
compressor, which operates on the marked signal histograms, before embedding in order to equalize
the p.d.f. of cover-content. The embedded message is thus statistically invisible as shown in Fig. 4(a).
Unfortunately, the resulting stego-system is less flexible, because the encoding and decoding steps highly
depend on the statistics of the cover-content and the receiver also requires precise knowledge of these
statistics and the receiver also requires precise knowledge of these statistics. In addition, as figured on
Fig. 4(b), the scheme is less resistant to the active warden attacks than the SCS, due to the compression
and decompression which increase the distortions.

It has been shown that the artifacts in the stego-signal are due to the use of a regular partitioning
codebook. In the next section, we propose to use a structured codebook based on TCQ.

IV. ANALYSIS OF THE TCQ-BASED SCHEME

The approach proposed here concerns the use of a trellis-based quantization, for a pseudo-random
partitioning of the codebooks, in order to avoid the artifacts introduced in the p.d.f. of stego-content by
regular partitioning (as observed in the previous stego-system).

November 4, 2008 DRAFT

10

0.1 Original signal 100
0.09 Guillon et al. Scheme
SCS
0.08 Guillon et al.

10−1

0.07

0.06 10−2

0.05 b.e.r.

0.04 10−3

0.03

0.02 10−4

0.01

0 10−5 10−4 10−3 10−2 10−1 100
−25 −20 −15 −10 −5 0 5 10 15 20 25

D2

(a) (b)

Fig. 4. (a) Probability density function of the cover-signal and the stego-signal for the Guillon et al. scheme. (b) BER induced
by the warden attack strength D2 in the case of SCS stego-system and the improved SCS of Guillon et al. scheme such as the
embedding strength D1 = 1.

A. Principles

Consider a trellis defined by a transition function: E × {0, 1} −→ E, tr : (e[i], m[i]) −→ e[i + 1], with
E = {0, 1, . . . , 2r−1} groups of possible states, where r is an integer such as r > 1, and i is the index
of the current transition. Contrary to the SCS, the dithering d is not random but becomes a function of
the current state and of the embedded symbol:

E × {0, 1} −→ [−∆/2, +∆/2], (13)
f : (e[i], m[i]) −→ d[i]. (14)

In this stego-system, the codebooks are defined by

Um[i] = {n∆ + f (e[i], m[i]), n ∈ Z} ,

and the closest codeword u ∈ Um to s[i] is chosen using the Viterbi algorithm [20] – with a high a

priori – in order to be sure that the obtained codeword belongs to Um:

G (15)

u = arg min (s[j] − u[j])2 .

u∈Um j=1

The stego-signal is given by:

x = s + α (u − s) . (16)

November 4, 2008 DRAFT

11

To extract the embedded message, we have to apply the Viterbi algorithm in order to retrieve the path
which corresponding to the stego-signal.

B. Performance analysis

Theorem 2: For a cover-signal s and some embedding noise e, of variance σE2 , the p.d.f. of the stego-

signal x is the mean of the p.d.f. of the host signal in the interval x − σE (3), x + σE (3) , i.e.

pX (x) = σE√1 12 √
x+σE 3
(17)
√ pS(z) dz.
Proof: See appendix III.
x−σE 3

We have implemented Eqn. (17) for a signal with a Gaussian p.d.f., and we obtain the results presented

on Fig. 5(a) to 5(c). We can notice the good match between the p.d.f. obtained with the TCQ algorithm

(experimental), the theoretical version and the original one for the same high embedding power. In

Fig. 6(a) and Fig. 6(b), 100 real images of size 350 × 350 pixels are used to validate the theoretic

model. From Eqn. (17), the p.d.f. of the stego-signal is not distorted -by the TCQ embedding of the

stego-message- because it is an averaging, over a very small interval, of the original signal p.d.f..

The figures show the relative entropy between the p.d.f. of the cover and the stego-signal. We note

that the TCQ stego-system allows a better undetectability than the SCS scheme. Thus, contrary to the

Guillon et al. scheme, using the TCQ permits to have a flexible system (since the system is independent

of the cover-signal). In addition, the embedded message resists to the different distortions while the

undetectability is preserved as shown by the compromise Robustness-undetectability given in Fig. 7(a).

On Fig. 7(b) and Fig. 7(d), we show that the capacity and resistance against an active warden of the

TCQ stego-system against an AWGN attack is not as good as the SCS especially in strong warden attacks

cases. So, even if the TCQ offers a good undetectability level, it is not the most efficient in the context

of active warden. In order to propose a stego-system with a good performance for a steganography with

active warden, this is now combined with the spread transform known for its robustness.

V. SPREAD TRANSFORM (ST)

It is well known that ST-based quantization scheme is an efficient way to improve the robustness facing
the AWGN attack [10]. This technique is briefly recalled below.

Chen and Wornel in [21] have introduced an efficient watermarking scheme which allows to spread
the message on several host signal samples. In this work, we use this technique in the specific context
of steganography with an active warden in order to enhance the resistance of the stego-system against
the warden attacks. The global process is depicted on Fig. 8.

November 4, 2008 DRAFT

12

0.1 0.1 0.1
PDFtheo TCQ: !=0.3 PDFtheo TCQ : !=0.5 PDFtheo TCQ : !=0.7

0.09 PDFpract TCQ : !=0.3 0.09 PDFexp TCQ : !=0.5 0.09 PDFpract TCQ : !=0.7
0.08 Original PDF 0.08 Origianl PDF 0.08 Original PDF
0.07 0.07
0.06 0.06 0.07
0.05 0.05
0.04 0.04 0.06
0.03 0.03
0.02 0.02 0.05
0.01 0.01
0.04
0 0
−25 −20 −15 −10 −5 0 5 10 15 20 25 −25 −20 −15 −10 −5 0 5 10 15 20 25 0.03

0.02

0.01

0
−25 −20 −15 −10 −5 0 5 10 15 20 25

(a) (b) (c)

Fig. 5. Probability density functions of the cover and the stego-signal for embedding strength D1 = 1 by using the TCQ
stego-system for different value of a parameter α: (a) α = 0.3, (b) α = 0.5 and (c) α = 0.7.

The transformation of the cover-signal s, denoted by sst = [s0st, . . . , ssMt −1], is given by

τ l+τ −1

sst[l] = s[i] × t[i], (18)

i=τ l

where τ ∈ N is the spreading factor. The above operation is in fact a projection along direction t,

where t is a normalized vector. Next, the inverse transformation is applied to the transformed stego-

signal : xst = sst + est, such as est is the embedding noise in the transformed domain and we have

x = s + est × t . (19)

e

Note that in Eqn. (19), est is a scalar generated by the encoder in the transformed domain. As we said

before the attack is modeled as an AWGN during the transmission across the channel and finally, the

decoder receives y = s+est ×t+v. Before decoding the message m, the received signal y is transformed,

which leads to yst = sst + est + vst.

The good robustness of watermarking systems (equivalently, the good resistance to the active warden

attacks) obtained by using ST is explained by the following formulation:

σE2 = E Est · T 2 =E 1 Est 2 = σE2 st ⇒ σE2 st = τ σE2 , (20)
τ τ

where the embedding noise in the transformed domain Est is zero-mean and E[.] denotes the expectation

value of a random variable. So, using ST allows to multiply the embedding strength by a factor τ before

extracting the message. On the other hand, the spread transform improves the fidelity of any hiding

November 4, 2008 DRAFT

13

102 102
101 SCS
100
10−1 TCQ
10−2
10−3 ST−SCS : !=2
10−4
10−5 ST−SCS : !=10
10−6
101 ST−TCQ : !=2
10−3 ST−TCQ : !=10

D(PS||PX) 100
D(PS||PX)

SCS 10−1
TCQ
10−2 10−1 100 ST−SCS :!=2 10−2
ST−SCS : !=10 101 102 103 104 105
ST−TCQ : !=2 D1
ST−TCQ : !=10

101 102

D1

(a) (b)

Fig. 6. (a) The 1-dimensional relative entropy between the p.d.f. of the cover (Gaussian signal) and the stego-signal with respect
to the embedding power strength D1, in the case of SCS, TCQ, ST-SCS and ST-TCQ stego-system. (b) The 1-dimensional relative
entropy between p.d.f. of the cover and the stego-real images (we use 100 different real images) of size 350 × 350 pixels.

system without any loss in the robustness, since the inverse spread transform divides by a factor τ the
embedding strength.

A. Analysis of ST-SCS

We first proceed to theoretical and experimental analysis for the ST-SCS stego-system [10] in order
to evaluate its undetectability.

Theorem 3: If s is the cover-signal, m the embedding message and u the corresponding codeword,
the probability density function of the ST-SCS with spreading factor τ and spreading direction t is given
by

pX (x) = τ δ u − Q∆ τ τ α (x + αy × t − αu × t) t + y
4(τ − α) u,m,t −
y

×pS τ τ α (x + αy × t − αu × t) pY (y) dy. (21)
−

where y is an auxiliary variable (defined in Eqn. (42)), α is Costa’s parameter and ∆ is the path of the

scalar quantizer used in the ST-SCS.

If we replace t with its two possible realizations, i.e. ±1/√τ , and we take τ → ∞ with finite σs2 (the
variance of cover-signal s), the stego-signal x has the same density as the cover-signal s, in this case the

November 4, 2008 DRAFT

14

(a) 100 100 (b)
10−1 10−1
10−2 b.e.r. 10−2 10−2
10−3 10−3
10−4 10−4 D2 SCS
10−5 10−5 TCQ
10−6 10−6 10−2 ST−SCS : !=2
102 ST−SCS : !=10
10−4 (d) ST−TCQ : !=2
ST−TCQ : !=10

10−4 10−2 100 10−3 10−1 100
10−4 100 10−3
D(PS||PX) 102 10−4 10−1 100
100 100
10−2

10−1 Capacity(Bits/Sample) 10−1

10−2 10−2

10−3 10−3

10−4 10−4

(c)

Fig. 7. Performance of the SCS, TCQ, ST-SCS and ST-TCQ stego-system: (a) BER as function of the warden attack strength
D2, (b) BER vs. relative entropy, (c) capacity as function of warden attack D2, (d) capacity vs. relative entropy.

November 4, 2008 DRAFT

15

s ST ST−1
m Encoder

Active warden

m Decoder ST

Fig. 8. Spread transform combined with an informed stego-system.

0.1 0.1 0.1
PDFtheo STSCS : PDFtheo STSCS: PDFtheo STSCS:

0.09 !=0.3 and "=2 0.09 !=0.5 and tau=2 0.09 !=0.7 and "=2
0.08 PDFexp STSCS : 0.08 PDFpract STSCS: 0.08 PDFpract STSCS:

!=0.3 and "=2 !=0.5 and tau=2 !=0.7 and "=2
0.07 Original 0.07 Original 0.07 Original
0.06 PDF 0.06 PDF 0.06 PDF

0.05 0.05 0.05

0.04 0.04 0.04

0.03 0.03 0.03

0.02 0.02 0.02

0.01 0.01 0.01

0 0 0
−25 −20 −15 −10 −5 0 5 10 15 20 25 −25 −20 −15 −10 −5 0 5 10 15 20 25 −25 −20 −15 −10 −5 0 5 10 15 20 25

(a) (b) (c)

0.1 0.1 0.1
PDFtheo STSCS : PDFtheo STSCS : PDFtheo STSCS :

0.09 !=0.3 and "=10 0.09 !=0.5 and "=10 0.09 !=0.7 and "=10
0.08 PDFpract STSCS : 0.08 PDFpract STSCS : 0.08 PDFpract STSCS :

!=0.3 and "=10 !=0.5 and "=10 !=0.7 and "=10
0.07 Original 0.07 Original 0.07 Original
0.06 PDF 0.06 PDF 0.06 PDF

0.05 0.05 0.05

0.04 0.04 0.04

0.03 0.03 0.03

0.02 0.02 0.02

0.01 0.01 0.01

0 0 0
−25 −20 −15 −10 −5 0 5 10 15 20 25 −25 −20 −15 −10 −5 0 5 10 15 20 25 −25 −20 −15 −10 −5 0 5 10 15 20 25

(d) (e) (f)

Fig. 9. Probability density functions of the cover and stego-signal by using the ST-SCS stego-scheme for τ = 2 with different
value of a parameter α: (a) α = 0.3, (b) α = 0.5 and (c) α = 0.7; and for τ = 10 with (d) α = 0.3, (e) α = 0.5 and (f)
α = 0.7.

November 4, 2008 DRAFT

16

two p.d.f. are both Gaussian. i.e.

pX (x) = 1 δ (u − Q∆ (y)) × pS(x)pY (y) dy.
2
y
u,m
Proof: See appendix IV.

In Fig. 9, the experimental p.d.f. of the stego-signal validates the theoretical model given by Eqn. (21),

so we can see that the theoretical p.d.f. follows the experimental one. The stego-signal preserves the

same probability law of the cover-signal – since both are gaussian – and the two p.d.f. are very close. It

is due to the spreading of the stego-message over several cover-samples, because we can write Eqn. (22)

:

PX (x) = 1 u+∆/2
2
PS (x) PY (y) dy,
u,m
u−∆/2

= PS (x) PY (y) dy = PS (x) PY (y) dy = PS (x) . (22)

yy

In the limit case, we can say that the ST-SCS preserve perfectly the p.d.f. of the stego-signal. In Fig. 9,

we show that the distortion induced by the ST-SCS embedding is limited even for a realistic case when the

spreading factor value is moderate. This is also confirmed by Fig. 10(a) and Fig. 10(b) where it appears

that the ST-SCS has the same level of the undetectability as the TCQ stego-system. However, Fig. 11(a)

shows that the differentiation of the relative entropy by respect to α is not always close to zero, even if

this differentiation is always negative and converges quickly to zero, thus the relative entropy does not

take – theoretically – its minimal value for all values of the parameter α (see Fig. 10(a)) and especially for

low values of the parameter α, which correspond to the case of a very strong active warden attack [10].

Moreover, if the spreading parameter t is public or the warden performs her attacks according to the

projection direction t, thus the resistance against the warden attacks of the ST-SCS will become the same

as the SCS. Thus, we should proceed to some improvement on the ST-SCS watermarking stego-system

by replacing the SCS with the TCQ scheme to have an undetectable system in the transformed domain

and thus remove all the effects of parameter α on the stego-system.

VI. SPREAD TRANSFORM TRELLIS-CODED QUANTIZATION

We combine the TCQ stego-system with ST in order to enhance the undetectability of the system, even
when the spreading parameter t is known, and to compensate the weaknesses of the TCQ stego-system
(a bad resistance against the active warden for an important attack power) by the ST. The resulted system
is called the ST-TCQ stego-system.

November 4, 2008 DRAFT

17

101 101
ST−SCS : "=1
SCS ST−SCS : "=0.5
TCQ ST−SCS : "=0.3
100 ST−SCS : "=2
ST−SCS : "=10 100
ST−TCQ : "=2
10−1 ST−TCQ : "=10 10−1
D(PS||PX)

D(PS||PX)
10−2 10−2

10−3 10−3

10−4 1 10−4 10 20 30 40 50 60
0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 0 !

!

(a) (b)

Fig. 10. The relative entropy with embedding strength D1 = 1 as function of (a) the parameter α with different value of τ
for the SCS, TCQ, ST-SCS, ST-TCQ stego-system; and (b) the spreading factor τ for different value of α with the ST-SCS
stego-system.

A. Performance analysis

Theorem 4: The probability density function of the stego-signal x is given by the following formula

P (x) = τ
2 (τ − α)

1/2 + m ∆ − Q∆ τ x + αyt − α + m ∆t t+y
2 τ −α 2
×δ l − γ l − γ

l,m,t 0 y

× Ps τ x + αyt − α l + m − γ ∆t PY (y) dγ dy, (23)
τ −α 2

in which:

• s is the cover-signal and y is the auxiliary variable (the exact expression of y is given in Eqn. (42)),
• α and ∆ are respectively Costa’s parameter and the path scalar quantizer Q∆(.); they are used in

the ST-SCS stego-signal with spreading factor τ ,
• m is the embedding message and t is the spreading direction.

Proof: See appendix V.
Fig. 12 shows that for a different values of the spreading factor τ and Costa’s parameter α, the
experimental model follows the theoretical one, which is very close to the p.d.f. of the cover-signal.
In addition, we note that the ST-TCQ embedding does not distort the p.d.f. of the stego-signal. It is
explained by following :

November 4, 2008 DRAFT

18

From appendix V, the p.d.f. of the stego-signal in the case of ST-TCQ can be expressed as

PX (x) = 4 · τ α) · 1 G δ ui − Q∆ τ τ α (x + αy · t − αui · t) · t + y
(τ − G i=1 −
ui,m,t

· PS τ τ α (x + αy · t − αui · t) PY (y) dy, (24)
−

when the spreading factor τ is large and if t takes two equiprobable values ± √1 , the last equation
τ

becomes 1 G
2G i=1
PX (x) = δ (ui − Q∆ (y)) · PS (x) PY (y) dy,

ui,m

thus,

PX (x) = 1G ui+∆/2
2G i=1 ui,m
PS (x) PY (y) dy,

ui−∆/2

= 1G PS (x) PY (y) dy,
G
y
i=1

= PS (x) PY (y) dy = PS (x) PY (y) dy = PS (x) , (25)

yy

therefore, the p.d.f. of the stego signal with ST-TCQ is exactly the same as the p.d.f. of the cover-signal

in the limit case (large τ ). In Fig. 12, we illustrate a realistic case with two moderate values of the

spreading factor. It is clear that we obtain a good matching between the p.d.f. of the stego-signal and that

of the cover-signal with moderate values of the spreading factor τ . Note that we demonstrate in appendix

VI that (under some constraints) the spread transform permits to a quantization based stego-systems to

preserve the original p.d.f.. As shown in Fig. 7 and for the same active warden attack, even if the TCQ

embedding permits a small gain in terms of capacity, it does not resist to the warden attack (there are

approximatively 2 × 105 bit errors for 106 transmitted bits) while the ST-TCQ, with a spreading factor

τ equals to 10, resists perfectly to this warden attack and makes only two bit errors for 106 transmitted

bits, in addition, the undetectability level is better for the ST-TCQ than the TCQ for this case. We note

from Fig. 7 that the global performance of the ST-TCQ is in the same level as the ST-SCS stego-system.

However, the gain given by the ST-TCQ scheme in terms of undetectability is not questionable, since the

undetectability in the transformed domain is as good as the TCQ stego-system (the ST-SCS stego-system

distorted the cover-signal in the transformed domain) and, contrary to the ST-SCS stego-system, it is not

worst for a low value of α (see Fig. 10 and Fig. 11). Moreover, the ST-TCQ stego-system still invisible

even in the transformed domain, since it has the same undetectability as the TCQ in the non-transformed

domain. Note that in Fig. 6(a) the ST-SCS is slightly better than the ST-TCQ in terms of undetectability.

November 4, 2008 DRAFT

19

0.02 ST−TCQ :"=1
0 ST−TCQ : "=0.5
ST−TCQ : "=0.3
−0.02

dD(PS||PX)/d!−0.04
D(PS||PX)
−0.06

−0.08

−0.1 10−3

ST−TCQ : "=2 0 10 20 30 40 50 60
!
ST−SCS : "=2

−0.12 1
0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

!

(a) (b)

Fig. 11. (a) The differentiation of the relative entropy D(PS||PX ) with respect to the parameter α, in the case of the ST-SCS
and ST-TCQ stego-system for τ = 2. (b) The relative entropy with embedding power : D1 = 1 as function of τ for different
values of α with the ST-TCQ stego-system.

It does not mean that the ST-SCS is less easily detectable than the ST-TCQ, since the difference in the
relative entropy is due to the specific experimental context (gaussian cover-signal with a steganographic
constraint).

In order to compare the effects of the embedding on the correlation between the images pixels, we
compute the relative entropy between the joint density function (2-dimensional relative entropy) of the
image pixels and their nearest pixels and we consider the same context as the 1-dimensional relative
entropy experiments. It is clear that , even if the simple p.d.f. pX (x) is not distorted by the embedded-
signal, the undetectability condition is not necessary meeting. In fact, the dependence between pixels can
be broken after embedding the stego-message. In this case, the joint p.d.f. will necessarily be distorted.
Thus, two dimensional relative entropy for the SCS, the TCQ, the ST-SCS and the ST-TCQ is presented
in Fig. 13. We note that for real images, the SCS affects the joint density function of the stego signal
even for low embedding distortion contrary to the other systems. For this experiment, it is important to
consider real images in order to see the effects of the embedding on the correlated pixels.

From Fig. 14, we remark that the fidelity of the stego-image with the SCS, the TCQ, the ST-SCS and
the ST-TCQ embedding are at the same level – since the PSNR is around 40 dB – when the embedding
strength is not important. On the other hand, Tab. I presents a comparison between the obtained relative
entropies and the BER when an image of size 320 × 240 is used as a cover-object, such as the ratio

November 4, 2008 DRAFT

20

Payload/image size (i.e. bits/pixel) SCS TCQ ST-SCS ST-TCQ
BER 1 1 0.1 0.1

D(PS||PX ) 0.2278 0.4194 0.0039 < 10−5
0.9910 0.0094 0.0093 0.0072

TABLE I

BIT ERROR RATE (BER) AND RELATIVE ENTROPY FOR SCS, TCQ, ST-SCS AND ST-TCQ SCHEMES WHEN THE MESSAGE

IS INSERTED IN A REAL IMAGE OF SIZE 320 × 240 (FIG. 14). THE RATIO BETWEEN THE EMBEDDING STRENGTH AND THE

WARDEN ATTACK IS EQUAL TO 2 DB AND THE RATIO BETWEEN THE COVER SIGNAL STRENGTH AND THE EMBEDDING

DISTORTION STRENGTH EQUAL TO 35 DB.

between the cover signal strength, the embedding distortion strength equal to 35 dB and the embedding
strength and the warden attack is equal to 0 dB.

VII. CONCLUSIONS

The major contributions can be summarized as follows:
• a complete analysis in the active warden context was performed for different stego-schemes based

on Costa’s work,
• thanks to the two dimensional relative entropy, the effects of four different embedding techniques

(SCS, TCQ, ST-SCS and ST-TCQ) on the correlation between pixels were studied,
• a new stego-scheme called ST-TCQ which results from the combination of the spread transform

with the trellis-coded quantization was proposed,
• an analytic expression for the probability density function of the stego-signal was developed in the

case of SCS, TCQ, ST-SCS and ST-TCQ embedding; we grouped them in four theorems.
In the context of steganography with an active warden, we have shown the limits and the advantages of
several informed-based stego-systems, in terms of undetectability, resistance against the warden attacks
and steganographic capacity. For each system, the experimental results have been used to validate the
theoretical models. For SCS, the stego-signal is regularly partitioned, thus, many artifacts in the p.d.f. of
the stego-signal were introduced. We proved this intuitive result theoretically. Due to these observation,
we have proposed an analysis of two other systems. The first one is based on pseudo-random partitioning
(the TCQ-based system), which allows obtain a more common and undetectable public stego-system (the

November 4, 2008 DRAFT

21

0.1 0.1 0.1
PDFtheo STTCQ : PDFtheo STTCQ : PDFtheo STTCQ :

0.09 !=2 and "=0.3 0.09 !=2 and "=0.5 0.09 !=2 and "=0.7
0.08 PDFexp STTCQ : 0.08 PDFexp STTCQ : 0.08 PDFexp STTCQ :

!=2 and "=0.3 !=2 and "=0.5 !=2 and "=0.7
0.07 Original PDF 0.07 Original PDF 0.07 Orginal PDF
0.06 0.06 0.06

0.05 0.05 0.05

0.04 0.04 0.04

0.03 0.03 0.03

0.02 0.02 0.02

0.01 0.01 0.01

0 0 0
−25 −20 −15 −10 −5 0 5 10 15 20 25 −25 −20 −15 −10 −5 0 5 10 15 20 25 −25 −20 −15 −10 −5 0 5 10 15 20 25

(a) (b) (c)

0.1 0.1 0.1
PDFtheo STTCQ : PDFtheo STTCQ : PDFtheo STTCQ :

0.09 !=10 and "=0.3 0.09 !=10 and "=0.5 0.09 !=10 and "=0.7
0.08 PDFexp STTCQ : 0.08 PDFexp STTCQ : 0.08 PDFexp STTCQ :

!=10 and "=0.3 !=10 and "=0.5 !=10 and "=0.7
0.07 Original PDF 0.07 Original PDF 0.07 Original PDF
0.06 0.06 0.06

0.05 0.05 0.05

0.04 0.04 0.04

0.03 0.03 0.03

0.02 0.02 0.02

0.01 0.01 0.01

0 0 0
−25 −20 −15 −10 −5 0 5 10 15 20 25 −25 −20 −15 −10 −5 0 5 10 15 20 25 −25 −20 −15 −10 −5 0 5 10 15 20 25

(d) (e) (f)

Fig. 12. Probability density functions of the cover and the stego-signal by using the ST-TCQ scheme for τ = 2 and embedding
power D1 = 1 with different value of α: (a) α = 0.3, (b) α = 0.5 and (c) α = 0.7; and for τ = 10 with (d) α = 0.3, (e)
α = 0.5 and (f) α = 0.7.

technique does not depend on the cover-signal distribution). The second one is based on the combination
of SCS with spread transform (the ST-SCS), providing a good undetectability and resistance facing the
warden attacks, resulting in a good capacity-undetectability-resistance compromise. Since the performance
of the ST-SCS are the same as the SCS in the transformed domain, we have proposed a new stego-system
resulting from the combination between the ST and TCQ. The ST-TCQ permits a good performance closed
to the ones of ST-SCS for higher security level. In the other hand, the proposed scheme has the same
advantages as the TCQ stego-system in the transformed domain.

ACKNOWLEDGMENT
The authors would like to thank Prof. Pierre Duhamel for his help and collaboration in this work.

November 4, 2008 DRAFT

22D(P ||P )

103SX
SCS
TCQ
ST−SCS : !=2
ST−SCS : !=10
ST−TCQ : !=2

102 ST−TCQ : !=10

101

100

10−1
101 102 103 104 105
D
1

Fig. 13. The 2-dimensional relative entropy with respect to the embedding power strength D1, in the case of the SCS, TCQ,
ST-SCS and ST-TCQ stego-system; we use 100 different real images of size 350 × 350 pixels.

(a) (b)

(c) (d)

Fig. 14. A stego-image (Grenoble) with size 320 × 240 pixels for: (a) SCS, (b) TCQ, (c) ST-SCS for τ = 10 and (c) ST-TCQ
for τ = 10, such as the ratio between the document and the embedding noise strength is equal to 35 dB.

November 4, 2008 DRAFT

23

APPENDIX I
THEORETICAL RELATIVE ENTROPY BETWEEN COVER AND STEGO-SIGNAL

The stego-signal is considered as the realization set of Gaussian random variables, independent and
non stationary: X = {X[1], . . . , X[N ]}. Consider the following formulation :

X[i] = S[i] + E[i], ∀i = 1, . . . , N, (26)

where S is the cover-signal modeled by a realization set of Gaussian random variables, independent and

non stationary: S = {S[1], . . . , S[N ]}. As S and X, the embedding noise E is modeled by the realization

set of Gaussian random variables, independent and non stationary: E = {E[1], . . . , E[N ]}.

The relative entropy between the p.d.f. of cover-signal and that of the stego-signal is given by:

D(PS||PX ) = pS(z) ln pS (z ) dz. (27)
pX (z)

If we consider that the cover-signal S ∼ N (0, σS2 ) and the stego-signal remains Gaussian with zero mean
and variance equal to σS2 + σE2 , where σE2 represents the variance of the embedding noise (we consider
the embedding noise independent of the cover-signal S), thus, the relative entropy between the p.d.f. of

the stego and that of the cover-signal is formulated as:

 √ e1 − −z2 
 2σS2 
+∞ 2πσS2
D(PS||PX ) = −∞ pS (z ) ln dz (28)
= − z2 (29)
√ e1 ) (30)
(2 σS2 +σE2 (31)
2π(σS2 +σE2 )
(32)
+∞ e− 1 −z2 z2 σS2 + σE2 dz
2 σS2
pS(z) ln σS2 σS2 +σE2

−∞

+∞ σS2 + σE2 dz − +∞ pS (z ) z2 σE2 /σS2 dz
σS2 −∞ 2 σS2 + σE2
= pS(z) ln

−∞

= ln σS2 + σE2 +∞ σE2 /σS2 +∞ pS (z) z2 dz.
σS2 σS2 + σE2 −∞ 2
pS(z)dz −

−∞

Because +∞ pS (z ) dz = 1 and σS2 = +∞ z 2 pS (z ) dz, thus
−∞ −∞

D(PS||PX ) = 1 ln σS2 + σE2 − 1 σE2 .
2 σS2 2 σS2 + σE2

November 4, 2008 DRAFT

24

APPENDIX II
DEMONSTRATION OF EQN. (12)

It is given by the following equation (in the sequel, we drop the index of the variable for ease of

presentation):

X = (1 − α)S + αU, (33)

where α represents Costa’s optimization parameter [17]. According to the product rule p(s, u|m) =

p(s|u, m) × p(u|m) = p(u|s, m) × p(s|m), and

p(s|u, m) = p(u|s, m)pS (s) ,
p(u|m)

we have: 

p(u|s, m) =  1 if s ∈ [u − ∆ , u + ∆ ]
0 otherwise 2 2

or

p(u|s, m) = δ(u − Q∆(s)), (34)

where δ represents the Kronecker symbol and Q∆(.) represents a scalar quantizer with a step ∆. On the
other hand,

p(s|m) = p(s|u, m)p(u|m) = δ(u − Q∆(s))pS(s). (35)
(36)
uu (37)

If we replace S= X −αU in the last equation, we obtain
1−α

p(x|m) = 1 1 α δ u − Q∆ x − αu × pS x − αu .
− 1−α 1−α
u

When the information bits are equiprobable, we write:

pX (x) = 1 α) δ u − Q∆ x − αu × pS x − αu .
2(1 − 1−α 1−α
u,m

APPENDIX III
DEMONSTRATION OF EQN. (17)

We denote by et[i] – for i = 1, . . . , G – the trellis states and we suppose that the states follow an
uniform distribution pEt(et) = 1/G. In the TCQ-based stego-systems, we substitute the host samples by
U(n,m,et), n ∈ Z, the codeword of sub-codebook which corresponds to the state et and message-bit m.
It is given by U(n,m,et[i]) = (n + m/2 − i/G)∆ for i = 1, . . . , G/2 and U(n,m, et[i]) = Un,m, et[i−G/2] for

November 4, 2008 DRAFT

25

i = G/2 + 1, . . . , G. Using the result of appendix II, the p.d.f. formulation of the TCQ stego-signal given

a fixed state et is:

p(x|et) = 1 1 − 1 , 1 (x − u(n,m,et))pS x − αu(n,m,et) ,
2 (1 − α) 2(1−α) 2(1−α) 1−α
n,m

and

G

pX (x) = pX (x|et[i])pE(et[i])

i=1

= 1 1 G/2 − 1 , 1 x − u(n,m,et[i]) × pS x − αu(n,m,et[i])
(1 − α) G 2(1−α) 2(1−α) 1−α
n,m 1

i=1

= 1 1 × 1 G/2 − 1 , 1 x− n + m − i × 1 ∆
(1 − α) 2 G/2 2(1−α) 2(1−α) 2 G/2 2
n,m 1

i=1

x−α n + m − i × 1 ∆
×pS  2 G/2 2 . (38)

1−α

If the number of states is large, thus:

pX (x) = lim 1 1 × 1 G/2 − 1 , 1 x− n + m − i × 1 ∆
(1 − α) 2 G/2 2(1−α) 2(1−α) 2 G/2 2
G→∞ n,m 1

i=1

x−α n + m − i × 1 ∆
×pS  2 G/2 2 . (39)

1−α

Using on the properties of the Riemann sum, we have:

1 1 m x−α n + m − γ ∆
− 2 2
pX (x) = 1 12 1 1 x − (n + − γ ∆) × pS 1−α dγ.
α − 2(1−α) , 2(1−α) (40)
n,m 0

If we replace m by its two possible values, i.e. 0 or 1, and make the following variable change Z =

X −αγ ∆ , we obtain:
1−α

pX (x) = 1 x+ α∆ pS (z ) dz = σE√1 12 √ (41)
α∆ 2 x+σE 3

x− α∆ √ pS(z) dz.
2
x−σE 3

APPENDIX IV
DEMONSTRATION OF EQN. (21)

The transformation of the original signal s is modeled as the realization set of Gaussian random
variables, independents and non stationary, i.e. Sst = {Sst[1], . . . , Sst[N/τ ]}. In addition, we take the
spreading direction t such as for i = {1, ..., N } : t[i] = ± √1τ and it is modeled by a set of Gaussian,

November 4, 2008 DRAFT

26

independents and non stationary random variables, i.e. T = {T [1], . . . , T [N ]}. thus, when the ST-SCS is
used to embed the message, the marked signal X is given by X = S + α(U − Sst) × T , if we consider:

τ l+τ −1

Slst = S[i] × T [i] = S[n] × T [n] + S[i] × T [i] = S[n] × T [n] + Yn[l], (42)

i=τ l i=n

Yn[l]

where Y is considered as a random variable modeled by a set Y = {Y1[1], . . . , YN [N/τ ]}, thus

X = S + α(U − S × T − Y ) × T . (43)

Since ∀i, t2[i] = 1/τ , the above equation becomes

X= 1 − α × S − αY × T + αU × T . (44)
τ

Now, we observe the p.d.f of the codeword U conditionally to S, Y , T and the message min

p(u|s, y, t, m) = δ (u − Q∆ (s × t + y)) . (45)

Therefore (u (s × t + y)) p(s|y, m)
p(u|y, t, m)
p(s|u, y, t, m) = δ − Q∆ t, . (46)

In this work, we consider S as a random variable independent of T and Y . Therefore p(s|y, t, m) = p(s)

and (u Q∆ (s × t + y)) (s)
p(u|y, t, m)
p(s|u, y, t, m) = δ − pS . (47)

Now, we make the following variable change:

S = τ τ × (X + αY ×T − αU × T ). (48)
−α

thus, we obtain

p(x|u, y, t, m) = τ δ u − Q∆ τ τ (x + αy × t − αu × t) ×t+y
τ −α −α

p(u|y, t, m)

×pS τ τ α (x + y − αu × t) , (49)
−

with a marginalization over U :

p(x|y, t, m) = p(u|y, t, m) × p(x|u, y, t, m)

u

= τ δ u − Q∆ τ τ α (x + αy × t − αu × t) × t + y
τ −α −
u

×pS τ τ α (x + αy × t − αu × t) . (50)
−

November 4, 2008 DRAFT

27

Since T is a random variable the realizations of which take two values ±1/√τ , and since m is also
considered as equiprobable, the marginalization over these two variables gives

p(x|y) = 4 (τ τ α) δ u − Q∆ τ τ α (x + αy × t − αu × t) × t + y
− −
u,m,t

×pS τ τ α (x + αy × t − αu × t) , (51)
−

thus

pX (x) = τ δ u − Q∆ τ τ α (x + αy × t − αu × t) × t + y
4 (τ − α) u,m,t −
y

×pS τ τ α (x + αy × t − αu × t) pY (y) dy. (52)
−

APPENDIX V
DEMONSTRATION OF EQN. (23)

Using the result of appendix IV, the p.d.f. of the watermarked signal with the ST-TCQ is given by :

P (x|et) = τ δ u − Q∆ τ τ α (x + αy · t − αu · t) · t + y
4 · (τ − α) u,m,t −

· PS τ τ α (x + αy · t − αu · t) PY (y) dy. (53)
− (54)

By marginalization over the trellis states Et, we obtain:

G

P (x) = PX (x|et[i])P (et[i])

i=1

τ 1 G τ
(τ − G −
= 4 · α) · δ ui − Q∆ τ α (x + αy · t − αui · t) · t + y

i=1 ui,m,t

· PS τ τ α (x + αy · t − αui · t) PY (y) dy,
−

therefore:

P (x) = τ
2 · (τ − α)

· 1 G/2 l + m − i ∆ − Q∆ τ x + αy · t − α l + m − i ∆·t ·t+y
G/2 δ 2 G τ −α 2 G
l,m,t
i=1

· PS τ x + αy · t − α l + m − i ∆·t · PY (y) dy. (55)
τ −α 2 G

November 4, 2008 DRAFT

28

If we consider γi = i · 1 , thus:
G/2 2

1 2 G/2 τ
2 G/2 (τ −
I = lim · 2 · α)

G→∞ i=1

·δ l + m − i · 1 ∆ − Q∆ τ x + αy · t − α l + m − i · 1 ∆·t ·t+y
2 G/2 2 τ −α 2 G/2 2
l,m,t y

· PS τ x + αy · t − α l + m − i · 1 ∆·t · PY (y) dy
τ −α 2 G/2 2

= lim 1 · 1 G/2 2 · τ α)
2 G/2 i=1 (τ −
G→∞

·δ l + m − γi ∆ − Q∆ τ x + αy · t − α l + m − γi ∆·t ·t+y
2 τ −α 2
l,m,t y

· PS τ x + αy · t − α l + m − γi ∆·t · PY (y) dy, (56)
τ −α 2

because the previous sum has the form of a Rieman sum.

In this case, we have:

PX (x) = τ
2 · (τ − α)

1/2 + m ∆ − Q∆ τ x + αy · t − α + m ∆·t ·t+y
2 τ −α 2
·δ l − γ l − γ

l,m,t 0 y

· PS τ x + αy · t − α l + m − γ ∆·t · PY (y) dγ dy. (57)
τ −α 2

Now, we replace m by its two possible values {0, 1}, therefore:

PX (x) = 2 · τ α) · 1/2 (l − γ) ∆ − Q∆ τ τ α (x + αy · t − α (l − γ) ∆ · t) · t + y
(τ − −
l,t δ

−1/2 y

· Ps τ τ α (x + αy · t − α (l − γ) ∆ · t) · PY (y) dγ dy. (58)
−

APPENDIX VI
THE UNDETECTABILITY ENHANCEMENT GIVEN BY THE SPREAD TRANSFORM

For quantization based systems using the ST with a spreading parameter t, the stego-signal x can be

formulated as following :

x = s + q · t, (59)

where s is the cover-signal and q is a quantization error. Note that we consider the scalar quantizer as
uniform and we place it in a high-resolution case. In other words, the quantization error q has a uniform

November 4, 2008 DRAFT

29

Fig. 15. The uniform density function tends to the dirac function when the spreading factor tends to the infinity.

p.d.f. and varies into the interval [− ∆ , ∆ ] (see [22]).
2 2

When the spreading parameter t takes two possible values ± √1 , the embedding signal q · t has also a
τ

uniform pdf but varies into the interval [− √∆ , √∆ ]. Thus, when the spreading factor τ is large comparing
2τ 2τ

to the quantizer path ∆, the uniform p.d.f. gτ of the embedded-signal becomes a dirac function δd (as

illustrated in Fig.15) defined as following : 

δd =  +∞ if e = 0 , (60)
 0 if e = 0

and (61)

∞

δd(e)de = 1.

−∞

Therefore, the p.d.f. of the stego-signal is given by :

PX (x) = (PS ∗ δd)(x) = PS(x), (62)

thus, the embedding does not induce any modification on the stego-signal p.d.f. thanks to the ST.
Note that this result is easily generalized with a non-uniform quantizer with limited cells size.

REFERENCES

[1] S. Braci, R. Boyer, and C. Delpha, “On the tradeoff between security and robustness of the trellis coded quantization
scheme,” IEEE International Conference on Accoustics, Speech and Signal Processing (ICASSP), Apr. 2008.

[2] S. Braci, C. Delpha, R. Boyer, and G. Le Guelvouit, “Informed stego-systems in active warden context : Statistical
undetectability and capacity,” IEEE Proc. MMSP, Oct. 2008.

[3] Herodotus, The histories, Penguin books, London, 1996.
[4] F. A. P. Petitcolas, R. J. Anderson, and M. G. Kuhn, “Information hiding: a survey,” Proc. of the IEEE, vol. 87, no. 7,

pp. 1062–1078, July 1999.

November 4, 2008 DRAFT

30

[5] I. J. Cox, M. L. Miller, J. A. Bloom, J. Fridrich, and T. Kalker, Digital watermarking and steganography, Morgan
Kaufmann, second edition, 2008.

[6] C. Cachin, “An information-theoretic model for steganography,” Lecture Notes in Computer Science, vol. 1525, pp.
306–318, 1998.

[7] R. Chandramouli, M. Kharrazzi, and N. Memon, “Image steganography and steganalysis: Concepts and practice,” 2004,
vol. 1525, Springer-Verlag.

[8] Y. Wang and P. Moulin, “Perfectly secure steganography: capacity, error exponents, and code constructions,” to appear in
IEEE Trans. Information Theory, special issue on Security, June 2008.

[9] G. J. Simmons, “The prisonners’ problem and the subliminal channel,” Advances in Cryptology: Proc. of CRYPTO, pp.
51–67, 1984.

[10] J. J. Eggers, R. Bauml, R. Tzchoppe, and B. Girod, “Scalar costa scheme for information embedding,” IEEE Trans. on
Signal Processing, Apr. 2003.

[11] P. Guillon, T. Furon, and P. Duhamel, “Applied public-key steganography,” in Proc. SPIE, San Jose, CA, 2002.
[12] G. Le Guelvouit, “Trellis-coded quantization for public-key steganography,” in accepted to IEEE Conf. on Acoustics,

Speech and Signal Proc., Mar. 2005.
[13] M.W. Marcellin and T.R. Fischer, “Trellis-coded quantization of memoryless and gauss-markov sources,” IEEE Trans. on

Com., vol. 38, pp. 83–93, Jan. 1990.
[14] D. Kundur and D. Hatzinakos, “A robust digital image watermarking method using wavelet-based fusion,” in Proc. on

Int. Conf. on Image Processing, Oct. 1997, vol. 1, pp. 544–547.
[15] N. Cvejic and T. Seppnen, “Improving audio watermarking scheme using psychoacoustic watermark filtering,” in Proc.

of the first IEEE International Symposium on Signal Processing and IT, Cairo, Egypt, 2001, pp. 163–168.
[16] T. Cover and J. Thomas, Elements of Information Theory, Wiley, 1991.
[17] M. H. M. Costa, “Writing on dirty paper,” IEEE Transactions on Information Theory, vol. 29, no. 3, pp. 439–441, May

1983.
[18] I.J. Cox, J. Kiliany, T. Leightonz, and T. Shamoony, “Secure spread spectrum watermarking for multimedia,” IEEE Trans.

on Image Processing, vol. 6, pp. 1673–1687, Dec. 1997.
[19] R. J. Anderson and F. A. P. Petitcolas, “On the limits of steganography,” IEEE Journal of Selected Areas in Communication,

vol. 16, no. 4, pp. 474–481, 1998.
[20] G. D. Forney Jr., “The viterbi algorithm,” Proc. IEEE, vol. 61, pp. 268–278, Mar. 1973.
[21] B. Chen and G. W. Wornell, “Quantization index modulation: a class of provably good methods for digital watermarking

and information embedding,” IEEE Trans. on Information Theory, vol. 47, pp. 1423–1443, May 2001.
[22] A. Gersho and R. M. Gray, Vector quantization and signal compression, Kluwer academic publishers, 1992.

November 4, 2008 DRAFT