216

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 8, NO. 1, JANUARY 2013

Pixel Group Trace Model-Based Quantitative

Steganalysis for Multiple Least-Significant
Bits Steganography
Chunfang Yang, Fenlin Liu, Xiangyang Luo, and Ying Zeng
AbstractFor analyzing the multiple least-significant bits
(MLSB) steganography, a pixel group trace model is presented.
Based on this model and some statistical characteristics of images,
two quantitative steganalysis methods are proposed for two typical
MLSB steganography paradigms. The pixel group trace model
simulates the MLSB embedding by exclusive or operation, and
traces the transition relationship among the possible structures
of the pixel groups value by some trace pixel group subsets.
Then, the estimation equations of embedding ratio are derived
from the transition probability matrix among trace subsets and
the symmetry of regular and singular pixel group sets. Finally,
a series of experimental results for the case of triple pixel group
show that the proposed steganalysis methods can estimate the low
embedding ratio with smaller error, especially, for some cases, the
interquartile range of the estimation errors is smaller than the
best one of the others by more than 45%.
Index TermsSteganography, steganalysis, quantitative steganalysis, multiple least-significant bits (MLSB), pixel group,
embedding ratio.

I. INTRODUCTION

EPLACEMENT of bit planes are an important category

of steganography methods. Because of their simple implementation and excellent concealment to human sense system,
the steganography tools developed based on them have been
widespread and led to the significant value of the quantitative
steganalysis techniques for replacement steganography.
For LSB (least significant bit) replacement steganography,
many quantitative steganalysis methods have been designed,
such as regular and singular groups method [1], sample pair
analysis method [2], weighted stego-image method [3] and so
on [4], [5]. However, it cannot be expected that they can give
correct answer for the size of payload in the MLSB (multiple
Manuscript received February 23, 2012; revised November 05, 2012; accepted November 10, 2012. Date of publication November 27, 2012; date of
current version January 02, 2013. This work was supported by the National Natural Science Foundation of China (61272489, 60970141, 60902102, 61170032),
by the Innovation Scientists and Technicians Troop Construction Projects of
Zhengzhou City (10LJRC182), by the Doctoral Dissertation Innovation Fund of
Zhengzhou Information Science and Technology Institute (BSLWCX201002),
and by the Strategic Priority Research Program of Chinese Academy of Sciences
(XDA06030601). The associate editor coordinating the review of this manuscript and approving it for publication was Prof. Chiou-Ting Hsu.
C. Yang, F. Liu, and Y. Zeng are with Zhengzhou Information Science
and Technology Institute, Zhengzhou, Henan 450002, China (e-mail: chunfangyang@126.com; liufenlin@vip.sina.com; zengying510@yahoo.com.cn).
X. Luo is with Zhengzhou Information Science and Technology Institute,
Zhengzhou, Henan 450002, China, and also with State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of
Sciences, Beijing, 100093, China (e-mail: xiangyangluo@126.com).
Digital Object Identifier 10.1109/TIFS.2012.2229987

least significant bits) planes. In the past several years, the quantitative steganalysis for embedding in MLSB has attracted many
attentions, and some relevant quantitative steganalysis methods
have been proposed for the following two categories of typical
MLSB steganography (for description, is used to denote the
number of bit planes containing the embedded message.):
1) Randomly select samples and replace their LSBs with the
message fragments with size of . This category is called
as TMLSB steganography (T is the shortening of typ.
ical), such as T2LSB steganography for
2) Randomly select bits from the LSB planes and replace
them with the message bits. This category is called as
IMLSB steganography (I signifies the independence
of the effects on different bit planes), such as I2LSB
steganography for
.
Currently, the quantitative steganalysis methods for the above
two categories of typical MLSB steganography can be mainly
classified into two categories: 1) the weighted stego image steganalysis; and 2) the structural steganalysis.
The weighted stego image steganalysis was first proposed by
Fridrich et al. for LSB replacement [3]. In 2005, Yu et al. [6] extended it into the quantitative steganalysis for TMLSB steganography. Subsequently, Yu et al. [7] further improved the extended
result in [6]. The weighted stego image steganalysis is simple,
and outperforms the others for the high embedding ratio, especially for the embedding ratio closing to 1. However, the weighted
stego image steganalysis usually estimates the low embedding
ratio with larger error than the structural steganalysis.
The structural steganalysis was also first proposed for LSB replacement [1], [2]. In 2007, Ker and Luo et al. [8], [9] introduced
it into the quantitative steganalysis for 2LSB replacement. And
in 2008, the structural steganalysis method for LSB replacement
in [2] was extended to the quantitative steganalysis for TMLSB
and IMLSB steganography by Yang et al. [10]. The structural
steganalysis degrades rapidly when the embedding ratio is large,
especially close to 1. But the structural steganalysis usually estimates the low embedding ratio with less error.
Recently, Pevn et al. [11] proposed a general method for
constructing quantitative steganalyzers from features used in
blind steganalysis, and constructed the quantitative steganalyzer with SVR (Support Vector Regression) for steganography
in spatial domain which also works for MLSB steganography.
However, the constructed quantitative steganalyzer still offer
lower accuracy for bit plane replacement steganography.
Because the stego image with a low embedding ratio is usually detected more difficultly, the steganalysis of the stego image
with a low embedding ratio has been one of the important and

1556-6013/$31.00 2012 IEEE

YANG et al.: PIXEL GROUP TRACE MODEL-BASED QUANTITATIVE STEGANALYSIS FOR MLSB STEGANOGRAPHY

difficult issues of steganalysis. Although the structural steganalysis can estimate the low embedding ratio with less error than
others, the existing structural steganalysis methods for MLSB
steganography only utilize the correlation between two adjacent samples. For LSB replacement, the structural steganalysis
methods utilizing the correlation among more than two adjacent
pixels can usually estimate the low embedding ratio with higher
precision [4], [5], [12]. Intuitively, one should also be able to
improve the estimation accuracy for the low embedding ratio of
MLSB steganography by utilizing the correlation among more
adjacent pixels.
Therefore, this paper mainly discusses how to utilize the
correlation among more than two pixels to estimate the embedding ratio of image MLSB steganography. It is constructed
as follows. In Section II, the pixel group trace model is built.
And some statistical characteristics of images are described
in Section III. Then, the quantitative steganalysis methods for
TMLSB and IMLSB steganography are given in Section IV. In
Section V, the statistical characteristics of images are analyzed
by experiments, and the quantitative steganalysis methods are
improved. In Section VI, a series of experimental results are
given. The paper closes in Section VII with a conclusion. In
order not to obscure the main ideas, some necessary but lengthy
details of derivation are put in two Appendices.
II. PIXEL GROUP TRACE MODEL FOR ANALYZING MSLB
STEGANOGRAPHY
Throughout this paper, an image is represented by a succession of pixels
, where the
index denotes the location of a pixel in the image, denotes
the number of pixels in the image, and denotes the number
of bits used to store a pixel. Let
and
denote the high
bits and the least significant bits of the
value , respectively. A -tuple
is named as a pixel group composed of adjacent pixels
. After MLSB steganography, a pixels
LSBs are possibly replaced by secret messages, but its high
bits are impossibly altered. Thus, a trace set of pixel
groups is defined based on the difference between the high
bits of
and
as follows:
(1)
where
. The trace sets are closed under MLSB steganography. In order to trace the influence of MLSB steganography
to the structures of pixel groups values, each trace set
is
partitioned into
trace subsets based on the LSBs of the
pixels in the pixel groups as follows:
(2)
where
.
When embedding messages into an image by MLSB
steganography, if the bits in the embedding positions are different from the message bits, they should be modified, viz.
the bits 1 (and 0) should be flipped to be 0 (and 1); otherwise,

217

they should be kept the same. This kind of modification can

be simulated by the bitwise exclusive or operation between
the pixel and an integer in
. Therefore, for the pixel
group containing pixels, there should be
possible modification patterns denoted by
vectors
.
In order to simplify the expression,
and
are
used to denote the image, pixel group and trace subset after embedding by MLSB steganography, respectively. The following
Proposition 1 gives the transition relationship among all trace
subsets when embedding by MLSB steganography.
Proposition 1: If a pixel group
in the trace subset
is modified to be
by the modification pattern
, the modified pixel group
should belong
to
, where
denotes the bitwise exclusive or operation.
Proof: If a pixel group
belongs to
, the LSBs
of the pixel
should be
. From the definition
of modification pattern, after modifying the pixel group
by
the pattern , its -th pixel should be
(3)
is
. Because MLSB steganogwhere the LSB of
raphy does not affect the difference between the high
bits
of adjacent pixels, from the definition of the trace subset, after
embedding, the pixel group should belong to the trace subset
, viz.
.
Let
denote the vector composed of the cardinalities of all
trace subsets in the trace set
, where the cardinality of
is the -th
component, and
denote the
vector corresponding to
after MLSB steganography, where
the cardinality of
is the -th component. From Proposition 1, the pixel groups in
should be transferred to the
trace subset
by the modification pattern . Because the
probability that the pattern occurs is related to the embedding
ratio , the relationship among the cardinalities of the trace subsets can be described as follows:
(4)
denotes the transition probability matrix whose
where
element in the -th row and -th column, viz.
is the probability that the modification pattern occurs,
and
.
If
is invertible, the formula (4) can be written as
(5)
denotes the inverse of the matrix
.
where
Therefore, if one owns the inverse of the transition probability
matrix, viz.
, then the cardinalities of the trace subsets in the cover image can be represented by a function about
the embedding ratio and the known cardinalities of the trace
subsets in the stego image.
III. SOME STATISTICAL CHARACTERISTICS OF IMAGES
From the methodology of quantitative steganalysis in [13],
if there is a function which satisfies the following conditions:
1) the value of this function is a constant for the cover image;

218

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 8, NO. 1, JANUARY 2013

2) the values of this function differ for different embedding

ratio, it can be used as the distinguishing statistic to carry out
quantitative steganalysis. This section focuses on the distinguishing statistics satisfying the above two conditions.
First, the following noise level function of the pixel group
defined in [1] is introduced:
(6)

For natural images, applying the nonnegative mask and the

symmetrical nonpositive mask
to the pixel groups whose
noise levels are will increase the pixel groups noise levels
with the same probabilities, and also decrease the pixel groups
noise levels with the same probabilities. Therefore, the cardinalities of the regular pixel group sets
and
will be approximately equivalent, and the cardinality of the singular pixel
group sets
and
will also be approximately equivalent. Namely, when
,
(11)

The MLSB steganography can be viewed as adding the stego

noise, and can be simulated by the following flipping function:
(7)
where is an integer in
. Correspondingly, a symmetrical shifted flipping function is defined as follows:
(8)
which modifies the -th bit of towards the opposite direction
of exclusive or operation, viz. subtracts
from whose -th
bit is 0 and adds
to whose -th bit is 1, when the -th bit
of is 1. Then, adding the stego noise of MLSB steganography
and the symmetrical noise into a pixel group can be simulated
by applying the masks
and
to it as follows:

(9)

(12)
However, when applying the nonnegative mask to the pixel
group with noise level , if some pixels LSBs have been
flipped by MLSB steganography, they would be reflipped to the
natural versions. Because the pixel group noise in the natural
image is usually lower than it in the stego image, with the increase of the embedding ratio, the pixel group noise level will
increase with lower probability, and decrease with higher probability. When applying the nonpositive mask
to the pixel
group with noise level , if some pixels LSBs have been
flipped by MLSB steganography, they would be shifted to the
values farther from the natural versions, viz. the noise would
be enhanced. Then with the increase of the embedding ratio,
the pixel group noise level will increase with higher probability, and decrease with lower probability. Therefore, with the
increase of the embedding ratio of MLSB steganography, the
statistic
will decrease, and the statistic
will increase, viz. when
,
(13)

(10)
are the integers in
and not all
where
of them are 0.
For the pixel groups whose noise levels are , based on the
difference between the noise levels of them before and after
applying the nonnegative mask to them, they can be divided
into regular pixel group set
, singular pixel group set
and unchanged pixel group set
as follows:
1) If
, then
;
2) If
, then
;
3) If
, then
.
Similarly, they can also be divided into regular pixel group set
, singular pixel group set
and unchanged pixel
group set
with the nonpositive mask
.

(14)
where
(15)
(16)
In [1], Fridrich et al. have explained the reasons of (13) and
(14) for LSB steganography. In Section V, the rationality of
(11)(14) will be further explained by experiments.
For the pixel groups in the trace subset
, from the definition of the noise level function in (6) and Proposition 1, one can
obtain the following relationships among
and the noise
levels of the pixel groups before or after applying the masks
or
to them, viz (17), shown at the bottom of the page.

(17)

YANG et al.: PIXEL GROUP TRACE MODEL-BASED QUANTITATIVE STEGANALYSIS FOR MLSB STEGANOGRAPHY

Due to the same

and , the pixel groups in the trace subset
have the same noise levels. And after applying the same
mask , they will also have the same noise levels. Namely, after
applying the same mask, the noise levels of the pixel groups
in the same trace subset must all increase (belong to the same
regular pixel group set), all decrease (belong to the same singular pixel group set), or all unchanged (belong to the same
unchanged pixel group set). Thus, the regular, singular and unchanged group sets can be expressed as the unions of some trace
subsets as follows:

(18)

where

219

that a pixel does not contain messages is

, and the probability that the LSBs of the selected pixel becomes any one of
the possible message fragments
is
.
Because one of the possible message fragments must be the
same as the LSBs of the pixel, each pixel will keep the same
with the probability
. Thus, a pixel group
would be modified by the pattern with the probability
(22)
is used to judge whether equals to
where the function
0, when
, otherwise
.
From Proposition 1 and the probability in (22), Theorem 1
describes the change of the cardinality of each trace subset when
embedding by TMLSB steganography.
Theorem 1: When embedding random messages into the
LSB planes of an image by TMLSB steganography, the relationship among the cardinalities of trace subsets in the trace set
can be described as follows:
(23)

(19)
is used to judge whether applying the mask
will increase, decrease or maintain the noise levels of the pixel
groups in
which originally equal to . Applying the formulas (18) to (15) will yield the following function about the
cardinalities of the trace subsets:

(20)
where
.
Similarly, the function (16) can also be rewritten as follows:

where
denotes the -fold Kronecker
tensor product of the transition probability submatrix , and

..
.

..
.

..

..
.

(24)

Proof: From Proposition 1, it can be derived that for any

one pixel group in the subset
, if it comes
, it should have been modifrom the subset
fied by the pattern
.
From (22), when embedding random messages by TMLSB
steganography, the probability that the pattern occurs is
(25)

(21)
For cover images, the statistical characteristics (11) and (12)
denote that the values of (20) and (21) are approximately the
constant 0. For stego images, the statistical characteristics (13)
and (14) denote that with the increase of the embedding ratio,
(20) and (21) decreases and increases strictly, respectively.
Therefore, it is possible to apply the functions (20) and (21) to
the quantitative steganalysis for MLSB steganography.

where
(26)
and

is used to judge whether equals to , when

, otherwise
. Because TMLSB steganography does not modify the high
bits of each pixel, the
pixel groups in
must belong to the trace set
before embedding. Thus,

IV. QUANTITATIVE STEGANALYSIS FOR TWO CATEGORIES OF

TYPICAL MLSB STEGANOGRAPHY
In this section, the estimation equations of the embedding
ratio for TMLSB and IMLSB steganography will be derived
from the above model and statistical characteristics.
A. Quantitative Steganalysis for TMLSB Steganography
When TMLSB steganography is used to embed random messages into an image with the embedding ratio , the probability

(27)
The right item in (27) equals to the dot product between the
-th row vector of the matrix
and the
vector
. Thus, the formula (23) can be derived.
One can subtract the first row from the 2nd, 3rd, , and -th
rows in the submatrix , and add the obtained 2nd, 3rd, , and

220

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 8, NO. 1, JANUARY 2013

-th columns to the obtained first column. Then the transition

probability submatrix is transformed to

where

(34)
..
.

..
.

..

(28)

..
.

(35)
and
equivwhich owns an eigenvalue
alent eigenvalues
. It implies that
is only singular when
, viz.
. Thus, from the property of
the Kronecker tensor product, when
, the inverse of the
matrix
is

L
L

(36)

L
..
.

..
.

..

..
.

(29)

For TMLSB steganography, one can directly count the cardinality of each trace subset in the stego image, and estimate
the statistics (20) and (21) of the cover image, viz.
and
, by replacing the item
in (5) with
. Then, the following two estimation equations of
the embedding ratio can be derived based on the statistical characteristics of cover images given by (11) and (12):

(30)

(31)
where
denotes the
-th
row vector of the matrix
. Then (30) and (31) can
be translated into the following general equations respectively
(The details are given in Appendix A):

L
is a lattice in the -dimensional integer
space.
The estimation equations (32) and (33) are both polynomial
equations of degree which could lead to up to roots for the
embedding ratio . The Proposition 2 describes how to select the
appropriate real root as the estimated embedding ratio under
the condition that the statistical characteristics given by (11) and
(12) are exactly satisfied, viz. two sides of the formulas (11) and
(12) are exactly equivalent.
Proposition 2: For the cover image with the statistical characteristics given by (11) and (12), when embedding random
messages into its LSB planes with the embedding ratio
by TMLSB steganography, should be the smallest nonnegative real root of (32) and (33).
Proof: From Theorem 1 and the derivation of (32) and (33),
it can be seen that the embedding ratio
must be one of the
real roots of (32) and (33). Then this proposition is proven by
reduction to absurdity.
1) If the embedding ratio
is not the smallest nonnegative
real root of the estimation equations (32) and (33), then the
estimation equations (32) and (33) would have another real
root
, which should satisfy (32) and (33). From
(5) and (29), one can obtain
,
where
would satisfy the statistical characteristics of
cover images given by (11) and (12).
2) Because
, the following equation
can be obtained:
(37)
The item
as

in (37) can be reduced

(32)
..
.
(33)

..
.

..

..
.

(38)

YANG et al.: PIXEL GROUP TRACE MODEL-BASED QUANTITATIVE STEGANALYSIS FOR MLSB STEGANOGRAPHY

221

where

where
.
Because

and

, the root satisfies

. Thus, the formula (37) can be

(43)

(39)

is the Hamming distance between two numbers

and
and . Because IMLSB steganography does not modify the
high
bits of each pixel, the pixel groups in
must
belong to the trace set
before embedding. Thus,

rewritten as

is approximately equivalent
which demonstrates that
to the vector of the cardinalities of the trace subsets in the
stego image with the embedding ratio
.
From the statistical characteristics of stego images given
by (13) and (14), the embedding ratio
would cause
and
, viz.
would not satisfy
the statistical characteristics of cover images given by (11) and
(12). This is in conflict with the result in 1) which is derived
from the precondition that
is not the smallest nonnegative
real root of (32) and (33).
Therefore, the embedding ratio should be the smallest nonnegative real root of (32) and (33).

(44)
Because the right item in (44) equals to the dot product between
the
-th row vector of the matrix
and the
vector
, the formula (41) can be derived.
Because
is not singular except for
, when
owns the following inverse matrix:
(45)

B. Quantitative Steganalysis for IMLSB Steganography

When IMLSB steganography is used to embed random messages into an image with the embedding ratio , each bit in the
LSBs of a pixel would be modified with the probability
,
and kept the same with the probability
. Therefore,
a pixel group would be modified by the pattern with the probability
(40)
is the Hamming weight of .
where
From Proposition 1 and (40), Theorem 2 describes the
change of the cardinality of each trace subset when embedding
by IMLSB steganography.
Theorem 2: When embedding random messages into the
LSB planes of an image by IMLSB steganography, the relationship among the cardinalities of trace subsets in the trace set
can be described as follows:

For IMLSB steganography, one can also directly count the

cardinality of each trace subset in the stego image, and estimate
the statistics (20) and (21) of the cover image, viz.
and
, by replacing the item
in (5) with
. Then, the following estimation equations of the
embedding ratio can be derived based on the statistical characteristics of cover images given by (11) and (12):

(46)

(41)
where
(47)

Proof: From Proposition 1, it can be derived that for any

one pixel group in the subset
, if it comes
from the subset
, it should have been modified by the pattern
.
From (40), when embedding random messages by IMLSB
steganography, the probability that the pattern occurs is
(42)

They can also be further translated into the following general

equations respectively (The details are given in Appendix B):

(48)

(49)

222

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 8, NO. 1, JANUARY 2013

when the equations have no real root, the embedding ratio is

viewed as 1.

where

(50)

The estimation equations (48) and (49) are both polynomial

equations of degree which could lead to up to roots for the
embedding ratio . The following Proposition describes how to
select the appropriate real root as the estimated embedding ratio
under the condition that the statistical characteristics given by
(11) and (12) are exactly satisfied.
Proposition 3: For the cover image with the statistical characteristics given by (11) and (12), when embedding random
messages into its LSB planes with the embedding ratio
by IMLSB steganography, should be the smallest nonnegative real root of (48) and (49).
Proof: From Theorem 1 and the derivation of the estimation equations (48) and (49), it can be seen that the embedding
ratio must be one of the real roots of (48) and (49). Then this
proposition is proven by reduction to absurdity.
1) If the embedding ratio
is not the smallest nonnegative
real root of the estimation equations (48) and (49), the estimation equations (48) and (49) would have another real
root
which should satisfy (48) and (49). From
(5) and (45), one can obtain
,
where
would satisfy the statistical characteristics of
cover images given by (11) and (12).
2) Because
, the following equation
can be obtained:
(51)
Similar to the proof of Proposition 2, the formula (51) can
be rewritten as
(52)
is approximately equivalent
which demonstrates that
to the vector of the cardinalities of the trace subsets in the
stego image with the embedding ratio
.
Because
, the vector
would not satisfy the statistical characteristics of cover
images given by (11) and (12). This is in conflict with the
result in 1) which is derived from the precondition that
is not the smallest nonnegative real root of (48) and (49).
Therefore, the embedding ratio should be the smallest nonnegative real root of (48) and (49).
Actually, because of the complex contents of images, two
sides of the formulas (11) and (12) are usually just approximately equivalent. This would generate the estimation error. Because too large error will make the estimation meaninglessly, we
will discard implausible roots outside
and select the
root whose absolute value is least as the estimation of embedding ratio. Additionally, when the embedding ratio is close to
1, the coefficient matrixes of (23) and (41), viz.
and
, become ill-conditioned, then the estimation equations of embedding ratio are likely to have no real root. Thus,

V. ANALYSIS OF STATISTICAL CHARACTERISTICS AND

IMPROVEMENT OF QUANTITATIVE STEGANALYSIS
In [14], Ker pointed out that unless that the embedding ratio is
very large, the error of quantitative steganalysis consists mainly
of the between-image error which is entirely due to the statistical
characteristics of cover images. Additionally, if the statistical
characteristics of stego images given by (13) and (14) can not be
satisfied, then the functions
and
would also
not be able to discriminate different embedding ratios. Therefore, this section will analyze the statistical characteristics of
cover images and stego images given by (11)(14), then improve the quantitative steganalysis methods in Section IV based
on the analysis results.
When the masks are different, the regular, singular and unchanged pixel group sets would contain different trace subsets.
For example, when applying the masks (1, 2, 1) and (0, 1, 3)
to the pixel groups in the trace subset
, their noise
levels will be changed from 2 to 0 and 3. Namely, the subset
are contained by
and
respectively. Thus, the statistical characteristics of the cover and stego
images would be met with different degrees for different masks.
In our experiments, when the masks are (1, 2, 1) and (2, 5, 2),
the statistical characteristics of the cover images and the stego
images of T2LSB, I2LSB, T3LSB and I3LSB steganography
are met best. So we mainly focus on the discussion of statistical
characteristics under the masks (1, 2, 1) and (2, 5, 2).
A. Analyzing Statistical Characteristics of Cover Images
Actually, in an image, the numbers of pixel groups usually
significantly differ according to their noise levels; in different
images, the numbers of pixel groups with the same noise level
are usually significantly different. In regression, the standard
estimation error used to evaluate the fitness is affected by the
values of the dependent variable seriously. Thus, we divide the
statistics
and
with
,
divide
and
with
to
reduce the effects of the dependent variables difference, then
adopts the following regression models to analyze the statistical
characteristics of cover images given by (11) and (12) (with
IBM SPSS Statistics version 19.0.0.):
(53)
(54)
where is the regression coefficient which is the estimated ratio
of
to
(or
to
. The regression
coefficients and the standard estimation errors of the models
(53) and (54) are adopted to measure the consistency of
and
to the statistical characteristics
(11) and (12). The standard estimation error is the standard error
of the estimated values of the dependent variable by the obtained
model. When the regression coefficient is closer to 1 and the
standard estimation error is closer to
and
(or
and
) are more consistent with (11) (or (12)).

YANG et al.: PIXEL GROUP TRACE MODEL-BASED QUANTITATIVE STEGANALYSIS FOR MLSB STEGANOGRAPHY

223

B. Analyzing Statistical Characteristics of Stego Images

For TMLSB steganography, from Theorem 1 and the definitions of
and
in (20) and (21), both of them
can be denoted as the functions about the embedding ratio and
the cardinalities of the trace subsets in the cover image (The details are similar to Appendix A and omitted.)

(55)

Fig. 1. Regression results of the models (53) and (54) for different noise levels
: (a) and (c) the regression coefficients; (b) and (d) the stanand
dard estimation errors.

(56)
where
L

The regression models (53) and (54) are fitted to the data generated in the following experimental setup: 1) download 3000
images from http://photogallery.nrcs.usda.gov with originally
very high resolution in format tiff; 2) divide 3000 images
into three parts averagely, and convert these three parts of images to gray-scale bmp images with size of about 512 366,
768 549 and 1024 731, respectively (The tool used is Advanced Batch Converter 3.8.20 with the typical interpolation
filterbilinear.).
For the case of
and
, the mask
is set as (1,
2, 1) to regress the models (53) and (54). In Fig. 1, the solid
circles denote the regression results for the even noise levels,
and the hollow circles denote the regression results for the odd
noise levels. Fig. 1(a) and (c) show that the regression coefficients of the models (53) and (54) are all very close to 1. Especially, when the noise levels are less than 30, most of the regression coefficients are 1. Fig. 1(b) and (d) show that most of
the standard errors of the models (53) and (54) are less than
0.05. Especially, when the noise level is odd and larger than 5,
the standard error is significantly less than that of the neighbor
even noise level. Additionally, the confidences of the significant
tests for the models (53) and (54) are all 0.000 which is certainly
less than the typical confidence level 0.05. These demonstrate
that when
, the models (53) and (54) can be used
to well describe the relationship between
and
,
and the relationship between
and
, respectively.
For the case of
and
, the mask
is set as (2,
5, 2) to regress the models (53) and (54). One can obtain the
similar results to that of the case of
, though the models
with odd noise levels are not always fitted better than the models
with even noise levels. (For the reason of space, the detailed
experimental results are not shown.)
The consistency of the above regression results with (11) and
(12) nicely explains the rationality of the statistical characteristics given by (11) and (12).

L
.
The above formulas are related to the cardinalities of the trace
subsets in the cover images seriously. They are too complicated
to theoretically infer their monotony. Therefore, we count the
cardinalities of the trace subsets in the typical image lena.bmp
and above 3000 NRCS images, and apply them to (55) and (56)
to evaluate their monotony. Fig. 2(a) takes the typical image
lena.bmp as an example to show the relationship between the
embedding ratio and the values of
and
with
. It can be seen that with the increase of the embedding ratio,
and
would decrease and increase
strictly, respectively. This is consistent with the statistical characteristics given by (13) and (14). For the 3000 NRCS images,
whether
and
are consistent with the (13)
and (14) is judged based on the signs of the derivatives of (55)
and (56). Fig. 2(b) and (c) show that except that the noise level
is
and
decreases strictly and
increases strictly for most images when
and the embedding ratio is in [0, 1], though the ratio of strictly decreasing
and the ratio of strictly increasing
decrease
with the increase of the noise level. Additionally, for T3LSB
steganography, the similar results can also be obtained when
. These results demonstrate that most of the stego
images of TMLSB steganography satisfy the statistical characteristics given by (13) and (14).
For IMLSB steganography, From Theorem 2, both of
and
can be denoted as the following functions (The details are similar to Appendix B):

(57)

224

Fig. 2. When
and
images where

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 8, NO. 1, JANUARY 2013

and the embedding ratio of T2LSB steganography is in [0, 1], (a) the relationship between the embedding ratio and the values of
for the image lena.bmp; (b) the ratio of the number of images where
decreases strictly; and (c) the ratio of the number of
increases strictly.

(58)
For I2LSB and I3LSB steganography, the experimental results
in the typical image lena.bmp and the 3000 NRCS images are
still consistent with the statistical characteristics given by (13)
and (14), and not supplied for the reason of space.
C. Improving Quantitative Steganalysis of TMLSB and IMLSB
Steganography
From the source of between-image error, the obvious idea to reduce it is to select the proper noise level which minimizes the absolute value of
or
and satisfies the statistical
characteristics given by (13) and (14). However, different images
usually own different proper noise levels. If one selects a certain
noise level , especially if the selected certain noise level is large,
the number of the pixel groups utilized will be too few to respond
to the embedded messages enough sensitively. In order to make
the most of the pixel groups and eliminate the outlier cases of (11)
and (12) as possible as we can, we select multiple different noise
levels which not only cause
or
very small,
but also well satisfy the statistical characteristics given by (13)
or (14), then combine the corresponding formulas (11) and (12)
to obtain the following statistical characteristic:

(59)
(and
) is the set of noise levels which not only cause
(and
) very small, but also well satisfy the
statistical characteristic given by (13) (and (14)).
Based on the statistical characteristic given by (59), the
following improved estimation equations can be obtained for
TMLSB and IMLSB steganography, respectively:

where

(60)

(61)
It can be seen that the accuracies of the improved estimation
equations (60) and (61) are seriously interrelated by the selected
noise level sets
and
. Ideally, one can apply various possible noise level sets to the (60) and (61), then select the proper
noise level sets
and
. Obviously, this would make the
selection of the proper
and
too complicated to be feasible. Therefore, the noise level sets
and
will be recommended by the following steps:
1) Select the initial noise level sets
and
based on the
regression coefficients. In our experiments, the noise levels
with which the models (53) (and (54)) own the regression
coefficients in [0.999, 1.001] are put into
(and
).
2) Eliminate the noise levels which do not satisfy the statistical characteristic (13) (and (14)) from
(and
). In
experiments, if the ratio of strictly decreasing
(and
strictly increasing
) is less than 95%, the corre(and
).
sponding value of would be eliminated from
3) Reorder the residual elements in
and
based on the
standard estimation errors of the regression models;
4) Select the first
noise levels obtained
by 3). If the selected noise levels belong to
before reordering, add them to the possible proper set
; oth. For
erwise, add them to the possible proper set
and
to (60) or
each value of num, apply
(61) to estimate the embedding ratios. When the interquartile range of the estimation errors is minimum, the corresponding noise level sets
and
are selected
as the recommended noise level sets
and
.
Following above steps, the following recommended noise
level sets are obtained from the NRCS image set in Section V.A
for T2LSB, I2LSB, T3LSB and I3LSB steganography:

YANG et al.: PIXEL GROUP TRACE MODEL-BASED QUANTITATIVE STEGANALYSIS FOR MLSB STEGANOGRAPHY

225

Fig. 3. Performance comparison for T2LSB steganography: (a), (b), and (c) estimation errors in NRCS images; (d), (e), and (f) estimation errors in BOSS images.

VI. EXPERIMENTAL RESULTS AND ANALYSIS

In this section, the quantitative steganalysis methods described above are compared with the methods in [7], [8], [10],
[11] on the NRCS image set introduced in Section V.A and
the BOSS (v1.0) image set [15] which contains 10000 spatial
cover images. Because the quantitative steganalysis method
in [11] needs the training images embedded with a range of
known embedding ratios, we randomly select 1500 images
from the NRCS image set and 5000 images from the BOSS
image set, then embed random messages into each of them
with a random embedding ratio between 0 and 1. The obtained
stego images compose of the training set. The residual 1500
NRCS images and 5000 BOSS images compose of the test
cover NRCS image group and cover BOSS image group,
respectively. 168 groups of test stego images are generated
from these two groups of test cover images by T2LSB, I2LSB,
T3LSB and I3LSB steganography with the embedding ratios
. The final test
images total up to 1,105,000 images.
The case of
is taken as an example to evaluate
the proposed methods called as T2Triple, I2Triple, T3Triple
and I3Triple methods for T2LSB, I2LSB, T3LSB and I3LSB
steganography respectively, where Triple denotes that the
methods are derived based on triple. The median, interquartile
range (IQR) and absolute mean of the estimation errors are
adopted to measure the accuracies of the quantitative steganalysis methods. The receiver operating characteristics (ROC)
curve is also used to evaluate their reliabilities. In the following
figures, the scales of the embedding ratio, IQR and absolute
mean of estimation errors are logarithm.

Fig. 4. ROC curves for the embedding ratio 0.02 in (a) NRCS images and
(b) BOSS images.

Firstly, for T2LSB steganography, Fig. 3(a), (b), (d) and (e)
show that when the embedding ratios is smaller than 0.6, the
estimation error IQR of the T2Triple method is significantly
smaller than that of the T2SPA [10], 2Couples [8], 2-WS [7]
and SVR [11] methods (Fig. 3(b) and (e)), and the estimation
error median of the T2Triple method is approximately equivalent to that of the T2SPA method which is the best one among
the T2SPA, 2Couples, 2-WS and SVR methods (Fig. 3(a) and
(d)). Especially, when the embedding ratio is not larger than 0.3,
the estimation error IQR of the T2Triple method is smaller than
that of the T2SPA method by about 29% (0.004) for the NRCS
images (Fig. 3(b)), and by about 45% (0.007) for the BOSS images (Fig. 3(e)). The small biases and less IQRs make the mean
absolute errors of the T2Triple method also significantly smaller
than that of others (Fig. 3(c) and (f)). Moreover, the ROC curves
for the embedding ratio 0.02 show that the T2Triple method
can distinguish the stego images with low embedding ratio of
T2LSB steganography more reliably than others (Fig. 4).

226

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 8, NO. 1, JANUARY 2013

Fig. 5. Performance comparison for I2LSB steganography in NRCS images

[(a), (c), and (e)] and BOSS images [(b), (d), and (f)]: the scales of the y-axis
.
should be multiplied by

Fig. 6. Performance comparison for T3LSB steganography [(a), (c), and (e)]
and I3LSB steganography [(b), (d), and (f)] in BOSS images: the scales of the
.
y-axis should be multiplied by

For I2LSB, T3LSB and I3LSB steganography, Figs. 5 and 6

show that the proposed I2Triple, T3Triple and I3Triple methods
also outperform the others for low embedding ratios. Additionally, it can be found that although the recommended noise level
sets are obtained from the NRCS images, for the BOSS images,
they still generate good performance, and even better performance than that for the NRCS images. Although the latest SVR
method is more general, it can not estimate the embedding ratio
with higher accuracy than others for MLSB steganography. This
should be ascribed to the fact that the utilized SPAM (Subtractive Pixel Adjacency Matrix) features do not exploit the asymmetric modifications to the bits which differ from the message
bits.
The superiorities of the proposed methods are mainly owed
to the correlation among more adjacent pixels. However, the
coefficient matrixes of the (23) and (41), viz.
and
, are ill-conditioned for the embedding ratio close to
1. Thus, the proposed methods degrade rapidly when the embedding ratio is large. Especially, when
, because the condition number of
is larger than that of
,
the I2Triple and I3Triple methods degrade more rapidly than
the T2Triple and T3Triple methods.

characteristics of cover images and stego images were given;

3) the estimation equations of embedding ratio were derived
for TMLSB and IMLSB steganography; 4) a series of experiments were carried out to verify that the proposed quantitative
steganalysis methods outperform the others.
However, there are still some issues not addressed, which
are postponed to future work. For example, 1) how to apply
the pixel group trace model to the quantitative steganalysis for
other MLSB steganography paradigms, such as embedding in
MLSB planes with different embedding ratios [16], [17] and
some adaptive MLSB steganography [18], 2) what is the number
of the pixels in the pixel group with which the quantitative steganalysis methods can reach highest accuracy?

APPENDIX A
DERIVATION OF ESTIMATION EQUATIONS (32) AND (33)
Expand the first summation item in (30) by the components
of the vectors
and as follows:

VII. CONCLUSION
Since more than two adjacent pixels still own strong correlation, the quantitative steganalysis for MLSB steganography
was discussed based on a pixel group trace model presented in
this paper. And the following results have been obtained: 1) a
pixel group trace model was built, which considers the relationship among more than two adjacent pixels; 2) some statistical

(62)

YANG et al.: PIXEL GROUP TRACE MODEL-BASED QUANTITATIVE STEGANALYSIS FOR MLSB STEGANOGRAPHY

After taking the common factor

outside the second
summation sign, the first summation item in (30) can be translated into the following formula from (29) and the definition of
item
in (36):

227

outside the second

After taking the common factor
summation sign, the first summation item in (46) can be translated into the following formula from (45) and the definition of
item
in (36):

L
(71)

(63)
where L
. Because
can further be translated into

, (63)

L
Because

, (71) can be translated into

(64)
Similarly, the residual three summation items in (30) and (31)
can also be reduced. Then, the estimation equations (30) and
(31) would be translated into

(72)
Similarly, the residual three summation items in (46) and (47)
can also be reduced. Then the estimation equations (46) and (47)
would be translated into

(65)
(73)
(66)
From the binomial theorem, it can be obtained that
(67)
Applying (35) and (67) to (65) and (66) yields

(74)
From the binomial theorem, it can be obtained that

(68)
(69)

(75)
Applying (50) and (75) to (73) and (74) yields

Let
and apply it to (68) and (69). Then, the
general estimation equations (32) and (33) can be obtained.

(76)
(77)

APPENDIX B
DERIVATION OF ESTIMATION EQUATIONS (48) AND (49)
Expand the first summation item in (46) by the components
and as follows:
of the vectors

(70)

Let
and apply it to (76) and (77). Then, the general
estimation equations (48) and (49) can be obtained.
REFERENCES
[1] J. Fridrich, M. Goljan, and R. Du, Detecting LSB steganography in
color and gray-scale images, IEEE Multimedia, Special Issue on Security, vol. 8, no. 4, pp. 2228, Oct./Dec. 2001.
[2] S. Dumitrescu, X. Wu, and Z. Wang, Detection of LSB steganography
via sample pair analysis, IEEE Trans. Signal Process., vol. 51, no. 7,
pp. 19952007, Jul. 2003.
[3] J. Fridrich and M. Goljan, On estimation of secret message length
in LSB steganography in spatial domain, in Proc. SPIE, Security,
Steganography, and Watermarking of Multimedia Contents VI, E. J.
Delp, III and P. W. Wong, Eds., San Jose, CA, 2004, vol. 5306, pp.
2334.

228

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 8, NO. 1, JANUARY 2013

[4] A. Ker, A general framework for the structural steganalysis of LSB

replacement, in Proc. 7th Information Hiding Workshop, LNCS, B.
Mauro, H. J. Jordi, K. Stefan, and P. G. Fernando, Eds., Barcelona,
Spain, 2005, vol. 3727, pp. 296311.
[5] S. Dumitrescu and X. Wu, A new framework of LSB steganalysis
of digital media, IEEE Trans. Signal Process., vol. 53, no. 10, pp.
39363947, Oct. 2005.
[6] X. Yu, T. Tan, and Y. Wang, Extended optimization method of LSB
steganalysis, in Proc. IEEE Int. Conf. Image Processing, Genoa, Italy,
2005, vol. 2, pp. 11021105.
[7] X. Yu and N. Babaguchi, Weighted stego-image based steganalysis in
multiple least significant bits, in Proc. IEEE Int. Conf. Multimedia &
Expo, Hannover, Germany, 2008, pp. 265268.
[8] A. Ker, Steganalysis of embedding in two least-significant bits, IEEE
Trans. Inf. Forensics Security, vol. 2, no. 1, pp. 4654, Mar. 2007.
[9] X. Luo, C. Yang, D. Wang, and F. Liu, LTSB steganalysis based on
quartic equation, LNCS Trans. Data Hiding Multimedia Security II,
vol. 4499, pp. 6890, 2007.
[10] C. Yang, F. Liu, X. Luo, and B. Liu, Steganalysis frameworks of embedding in multiple least-significant bits, IEEE Trans. Inf. Forensics
Security, vol. 3, no. 4, pp. 662672, Dec. 2008.
[11] T. Pevn, J. Fridrich, and A. Ker, From blind to quantitative steganalysis, IEEE Trans. Inf. Forensics Security, vol. 7, no. 2, pp. 445454,
Apr. 2012.
[12] A. Ker, Fourth-order structural steganalysis and analysis of cover
assumptions, in Proc. SPIE, Security, Steganography, and Watermarking of Multimedia Contents VIII, E. J. Delp, III and P. W. Wong,
Eds., San Jose, CA, 2006, vol. 6072, pp. 2538.
[13] J. Fridrich, M. Goljan, D. Hogea, and D. Soukal, Quantitative steganalysis of digital images: Estimating the secret message length,
ACM Multimedia Syst. J., Special Issue on Multimedia Security, vol.
9, no. 3, pp. 288302, 2003.
[14] A. Ker, Derivation of error distribution in least squares steganalysis,
IEEE Trans. Inf. Forensics Security, vol. 2, no. 2, pp. 140148, Jun.
2007.
[15] P. Bas, T. Filler, and T. Pevn, Break our steganpgraphic
systemThe ins and outs of organizing BOSS, in Proc. 13th
Information Hiding Conf. (LNCS), T. Filler, Ed. et al., Prague, Czech
Republic, 2011, vol. 6958, pp. 5970.
[16] C. Yang, X. Luo, and F. Liu, Embedding ratio estimating for each bit
plane of image, in Proc. 11th Information Hiding Workshop (LNCS),
K. Stefan and S. Ahmad-Reza, Eds., Darmstadt, Germany, 2009, vol.
5806, pp. 5972.
[17] C. Yang, F. Liu, and S. Lian, Weighted stego image steganalysis of
message hidden into each bit plane, Comput. J., vol. 55, no. 6, pp.
717727, 2012.
[18] X. Luo, F. Liu, C. Yang, and S. Lian, Modification ratio estimation
for a category of adaptive steganography, Sci. China: Inf. Sci., vol.
53, no. 12, pp. 24722484, 2010.

Chunfang Yang was born in 1983. He received the

B.S., M.S., and Ph.D. degrees from the Zhengzhou
Information Science and Technology Institute in
2005, 2008, and 2012, respectively.
Currently, he is a lecturer with Zhengzhou Information Science and Technology Institute. His current
research interests include image steganography and
steganalysis technique.

Fenlin Liu was born in 1964. He received the B.S.

degree from Zhengzhou Information Science and
Technology Institute in 1986, the M.S. degree from
Harbin Institute of Technology in 1992, and the
Ph.D. degree from the Northeast University in 1998.
Currently, he is a Professor of Zhengzhou Information Science and Technology Institute. His
research interests include information hiding and
security theory.

Xiangyang Luo was born in 1978. He received the

B.S., M.S., and Ph.D. degrees from Zhengzhou Information Science and Technology Institute in 2001,
2004, and 2010, respectively.
He has been with Zhengzhou Information Science
and Technology Institute since 2004. From 2006 to
2007, he was a Visiting Scholar with the Department
of Computer Science and Technology, Tsinghua
University. From 2011, he is a Postdoctoral with
Institute of China Electronic System Equipment
Engineering Co., Ltd. His research interests include
image steganography and steganalysis.

Ying Zeng was born in 1983. She received the

B.S., M.S., and Ph.D. degrees from the Zhengzhou
Information Science and Technology Institute in
2004, 2007, and 2011, respectively.
Currently, she is a lecturer with Zhengzhou Information Science and Technology Institute. Her current
research interest includes pattern recognition and information security technique.