Generating steganographic images via adversarial training
Adversarial training has proved to be competitive against supervised learning methods on computer vision tasks. However, studies have mainly been confined to generative tasks such as image synthesis. In this paper, we apply adversarial training techniques to the discriminative task of learning a steganographic algorithm. Steganography is a collection of techniques for concealing the existence of information by embedding it within a non-secret medium, such as cover texts or images. We show that adversarial training can produce robust steganographic techniques: our unsupervised training scheme produces a steganographic algorithm that competes with state-of-the-art steganographic techniques. We also show that supervised training of our adversarial model produces a robust steganalyzer, which performs the discriminative task of deciding if an image contains secret information. We define a game between three parties, Alice, Bob and Eve, in order to simultaneously train both a steganographic algorithm and a steganalyzer. Alice and Bob attempt to communicate a secret message contained within an image, while Eve eavesdrops on their conversation and attempts to determine if secret information is embedded within the image. We represent Alice, Bob and Eve by neural networks, and validate our scheme on two independent image datasets, showing our novel method of studying steganographic problems is surprisingly competitive against established steganographic techniques.
The authors studied how to use adversarial training to learn the encoder, the steganalyzer and the decoder at the same time using unsupervised learning. Specifically, the authors designed an adversarial game of three parties. The encoder generates images based on the cover and the message. Then the generated image can be received to both decoder and steganalyzer. The goal of the encoder and decoder is to correctly encode and decode the message, and the goal of the steganalyzer is to determine whether the image is encrypted. Thus it is a minimax game.
 
Despite the algorithmic part of the paper first, my major concern is the correctness of the methodology. As we all know, the neural networks have great ability to fit or classify the training data. You use two almost same neural network architectures as the decoder and steganalyzer. Then the question raises, as the decoder and steganalyzer use the same information in the training process. If the steganalyzer can correctly predict the label of the image, then the task fails. But if the steganalyzer cannot correctly predict the label, I don't think the decoder can recover the message well. I am confused about this and hope the author can answer the question in the rebuttal phase.
 
From the experiment we can see the loss of steganalyzer is super large according to figure 3 and 4, which means that the steganalyzer fails to classify almost all examples. However, the authors also shown that steganalyzer is "pretty well" if the steganographic algorithm is "fixed". I am also confused about such self-contradictory explanations. Do you mean that during training, your steganalyzer is not well learnt? And your encoder and decoder is learnt using a bad steganalyzer?
 
Here are also some minor comments:
1.	Line 151: the loss function L_E has no dependency on \theta_A given C'
2.	Line 152: parameter C should be included into loss function L_E 
3.       A large number of details are missed in the experiments. What are the values of hyperparameters? In the paper, the author claimed it is converged after 150 training steps. As the batch size is 32, you cannot even make a full pass to the training examples during training. How can you explain this?