Steganalysis: detecting the hidden message

Hiding a message is one thing; ensuring that no one can detect that it exists is another. The discipline that seeks to spot hidden messages is called steganalysis.

The goal of steganalysis

Steganalysis is the counterpart of cryptanalysis. Where cryptanalysis attempts to read an encrypted message, steganalysis seeks only to detect the presence of a hidden message — without necessarily reading it.

For the attacker, this is already decisive: if you prove that an image contains a concealed message, the very goal of steganography (invisibility) is ruined.

The Achilles' heel of naive LSB

The naive LSB method leaves statistical traces. In a natural image, the least significant bits are not perfectly random: they follow the local structure of the image (smooth areas, gradients). Inserting data modifies this distribution and makes it abnormally uniform or random.

Least significant bits of a (smooth) sky area:

  Natural image:     0 0 0 0 1 0 0 0 0 1 0 0   (mostly 0s)
  After embedding:   1 0 1 1 0 1 0 0 1 1 0 1   (half 0s, half 1s)
                     ^ distribution has become "too random"

A classic attack, pairs of values analysis, counts how many times neighbouring values (200/201, 202/203...) appear. LSB insertion tends to equalise these pairs, which betrays the presence of hidden data.

An endless race

Concealment and detection wage a permanent race:

CONCEALMENT		DETECTION
naive LSB	-->	simple statistical analysis
adaptive embedding	<--	pairs-of-values analysis
(noisy areas)	-->	machine learning
...	<--	...

To resist, modern methods are adaptive: they insert bits into the noisiest areas of the image (textures, edges, contours), where a small modification blends into the natural disorder and does not create a visible statistical anomaly.

On the other side, recent detectors rely on machine learning: trained on thousands of clean and tampered images, they spot signatures that no simple rule could formulate.

In summary

• Steganalysis seeks to detect the presence of a hidden message.
• Naive LSB leaves statistical traces (abnormal distribution of the least significant bits).
• Pairs of values analysis is a classic attack against LSB.
• It is a race: adaptive insertion (noisy areas) against statistical analysis and machine learning.