S1 Settings

We make use of three datasets, namely CIFAR-10, BOSS1.0.1, and ImageNet for the evaluation. CIFAR-10 and ImageNet are

widely used for various vision-related tasks and BOSS1.0.1 is the dataset commonly covered by the stenography fields. For the

overall experiments, for CIFAR-10, we utilize its training dataset for training and the testing dataset for testing. In the case of

BOSS1.0.1, it contains 10,000 images in total. We split the dataset into two: 9,000 for training and 1,000 for testing. In the case

of ImageNet, for all experiments including PixelCNN++ training, we utilize its training dataset for training and its validation

dataset for testing. We use 32 × 32 × 3 for CIFAR-10, 128 × 128 × 1 for Boss-1.0.1 dataset, and 64 × 64 × 3 for ImageNet. For

experimental settings, we spend approximately 1 week to train a PixelCNN++ model for each dataset using four NVIDIA P100

GPUs. For training Deep Steganography and ISGAN, we need less than 3h for each case on one NVIDIA GTX 1080 GPU. In

we evaluate its effect on the decoded secret image by measuring the residual between the secret image decoded by unmodified

stego image and randomly modified stego image, respectively. An increase by 1 in any position in any color channel of the

stego image has an impact across all color channels in the decoded secret image. We see that the largest impact commonly

occurs on the same channel.

We also witness that the secret image is encoded in a distributive but location-limited way. In other words, the pixel in-

formation of the left top corner of the secret image is only encoded on the left top corner of the cover image and likewise

for other areas. Based on this finding, we confirm that active steganalysis algorithms adjusting the stego image generated by

the deep learning-based encoding algorithms should apply the alternation of all the pixels of the stego image for the definitive

steganography removal.

Figure S1: Impact of increasing a pixel value of the stego image by 1 on the decoded secret image. The left side of the figure is the residual

on each RGB channel between the stego image and modified stego image. The right side of the figure is the residual on each RGB channel

between the secret images decoded by the stego image and modified stego image, respectively.

S3 Destruction Rate

Table S1: The average of decoded rate (DC) and destruction rate (DT) of Deep Steganography on each dataset.

Table S2: The average of decoded rate (DC) and destruction rate (DT) of ISGAN on each dataset.

Table S3: The average of decoded rate (DC) and destruction rate (DT) of LSB on each dataset.

S4 Experimental Results on Original Images

Figure S2: The degree of degradation on the original images after four active steganalysis methods. We can see that the quality of the modified

images after our method is always better than the other three methods: Gaussian noise, Denoising, and Restoration. In case of restoration, the

S18.

S5 Experimental Results on ImageNet

Figure S3: The comparison of our method with the three comparing methods when using the ImageNet dataset. The overall trends of the

8. It can be interpreted that our attempt to move the distribution of the stego image towards the distribution of the original cover image quite

S6 Experimental Results on BOSS1.0.1

Figure S5: The comparison of our extracted edge distribution with a famous edge detector, Prewitt. Prewitt = an edge distribution of a stego

image from the well-known edge detector, Prewitt. PS = an edge distribution of a stego image from our trained deep neural network. Each

pair of images is alike. The good results using the extracted edge distribution show that the edge distribution is well-used for the original

purpose.

S8 Residual between a Cover Image and a Stego Image

Fig. S6 shows the location where the secret image is more encoded. The residual between the cover image and stego image is

much larger on the edge areas while the residual values are comparably small on the non-edge (low frequency) areas.

S9 Denoising and Restoration

=

S10 Ablation Study Examples

We provide a perceptual sample out of the edge condition examples of the ablation study in Table S4 in Fig. S9.

Table S4: Ablation results of our proposed methods. DC = decoded rate, and DT = destruction rate. In the case of PSNR, SSIM and DA, the

larger the value, the better. DC is the opposite.

= decoded secret image,

=

S11 Comparison at the Same Decoded Rate

We provide a random sample of the examples of how our method and the conventional method, Gaussian noise, differ in the

efficiency at the same decoded rate in Fig. S10 and S11 as described in Sec. 5.1.

S12 Comparison at the Same PSNR

In Fig. S5, S8, S7, S8, S9, and S10, we provide a random sample of the examples of how our method and the conventional

method, Gaussian noise, differ in the efficiency at the same PSNR for all the given cases as described in Sec. 5.1 and Fig. 4.