JPEG Steganalysis Using Leaked Cover Thumbnails

JPEG steganalysis seeks to detect the presence of hidden messages in JPEG images. In some cases, additional information is available that may aid JPEG steganalysis. One instance is a thumbnail of the cover image, which may be acquired from a seized device or from the image file because the steganography software did not update the metadata. This paper studies how a leaked cover thumbnail can aid JPEG steganalysis. We distinguish two types of thumbnails: pre-compression thumbnails produced from uncompressed pre-covers, and post-compression thumbnails produced from JPEG-compressed covers. The analysis proceeds in three stages. First, we quantify the amount of information left in the cover thumbnail. Second, we demonstrate that post-compression cover thumbnails allow for near-perfect steganalysis by re-creating the thumbnail. Third, we study how an EfficientNet detector can benefit from the additional cover information in pre-compression thumbnails.