Reversible Data Hiding in Encrypted Images Using
Reformed JPEG Compression
Xiaozhu Xie*
Department of Computer Science
Xiamen University of Technology
Xiamen 361024, China
Department of Information Engineering and
Computer Science, Feng Chia University
Taichung 40724, Taiwan
xz4xxz@gmail.com
Abstract— A scheme of reversible data hiding in encrypted
image (RDH-EI) with high embedding capacity is proposed in
this paper. First, cover image is transformed to the quantized
discrete cosine transform (DCT) coefficients, which are reformed
and encrypted to generate the encrypted image. Then the secret
message is embedded into the encrypted image in the location of
zero alternating current (ac) coefficients to generate the marked
encrypted image. The JPEG image can be recovered by using the
encryption key. The secret message can be extracted using the
embedding key. The experimental results showed that the
proposed scheme can obtain a high embedding ratio while
ensuring that the recovered image will have good quality.
Keywords—reversible data hiding (RDH); image encryption;
JPEG compression
I. INTRODUCTION
Reversible data hiding in encrypted images (RDH-EI) is in
high demand in various fields, such as preventing information
leakage in cloud services, protecting patients’ privacy in
medical diagnosis, and anti-theft for military secrets. The
results of RDH-EI research are measured mainly by two chief
norms, i.e., the quality of the recovered image as evaluated by
peak signal-to-noise ratio (PSNR) and the embedding capacity
as evaluated by embedding ratio, Re . Many researchers and
scholars have conducted extensive research aimed at increasing
both PSNR and Re [1-4,6-9].
Some RDH-EI methods embed the message by directly
modifying the least significant bits (LSBs) of encrypted images.
Zhang [1] proposed an RDH-EI scheme that involved flipping
the three LSBs of two different sets in non-overlapping blocks
to embed the secret message. Hong et al. [2] improved Zhang’s
method by calculating block smoothness using side-match to
decrease the error rate during the process of image recovery.
The embedding capacities of two methods in [1] and [2] rely
on the size of the blocks and keeping it low to ensure that the
PSNR is high. Also, the two methods are inseparable between
image decryption and message extraction. Ma et al. [3] divided
the cover image into two parts and then made room for
embedding the message before encryption by embedding the
LSBs of one part into the other part using a traditional RDH
method. Re in [3] can achieve up to 0.5 bpp. However, it
Supported by Natural Science Foundation of P. R. China under Grant
61503316, Natural Science Foundation of Fujian Province under Grant
2016J01326.
Chin-Chen Chang
Department of Information Engineering and
Computer Science, Feng Chia University
Taichung 40724, Taiwan
alan3c@gmail.com
requires additional RDH computation. Unlike the previous
method, Liu [4] proposed a novel RDH-EI method, which
takes the LSBs of region of interest (ROI) as a part of secret
message embedded into the cover image by LSB substitution.
Therefore, lossless ROI can be recovered with both the
encryption key and the embedding key. However, the method
in [4] is applicable only in the case of a cover image with a
small ROI.
Other researchers have reserved room for embedding the
message by compressing encrypted images. Johnson et al. [5]
developed an effective compression method for encrypted
images based on the Low Density Parity Check Code (LDPC
Code), which was a great contribution to the field of
compressing encrypted images. Later on, many scholars
proposed RDH-EI methods based on LDPC. A separable RDH-
EI method was proposed by Zhang [6], which reserved room
by compressing LSBs with LDPC. Qian et al. [7] extended
Zhang`s method to improve the embedding ratio. The method
in [7] divided the encrypted image into three sets, and then
embedded the message into each set in a method similar to that
in [6]. At the image recovery phase, Qian et al. [7] recovered
the image progressively, which means it was recovered one set
after another. Inspired by distributed source coding (DSC) [8-
9], Qian and Zhang [10] proposed an RDH-EI method using
the most significant bits (MSB) plane and the LDPC-based
DSC, in which the maximum Re that can be achieved is 0.57
bpp. The schemes mentioned above achieve higher embedding
capacity than those that directly modify the LSBs of the
encrypted image. However, the embedding ratio is still not
acceptable in some applications.
Inspired by RDH in JPEG compressed images [11], we
propose an RDH-EI method using JPEG compression to
improve the embedding capacity. The proposed scheme is
described in Section ϩ , and the experimental results are
analyzed in Section Ϫ  Our conclusions are presented in
Section ϫ.
II. PROPOSED SCHEME
A. Framework
 Fig.1. Framework of the proposed scheme
Fig.2. Process of reformed JPEG compression
(a) (b)
Fig.3. Example of reforming process
The framework of the proposed scheme is illustrated in Fig.
1. On the content-owner side, the original image is compressed
by applying reformed JPEG compression to vacate space,
which is described in detail in the next section. After that, the
compressed image is encrypted using the encryption key. The
data hider embeds the secret message into the encrypted image
by using the embedding key to generate the marked encrypted
image. A JPEG image can be recovered directly from the
marked encrypted image using the encryption key. The secret
message can be extracted with the embedding key.
B. Reformed JPEG Compression
According to JPEG compression, the original image I
sized M u N is divided into 8 u 8 non-overlapping blocks, on
which DCT is performed, respectively, to obtain the DCT
coefficients. Then, these coefficients are quantized using the
quantization table to generate the quantized DCT coefficients.
As shown in Fig. 3(a), the vast majority of alternating current
(ac) coefficients in high frequency are zeros, and only a few
non-zero ac coefficients and direct current (dc) coefficients
converge at the top left corner. Therefore, we proposed to
embed the secret message into the zeros. We must reform the
quantized DCT coefficients for the following reasons:
1. The information of positions for embedding data must be
recorded.
(c) (d)
2. Aimed at directly transmitting the quantized DCT
coefficients to the recipient, we must transform these
coefficient values in the range [0, 255] so as to look like an
“image.”
Reforming steps:
Step 1: Find the last non-zero coefficient in zigzag scanning
order and record the position. To find the last non-zero
coefficient, we zigzag reversely scan the quantized DCT
coefficients until the first non-zero coefficient, which is the last
non-zero coefficient in the zigzag scanning order, as shown in
Fig. 3(a). Denote these coefficients in zigzag scanning order as
Ck [ck ,1 , ck ,2 ,..., ck ,64 ] , where k is the block index. Denote the
index of the first nonzero coefficient as pk and embed pk into
ck ,64 to generate Ck [ck ,1 , ck ,2 ,..., pk ] , as shown in Fig. 3(b).
Step 2: To make the coefficient values range from 0 to 255,
coefficients are modified as shown in (1),
­ 0, if˄ck ,i  -128˅
' °
ck , i ® 255, if˄ck ,i ! 127˅ (1)
°c  128, otherwise,
¯ k ,i
 where 2 d i d pk . Denote ª¬ck ,1 , ck' ,2 ,..., ck' , pk , ck , pk 1 ,..., pk º¼
a pixel in set Ck' , as shown in Fig. 3(c). Because the dc
coefficient is always positive, even it is greater than 255 when
quality factor (QF) is large enough. Therefore, we do not do the
computation of (1) to dc coefficient. The overflow/underflow
information is recorded for recovering the image.
Step 3: Replace the zero coefficients from ck , pk 1 to ck ,63
with random numbers ranging from 0 to 255 generated by key
1 to obtain the reformed quantized
Rk ª¬ rk ,1 , rk ,2 ,..., rk ,64 º¼ , as shown in Fig. 3(d). The reformed
quantized blocks synthesize the “reformed image” R(I) .
Step 4: Accessorial information, including the quantization
table, key 1 and the overflow/underflow information is
embedded into R(I) from the appointed Rk in a similar
method depicted in the following section using a key shared
with the recipient. This accessorial information is necessary for
recovering I from R(I) .
C. Encryption
We do the encryption conditionally to the “reformed
image” R(I) by (2) aimed at transmitting pk to data hider for
embedding data in proper position.
E (I) R (I) \ r ( k *8, k *8) † K ENC ,
where E (I) is the encrypted image, R (I) \ r ( k * 8, k * 8)
represents the pixels in R(I) except that r ( k *8, k *8) ,
k (1 d k d M u N / 64) is the block index, † is the XOR
operation, and K ENC is the encryption key. As described in the
phase of “Reformed JPEG Compression”, pk values are stored
in the location of r ( k *8, k *8) , which remains in the
plaintext form after the encryption phase. Let e(i, j ) be a pixel
value in E (I) .
D. Embedding data
In the proposed method, the data hider embeds the secret
message into the encrypted image E (I) . First, divide E (I) into
8 u 8 non-overlapping blocks, denoted as Ek , and
ek ,i , (1 d i d 64) represents a pixel value in Ek . Then, embed
the secret message into each block according to the following
steps:
Step 1: Use the embed key K EMB to encrypt the secret
message S by (3):
S
'
S † K EMB .
'
Step 2: Split S into ª L / 8 º groups, with each group
having 8 bits. L is the length of the secret message S . The
symbol ª º denotes a ceiling function meaning “the smallest
integer greater than or equal to”. Then convert each group with
'
8 bits to a decimal number sd (i ) , where 1 d i d ª« L / 8º» .
'
Step 3: Embed sd (i ) to E (I) from the appointed block Ek
(can be controlled by the embedding key) as follows:
a. Retrieve pk from Ek . As depicted in encryption
phase, e(k *8, k *8) is the plaintext of pk .
b. Embed S ' to blocks in zigzag scanning order from
block '
index pk  1 to 63 by replacing ek ,i with sd (i ) .
'
c. If all decimal numbers sd (i ) ( 1 d i d ǻ L / 8ȼ ) have
been embedded, go to Step 4. Otherwise, embed the
remaining numbers into the next block by repeating a
to c.
Step 4: Embed L (represented by l bits ) into the blocks
in the same method.
Finally, the marked blocks synthesize the marked image
M ( I ) delivered to the recipient.
E. Message Extraction and Image Recovery
When the recipient has the embedding key, he/she can
extract the secret message. The algorithm is as follows:
Input: marked image M ( I ) , Embedding key, message
(2)
length L .
Output: secret message S .
Step 1: Divide M ( I ) into non-overlapped blocks sized
8 u 8 . The initial LL ª L / 8º , where LL represents the
number of decimal number for the secret message that are not
being extracted.
Step 2: Zigzag scan the first block embedded into the secret
message to get Ck [ck ,1 , ck ,2 ,..., ck ,64 ] , from which we retrieve
pk in the location of ck ,64 . As we know, pk  1 is the position
started to embed data in block k .
Step 3: If (63  pk )  LL , extract secret data in the form
of decimal numbers from ck , pk 1 to ck ,63 , update LL by (4),
go to Step 4.
LL LL  (63  pk ) . (4)
Otherwise, extract secret data from ck , pk 1 to ck , pk  LL , go to
Step 5.
Step 4: Extract the remaining secret message from next
block by repeating Step 2 and Step3.
Step 5: Convert the decimal secret data to the binary form,
the front L bits are exactly the encrypted secret message S ' .
(3) With embedding key K EMB , we obtain secret message S by (5).
'
S S † K EMB . (5)
With encryption key, the recipient can decrypt the marked
image M ( I ) directly to obtain a JPEG image. The algorithm is
described as follows:
 (a) (b) (c) (d) (e)

(a’) (b’) (c’) (d’) (e’)

Fig.4. Experimental results with QF=90. (a)-(e) Original images sized 512x512 ( (a) Lena (b) Barbara (c) Pepper (d) Jet (e) Baboon) , (a’)- (e’) The
corresponding recovered images
TABLE 1. PSNRs(dB) and embedding rate Re (bpp) When compressed with different QFs
QF 50 60 70 80 90
Image
{ Re , PSNR} { Re , PSNR} { Re , PSNR} { Re , PSNR} { Re , PSNR}
Lena 6.43, 38.09 6.19, 38.67 5.80, 39.40 5.15, 40.42 3.37, 42.37
Barbara 5.44, 35.76 5.19, 36.48 4.84, 37.51 4.30, 39.08 2.91, 41.95
Pepper 6.38, 37.22 6.10, 37.67 5.68, 38.20 4.97, 38.91 1.99, 40.70
Jet 6.35, 38.34 6.14,39.06 5.81, 39.95 5.03, 41.17 3.74, 43.42
Baboon 4.42, 32.87 4.05, 33.44 3.51, 34.30 2.65, 35.82 0.98, 39.56
Average value 5.80, 36.46 5.53, 37.06 5.13, 37.87 4.42, 39.08 2.60, 41.60

(a)
Fig.5. Comparison of recovered image quality between proposed scheme and Ma [3]. (a) QF=50, (b) QF=90
Input: Marked image M ( I ) , encryption key K ENC , share
key.
Output: Recovered image I .
Step 1: Decrypt directly using (6) to get the reformed image
R(I) . Equation (6) is the reverse transform of (2).
R (I) M (I) \ m( k *8, k *8) † K ENC .
Step 2: With the shared key, quantization table, and the
overflow/underflow information can be extracted in the similar
way depicted in extraction phase.
Step 3: Divide R(I) into 8 u 8 non-overlapping blocks, and
then retrieve pk from each block in the location of r (8,8)
respectively.
(b)
Step 4: With pk and overflow/underflow information, do
the reverse operations of reforming steps described in the phase
of “Reformed JPEG Compression” on blocks to restore the
original quantized DCT coefficients.
Step 5: Use quantization table to anti-quantize the
quantized DCT coefficients, and, finally, recover the JPEG
(6) image of the original image.
When the recipient has both keys, he/she can extract the
secret message and recover the JPEG image using the
aforementioned algorithms, respectively.
III. EXPERIMENTAL RESULTS
To verify the performance of the proposed scheme, we
conducted the experiments on the original images shown in Fig.
4(a)-(e). Fig. 4(a’)-(e’) are the corresponding recovered images
with QF = 90, which preserved good quality.
 The results in Table 1 verify that the proposed scheme can
reach high embedding capacity up to 2.60 bpp while the
recovered image preserves good quality with an average PSNR
value of 41.60 dB. From the results in Table 1, we also can
conclude that images with simpler texture have higher
embedding ratios and better image quality, such as “Lena” and
“Jet.” On the contrary, images with more complex texture have
lower embedding ratios and worse image quality, such as
“Barbara” and “Baboon.” The reason for this is that the
proposed scheme embeds the message into zeros in the high
frequencies of the DCT-quantized blocks. And according to the
DCT transform principle, the more complex the image is, the
fewer zeros there are in its high frequency. However, even with
complex texture, the proposed method can still reach high
embedding ratios up to 0.98 bpp with PSNR values 39.56 dB.
The proposed scheme was compared with Ma et al.’s [3].
Both schemes reserved room by compressing before encryption.
Fig. (5) shows a comparison of the quality of the recovered
image with different embedding ratios between the proposed
scheme with QF = 90 and Ma [3]. The results show that the
PSNR decreases sharply when the embedding ratio increases
slightly in [3], and PSNR goes down to 25 dB when the
embedding ratio approaches 0.5 bpp. The proposed scheme
outperforms [3] when the embedding ratio is greater than 0.5
bpp, and it maintains the high PSNR value of 42.37 dB when
the embedding ratio reaches 3.37 bpp using the test image
“Lena” .
IV. CONCLUSION
In this paper, we proposed a scheme of RDH-EI using
reformed JPEG compression. First, the cover image is
transformed to quantized DCT coefficients, of which the vast
majority of ac coefficients at high frequency is zeros. Therefore,
we proposed to embed the secret message into the zeros.
Before embedding, quantized DCT coefficients were reformed
and encrypted to generate the encrypted image. The recipient
can extract data from the marked image with the embedding
key. JPEG image can only be recovered with the encryption
key. The experimental results demonstrated that the proposed
scheme can obtain an average embedding ratio up to 2.6 bpp
while maintaining a good quality recovered image with an
average PSNR value of 41.60 dB.
Although the proposed scheme still recovers a JPEG image
with both keys, it maintains good quality, which is more than
required in some applications. In order to extend its
applications, we plan to improve the quality of the recovered
image in our subsequent research.
REFERENCES
[1] X. P. Zhang, “Reversible Data Hiding in Encrypted Image,” IEEE
Signal Processing Letters, vol. 18, no. 4, pp. 255-258, 2011.
[2] W. Hong, T. S. Chen and H. Y. Wu, “An Improved Reversible Data
Hiding in Encrypted Images Using Side Match,” IEEE Signal
Processing Letters, vol. 19, no. 4, pp. 199-202, 2012.
[3] K. D. Ma, W. M. Zhang, X. F. Zhao, N. H. Yu and F. H. Li, “Reversible
Data Hiding in Encrypted Images by Reserving Room Before
Encryption,” IEEE Transactions on Information Forensics and
Security, vol. 8, no. 3, pp. 553-562, 2013
[4] Y. Liu, X. Qu and G. Xin, “A ROI-based Reversible Data Hiding
Scheme in Encrypted Medical Images,” Journal of Visual
Communication and Image Representation, vol.39, pp.51-57, 2016.
[5] M. Johnson, P. Ishwar, V. M. Prabhakaran, D. Schonberg, and K.
Ramchandran, “On Compressing Encrypted Data,” IEEE Transactions
on Signal Processing, vol. 52, no. 10, pp. 2992-3006, 2004.
[6] X.P. Zhang, “Separable Reversible Data Hiding in Encrypted
Image,” IEEE Transactions on Information Forensics and Security, vol.
7, no. 2, pp. 526-532, 2012.
[7] Z.X Qian, X.P. Zhang and G.R Feng, “ Reversible Data Hiding in
Encrypted Images Based on Progressive Recovery,” IEEE Signal
Processign Letters, vol. 23, no.11, pp.1672-1676,2016.
[8] W. Liu, W. Zeng, L. Dong, and Q. Yao, “Efficient compression of
encrypted grayscale images,” IEEE Transations on Image Process, vol.
19, no. 4, pp. 1097–1102, Apr. 2010.
[9] S. S. Pradhan and K. Ramchandran, “Distributed source coding using
syndromes (DISCUS): Design and construction,” IEEE Transstion on
Information Theory, vol. 49, no. 3, pp. 626–643, Mar. 2003.
[10] Z. Qian and X. Zhang, “Reversible Data Hiding in Encrypted Image
with Distributed Source Encoding,” IEEE Transactions on Circuits and
Systems for Video Technology, vol. 26, no. 4, pp. 636-646, 2016.
[11] C.C. Chang, C.C. Lin, and C.S. Tseng, “Reversible hiding in DCT-based
compressed images,” Information Sciences, vol. 177, no.13, pp. 2768-
2786, 2007.