目的 自然隐写是一种基于载体源转换的图像隐写方法，基本思想是使隐写后的图像具有另一种载体的特征，从而增强隐写安全性。但现有的自然隐写方法局限于对图像ISO(International Standardization Organization)感光度进行载体源转换，不仅复杂度高，而且无法达到可证安全性。为了提高安全性，本文结合基于标准化流的可逆图像处理模型，在隐空间完成载体源转换，同时通过消息映射的设计做到了可证安全的自然隐写。方法 利用目前发展迅速的基于可逆网络的图像处理方法将图像可逆地映射到隐空间，通过替换使用的隐变量完成载体源的转换，从而避免对原始图像复杂的建模。同时，改进了基于拒绝采样的消息映射方法，简单地从均匀分布中采样以获得需要的条件分布，高效地将消息嵌入到隐变量中，并且保证了嵌入消息后的分布与原本使用的分布一致，从而实现了可证安全的自然隐写。结果 针对图像质量、隐写容量、消息提取准确率、隐写安全性和运行时间进行了实验验证，结果表明在使用可逆缩放网络和可逆去噪网络时能够在每个像素值上平均嵌入5.625 bit消息，且具有接近99%的提取准确率，同时隐写分析网络SRNet(steganalysis residual network)和Zhu-Net的检测准确率都在50%附近，即相当于随机猜测。结论 本文提出的隐写框架利用可逆图像处理网络实现了可证安全的自然隐写，在隐写容量和安全性上都具有很大优势。

Objective Natural steganography is regarded as a cover-source switching based image steganography method. To enhance the steganographic security, its objective is focused on more steganographic image-related cover features. Natural steganography is originally designed for ISO (International Standardization Organization) sensitivity through adding noise to a low ISO image to yield a high ISO image feature, and modeling this noise signal to complete the message embedding. This approach is required for modeling the generation of ISO sensor noise, the development pipeline from raw sensor data stored in RAW format is commonly used like portable network graphics (PNG) or joint photographic experts group (JPEG) format images, which is very complex and not precise enough and the existing natural steganography approaches cannot be identified for safety inefficiently. To make the stylized images generated by steganography indistinguishable from other stylized images, some existing approaches are employed to explore steganography on the basis of image style transformation. However, it is challenged that the steganography-generated stylized image has the same distribution as the stylized image from another source, and none of them is as secure as traditional natural steganography. Actually, it is possible to achieve clarified security via using generated images as the cover image. Steganography is tackled for stronger invisibility than cryptography, but it has been difficult to achieve identifiable security, and most of methods are constrained of empirical security. Due to existing identifiable secure methods is required to obtain the distribution of cover datasets or the ability to sample from the cover distribution accurately, it is not feasible for traditional cover datasets. However, datasets-generated are easy to exact sampling because generative models random variables are required to be introduced to manipulate data generation. Therefore, to accomplish cover-source switching in latent space, and achieve identifiable secure natural steganography, the invertible image processing network is coordinated in terms of normalization flow. Method First, the image is mapped to the latent space in reverse using invertible neural networks-based image processing method, and the distribution of the latent variables are used to determine the cover features. To avoid modeling the original image features like ISO sensitivity, latent variable is configured as cover-source to switch and it can optimize the complexity of steganography significantly. At the same time, the identifiable secure steganography is implemented in the invertible image processing. The source switching-after cover is exactly the same as the cover of the other source, instead of the traditional natural steganography method, which can only be approximated in maximize. Since most of the invertible neural networks-based image processing methods use normal distribution-oriented latent variables to participate in recovery, conditional probability distribution of the stego latent variables about uniformly distributed messages can be designed. To enable message embedding and extraction, the stego latent variables can meet the requirement of normal distribution and the messages-linked correlation is obtained at the same time. To obtain the stego latent variable that matches the target conditional probability distribution, the inverse transform sampling-based message-embedding can be done efficiently via simplified regular distribution sampling. By keeping the stego latent variables with the same normal distribution as the latent variables used in normal image processing, the images involved in recovering or generating have the same distribution as well. Result Experiments are carried out in terms of image quality, steganographic capacity, message extraction accuracy, steganographic security, and its runtime. Using the same quality evaluation method with the original image processing network, there is almost no difference in peak signal-to-noise ratio and structural similarity between our Steganography and non-steganography images. To optimize steganographic capability, invertible de-noising and invertible rescaling network-based steganography methods are able to extract the message with about 99% accuracy while embedding 5.625 bits per pixel on the stego image. And, invertible de-colorization network-based steganography method achieves more than 99% extraction accuracy while embedding 0.67 bits of message per pixel. For steganographic security, we demonstrate the identifiable security of the proposed method, and neither of the two deep learning steganalysis networks used can distinguish the stego image from the cover image with better accuracy than random guesses. Furthermore, to reduce the time from the exponential growth of the latter to a constant time, our improved message mapping algorithm can be used to improve the efficiency compared to the rejection sampling approach. Conclusion An identifiable secure natural steganographic system is facilitated based on invertible image processing network, and the experimental results show that our method has its potentials for steganographic-related capacity and security.