IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY
1
DASM: Domain-Aware Sharpness Minimization for Multi-Domain Voice Stream Steganalysis
arXiv:2605.19955v1 [cs.CR] 19 May 2026
Pengcheng Zhou † , Pianran Guo † , Shuhua Chen , Mengqin Zhao , Zhongliang Yang , and Linna Zhou
Abstract—The growing use of information hiding in network streaming media for covert communication poses a significant security threat, necessitating the development of robust detection technologies. However, existing steganalysis methods for network voice streams mostly rely on data distributions in specific scenarios, making it difficult to adapt to the practical detection needs of non-homologous data distributions. Through Hessian analysis, we find that the loss landscapes of mainstream models are dominated by numerous saddle points and sharp local minima, rendering them highly sensitive to data distribution shifts and fundamentally limiting generalization. Therefore, we propose a new optimizer, Domain-Aware Sharpness Minimization (DASM). The core mechanisms of DASM consist of two aspects: first, it integrates domain-supervised contrastive learning with sharpness-aware optimization, explicitly preserving inter-domain feature separation while seeking flat minima; second, we design an adaptive domain gap modulation strategy that dynamically calibrates the optimization loss weights by sensing the real-time feature separability of different domains. Extensive experimental results demonstrate that our method outperforms the stateof-the-art methods by a large margin and achieves excellent generalization and robustness. Our codes are available at Index Terms—Voice over IP, steganalysis, sharpness-aware minimization, domain generalization, contrastive learning, covert communication.
I. I NTRODUCTION
V
Fig. 1. Multi-domain Hessian analysis. Eigenvalue spectral density and loss landscape visualizations reveal that AHCM and LSB converge to flat minima while QIM and PMS are dominated by saddle points, highlighting optimization challenges in heterogeneous distributions.
Manuscript received 15 May 2026; revised XX Month 2026; accepted XX Month 2026. Date of publication XX Month 2026; date of current version 15 May 2026. ( † Pengcheng Zhou and Pianran Guo contributed equally to this work.) (Corresponding authors: Zhongliang Yang; Linna Zhou.) Pengcheng Zhou is with the Department of Electrical and Computer Engineering, National University of Singapore, Singapore 117583, Singapore. Pianran Guo, Shuhua Chen, Zhongliang Yang and Linna Zhou are with the School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing 100876, China (e-mail: [email protected]; [email protected]). Mengqin Zhao is with the College of Communication Engineering, Jilin University, Changchun 130012, China.
Hessian spectral analysis (Fig. 1), we reveal a critical finding that the loss landscapes of mainstream models are dominated by numerous saddle points and sharp local minima, particularly in domains with complex embedding mechanisms. This geometric characteristic renders models highly sensitive to distribution shifts, restricting their generalization capability. To mitigate the issue of saddle points and enhance generalization under distributional shifts, optimization algorithms that seek flat minima, most notably Sharpness-Aware Minimization (SAM) and its variants, have become established solutions in the general machine learning community [12]–[15]. Specifically, recent works have explored leveraging sharpness-aware minimization to escape saddle points and handle domain shifts [16]–[18]. However, directly transferring generic SAM algorithms to multi-domain voice stream steganalysis proves suboptimal due to the unique nature of steganographic data. Unlike computer vision tasks characterized by explicit semantic domain shifts, the domain discrepancies in VoIP steganalysis are both minute and imbalanced. First, the domain gap is extremely minute because the primary goal of steganography is imperceptibility, resulting in critically weak distinguishing
OICE over Internet Protocol (VoIP) streams have become a ubiquitous carrier for covert communication due to their high throughput and ephemeral nature, posing potential security risks. To counteract these threats, steganalysis techniques have evolved from traditional correlation-based methods [1], [2] to advanced deep learning frameworks [3]– [8], achieving remarkable success in controlled environments. However, these methods encounter a significant challenge where they often suffer from performance degradation when facing non-homologous data distributions. This phenomenon arises from the distinct statistical footprints introduced by different steganographic algorithms, specifically Quantization Index Modulation (QIM) [9], Pitch Modulation Steganography (PMS) [10], Least Significant Bit (LSB), and Adaptive Huffman Code Mapping (AHCM) [11]. Through rigorous
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY
features. Second, the domain gaps are imbalanced because different algorithms exhibit varying levels of detection difficulty. To address these challenges, we propose a novel optimizer, Domain-Aware Sharpness Minimization (DASM), designed to navigate the complex optimization landscape of multialgorithm steganalysis. First, to address the minute domain gaps caused by high imperceptibility, we introduce DomainSupervised Contrastive Learning (DSCL), which explicitly widens the separation between different steganographic domains during the perturbation step to enhance feature discriminability. Second, to handle the imbalanced domain gaps caused by varying detection difficulties, we design Adaptive Domain Gap Modulation (ADGM), which dynamically calibrates the optimization weights by sensing the real-time feature separability of different domains, ensuring the optimizer focuses on the most challenging directions to effectively escape saddle points. Extensive experiments on datasets containing QIM, PMS, LSB, and AHCM algorithms demonstrate that DASM significantly outperforms state-of-the-art methods, achieving superior detection accuracy and robustness against distribution shifts. Our main contributions are summarized as follows: We perform the first Hessian analysis in voice stream steganalysis, identifying that poor generalization on nonhomologous data stems from convergence to saddle points and sharp minima in the loss landscape. • We propose DASM, which integrates DSCL to amplify minute feature differences and employs ADGM to balance uneven detection difficulties, effectively enabling the model to escape saddle points. • Extensive experiments on datasets containing QIM, PMS, LSB, and AHCM algorithms demonstrate that DASM significantly outperforms state-of-the-art methods, establishing new benchmarks for generalization and robustness.
•
II. R ELATED W ORK A. VoIP Steganalysis Techniques Voice over IP (VoIP) has emerged as a primary carrier for covert communication, allowing secret data to be imperceptibly embedded into real-time speech streams. The evolution of steganography has progressed from rudimentary Least Significant Bit (LSB) substitution [19]–[22] to highly sophisticated mechanisms deeply integrated into speech encoding standards. Prominent techniques include Quantization Index Modulation (QIM) [23]–[27], which alters quantization indices during encoding; Pitch Modulation Steganography (PMS) [10], [28]– [31], which manipulates adaptive codebook parameters; and Adaptive Huffman Code Mapping (AHCM) [32], which modifies entropy coding. However, the distinct statistical artifacts introduced by these diverse embedding algorithms create a highly heterogeneous feature space with minute, imperceptible modifications. This poses a significant challenge for detecting low-rate steganography across varying domains, necessitating a geometry-aware optimization approach to capture these subtle signal variations robustly.
2
B. VoIP Steganalysis Methods Steganalysis has evolved from handcrafted statistical features [33], [34] to advanced deep learning architectures. Significant progress includes mechanism-aware detectors like CCN [1] and SS-QCCN [2]; models leveraging temporalspectral representations such as SFFN [4] and KFEF [3]; detectors capturing frame-level correlations like FS-MDP [5] and LStegT [6]; and streaming architectures including DVSF [8] and DAEF-VS [7]. Despite these advancements, most approaches rely on Empirical Risk Minimization, which excels on i.i.d. data but falters under distribution shifts caused by varying codecs and network conditions. However, standard domain adaptation methods fail to address the granular and imbalanced domain gaps inherent to low-rate embedding, often causing models to converge to sharp minima or saddle points. This highlights the critical need to explicitly model the geometric structure of the multi-domain loss landscape for improved generalization. C. Sharpness-Aware Optimization Generalization capability is closely linked to the geometry of the loss landscape. Theoretical and empirical studies indicate that models converging to flat minima exhibit better generalization [35]. Sharpness-Aware Minimization (SAM) was proposed to guide optimization toward flat regions by minimizing the maximum loss within a neighborhood [12]. Subsequent works have improved the efficiency and effectiveness of SAM: ESAM enhances computational efficiency [13], FSAM removes harmful gradient components to improve generalization [15], and SAGM uses gradient matching for domain generalization [14]. Recent domain-inspired variants like DISAM [17] and DGSAM [18] further explore sharpnessaware training under distribution shifts. However, a fundamental limitation persists: these methods primarily choose a uniform or isotropic smoothness constraint over the parameter neighborhood, which is misaligned with problems where discriminative signals are microscopic and heterogeneously distributed across domains, as in low-rate steganalysis. An isotropic perturbation risks obliterating the very faint, domainspecific features that are crucial for detection. III. P ROBLEM F ORMULATION We define multi-domain audio steganalysis as a binary classification task over a heterogeneous dataset D = {D1 , . . . , DS } consisting of S distinct source domains. Each domain Ds corresponds to a specific steganographic embedding algorithm (e.g., QIM, PMS, LSB, AHCM) with a unique data distribution Ps (X, Y ). The dataset for the s-th domain is s d s defined as Ds = {(xsi , yis )}N i=1 , where xi ∈ R represents the input audio feature vector (e.g., deep representations of cover or stego audio), and yis ∈ {0, 1} is the corresponding binary label (0 for cover, 1 for stego). Given the low embedding rates, the feature discrepancy between cover and stego samples is microscopic, while the distribution shift between domains Pi ̸= Pj is significant. We define the training set as the SS union of all source domains Strain = s=1 Ds . The goal is to learn a robust mapping function fθ : Rd → {0, 1},
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY
3
parameterized by θ, using Strain . The objective is to find a parameter configuration θ∗ that correctly assigns the binary label y ∈ {0, 1} to an input query from the target domain Dtarget , by learning discriminative features robust to the minute and imbalanced domain gaps across heterogeneous steganographic algorithms. IV. M ETHODOLOGY Building upon the problem formulation, we propose Domain-Aware Sharpness Minimization (DASM). Fig. 2 provides an overview of the DASM framework. To robustly solve the multi-domain detection task, we model the training process as a minimax optimization problem, aiming to find parameters that minimize the worst-case loss within a perturbation neighborhood.
Algorithm 1 Domain-Aware Sharpness Minimization (DASM) Input: Training dataset D, batch size B, learning rate η, perturbation radius ρ, contrastive temperature τ , EMA momentum µ Output: Trained parameters θ 1: Initialize model parameters θ0 , domain centers C = {ck }K k=0 , step t ← 0 2: while not converged do 3: Sample a minibatch B = {(xi , yi , di )}B i=1 from D 4: Extract features and update domain centers ck via EMA
6: 7: 8:
Compute domain gaps gk = ∥ck − ccover ∥2 Compute adaptive temperature τg = std({gk }) + ξ Compute adaptive weights wk = softmax(−gk /τg ) Compute composite loss Ltotal = LCE + LDSCL + LADGM
A. Overview of DASM
9:
Compute gradient g = ∇θ Ltotal (θt )
Standard training minimizes the empirical risk, which often leads to sharp minima. In contrast, our method seeks a flat minimum by solving the following sharpness-aware objective: (1) min E(x,y)∼Strain max Ltotal (θ + ϵ) ,
10: Compute adversarial perturbation ϵ̂ = ρ · g/∥g∥2 11: Compute perturbed gradient gadv = ∇θ Ltotal (θt + ϵ̂) 12: Update parameters θt+1 ← θt − η gadv 13: t←t+1 14: end while 15: return θt
∥ϵ∥2 ≤ρ
θ
where ρ represents the perturbation radius, and ϵ is the adversarial weight perturbation. Standard SAM approximates the inner maximization of (1) by solely maximizing the cross-entropy loss. However, in the context of multi-domain steganalysis, a perturbation that simply maximizes classification error does not necessarily reflect the geometric collapse of minute steganographic features. Therefore, we redesign the optimization objective to enforce that the model maintains both feature separation and domain balance even under the worst-case perturbation. Specifically, at each training step t, let B = {(xi , yi , di )}B i=1 be a mini-batch, where di denotes the domain index. We define a composite domain-aware loss Ltotal as the sum of three components: Ltotal (θ) = LCE (θ) + LDSCL (θ) + LADGM (θ),
(2)
where LCE is the standard cross-entropy loss for classification, LDSCL is the Domain-Supervised Contrastive Learning loss that preserves inter-domain feature separability, and LADGM is the Adaptive Domain Gap Modulation loss that balances optimization across domains. The three loss terms are designed to be self-normalized to comparable scales, eliminating the need for manual balancing coefficients. The proposed method performs a two-step optimization. First, it computes an adversarial perturbation ϵ̂ that maximizes Ltotal within the local neighborhood defined by ρ via a firstorder Taylor expansion: ϵ̂ = ρ
∇θ Ltotal (θt ) . ∥∇θ Ltotal (θt )∥2
(3)
Second, the model parameters are updated using the gradient evaluated at the perturbed state θt + ϵ̂:
5:
where η is the learning rate. Note that Ltotal in (2) incorporates adaptive weights wk through LADGM (wk ), where wk are computed adaptively based on domain gaps as described in Section IV-C. By incorporating LDSCL and LADGM into the perturbation generation process, the optimizer is guided to find a flat region where the loss landscape is robust not only in terms of classification accuracy but also in terms of domain separability and balance. The complete training procedure is summarized in Algorithm 1. B. Domain-Supervised Contrastive Learning The domain discrepancies between cover and steganographic streams are inherently minute. Standard optimization often leads to feature representations that are inseparable near the decision boundary, making the model vulnerable to slight distribution shifts. To counteract this, we introduce DomainSupervised Contrastive Learning (DSCL). The core insight is to enforce feature separability under worst-case perturbation by pulling together samples from the same domain while pushing apart samples from different domains. Let zi = fθ (xi )/∥fθ (xi )∥2 be the L2-normalized feature representation of sample xi . For each anchor sample i in the batch, we define the set of positive samples P (i) = {j : dj = di , j ̸= i} as samples sharing the same domain label, and the set of negative samples N (i) = {j : dj ̸= di } as samples from different domains. The DSCL loss aggregates positive and negative similarities: X X Si+ = exp(z⊤ Si− = exp(z⊤ i zp /τ ), i zn /τ ), p∈P (i)
θt+1 = θt − η∇θ Ltotal (θt + ϵ̂),
(4)
n∈N (i)
(5)
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY
4
Fig. 2. Overview of DASM for multi-domain voice steganalysis. (1) Input: Cover and steganographic audio patches with multiple embedding rates. (2) Feature Extraction: Raw audio projected into a shared representation space, revealing imbalanced domain gaps. (3) Pre-DASM Loss Landscape: Dominated by saddle points and sharp minima. (4) DASM Core Principle: Combines domain-supervised contrastive learning LDSCL and adaptive domain gap modulation LADGM with sharpness-aware perturbation to reshape the landscape. (5) Iterative Optimization Loop: Solves minθ max∥ϵ∥≤ρ Ltotal (θ + ϵ) with adaptive weights focusing on hard domains, enabling robust detection across distribution shifts.
where τ is a temperature hyperparameter. The DSCL loss follows an InfoNCE formulation: 1 X S+ LDSCL = − (6) log + i − . |B| Si + Si i∈B A smaller τ produces sharper similarity distributions that enforce stronger separation between domains. By minimizing (6) within the sharpness-aware optimization loop, the method prevents the feature boundaries of different steganographic algorithms from collapsing into the cover domain, even when the model is subjected to adversarial weight perturbations. C. Adaptive Domain Gap Modulation In multi-domain steganalysis, different algorithms exhibit varying detection difficulties, leading to imbalanced domain gaps. Standard optimizers naturally prioritize easier domains with larger gradients, causing the model to converge to saddle points with respect to harder domains. To resolve this, we propose Adaptive Domain Gap Modulation (ADGM), which dynamically adjusts the optimization focus based on real-time domain separability. Drawing inspiration from center-based feature learning [36] and online prototype clustering [37], we maintain a running centroid ck for each domain k using Exponential Moving Average (EMA): (t)
(t−1)
ck = µ · c k (t)
(t)
+ (1 − µ) · z̄k ,
Based on the tracked centers, we define the domain gap gk = ∥ck −ccover ∥2 as the Euclidean distance between the k-th steganographic domain center and the cover center. A smaller gk implies a harder detection task. To automatically focus on hard domains, we compute adaptive weights via softmax over the negated gaps: exp(−gk /τg ) w k = PS , j=1 exp(−gj /τg )
(8)
where τg = std({g1 , . . . , gS }) + ξ is an adaptive temperature computed from the current gap distribution. This formulation assigns larger weights to domains with smaller gaps, enabling the optimizer to automatically discover and prioritize hard-toseparate domains. Using these adaptive weights, we define the ADGM loss as: PS wk · g k , (9) LADGM = 1 − k=1 maxk (gk ) + ξ where ξ is a small constant for numerical stability. The numerator computes a weighted average of domain gaps emphasizing harder domains, while the denominator normalizes by the maximum gap, making the loss self-normalized to [0, 1). By minimizing (9), the optimizer dynamically focuses on expanding the feature distance of hard domains, acting as a geometric regularizer that prevents the optimization trajectory from stagnating in saddle points.
(7)
where z̄k is the mean feature of domain k in the current batch and µ is the momentum coefficient. We separately track the cover domain center ccover and each steganographic domain center ck for k ∈ {1, . . . , S}.
V. E XPERIMENTS A. Experimental Settings Datasets and Evaluation. We construct a binary classification dataset comprising natural audio samples and stegano-
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY
graphic audio samples. The steganographic samples are generated using four distinct algorithms: QIM, PMS, LSB, and AHCM, forming four separate domains with equal sample sizes. The audio sources exhibit high diversity, covering different genders, languages, and various content types. The datasets encompass five embedding rates: 0.1, 0.2, 0.3, 0.4 and 0.5. Each embedding rate maintains balanced positive and negative samples across all four domains. Training employs mixed data from all four domains simultaneously, while evaluation is conducted domain-specifically to assess cross-algorithm generalization capabilities. Baselines. To comprehensively evaluate the proposed DASM framework, we compare it with two categories of stateof-the-art methods. First, we consider advanced deep learning models for VoIP steganalysis: CCN, SS-QCCN, SFFN, KFEF, FS-MDP, LStegT, DVSF, and DAEF-VS. Second, we include prominent sharpness-aware optimizers: standard SAM and ERM; and domain-inspired variants DISAM, DGSAM, FSAM, and SAGM. These baselines are implemented with identical network architectures and training configurations as DASM to ensure a fair comparison. Implementation Details. All experiments are conducted on NVIDIA vGPU-32GB with 72 GB memory. Training configuration includes batch size 128, learning rate 0.001, and Adam optimizer for baseline models with a Transformer backbone for SAM variants. For DASM, we set the perturbation radius ρ = 0.03, contrastive temperature τ = 0.1, and EMA momentum µ = 0.9 for domain center tracking. The three loss components in (2) are self-normalized and directly summed without additional balancing coefficients. All models train for 100 epochs with early stopping based on validation loss, using detection accuracy and AUC as evaluation metrics. B. Main Results We evaluate DASM against the comprehensive baseline suite on balanced test sets across all four domains. Table I summarizes the detection accuracy at embedding rate 0.5, with all results averaged over three independent runs. The experimental results reveal several key findings. Superiority over State-of-the-Art. DASM achieves the highest average accuracy of 93.06%, surpassing the best domain-specific method DAEF-VS by 7.52%. The improvement is most pronounced in the challenging PMS domain, where DASM attains 82.38% compared to 73.31% for DAEFVS. This 9.07% gain demonstrates that our domain-aware optimization effectively captures subtle steganographic artifacts that specialized architectures fail to detect. Effectiveness against Saddle Points. On the Transformer backbone, standard SAM improves over ERM from 86.13% to 87.96%, validating the benefit of flat minima. However, domain-aware variants DISAM and DGSAM fail to consistently outperform SAM because their isotropic perturbations cannot address the polarized domain gaps revealed by our PAD analysis in Appendix A. DASM overcomes this limitation through adaptive gap modulation, achieving a 5.10% improvement over SAM. The loss landscape visualizations in Appendix B further corroborate that DASM transforms the
5
(a) Adam
(b) SAM
(c) DAEF-VS
(d) DASM
Fig. 3. 3-D t-SNE visualization of feature distributions. DASM achieves the clearest separation between Cover and Stego samples, while baseline methods exhibit significant overlap. Per-domain visualizations are provided in Appendix D.
rugged optimization terrain into smooth, flat basins across all domains. Robustness across Embedding Rates. Table II presents performance across embedding rates from 0.1 to 0.5, with trends visualized in Appendix C. As ER decreases, steganographic signals weaken critically. Adam degrades to nearrandom accuracy of 54.63% at ER=0.1, while SAM improves only marginally to 63.80%. DASM maintains 78.05% average accuracy at ER=0.1, representing a 14.25% gain over SAM. The advantage is most significant in the PMS domain, where DASM outperforms SAM by 11.48% at ER=0.3. This robustness stems from the adaptive weighting mechanism that dynamically prioritizes hard domains even when their feature gaps collapse toward zero, as quantified by the PAD analysis in Appendix A showing PMS gap compression from 1.064 to 0.328 across ERs. Feature Space Geometry. Fig. 3 provides qualitative validation through t-SNE visualization. Adam produces severely entangled Cover-Stego features, explaining its poor generalization. SAM provides marginal improvement but maintains substantial overlap in the PMS and QIM regions. DAEFVS, despite its specialized architecture, fails to achieve complete separation. In contrast, DASM produces well-structured feature clusters with clear Cover-Stego boundaries across all domains. This geometric organization directly correlates with the detection accuracy in Table I and validates that the domain-supervised contrastive loss effectively prevents feature collapse. Per-domain visualizations in Appendix D confirm consistent separation even for the challenging PMS domain.
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY
6
TABLE I D ETECTION ACCURACY (%) AT ER=0.5. DASM C ONSISTENTLY O UTPERFORMS S PECIALIZED S TEGANALYSIS M ETHODS AND A DVANCED O PTIMIZATION S TRATEGIES , PARTICULARLY IN PMS AND QIM. B EST R ESULTS IN B OLD . Algorithm (Reference)
QIM
PMS
LSB
AHCM
Average
CCN [1] SS-QCCN [2] LStegT [6] KFEF [3] SFFN [4] FS-MDP [5] DAEF-VS [7] DVSF [8]
90.79 +8.47 91.66 +9.34 82.17 −0.15 90.97 +8.65 69.20 −13.12 87.41 +5.09 89.91 +7.59 89.37 +7.05
50.36 −22.58 51.06 −21.88 63.11 −9.83 71.89 −1.05 62.93 −10.01 52.44 −20.50 73.31 +0.37 51.03 −21.91
50.01 −33.04 47.96 −35.09 75.56 −7.49 85.93 +2.88 77.93 −5.12 88.38 +5.33 89.68 +6.63 76.62 −6.43
50.57 −39.32 50.22 −39.67 76.29 −13.60 80.17 −9.72 91.48 +1.59 80.47 −9.42 89.24 −0.65 52.20 −37.69
60.43 −21.62 60.23 −21.82 74.28 −7.77 82.24 +0.19 75.39 −6.66 77.18 −4.87 85.54 +3.49 67.31 −14.74
Transformer + ERM + SAM [12] + DISAM [17] + FSAM [15] + DGSAM [18] + SAGM [14] + DASM (Ours)
82.32 88.18 +5.86 92.09 +9.77 85.11 +2.79 86.26 +3.94 86.72 +4.40 89.13 +6.81 93.72 +11.40
72.94 70.14 −2.80 71.76 −1.18 70.91 −2.03 76.32 +3.38 68.56 −4.38 71.29 −1.65 82.38 +9.44
83.05 92.49 +9.44 94.76 +11.71 87.63 +4.58 90.87 +7.82 93.51 +10.46 95.27 +12.22 96.68 +13.63
89.89 93.72 +3.83 93.24 +3.35 92.44 +2.55 94.46 +4.57 91.15 +1.26 94.66 +4.77 99.44 +9.55
82.05 86.13 +4.08 87.96 +5.91 84.02 +1.97 86.98 +4.93 84.99 +2.94 87.59 +5.54 93.06 +11.01
TABLE II P ERFORMANCE C OMPARISON ACROSS E MBEDDING R ATES (%). B EST R ESULTS IN B OLD .
TABLE III A BLATION S TUDY OF DASM C OMPONENTS AT ER=0.5 (%). B EST R ESULTS IN B OLD .
Opt.
ER
QIM
PMS
LSB
AHCM
Avg.
Variant
QIM
PMS
LSB
AHCM
Avg.
Adam
0.1 0.2 0.3 0.4 0.5
52.79 66.52 72.52 78.65 82.32
51.73 58.34 63.15 68.32 72.94
90.88 85.67 82.65 83.44 83.05
95.88 92.30 90.84 89.26 89.89
72.82 75.71 77.29 79.92 82.05
Adam (Baseline) DSCL Only ADGM Only
82.32 90.63 91.53
72.94 77.57 80.62
83.05 90.81 91.75
89.89 97.49 98.83
82.05 89.13 90.68
DASM (Full)
93.72
82.38
96.68
99.44
93.06
SAM
0.1 0.2 0.3 0.4 0.5
60.64 72.97 80.57 85.45 92.09
52.31 58.31 65.02 72.91 71.76
93.63 92.60 92.20 91.53 94.76
99.29 95.52 98.36 96.25 93.24
76.47 79.85 84.04 86.53 87.96
DASM
0.1 0.2 0.3 0.4 0.5
63.21 75.68 84.18 89.40 93.72
52.08 57.12 65.73 74.25 82.38
97.08 96.29 95.72 95.88 96.68
99.84 98.30 99.48 99.15 99.44
78.05 81.85 86.28 89.67 93.06
C. Ablation Study We investigate the individual contributions of the core components in DASM: Domain-Supervised Contrastive Learning (LDSCL ) and Adaptive Domain Gap Modulation (LADGM ). Taking the standard Transformer-based classifier as the Baseline, we evaluate three variants: (1) DSCL Only, which incorporates contrastive loss to enforce feature separability; (2) ADGM Only, which employs adaptive weighting to balance optimization; and (3) DASM (Full), the complete framework. As summarized in Table III, each component provides a significant performance boost. A visual comparison of these improvements is provided in Appendix E. Effectiveness of DSCL. Incorporating LDSCL improves average accuracy to 89.13%. By maximizing inter-domain distance in the feature space, DSCL prevents different steganographic algorithms from collapsing into the cover domain, which is crucial for distinguishing algorithms with minute embedding traces like QIM.
Effectiveness of ADGM. The ADGM module achieves 90.68% average accuracy. Notably, it provides a substantial gain in the PMS domain (from 72.94% to 80.62%). This confirms that by dynamically up-weighting domains with smaller gaps, the optimizer successfully escapes saddle points associated with hard-to-detect domains. Synergy in DASM. The full framework achieves the highest accuracy of 93.06%. The synergy between DSCL and ADGM ensures that the model not only finds a flat region in the loss landscape but also maintains structured and discriminative feature boundaries across all domains. D. Hyperparameter Sensitivity Analysis We evaluate the sensitivity of DASM to two key parameters: the perturbation radius ρ and the contrastive temperature τ . The corresponding line charts are illustrated in Appendix F. Sensitivity to Perturbation Radius ρ. The radius ρ controls the neighborhood size for sharpness estimation. We fix τ = 0.5 and vary ρ ∈ {0.01, 0.03, 0.05, 0.08}. As shown in Table IV, performance is stable across a wide range. ρ = 0.03 yields the best average accuracy. A very small ρ (0.01) provides insufficient regularization to escape sharp minima, while a very large ρ (0.08) may over-smooth the landscape, potentially obscuring fine-grained steganographic features. Sensitivity to Contrastive Temperature τ . Temperature τ regulates the similarity distribution in DSCL. We fix ρ = 0.03 and vary τ ∈ {0.05, 0.1, 0.2, 0.5}. As shown in Table V, τ = 0.1 is optimal. Lower values of τ enforce stricter
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY
TABLE IV S ENSITIVITY A NALYSIS OF THE P ERTURBATION R ADIUS ρ (F IXED τ = 0.5, %). ρ
QIM
PMS
LSB
AHCM
Avg.
0.01 0.03 0.05 0.08
93.34 92.68 93.16 93.27
81.40 82.78 82.14 81.69
95.65 96.10 96.25 95.83
99.73 99.80 99.65 99.60
92.53 92.84 92.80 92.60
TABLE V S ENSITIVITY A NALYSIS OF THE C ONTRASTIVE T EMPERATURE τ (F IXED ρ = 0.03, %). τ
QIM
PMS
LSB
AHCM
Avg.
0.05 0.10 0.20 0.50
93.14 93.72 93.41 92.68
81.95 82.38 82.04 82.78
96.86 96.68 96.61 96.10
99.59 99.44 99.41 99.80
92.89 93.06 92.87 92.84
7
TABLE VI C OMPUTATIONAL C OMPLEXITY AND E MPIRICAL R ESULTS . P : M ODEL PARAMETERS ; K: D OMAINS ; D: F EATURE D IMENSION ; B: BATCH S IZE . E MPIRICAL M EASUREMENTS ON RTX 4090 WITH BATCH S IZE 128. (a) Theoretical Complexity Opt.
Fwd/Bwd
Time
Space
Adam SAM DASM
1/1 2/2 2/2
O(P ) O(2P ) O(2P +B 2 )
O(P ) O(2P ) O(2P +KD)
(b) Empirical Results Opt.
Mem. (GiB)
ms/batch
Rel. Time
Adam SAM DASM
11.3 11.3 11.3
182.0 ± 0.1 366.4 ± 1.0 370.0 ± 4.5
1.00× 2.01× 2.03×
formation of sharp directions in any specific domain and guaranteeing robust test-time performance. domain separation, which benefits domains with high task difficulty. However, an excessively small τ (0.05) can lead to optimization instability by over-focusing on hard-negative samples. E. Sharpness Analysis To empirically corroborate the theoretical premise that DASM enhances generalization by locating flatter minima, we conducted a quantitative analysis of the loss landscape geometry using zeroth-order sharpness metrics with a perturbation radius ρ = 0.05. As detailed in Appendix G, DASM achieves an exceptionally low mean sharpness of 0.252, representing a radical reduction in curvature compared to both the Adam baseline of 2.334 and standard SAM of 1.056. This finding provides a geometric justification for the superior generalization performance reported in Table I, confirming that our method successfully converges to a wide, stable basin where the model is insensitive to parameter perturbations. Crucially, this flatness is not achieved by sacrificing performance on challenging domains. In the PMS domain, where baseline methods often get trapped in sharp, unstable minima as evidenced by Adam’s sharpness of 2.272, DASM effectively smooths the landscape to a sharpness of 0.371. This result directly validates the efficacy of our adaptive domain gap modulation strategy. By dynamically up-weighting harder domains during the perturbation step, DASM forces the optimizer to escape the sharp valleys associated with subtle steganographic artifacts, thereby resolving the high detection error rates typically observed in the PMS domain. Furthermore, DASM demonstrates superior optimization stability compared to prior domain generalization approaches. While competitors often exhibit high variance in sharpness across domains—such as DGSAM with a standard deviation of 1.296, indicating an imbalance where easier domains are overoptimized at the expense of harder ones—DASM maintains a negligible standard deviation of 0.080. This uniformity confirms that our domain-aware mechanism ensures a consistently flat landscape across all distributional shifts, preventing the
F. Computational Overhead Table VI compares computational costs across optimization strategies. SAM incurs approximately 2× the training time of Adam due to its two-step optimization. DASM introduces only 1.0% overhead over SAM, arising from the domainsupervised contrastive loss with O(B 2 ) pairwise similarity calculations, maintaining K domain feature centers via EMA, and the adaptive gap modulation. The memory overhead is negligible as the contrastive loss operates on already-extracted features. At 370.0 ms per batch compared to SAM’s 366.4 ms, DASM demonstrates that domain-aware components introduce minimal computational cost while providing substantial generalization gains. VI. D ISCUSSION AND F UTURE W ORK While DASM establishes a new benchmark, two aspects merit future exploration. First, the two-step optimization introduces computational overhead during training. As quantified in Table VI, DASM incurs only 1.0% overhead over SAM while providing substantial generalization gains; developing efficient approximation techniques remains valuable. Second, the current supervised setting requires domain labels; extending DASM to semi-supervised or open-set scenarios would broaden its applicability. Future work will investigate theoretical convergence guarantees and explore defending against unknown steganographic algorithms via domain-invariant feature generalization. VII. C ONCLUSION In this paper, we identified that the generalization bottleneck in multi-domain voice stream steganalysis stems from the model converging to saddle points, a phenomenon induced by the minute and imbalanced gaps between steganographic distributions. To address this, we proposed Domain-Aware Sharpness Minimization (DASM), a novel optimization framework that synergizes domain-supervised contrastive learning with adaptive gap modulation. By explicitly reshaping the
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY
loss landscape to widen minute feature separations and inherently prioritizing hard-to-separate domains, DASM effectively guides the optimization trajectory out of saddle points toward robust flat minima. Extensive experiments on datasets containing QIM, PMS, LSB, and AHCM algorithms demonstrate that DASM achieves superior detection accuracy and robustness, offering a resilient solution for securing VoIP communications. R EFERENCES [1] S.-B. Li, Y.-Z. Jia, J.-Y. Fu et al., “Detection of pitch modulation information hiding based on codebook correlation network,” Chinese Journal of Computers, vol. 37, no. 10, pp. 2107–2116, 2014. [2] S. Li, Y. Jia, and C.-C. J. Kuo, “Steganalysis of qim steganography in low-bit-rate speech signals,” IEEE/ACM Transactions on Audio, Speech, and Language Processing, vol. 25, no. 5, pp. 1011–1022, 2017. [3] H. Wang, Z. Yang, Y. Hu et al., “Fast detection of heterogeneous parallel steganography for streaming voice,” in Proceedings of the 2021 ACM Workshop on Information Hiding and Multimedia Security. ACM, 2021, pp. 137–142. [4] Y. Hu, Y. Huang, Z. Yang et al., “Detection of heterogeneous parallel steganography for low bit-rate voip speech streams,” Neurocomputing, vol. 419, pp. 70–79, 2021. [5] M. Wei, S. Li, P. Liu et al., “Frame-level steganalysis of qim steganography in compressed speech based on multi-dimensional perspective of codeword correlations,” Journal of Ambient Intelligence and Humanized Computing, vol. 14, no. 7, pp. 8421–8431, 2023. [6] C. Zhang and S. Jiang, “Detection of qim-based steganography in voip streams: A mobilevit-inspired model,” IEEE Signal Processing Letters, vol. 31, pp. 1735–1739, 2024. [7] Z. Fang, P. Zhou, Z. Yang, Z. Zhou, and L. Zhou, “Daef-vs: An efficient universal voip steganalysis framework based on domain-aware knowledge,” in ICASSP 2025 - 2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2025, pp. 1–5. [8] P. Zhou, Z. Fang, Z. Yang, Z. Zhou, and L. Zhou, “Efficient streaming voice steganalysis in challenging detection scenarios,” IEEE Transactions on Information Forensics and Security, vol. 20, pp. 5966–5977, 2025. [9] B. Xiao, Y. Huang, and S. Tang, “An approach to information hiding in low bit-rate speech stream,” in IEEE GLOBECOM 2008-2008 IEEE global telecommunications conference. IEEE, 2008, pp. 1–5. [10] Y. Huang, C. Liu, S. Tang, and S. Bai, “Steganography integration into a low-bit rate speech codec,” IEEE transactions on information forensics and security, vol. 7, no. 6, pp. 1865–1875, 2012. [11] X. Yi, K. Yang, X. Zhao, Y. Wang, and H. Yu, “Ahcm: Adaptive huffman code mapping for audio steganography based on psychoacoustic model,” IEEE Transactions on Information Forensics and Security, vol. 14, no. 8, pp. 2217–2231, 2019. [12] P. Foret, A. Kleiner, H. Mobahi, and B. Neyshabur, “Sharpness-aware minimization for efficiently improving generalization,” in International Conference on Learning Representations (ICLR), 2021. [13] J. Du, H. Yan, J. Feng, J. T. Zhou, L. Zhen, R. S. M. Goh, and V. Tan, “Efficient sharpness-aware minimization for improved training of neural networks,” in International Conference on Learning Representations, 2022. [Online]. Available: https: //openreview.net/forum?id=n0OeTdNRG0Q [14] P. Wang, Z. Zhang, Z. Lei, and L. Zhang, “Sharpness-aware gradient matching for domain generalization,” in CVPR, 2023. [15] T. Zhang, H. Li, Z. Wang et al., “Friendly-sam: Leveraging stochastic gradient noise for improved sharpness-aware minimization,” Advances in Neural Information Processing Systems (NeurIPS), 2024. [16] H. Rangwani, S. K. Aithal, M. Mishra, and V. B. R, “Escaping saddle points for effective generalization on class-imbalanced data,” in Advances in Neural Information Processing Systems, S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh, Eds., vol. 35. Curran Associates, Inc., 2022, pp. 22 791–22 805. [17] R. Zhang, Z. Fan, J. Yao, Y. Zhang, and Y. Wang, “Domain-inspired sharpness-aware minimization under domain shifts,” CoRR, vol. abs/2405.18861, 2024. [Online]. Available: https://doi.org/10.48550/ arXiv.2405.18861 [18] Y. Song, Y. Hwang, J. Lee, H. Lee, and D.-Y. Lim, “Dgsam: Domain generalization via individual sharpness-aware minimization,” arXiv preprint arXiv:2503.23430, 2025.
8
[19] T. Cedric, R. Adi, and I. Mcloughlin, “Data concealment in audio using a nonlinear frequency distribution of prbs coded data and frequencydomain lsb insertion,” in 2000 TENCON Proceedings. Intelligent Systems and Technologies for the New Millennium (Cat. No.00CH37119), vol. 1, 2000, pp. 275–278 vol.1. [20] N. Cvejic and T. Seppanen, “Increasing the capacity of lsb-based audio steganography,” in 2002 IEEE Workshop on Multimedia Signal Processing., 2002, pp. 336–338. [21] A. Binny and M. Koilakuntla, “Hiding secret information using lsb based audio steganography,” in 2014 International Conference on Soft Computing and Machine Intelligence. IEEE, 2014, pp. 56–59. [22] J. Jezdimirović, N. Pekez, and J. Kovačević, “Security enhancement of lsb-based audio steganography method,” in 2023 Zooming Innovation in Consumer Technologies Conference (ZINC). IEEE, 2023, pp. 77–82. [23] B. Chen and G. Wornell, “Quantization index modulation: a class of provably good methods for digital watermarking and information embedding,” IEEE Transactions on Information Theory, vol. 47, no. 4, pp. 1423–1443, 2001. [24] B. Xiao, Y. Huang, and S. Tang, “An approach to information hiding in low bit-rate speech stream,” in IEEE GLOBECOM 2008 - 2008 IEEE Global Telecommunications Conference, 2008, pp. 1–5. [25] Z. jun WU, W. GAO, and W. YANG, “Lpc parameters substitution for speech information hiding,” The Journal of China Universities of Posts and Telecommunications, vol. 16, no. 6, pp. 103–112, 2009. [Online]. Available: https://www.sciencedirect.com/science/article/pii/ S1005888508602952 [26] H. Tian, J. Liu, and S. Li, “Improving security of quantization-indexmodulation steganography in low bit-rate speech streams,” Multimedia Syst., vol. 20, no. 2, p. 143–154, Mar. 2014. [Online]. Available: https://doi.org/10.1007/s00530-013-0302-8 [27] C. Zhang, S. Jiang, and Z. Chen, “Spm: estimating payload locations of qim-based steganography in low-bit-rate compressed speeches,” Multimedia Tools and Applications, vol. 83, no. 37, pp. 85 227–85 252, 2024. [Online]. Available: https://doi.org/10.1007/s11042-024-19501-4 [28] A. Nishimura, “Data hiding in pitch delay data of the adaptive multi-rate narrow-band speech codec,” in 2009 fifth international conference on intelligent information hiding and multimedia signal processing. IEEE, 2009, pp. 483–486. [29] Y. Huang, C. Liu, S. Tang, and S. Bai, “Steganography integration into a low-bit rate speech codec,” IEEE transactions on information forensics and security, vol. 7, no. 6, pp. 1865–1875, 2012. [30] A. Janicki, “Pitch-based steganography for speex voice codec,” Security and communication networks, vol. 9, no. 15, pp. 2923–2933, 2016. [31] Z. Wu, C. Zhang, and J. Guo, “A method of speech information hiding in inactive frame based on pitch modulation,” International Journal of Information and Computer Security, vol. 22, no. 1, pp. 1–27, 2023. [32] X. Yi, K. Yang, X. Zhao, Y. Wang, and H. Yu, “Ahcm: Adaptive huffman code mapping for audio steganography based on psychoacoustic model,” IEEE Transactions on Information Forensics and Security, vol. 14, no. 8, pp. 2217–2231, 2019. [33] M. Qiao, W. Zhang, T. Zhang et al., “Mdi2: A high-dimensional feature for voip steganalysis,” IEEE Transactions on Information Forensics and Security, vol. 14, no. 10, pp. 2589–2603, 2019. [34] Y. Liu, Y. Huang, and X. Zhang, “Co-occurrence matrix based steganalysis for low-bit-rate voip streams,” in Proceedings of the ACM Workshop on Information Hiding and Multimedia Security, 2020, pp. 45–56. [35] N. S. Keskar, D. Mudigere, J. Nocedal et al., “On large-batch training for deep learning: Generalization gap and sharp minima,” International Conference on Learning Representations (ICLR), 2017. [36] Y. Wen, K. Zhang, Z. Li, and Y. Qiao, “A discriminative feature learning approach for deep face recognition,” in European conference on computer vision. Springer, 2016, pp. 499–515. [37] M. Caron, I. Misra, J. Mairal, P. Goyal, P. Bojanowski, and A. Joulin, “Unsupervised learning of visual features by contrasting cluster assignments,” Advances in neural information processing systems, vol. 33, pp. 9912–9924, 2020. [38] S. Ben-David, J. Blitzer, K. Crammer, A. Kulesza, F. Pereira, and J. W. Vaughan, “A theory of learning from different domains,” Machine Learning, vol. 79, no. 1, pp. 151–175, 2010. [39] H. Li, Z. Xu, G. Taylor, C. Studer, and T. Goldstein, “Visualizing the loss landscape of neural nets,” in Advances in Neural Information Processing Systems, S. Bengio, H. Wallach, H. Larochelle, K. Grauman, N. Cesa-Bianchi, and R. Garnett, Eds., vol. 31. Curran Associates, Inc., 2018. [Online]. Available: https://proceedings.neurips.cc/paper files/paper/2018/file/a41b3bb3e6b050b6c9067c67f663b915-Paper.pdf
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY
A PPENDIX A. Empirical Analysis of Domain Discrepancies via Proxy ADistance To empirically validate the challenges of minute and imbalanced domain gaps articulated in the Introduction, and to elucidate why generic Sharpness-Aware Minimization methods fail in multi-domain VoIP steganalysis, we conducted a rigorous quantitative analysis using the Proxy A-Distance (PAD) [38]. PAD is a metric defined as dA = 2(1−2ϵ), where ϵ represents the generalization error of a domain classifier trained to distinguish between two domains. A PAD value of 0 implies the domains are indistinguishable, while a value of 2 indicates perfect separability. Fig. 4 visualizes the pairwise PAD matrices calculated on model features under varying embedding rates. These heatmaps reveal three critical findings regarding the optimization landscape. First, the heatmaps demonstrate a strong correlation between small domain gaps and high detection difficulty. Across all embedding rates, the PAD between PMS and Cover is consistently the lowest, decreasing from 1.064 at ER=0.5 to 0.328 at ER=0.1. This indicates that PMS features are statistically almost indistinguishable from Cover, making it the most challenging steganographic algorithm. In optimization terms, these minute gaps correspond to regions with vanishing gradients where standard optimizers struggle to find descent directions, leading to the saddle point convergence observed in our Hessian analysis. Second, comparing Figs. 4a–4c, we observe systemic compression of the feature space as embedding rate decreases. At ER=0.1, the gaps for QIM and PMS collapse towards zero while AHCM remains relatively distinct. This non-uniform compression creates a dynamic optimization landscape where static perturbation strategies fail to adapt to varying signal-tonoise ratios. Third, the data reveals drastic polarization in domain discrepancies that renders generic SAM suboptimal. At ER=0.1, the gap for AHCM is approximately 5.5 times larger than that for PMS. Standard SAM applies isotropic perturbations based on the average gradient, which is dominated by the easy AHCM domain with large gradients. Consequently, the optimization trajectory is biased towards widening the already sufficient margin of AHCM while neglecting the sharp minima associated with PMS. This necessitates our Adaptive Domain Gap Modulation to dynamically up-weight hard domains and Domain-Supervised Contrastive Learning to explicitly expand minute gaps during perturbation.
9
with their high detection difficulty. Standard optimization struggles to navigate the intricate curvature induced by minute steganographic perturbations, often converging to unstable sharp minima. The landscapes associated with DASM demonstrate significant smoothing across all domains. By explicitly maximizing the loss within the perturbation neighborhood while balancing domain gaps, DASM transforms the chaotic loss geometry into wide, flat basins. Even for PMS, the rugged terrain is regularized into a smoother surface. This geometric flatness facilitates escape from saddle points and underpins the superior generalization observed in our main experiments. C. Performance Dynamics Across Embedding Rates Fig. 6 illustrates detection accuracy across five embedding rates from 0.1 to 0.5 for Adam, SAM, and DASM. D. Detailed t-SNE Feature Space Visualization We present 3-D t-SNE visualizations of penultimate layer features at ER=0.5, comparing Adam, SAM, DAEF-VS, and DASM. Gray points represent Cover samples while colored points represent Stego samples. Adam Baseline. Fig. 7 shows significant overlap between Cover and Stego samples across all domains. This entanglement is particularly severe for PMS and QIM, correlating with the near-random detection accuracy observed in our main experiments. Standard SAM. Fig. 8 shows improved separation for AHCM and LSB compared to Adam, but PMS remains entangled. This validates that isotropic perturbations fail to address imbalanced domain gaps. DAEF-VS. Fig. 9 shows that despite its specialized architecture, DAEF-VS fails to achieve consistent separation, particularly for PMS. DASM. Fig. 10 demonstrates superior feature organization with clearly separated clusters across all domains. Even for PMS, DASM maintains structured separation, directly correlating with our superior detection accuracy. The t-SNE visualizations reveal a clear progression: Adam produces entangled features with poor discriminability; SAM improves separation for easier domains but fails on PMS and QIM; DAEF-VS demonstrates that sophisticated architectures alone cannot overcome optimization challenges; DASM achieves consistent separation across all domains. The absence of mode collapse in PMS and QIM under DASM validates our adaptive gap modulation in preventing easier domains from dominating the optimization.
B. Loss Landscape Visualization We employ the visualization technique proposed by Li [39] to plot the 3-D loss landscapes around converged model parameters at ER=0.5. Fig. 5 presents the comparison between Adam and DASM across all four steganographic domains. For the baseline Adam optimizer, the loss surfaces exhibit pronounced non-convexity characterized by numerous local maxima and saddle points. This geometric pathology is particularly acute in PMS and QIM domains, correlating
E. Visual Analysis of Ablation Study As illustrated in Fig. 11, we provide a visual performance comparison of the variants discussed in Section V-C. The transition from the Adam Baseline (82.05%) to the “DSCL Only” variant (89.13%) highlights the critical importance of preserving inter-domain feature separability in multi-domain VoIP steganalysis. The “ADGM Only” variant further improves the accuracy to 90.68%, validating the efficacy of
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY
(a) ER = 0.1
10
(b) ER = 0.3
(c) ER = 0.5
Fig. 4. Pairwise PAD matrices across embedding rates. Lighter colors indicate smaller domain gaps, correlating with higher detection difficulty. PMS consistently exhibits the minimum gap, validating its status as the most challenging domain.
(a) PMS (Adam)
(b) QIM (Adam)
(c) LSB (Adam)
(d) AHCM (Adam)
(e) PMS (DASM)
(f) QIM (DASM)
(g) LSB (DASM)
(h) AHCM (DASM)
Fig. 5. Loss landscape at ER=0.5. Top row: Adam converges to sharp minima with pronounced non-convexity in PMS and QIM. Bottom row: DASM smoothes the loss surfaces across all domains, widening basins and promoting convergence to flat minima.
adaptive weighting in guiding the optimizer toward a flat minimum that accounts for polarized domain gaps. The complete DASM framework reaches the peak accuracy of 93.06%, demonstrating a clear synergy between LDSCL and LADGM . F. Detailed Hyperparameter Sensitivity Trends This section expands upon the sensitivity analysis in Section V-D, characterizing the impact of ρ and τ on detection performance. Analysis of Perturbation Radius ρ. Fig. 12a shows the accuracy dynamics as ρ varies within {0.01, 0.03, 0.05, 0.08} while fixing τ = 0.5. The results indicate that ρ = 0.03
is the optimal radius for sharpness-aware estimation in this task. A minimal radius (ρ = 0.01) fails to provide a sufficient regularization effect to escape the sharp local minima associated with subtle steganographic artifacts. Conversely, an excessively large radius (ρ = 0.08) tends to over-smooth the loss landscape, which may inadvertently obscure the microscopic statistical deviations essential for distinguishing steganographic audio from cover audio. DASM maintains high stability within the [0.03, 0.05] range, suggesting a robust neighborhood for locating flat basins. Analysis of Contrastive Temperature τ . Fig. 12b illustrates the sensitivity to τ with ρ fixed at 0.03. The peak
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY
(a) QIM
(b) PMS
11
(c) LSB
(d) AHCM
Fig. 6. Detection accuracy across embedding rates from 0.1 to 0.5. DASM consistently outperforms Adam and SAM across all domains. The advantage is most pronounced in PMS and QIM at low embedding rates where steganographic signals are weakest.
(a) AHCM
(b) LSB
(c) PMS
(d) QIM
Fig. 7. t-SNE visualization for Adam. Severe overlap between Cover and Stego features indicates convergence to suboptimal solutions.
(a) AHCM
(b) LSB
(c) PMS
(d) QIM
Fig. 8. t-SNE visualization for SAM. Improved separation for AHCM and LSB, but PMS remains entangled due to limitations of isotropic perturbations.
performance at τ = 0.1 signifies the most effective scaling for the similarity distribution. As τ increases toward 0.5, the contrastive signal becomes diffused, which hinders the model’s ability to pull apart domains with extremely low discrepancies, such as PMS and Cover. On the other hand, an overly low τ (0.05) sharpens the distribution to an extent that makes the loss highly sensitive to hard-negative samples, potentially introducing optimization noise. These trends confirm that τ = 0.1 provides the ideal balance for enforcing domain separability without compromising optimization stability. G. Sharpness Analysis In this section, we provide the detailed quantitative measurements of the loss landscape sharpness referenced in Section V-E. Table VII lists the zeroth-order sharpness values for
individual domains as well as the aggregated metrics. The sharpness is calculated as max∥ϵ∥2 ≤ρ L(θ + ϵ) − L(θ) with ρ = 0.05 on the test set. Instability of Prior Methods. A critical observation from the table is the high variance exhibited by existing domain generalization methods. For instance, while DGSAM achieves a reasonable sharpness of 0.643 on PMS, it spikes significantly to 3.670 on QIM and 3.839 on LSB, resulting in a high standard deviation of 1.296. Similarly, SAGM suffers from extremely high sharpness across all domains with a mean of 8.303. This suggests that without adaptive modulation, these optimizers may achieve “pseudo-flatness” by overfitting to specific domain directions while leaving the loss landscape sharp and vulnerable in others. Isotropic Flatness of DASM. In contrast, DASM demonstrates true isotropic flatness. It does not merely minimize the
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY
(a) AHCM
12
(b) LSB
(c) PMS
(d) QIM
Fig. 9. t-SNE visualization for DAEF-VS. Specialized architecture alone yields limited improvement for difficult domains.
(a) AHCM
(b) LSB
(c) PMS
(d) QIM
Fig. 10. t-SNE visualization for DASM. Clear separation across all domains including PMS validates the effectiveness of domain-aware sharpness minimization.
(a) Sensitivity to ρ Fig. 11. Ablation Study: Average Accuracy at ER=0.5.
(b) Sensitivity to τ
Fig. 12. Hyperparameter sensitivity analysis of DASM.
average loss but regularizes the landscape uniformly. As shown in the table, DASM achieves the lowest sharpness values consistently across every single domain, such as 0.229 on QIM and 0.147 on LSB, with a negligible standard deviation of 0.080. This confirms that the combination of contrastive learning and adaptive gap modulation effectively eliminates sharp curvature in all principal directions, providing a rigorous geometric guarantee for the model’s robustness against diverse steganographic distribution shifts. H. Nomenclature Table VIII summarizes the mathematical notations used throughout this paper.
TABLE VII Z EROTH -O RDER S HARPNESS C OMPARISON (ρ = 0.05). L OWER VALUES I NDICATE F LATTER M INIMA . DASM ACHIEVES THE L OWEST S HARPNESS AND VARIANCE . Alg. Adam SAM DISAM SAGM FSAM DGSAM DASM
QIM
Individual Domains PMS LSB AHCM
2.326 0.527 2.611 9.675 3.271 3.670 0.229
2.272 0.754 0.314 9.114 0.750 0.643 0.371
3.142 0.477 2.948 9.186 3.409 3.839 0.147
1.596 2.465 1.791 5.238 2.509 3.289 0.262
Mean (Std)
Total
2.33 (0.55) 1.06 (0.82) 1.92 (1.02) 8.30 (1.78) 2.49 (1.06) 2.86 (1.30) 0.25 (0.08)
0.847 0.619 1.895 8.248 2.300 2.831 0.086
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY
13
TABLE VIII M ATHEMATICAL N OTATIONS AND H YPERPARAMETERS .
Symbol Description
Symbol Description
Problem Formulation θ Model parameters D Training dataset: tuples (x, y, d) B Mini-batch sampled from D B Batch size S / K Number of steganographic domains
fθ (·) zi z̄k di
Neural network parameterized by θ L2-normalized feature of sample xi Mean feature of domain k in the batch Domain index for sample i
Loss Functions Ltotal Composite total loss LCE Cross-entropy classification loss
LDSCL LADGM
Domain-supervised contrastive loss Adaptive domain gap modulation loss
Sharpness-Aware Optimization ρ Perturbation radius ϵ̂ Adversarial weight perturbation
η H
Learning rate Hessian matrix of the loss landscape
Contrastive Learning τ Temperature for similarity scaling P (i) Positive samples sharing domain with anchor i
N (i) Negative samples from different domains Si+ , Si− Aggregated positive/negative similarities
Domain Gap Modulation ck Running centroid for domain k ccover Running centroid for cover domain µ EMA momentum coefficient gk Domain gap between domain k and cover Evaluation Metrics dA Proxy A-Distance for domain discrepancy
τg wk ξ
Adaptive temperature for gap weighting Adaptive weight for domain k Numerical stability constant