Which attack presumes that the message and the stego-medium are available, enabling detection of the technique used to hide the message?

• A. Stego-only Attack
• B. Known-message Attack
• C. Known-stego Attack
• D. Chosen-stego Attack

Answer: (C)

When you can compare the hidden payload with the carrier you’ve been given, you can directly see how the hiding was done. This kind of analysis relies on having both the stego-medium and the message that was embedded, so you can map the changes in the carrier to the bits of the message and identify the specific embedding technique used.

Having the payload lets you test how its bits were placed into the cover and reveal footprints left by the method, whether it’s subtle bit-level changes, frequency-domain modifications, or another scheme. For example, a straightforward LSB substitution would show a clear, bit-by-bit correlation between the message and the stego bits, while a transform-domain approach would reveal patterned changes in certain coefficients that align with the payload.

If you only had the stego-medium, you’d be limited to detecting that something is hidden without confidently inferring the technique. If you know the message but don’t have the stego object, you can’t observe the exact changes made to the carrier. If you could choose the stego to analyze, that’s a different setup that’s not the situation described.