PaperlayerView exact revision on arXiv

Source-linked AI summary

Secret-Stego Dissimilarity as a Design Axis: Invertible Coverless Image Steganography with Diffusion Models

Hongxin Xu, Jianping Mei, Can Wang, Defang Chen

arXiv:2608.13597v1eess.IVcs.AIcs.CRcs.CVcs.MM

TL;DR

Diffusion-based coverless steganography can leave stego images visually similar to their secrets, risking leakage. InvCISD uses invertible latent mapping to increase dissimilarity while preserving stego quality and recovery, achieving 0.871 LPIPS versus 0.481 and 0.487 for two baselines.

  • Problem

    Existing diffusion-based CIS methods preserve secret structure and semantics, making substantial secret–stego dissimilarity difficult without degrading stego naturalness or recovery.

  • Method

    InvCISD maps each secret to an unrelated reference in diffusion latent space using invertible LIMNet, trained jointly with diffusion inversion and generation modules.

  • Results

    0.871 LPIPS versus 0.481 for CRoSS and 0.487 for DiffStega, while InvCISD achieves the highest visual dissimilarity and best stego quality on four of five metrics.

  • Takeaways & Limitations

    Secret–stego dissimilarity is a meaningful design objective for CIS alongside stego quality and secret reconstruction.

  • Takeaways & Limitations

    Recovery may fail under image perturbations or mismatched prompts, seeds, checkpoints, or inversion settings between sender and receiver.

Abstract

from arXiv · show

Coverless image steganography (CIS) synthesizes a stego image rather than modifying an existing cover image, enabling authorized recipients to reconstruct the original secret image from the stego. Existing diffusion-based CIS methods can generate natural-looking stego images but preserve substantial visual similarity to the secret image. This resemblance risks exposing structural and semantic cues, giving rise to security vulnerabilities that cannot be evaluated solely via recovery fidelity. Achieving substantial visual dissimilarity between the secret and stego images without compromising stego quality and recovery fidelity remains challenging. To address this issue, we propose InvCISD, an invertible diffusion framework that couples the latent representations of the secret and an irrelevant reference image with an invertible network called LIMNet. We first train LIMNet in diffusion latent space, followed by end-to-end fine-tuning of the entire network, i.e., LIMNet integrated diffusion inversion and generation modules. Experiments demonstrate that the proposed method substantially reduces secret-stego visual similarity, improves stego quality, and retains satisfactory secret reconstruction quality. Our further investigation shows that all evaluated methods are highly detectable by the CIS-oriented steganalysis model, indicating that resistance against targeted steganalysis constitutes a critical direction for future CIS research.

Introduction

Coverless image steganography synthesizes plausible stego images while enabling full-image secret recovery, but diffusion-based methods often retain recognizable secret cues. InvCISD addresses this trade-off by mapping secrets to unrelated diffusion-latent references through an invertible network, increasing dissimilarity while preserving stego quality and reconstruction.

  • Motivation: Coverless image steganography generates stego images without designated covers, reducing hidden-message detection risk from cover leakage while supporting recoverable full-image secrets.Diffusion-based CIS uses pretrained diffusion models to synthesize plausible stego images conditioned on reference images.
  • Problem: Diffusion-based CIS typically applies local or subtle secret-latent modifications to preserve reconstruction quality, causing high visual similarity and recognizable structural and semantic secret cues.This visible secret leakage creates a security concern beyond stego plausibility and recovery fidelity.
  • Method: InvCISD maps the secret to an unrelated, potentially distant diffusion-latent reference whose appearance governs stego generation, while invertibility supports reliable recovery.The framework explicitly incorporates secret–stego dissimilarity into diffusion-based CIS design.
  • Results: InvCISD achieves substantially greater secret–stego dissimilarity while maintaining satisfactory stego quality and secret reconstruction quality.The reported experiments evaluate the method comprehensively against the stated objective of increasing dissimilarity without sacrificing generation or recovery quality.
  • Method: InvCISD uses LIMNet, an invertible latent mapping network, with tailored losses and a training pipeline integrating the mapping into pretrained diffusion backbones.The pipeline first optimizes the invertible mapping and then supports its seamless integration with diffusion generation and inversion modules.

Related Work

Prior work spans cover-based steganography, invertible architectures, and diffusion-based coverless hiding. However, existing diffusion-based CIS methods rarely prioritize secret-stego visual dissimilarity, while diffusion inversion and conditioning provide components for integrating latent hiding with pretrained decoders.

  • Cover-based Image steganography: Cover-based steganography embeds secret messages through subtle modifications to selected cover images, including spatial or frequency-domain coefficients and end-to-end encoder-decoder hiding.Early approaches use least significant bits or transform coefficients, while deep learning shifted toward end-to-end encoder-decoder frameworks.
  • Cover-based Image steganography: Invertible architectures improve reconstruction consistency and capacity for image-secret hiding, but cover-based methods face elevated detection risks from cover leakage.Several works apply invertible architectures to cover-based steganography while identifying cover leakage as a security risk.
  • Diffusion-based CIS: Diffusion and latent diffusion models provide strong image priors, motivating generative latent spaces for controllable, robust, and training-free coverless hiding.CRoSS uses diffusion generation for controllability, robustness, and security-oriented hiding objectives, while DiffStega studies training-free coverless hiding.
  • Diffusion-based CIS: Existing diffusion-based CIS works rarely prioritize secret-stego visual dissimilarity in their core design.This limitation defines the related-work gap addressed by the paper’s design axis.
  • Diffusion inversion and conditioning: Diffusion inversion and image conditioning enable integration of invertible latent hiding with pretrained diffusion decoders.EDICT improves inversion consistency through coupled transformations, while IP-Adapter provides lightweight image prompting for text-to-image diffusion models.

Method

InvCISD couples a secret image with a shared-condition reference in diffusion latent space through an invertible LIMNet, using the reference to anchor stego content and the mapping to preserve recoverable secret information. Two-stage training and regularization address diffusion errors and the receiver’s sampled auxiliary latent, while stronger reference editing increases dissimilarity at a stego-quality cost.

  • Recovery stage: The receiver regenerates the reference from the shared prompt and seed, samples z′ ∼N(0, I) instead of receiving z, and inverts LIMNet to reconstruct the secret.Because sampled z′ is not generally the embedding-time z, recovery is not an exact inverse even when the received stego equals the transmitted stego.
  • Framework: InvCISD inverts the secret and shared-condition reference into diffusion latents, then connects them with the invertible network LIMNet.The reference supplies the visible basis for the stego image, while the invertible mapping preserves information needed for secret recovery.
  • Invertible architecture: LIMNet composes eight affine coupling blocks whose inverse reuses the same subnetworks in reverse order, avoiding a separate recovery network.Each block contains four residual dense subnetworks for scale and translation branches, with five convolutional layers per subnetwork.
  • Hiding stage: The stego latent is formed as ℓh = ℓr + f, with the reference latent anchoring visible content and the residual carrying information for the inverse mapping.An IP-Adapter feature extracted from the reference conditions diffusion decoding of the stego latent.
  • Design trade-offs: Stronger IP-Adapter editing improves visual dissimilarity but tends to reduce stego quality by moving latents away from accurately invertible regions.The trainable regularizer Rz directly limits expected squared error from replacing z with z′, but excludes diffusion inversion and VAE-decoding errors.
  • Training: Training first optimizes LIMNet on cached latent pairs, then fine-tunes the full network with diffusion inversion and generation to account for image-domain errors.End-to-end fine-tuning additionally penalizes the difference between the decoded stego image and its reference.

Experiments

Experiments evaluate leakage, reconstruction, stego quality, secret-stego dissimilarity, and steganalytic detectability. InvCISD substantially increases visual dissimilarity while preserving competitive stego quality and secret reconstruction, though all evaluated methods remain readily detectable by the tested steganalysis model.

  • Main comparison: InvCISD reaches LPIPS 0.871 versus 0.481 for CRoSS and 0.487 for DiffStega, while achieving the best stego quality on four of five metrics.The four metrics are PSNR, SSIM, LPIPS, and CLIPScore; reconstruction remains competitive.
  • Ablation: Removing LIMNet lowers stego PSNR from 17.44 to 13.71 dB and LPIPS from 0.871 to 0.708, while reconstruction PSNR rises to 19.62 dB.Removing Rz instead raises stego PSNR to 20.57 dB but lowers reconstruction PSNR to 17.83 dB, showing reconstruction alone misses the objective.
  • Editing strength: Increasing editing strength from 0.4 to 0.5 raises LPIPS from 0.857 to 0.871 with nearly unchanged reconstruction PSNR, whereas strength 0.6 lowers reconstruction PSNR by 0.50 dB.At larger strengths, dissimilarity saturates while reconstruction quality declines, motivating the default s = 0.5.
  • Semantic distance: High-tier prompt distributions shift upward by +1.36 to +1.74 standard deviations relative to paired low-tier values across CLIP and DINOv2, with InvCISD consistently more dissimilar.The tier manipulation is verified across all three methods and both embedding models.
  • Detectability: The tested XuNet steganalysis setting readily distinguishes all evaluated methods from generated references, but default-setting evaluation does not establish that visual dissimilarity causes detectability.XuNet uses five-fold cross-validation, attacker resources from 16 to 256 leaked pairs, and both prompt tiers.

Discussion and Limitations

The discussion identifies a tunable reconstruction–stego-quality trade-off and several reconstruction limitations, including sensitivity to perturbations and sender–receiver setting mismatches. It also warns that all methods become detectable with sufficient attacker data and that steganography can enable covert data exfiltration.

  • Trade-offs: Weaker auxiliary-latent regularization improves stego quality but reduces reconstruction quality, whereas stronger regularization preserves recovery with a moderate stego-quality penalty.The regularization strength controls the balance between minimizing stego distortion and maintaining recovery.
  • Forensic evaluation: All methods become detectable with sufficient attacker data in XuNet evaluation using leaked reference–stego pairs.The evaluated attacker-data range is 16–256 pairs, with results reported for the low tier.
  • Reconstruction limitations: Recovery is sensitive to received-image perturbations and requires matching the sender’s prompt, seed, checkpoints, inversion settings, and editing strength.Accurate inversion into diffusion latent space is necessary for reconstruction.
  • Reconstruction limitations: Large editing strengths can increase secret–stego distance but produce blurred or semantically incomplete reconstructions because the stego becomes difficult to invert.The dissimilarity gain therefore comes with an inversion and reconstruction penalty.
  • Reconstruction limitations: Weak reference conditioning can increase visual separation while reducing naturalness or prompt consistency, and mismatched sender–receiver settings can cause recovery failure.Such failures may occur even when the received image appears natural.
  • Ethics and misuse: The work frames steganography as susceptible to covert data exfiltration and advocates controlled research and stronger forensic evaluation rather than an operationally secure covert channel.Its stated purpose is to expose visible secret leakage as an additional failure mode.

Conclusion and Future Work · Appendix

InvCISD improves secret–stego visual dissimilarity through invertible latent diffusion, using an independent reference to guide stego content while preserving recoverable information. Future work targets broader evaluation, perceptual and extraction metrics, receiver mismatch, and robustness to channel distortions and diffusion-inversion sensitivity.

  • Conclusion and Future Work: InvCISD enhances secret–stego visual dissimilarity in diffusion-based coverless image steganography.It uses an invertible latent diffusion framework.
  • Conclusion and Future Work: An independently generated reference guides the visible content of the stego image in latent space.The reference is coupled with the secret during processing.
  • Conclusion and Future Work: An inverse mapping retains the information required to recover the secret from the stego image.This recovery mechanism is integrated into the latent-space framework.
  • Conclusion and Future Work: Unistega_full supports training and systematic evaluation of visual dissimilarity.It is introduced alongside InvCISD as an evaluation resource.
  • Conclusion and Future Work: Future evaluations should measure variation across random seeds and auxiliary-latent samples.They should also add perceptual reconstruction and extraction-failure metrics.
  • Conclusion and Future Work: Future work should evaluate mismatched receiver settings and improve robustness through differentiable channel-distortion training.Reducing diffusion-inversion sensitivity is also identified as necessary for robustness.

A Reconstruction Error Bound

The appendix establishes that bounded scale outputs and Lipschitz subnetworks make the LIMNet inverse Lipschitz, yielding a reconstruction-error bound controlled by auxiliary-latent substitution. The result supports minimizing the auxiliary-latent regularization loss but does not certify a numerical trained-network constant.

  • Assumptions: Lipschitz subnetworks and bounded scale outputs are the two design conditions used in the reconstruction-error analysis.Spectral-normalized layers and standard activations are 1-Lipschitz, while scale outputs satisfy ∥ρ(·)∥∞≤C and exp(ρ) lies in [e^−C,e^C].
  • Inverse Lipschitzness: Under these assumptions, each affine coupling-block inverse is Lipschitz because its recovery steps compose Lipschitz operations with bounded exponential scaling.The per-block inverse has a finite Lipschitz constant Li.
  • Inverse Lipschitzness: The full LIMNet inverse is Lipschitz, with an overall constant no larger than the product of its block-inverse constants.This follows by applying the composition lemma across the N-fold inverse composition.
  • Reconstruction error: With an ideal channel and preserved f, exact invertibility makes secret reconstruction error depend on the auxiliary-latent mismatch z−z′ when z′∼N(0,I).The inverse reconstruction uses G([f,z′]), while exact inversion recovers [ℓs,ℓr] from G([f,z]).
  • Limitation: The bound is existential rather than a numerical certificate because the implementation uses clamped-exponential scaling but does not currently enforce spectral normalization.Minimizing Rz shrinks E∥z−z′∥ and therefore the bound, motivating the loss design.

B Robustness

The robustness evaluation measures secret reconstruction PSNR after common channel distortions. All methods use default settings and are tested on a 100-image subset of the test set.

  • B Robustness: All methods are evaluated at their default settings on a 100-image subset of the test set.
  • B Robustness: Secret reconstruction robustness is evaluated using PSNR after common channel distortions.Table 3 reports the results in decibels.

C Complete Ablation Results

Table 4 provides complete ablation results across all metrics and identifies inference-time ablations performed on the same checkpoint.

  • C Complete Ablation Results: Table 4 extends the main-text ablation study with results for all metrics.
  • C Complete Ablation Results: Columns marked † denote inference-time ablations evaluated on the same checkpoint.

D Effect of Editing Strength

Table 5 evaluates all reported metrics across six editing strengths, spanning s = 0.3 to 0.8.

  • D Effect of Editing Strength: Table 5 reports all metrics for editing strengths s ∈ {0.3, 0.4, 0.5, 0.6, 0.7, 0.8}.The evaluation covers six discrete editing-strength settings.
  • D Effect of Editing Strength: The tested editing strengths range from 0.3 to 0.8.The passage specifies the complete set of evaluated strengths.
  • D Effect of Editing Strength: Editing strength is treated as the experimental variable in the metric evaluation.Metrics are reported across varying values of s.

E Detectability

InvCISD detectability is evaluated using XuNet detection accuracy and minimum detection error Pe as leaked reference–stego pairs increase across low and high tiers. At 256 leaked pairs, Pe converges across tiers for all methods.

  • Detection evaluation: At 256 leaked reference–stego pairs, Pe values converge across the low and high tiers for all methods.The convergence is reported for the minimum detection error metric.
  • Detection evaluation: Figure 8 evaluates XuNet detection accuracy and minimum detection error Pe against the number of leaked reference–stego pairs in low and high tiers.Shaded bands represent ±1 standard deviation across folds and seeds.
Loading 2608.13597v1…