Research map / Image generation / Fast diffusion sampling
Hiding Images in Diffusion Models by Editing Learned Score Functions
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Hides secret images in pixel-space DDPMs by editing the score function at one chosen timestep, using a hybrid gradient-selected layer plus LoRA fine-tuning to preserve model fidelity.
Problem
Hiding images in diffusion models with high extraction accuracy, model fidelity, and hiding efficiency; prior diffusion-based hiding methods entangle hiding with the full multi-step reverse process and are slow and degrade fidelity.
Approach
Embed a secret image at a single secret timestep of the reverse diffusion process by editing the learned score function, with the secret key being a noise seed and timestep; select sensitive layers by accumulated squared gradients and fine-tune them with LoRA, regularized by a fidelity loss against the original score function.
Key results
- Extraction PSNR of 52.90 dB for 32x32 images and 39.33 dB for 256x256 images, outperforming all nine compared baselines.
- FID of 4.77 versus 4.79 for the original DDPM on CIFAR10, while FID rises to 8.39 vs 7.46 at 256x256.
- Embedding takes 0.04 and 0.18 GPU hours for 32x32 and 256x256 images, over 50 times faster than the second-best method WDM.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Edit the learned score function at a selected timestep to embed the secret image | DDPM · 32 × 32 secret images | extraction PSNR: 47.72 -> 52.90 | Helped |
| Edit the learned score function at a selected timestep to embed the secret image | DDPM · 256 × 256 secret images | extraction PSNR: 37.42 -> 39.33 | Helped |
| Use 1 sensitivity-accumulation iteration instead of 50 (ablation) | Ours · 32 × 32 secret images | extraction PSNR: 52.90 -> 40.93 | Hurt |
| Increase sensitivity accumulation from 50 to 100 iterations (ablation) | Ours · 32 × 32 secret images | extraction PSNR: 52.90 -> 53.08 | No clear effect |
| Select 5 sensitive layers instead of 15 (ablation) | Ours · 32 × 32 secret images | extraction PSNR: 52.90 -> 47.48 | Hurt |
| Select 45 sensitive layers instead of 15 (ablation) | Ours · 32 × 32 secret images | model fidelity PSNR: 31.06 -> 27.87 | Hurt |
| Use 1,000 PEFT iterations instead of 2,000 (ablation) | Ours · 32 × 32 secret images | extraction PSNR: 52.90 -> 49.31 | Hurt |
| Increase PEFT iterations from 2,000 to 5,000 (ablation) | Ours · 32 × 32 secret images | model fidelity PSNR: 31.06 -> 25.88 | Hurt |
| Use full fine-tuning instead of hybrid PEFT (ablation) | Ours · 32 × 32 secret images | model fidelity PSNR: 31.06 -> 23.98 | Hurt |
| Add Gaussian noise with mean zero and variance 100 to the secret image (ablation) | Ours · 32 × 32 secret images | extraction PSNR: 52.90 -> 51.86 | Hurt |
| Hide 4 images for different recipients instead of 1 (ablation) | Ours · 256 × 256 secret images | model fidelity PSNR: 23.31 -> 17.78 | Hurt |
| Use DDPM++ instead of DDPM (ablation) | Ours · 32 × 32 secret images | extraction PSNR: 52.90 -> 53.05 | No clear effect |
Surprising findings
- Hiding a noisy secret image (Gaussian noise variance 100) barely degrades extraction accuracy (51.86 dB vs 52.90 dB PSNR).
Limitations
- Robustness to model perturbations such as noising, pruning, and compression is not addressed.
- Fidelity degrades noticeably as more secret images are embedded (e.g., 256x256 FID rises to 17.78 with 4 images).
- Evaluated only on pixel-space DDPM-family models at two resolutions.
Experimental setup
Datasets: CIFAR10 LSUN bedroom COCO DIV2K LSUN Church Places
Benchmarks: CIFAR10 LSUN bedroom
Metrics: PSNR SSIM LPIPS DISTS FID embedding time (GPU hours)
Baselines: Baluja17 HiDDeN Weng19 HiNet PRIS Chen22 BadDiffusion TrojDiff WDM
Builds on: DDPM LoRA rank stabilization (rsLoRA) learning rate decoupling (LoRA+) gradient-based parameter sensitivity (SNIP-style)
Closest papers by meaning
- DiffusionGuard: A Robust Defense Against Malicious Diffusion-based Image Editing (ICLR 2025 · similarity 0.89)
- Erasing Undesirable Influence in Diffusion Models (CVPR 2025 · similarity 0.89)
- MimicDiffusion: Purifying Adversarial Perturbation via Mimicking Clean Diffusion Model (CVPR 2024 · similarity 0.88)
- LoRID: Low-Rank Iterative Diffusion for Adversarial Purification (AAAI 2025 · similarity 0.88)
- Simplified and Generalized Masked Diffusion for Discrete Data (NeurIPS 2024 · similarity 0.88)
- Variance as a Catalyst: Efficient and Transferable Semantic Erasure Adversarial Attack for Customized Diffusion Models (ICML 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.