Research map / Image generation / Autoregressive and latent generation
MDDM: Practical Message-Driven Generative Image Steganography Based on Diffusion Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes MDDM, a training-free generative image steganography method that encodes a binary message into the initial Gaussian noise of a diffusion model via a shared Cardan grille, and recovers it by DDIM/EDICT inversion.
Problem
Existing diffusion-based generative image steganography struggles with extraction accuracy, controllability of generated content, and practicality, since prior methods require reproducing the full generation with the same seed and prompt.
Approach
Map secret bits to truncated-Gaussian values at Cardan-grille positions in the initial noise, so the stego image is produced by standard DDIM sampling with any prompt; the receiver inverts the image and reads signs at the grille positions, without needing seed or prompt.
Key results
- MDDM-LC on SD-V1.5 at 512x512 achieves 0.9987 extraction accuracy with 745 bits and 0.9946 with 5199 bits.
- Under Table 1 attacks, MDDM-LC (48 bits, SD-V1.4) reaches accuracy 0.99-1.00 across JPEG, resize, blur, drop, brightness, and rotation.
- Steganalysis detection rates (ZhuNet, SiaStegNet, XuNet, YeNet, StegNet, SRNet) are around 50%, indicating indistinguishability.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use MDDM-LC instead of LaWa | SD-V1.4 GIS · 512 × 512 attacks in Table 1 | extraction accuracy: PNG: 1.00 vs 1.00; JPEG: 1.00 vs 1.00; Resize: 0.99 vs 1.00; GB: 1.00 vs 0.99; Drop: 1.00 vs 1.00; Brightness: 1.00 vs 1 | Mixed |
| Use MDDM-LC instead of GS | SD-V2.1 GIS · 512 × 512 attacks in Table 1 | extraction accuracy: PNG: 1.00 vs 1.00; JPEG: 1.00 vs 1.00; Resize: 0.99 vs 1.00; GB: 1.00 vs 1.00; Drop: 1.00 vs 1.00; Brightness: 1.00 vs 1 | Mixed |
| Lower the truncation threshold from 2 to 1 (ablation) | MDDM-PU · Face | extraction accuracy: 0.9847 -> 0.9221 | Hurt |
| Lower the truncation threshold from 2 to 1 (ablation) | MDDM-LU · Face | extraction accuracy: 0.9977 -> 0.9890 | Hurt |
| Lower the truncation threshold from 2 to 1 (ablation) | MDDM-LC · Face | extraction accuracy: 0.9987 -> 0.9946 | Hurt |
| Increase payload by lowering the truncation threshold from 2 to 1 (ablation) | MDDM-PU · Face | capacity: 8946 -> 62386 Bits | Helped |
| Increase payload by lowering the truncation threshold from 2 to 1 (ablation) | MDDM-LU · Face | capacity: 559 -> 3899 Bits | Helped |
| Increase payload by lowering the truncation threshold from 2 to 1 (ablation) | MDDM-LC · Face | capacity: 745 -> 5199 Bits | Helped |
Surprising findings
- Extraction accuracy drops only modestly at higher payloads (e.g., MDDM-PU3 falls to 0.92 at 62386 bits on Face), and latent diffusion outperforms pixel-space diffusion.
Limitations
- Accuracy declines as message length grows, and extraction relies on inversion which is imperfect for conditional generation.
- No error-correcting codes are integrated yet, as acknowledged in the conclusion.
Experimental setup
Datasets: Stable-Diffusion-Prompts
Benchmarks: Face Bedroom Cat Stable-Diffusion-Prompts watermark setting
Metrics: extraction accuracy bit capacity FID steganalysis detection rate
Baselines: DwtDct DwtDctSvd RivaGAN LaWa GS Stable Diffusion-based regeneration GIS (Peng et al.)
Builds on: DDIM EDICT DDPM Cardan grille steganography
Closest papers by meaning
- Hiding Images in Diffusion Models by Editing Learned Score Functions (CVPR 2025 · similarity 0.86)
- SSHR: More Secure Generative Steganography with High-Quality Revealed Secret Images (ICML 2025 · similarity 0.85)
- StegaStyleGAN: Towards Generic and Practical Generative Image Steganography (AAAI 2024 · similarity 0.85)
- CoSDA: Enhancing the Robustness of Inversion-based Generative Image Watermarking Framework (AAAI 2025 · similarity 0.85)
- Neural Cover Selection for Image Steganography (NeurIPS 2024 · similarity 0.85)
- GaussMarker: Robust Dual-Domain Watermark for Diffusion Models (ICML 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.