Research map / Image generation / Autoregressive and latent generation
Neural Cover Selection for Image Steganography
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes optimizing the latent of pretrained DDIM or BigGAN generators so that generated cover images minimize message-recovery error for a fixed LISO steganographic encoder-decoder, and analyzes the result via a waterfilling interpretation.
Problem
Cover selection in image steganography relies on exhaustive search over fixed image databases with heuristic metrics that have unclear links to message-hiding efficacy; this paper asks how to choose or generate covers that hide messages more reliably.
Approach
Treat cover selection as guided image generation: invert a cover into a DDIM latent (or optimize a BigGAN latent) and backpropagate the message-recovery BCE loss through a frozen generator and pretrained LISO encoder-decoder to produce covers tailored to the message, then interpret the optimized covers via waterfilling over low-variance pixels.
Key results
- On ImageNet at 4 bpp, DDIM-optimized covers reduce error rates versus original covers (e.g., Robin 2.48% to 1.01%) and improve PSNR and SSIM on most classes, with DDIM outperforming GAN-based optimization.
- On CelebA-HQ at 1 bpp, DDIM optimization lowers error from 2.6E-04 to 1.5E-05, and on AFHQ-Dog at 2 bpp from 8E-04 to 6.8E-05.
- Fraction of high-message pixels lying in low-variance regions rises from 81.6% before optimization to 92.4% after.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| optimize the DDIM latent using message recovery loss | LISO cover selection · ImageNet classes, 4 bpp | error rate (%): 2.48 -> 1.01 (Robin); 0.84 -> 0.55 (Snow Leopard); 1.75 -> 1.43 (Daisy); 2.29 -> 1.85 (Drilling Platform); 0.21 -> 0.12 | Helped |
| optimize the BigGAN latent using message recovery loss | LISO cover selection · ImageNet classes, 4 bpp | error rate (%): 2.48 -> 1.32 (Robin); 0.84 -> 0.36 (Snow Leopard); 1.75 -> 0.97 (Daisy); 2.29 -> 1.88 (Drilling Platform); 0.21 -> 0.15 | Helped |
| use DDIM rather than GAN for latent optimization | LISO cover selection · ImageNet classes, 4 bpp | error rate (%): 1.32 -> 1.01 (Robin); 0.36 -> 0.55 (Snow Leopard); 0.97 -> 1.43 (Daisy); 1.88 -> 1.85 (Drilling Platform); 0.15 -> 0.12 | Mixed |
| optimize DDIM latents | LISO cover selection · CelebA-HQ and AFHQ-Dog, 1–4 bpp | error rate (%): 2.6E-04 -> 1.5E-05; 2.3E-03 -> 9E-04; 0.011 -> 0.002; 0.051 -> 0.019; 8E-05 -> 0.00; 8E-04 -> 6.8E-05; 0.007 -> 0.002; 0 | Helped |
| optimize DDIM latents with JPEG compression in the pipeline | LISO cover selection · CelebA-HQ and AFHQ-Dog, 1 bpp JPEG | error rate (%): 0.12 -> 0.06; 0.15 -> 0.11 | Helped |
| add edge-preservation regularization (ablation) | DDIM cover selection · CelebA-HQ, 2 bpp | error rate (%): 2E-03 -> 7E-04 | No clear effect |
| add l1 distance regularization (ablation) | DDIM cover selection · CelebA-HQ, 2 bpp | error rate (%): 2E-03 -> 1E-03 | No clear effect |
| add total-variation regularization (ablation) | DDIM cover selection · CelebA-HQ, 2 bpp | error rate (%): 2E-03 -> 7E-04 | No clear effect |
| add VGG feature-matching regularization (ablation) | DDIM cover selection · CelebA-HQ, 2 bpp | error rate (%): 2.1E-03 -> 7.5E-04 | No clear effect |
| add a differentiable steganalysis loss during training | LISO encoder-decoder and DDIM cover selection · AFHQ-Dog, steganalysis Scenario 2 | XuNet detection rate (%): Scenario 1 DDIM: 37.5, 15.42, 34.82, 97.35; Scenario 2 DDIM: 0.0, 0.0, 2.1, 8.6 | Helped |
| optimize DDIM latents under Gaussian noise | LISO cover selection · CelebA-HQ, 4 bpp, Gaussian noise variance 0.01–0.03 | error rate (%): 2.2 -> 1.9; 7.1 -> 6.5; 12.3 -> 11.8 | Helped |
Surprising findings
- Optimizing only for error rate also improved image quality metrics (BRISQUE, SSIM, PSNR) on many settings.
- Steganalysis detection rates did not consistently decrease with lower payload, as also observed for LISO.
Limitations
- Quality degrades at lower payloads on CelebA-HQ and AFHQ-Dog, and regularization did not fix it.
- Analysis is restricted to independent parallel Gaussian channels and a simple additive steganography model.
- Gains at 4 bpp on AFHQ-Dog are small; detection rates vs payload are non-monotonic.
Experimental setup
Datasets: ImageNet CelebA-HQ AFHQ-Dog CelebA
Benchmarks: ImageNet (10 classes) CelebA-HQ AFHQ-Dog
Metrics: error rate BRISQUE SSIM PSNR XuNet detection rate SRNet detection rate
Baselines: BigGAN-based cover selection original (unoptimized) cover images
Builds on: DDIM DDIM inversion LISO BigGAN
Closest papers by meaning
- Hiding Images in Diffusion Models by Editing Learned Score Functions (CVPR 2025 · similarity 0.87)
- ROBIN: Robust and Invisible Watermarks for Diffusion Models with Adversarial Optimization (NeurIPS 2024 · similarity 0.86)
- SSHR: More Secure Generative Steganography with High-Quality Revealed Secret Images (ICML 2025 · similarity 0.85)
- MDDM: Practical Message-Driven Generative Image Steganography Based on Diffusion Models (ICML 2025 · similarity 0.85)
- Robust Message Embedding via Attention Flow-Based Steganography (CVPR 2025 · similarity 0.84)
- Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks (ICLR 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.