ERROR REDUCTION FOR GEN-AI
STEGANOGRAPHY BY ADJUSTMENTS IN THE
LATENT SPACE

Aurelien Noirault, Tomas Pevny, Jan Butora, Vincent Itier, Patrick Bas

► To cite this version:

Aurelien Noirault, Tomas Pevny, Jan Butora, Vincent Itier, Patrick Bas. ERROR REDUCTION FOR GEN-AI STEGANOGRAPHY BY ADJUSTMENTS IN THE LATENT SPACE. 2025. hal-05271776

HAL Id: hal-05271776

https://hal.science/hal-05271776v1

Preprint submitted on 22 Sep 2025

**HAL** is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
ERROR REDUCTION FOR GEN-AI STEGANOGRAPHY
BY ADJUSTMENTS IN THE LATENT SPACE

Aurelien Noirault¹, Tomas Pevny², Jan Butora¹, Vincent Itier¹,³, Patrick Bas¹

1. UMR 9189 CRISTAL
Univ. Lille, CNRS,
Centrale Lille, Lille, France

2. Artificial Intelligence Center
Czech Technical University
Prague, Czech Republic.

3. IMT Nord Europe
Centre for Digital Systems,
Lille, France

ABSTRACT

By embedding directly in the latent space, generative steganography is a promising way to embed large payloads in an undetectable way. However, the embedding needs to be robust to the error caused by both the compression of the image in the pixel format and the inversion in the latent space. In this paper, we show how to design a potentially error free steganographic scheme by modifying an existing scheme based on high capacity binary spread spectrum [5]. By approximating the generation and inversion channels using a shift hypothesis, we perform error correction by first identifying erroneous components and then altering them in the latent space. In order to minimize detectability w.r.t. steganalysis both in the latent or image spaces, we also refine the norm of the corrected stego latent vector. Results highlight that 37% of PNG images become error free instead 0% without correction. When preserving the norm, we also show that the practical security w.r.t. steganalysis is still important.

***Index Terms***— Robust steganography, Generative, Correction using feedbacks, Latent space

1. INTRODUCTION

The main requirements of steganography are to embed the
largest payload in the least detectable way into popular con-
tents such as digital images. With this perspective in mind,
a new category of steganographic algorithms based on gen-
erative models, and relying on the principle of generative
steganography [4], is developed to embed the payload in the
latent space instead of the pixel space or the JPEG space.
This embedding strategy is attractive because, before genera-
tive models, generative steganography was only dedicated to
embedding in random weak signals such as sensor noise [10]
or random movements [3]. On generated images, since many
models such as glow models [6] or latent diffusion models
(LDM) [8] generate images by starting from a latent space
where the seed is drawn from an i.i.d. Gaussian distribu-
tion, the embedding capacity is potentially very important.
Moreover, contrary to embedding schemes working on image

<figure><img src="image_2.png" /><figcaption>**Fig. 1:** Visualization of the inversion noise combined with JPEG compression at QF95 by projecting the inverted latent image on 2 carriers $C_{0,0}$ and $C_{0,1}$ for 800 images. The corrected samples for embedding $(m_{0,1}, m_{0,0}) = (1, 1)$ show the effect of the correction strategy presented in section 3.</figcaption></figure>

pixels or DCT coefficients and performing small ±1 perturba-
tions, generative steganography enables important semantic
changes in the image, while being potentially undetectable.

However, generative steganography methods, embedding
in the latent space, face specific constraints similar to those
encountered in classical robust steganography [1]:

First, they need to be robust to lossy compression, loss-
less compression and to the inversion process, i.e. the noisy
process that transforms the generated image into a vector in
the latent space. If the inversion error can be rather small in
glow generative models (see, for example, [13] as a potential
embedding scheme), it can be rather important for classical
LDM [12]. Note that decoding errors are very problematic
since the payload needs, for security reasons, to be encrypted.
<figure><img src="image_3.png" /><figcaption>Fig. 2: Principle of the steganographic scheme [5] and our contribution in bold.</figcaption></figure>

Error correcting codes can be used, but they usually decrease a lot the capacity of the steganography channel, especially if the channel error rate is important.

Secondly, their practical security, i.e. their undetectability, needs to be important, both when performing steganalysis in the latent space [7] or in the image space.

Payload embedding in the latent space is usually done using a mapping function, which can be seen as a mapping from a label to different parts of the Gaussian distributions. For instance, with Gaussian Shading [12] the message is held in the sign of the sample (element of the latent variable). To improve the robustness to the inversion error, Zhu et. al. [14] create dead zones between decision thresholds.

Our paper analyses the inversion noise for the rather robust steganographic scheme proposed in [5] and proposes a way to adjust the samples in the latent space in order to reduce decoding errors. Since the norm of the vector tends to increase after the proposed adjustment, a second strategy is added in order to decrease the norm to a value closer to a cover<fnref n="1" /> vector one and reduce the detectability of the scheme both in the latent and image space. The proposed correction strategy being identical regardless of the compression scheme, it can be applied to lossless or lossy compression standards.

## 2. EMBEDDING VIA BINARY SPREAD SPECTRUM IN THE LATENT SPACE

### 2.1. Embedding scheme

The scheme proposed by Hu et. al. [5] offers a relatively important robustness (i.e. a low bit error rate, especially w.r.t. Gaussian Shading [12]), and relative security to steganalysis when the analysis is performed in the image domain. Conceptually, we can see the embedding as binary spread-spectrum watermarking [11] applied in the latent space. Note that this embedding strategy is an already existing and popular watermarking algorithm, since the very first watermarking scheme already used this method on digital images.

The nominal capacity of the scheme is 1 bit/sample. Since

Stable Diffusion 2 uses a latent space of dimension [64, 64, 4], which can be resized in a matrix of shape [128, 128], $n^2 = 128^2$ bits per image are transmitted. The whole process is illustrated in Figure 2. Each bit $m_{i,j} \in n^2$ from the message matrix $M \in \mathbb{R}^{n \times n}$, are encoded to $\{\pm 1\}$, then modulated by a pseudo-random orthonormal matrix $C_{i,j}$ of size $n \times n$, this matrix being a reshaped 2D version of the latent tensor.

Given a random orthonormal matrix $Q$ derived from a, the orthonormal carrier associated with each bit $m_{i,j}$ is consequently given by $C_{i,j} = q_i \cdot q_j^T$, where $q_k$ is the $k^{th}$ column of $Q$, and the payload matrix $M \in \{-1, +1\}^{n \times n}$ is transformed to a latent matrix $X_s$ by:

$$X_s = Q \cdot M \cdot Q^T. \quad (1)$$

By invocation of the Central Limit Theorem, the authors claim that each sample $x_{s_{i,j}}$ is asymptotically i.i.d. as the latent samples of cover images, i.e. $N(0, 1)$. Note that this assumption is wrong, as demonstrated in [7], and that the embedding is potentially detectable in the latent space when pooling enough images regardless of the secret key used.

After potential compression of the image, the noisy inversion process is applied, using the same parameters as for the generation (guidance scale, prompt, number of diffusion steps) to obtain the latent image $X_{inv}$, the decoding is computed using the inverse transform:

$$\hat{M} = Q^T \cdot X_{inv} \cdot Q. \quad (2)$$

### 2.2. Model of the inversion channel

Contrary to the Glow generative model [13], diffusion models are not invertible by design. An approximation of the inversion is, however possible with the algorithm DDIM [9]. The approximation also means that the decoding process defined in (2) is not error free. Fig. 1 shows the effect of the inversion channel on the modulations of 2 carriers, we can see that the inversion noise is substantial.

In order to compensate the inversion errors in the latent space, we evaluate in which extent shifting a sample $m_{i,j}$ by $s$ produces a shift in the inverted latent space after applying the decoding step (2). Considering a function $f(\cdot)$ which represents the whole inversion channel, illustrated in Fig. 2, i.e.

<footnote n="1">¹Literally, the cover is not a "cover" but a non-stego. However, since this terminology is used since the beginning of digital steganography, we continue to use this term here.</footnote>
<figure><img src="image_4.png" /><figcaption>**Fig. 3:** Testing the shift hypothesis: evolution of the shift in the latent space after inversion on one sample ($f(m_{i,j} + s) - \hat{m}_{i,j}$) w.r.t. the shift magnitude $s$, in the case of the lossless compression PNG. The standard deviation (std) shows the impact of the inversion noise.</figcaption></figure>

the coding of $m_{i,j}$, the generation, the compression, the inversion process, and the decoding into $\hat{m}_{i,j}$, we want to have the property:

$$f(m_{i,j} + s) \approx \hat{m}_{i,j} + s, \quad (3)$$

that we can frame as the shift hypothesis. In Fig. 3 we can see that this hypothesis holds in the case of the lossless compression PNG. We can, however, notice that the power of the inversion noise increases w.r.t. the shift magnitude. Associated with the impact of the coding format, we can conclude that the larger the error on $\hat{m}_{i,j}$, the more difficult it will be to cancel the error by changing the message value before generation. The next section presents an algorithm designed to deal with this issue.

### 3. VARIANCE PRESERVING ERROR CORRECTION

By definition, a bit is correctly decoded when the signs of $m_{i,j}$ and $\hat{m}_{i,j}$ are the same. The noise of the whole pipeline may change the sign of several symbols. Given a pipeline (generator and image compression format), according to the shift hypothesis, we can apply modifications to the message before the generation in order to mitigate this error and decode the correct message after image generation. However, since shifting a sample produces an additional inversion noise on all the samples of the latent vector (this is illustrated by the standard deviation term in Fig. 3), a correction applied to one direction will likely have an effect on the others. Correcting every error would be untractable. Therefore, the error correction has to be done in an iterative way.

This correction can be performed by refining two shift matrices $S_c \in \mathbb{R}^{n \times n}$ and $S_r \in \mathbb{R}^{n \times n}$ which update the

**Algorithm 1 Error Correcting Variance Preserving Algorithm**

**Require:** $Q$ (rotation matrix), $M$ (scaled message), $\alpha$ (learning rate), $f(\cdot)$ (target pipeline), $\tau_c, \tau_r$
**Do**
    $\hat{M} \leftarrow f(M + S_c + S_r)$
    **Error correction**
        Compute $B_c$ from (5)
        $S_c \leftarrow S_c - \alpha(\hat{M} - M)B_c$
        **Variance regularization**
            Compute $B_r$ from (8)
            $\alpha_r \leftarrow (\|M + S_c + S_r\|_2 - \|M\|_2) / \|B_rM\|_2$
            $S_r \leftarrow S_r - \alpha_r B_r M$
            **Stopping condition**
                $\hat{M} \leftarrow f(M + S_c + S_r)$
                $BER \leftarrow \frac{1}{n^2} \sum_i^n \sum_j^n 1_{\text{sign}(\hat{m}_{i,j}) \neq m_{i,j}}$
    **End while**

modulation matrix $M$:

* $S_c$ is updated in order to correct decoding errors,

* $S_r$ is constructed in order to regularize the variance of the seed in the latent space after correction.

#### 3.1. Error correction

At step $t$, the update rule of the shift matrix $S_c$ can be simply written as:

$$S_{c,t} = S_{c,t-1} - \alpha (\hat{M} - M) B_c, \quad (4)$$

with $\alpha$, a learning rate and a binary mask $B_c \in \mathbb{R}^{n \times n}$, constructed in such a way to correct the samples which are wrongly decoded or close to the boundary. $B_c$ is given by:

$$B_c = \begin{cases} 1, & \text{if} \\ (m_{i,j} > 0 \& \hat{m}_{i,j} < \tau_c) \parallel (m_{i,j} < 0 \& \hat{m}_{i,j} > -\tau_c) \\ 0, & \text{else,} \end{cases} \quad (5)$$

with $\tau_c$, a threshold.

#### 3.2. Variance regularisation

Variance regularization is motivated by the fact that the correction of the error pushes the problematic samples away from 0. This behavior increases the norm of the latent variable and results in a more detectable image. Indeed, the increase of the data norm will produce a more textured image and decrease the visual quality. As it is presented in Fig. 4, a regularized correction will operate at a semantic level, without visual quality discrepancy.

We can define the regularization matrix $S_r$ and its update rule by:

$$S_{r,t-1} = S_{r,t} - \alpha_r B_r M, \quad (6)$$
<figure><img src="image_5.png" /><figcaption>**Fig. 4:** Images generated for the same prompt, key, and message: norm regularization impacts the content more significantly, but without introducing artifacts.</figcaption></figure>

$\alpha_r$ is a scaling factor designed to match the norm discrepancy between $\mathbf{M}$ and $\mathbf{M}'$:

$$ \alpha_r = \frac{\|\mathbf{M} + \mathbf{S}_c + \mathbf{S}_r\|_2 - \|\mathbf{M}\|_2}{\|\mathbf{B}_r\mathbf{M}\|_2}. \quad (7) $$

$\mathbf{B}_r$ is a binary mask selecting the sample in the latent space with a large magnitude:

$$ \mathbf{B}_r = \begin{cases} 1, & \text{if } (m_{i,j} > 0 \& \hat{m}_{i,j} > \tau_r) \parallel (m_{i,j} < 0 \& \hat{m}_{i,j} < -\tau_r) \\ 0, & \text{else,} \end{cases} \quad (8) $$

with $\tau_r$ a threshold. Each step of the complete algorithm are outlined in Algorithm 1.

## 4. PERFORMANCE AND STEGANALYSIS

In this section, we evaluate the decoding capacity and the security of our algorithm compared to the original one.

Every image is generated with Stable Diffusion 2.1 via the HuggingFace implementation and pretrained weights<fnref n="2" />, with 50 diffusion steps and a guidance of 7.5. The generation is inverted with the algorithm DDIM [9] and the same parameters as for the generation. The images were compressed with the Python library Pillow, the JPEG compression is operated without chroma subsampling. The decision thresholds are set to $\tau_c = 0.2$, $\tau_r = 1$, and the learning rate to $\alpha = 0.2$.

The improvements in the decoding performances of our contribution compared to the original algorithm and of our proposed improvement are presented in Table 1. However, since the power of noise can change drastically depending on the image, the proposed algorithm is not enough to reach perfect decoding for every image, especially when the compression increases. For instance, the success rate, where a success is reaching 0 BER for a given pair of message and key, is 37% for the PNG compression and decreases to 20% and 13% for JPEG QF100 and JPEG QF95, respectively.

<table><caption>**Table 1:** Decoding performances for different image saving format.</caption><thead><tr><th rowspan="2">BER (%)</th><th rowspan="2">PNG</th><th colspan="2">JPEG</th></tr><tr><th>QF100</th><th>QF95</th></tr></thead><tbody><tr><td>Gaussian Shading [12]</td><td>13.24%</td><td>13.92%</td><td>15.29%</td></tr><tr><td>Hu et al. [5]</td><td>2.54%</td><td>3.18%</td><td>4.50%</td></tr><tr><td>Ours</td><td>1.75%</td><td>1.60%</td><td>3.86%</td></tr></tbody></table>

<table><caption>**Table 2:** Probability of error ($P_e$) of SRNet and JIN-SRNet trained on 2,000 images of each class. Ours w norm, stands for our algorithm without norm regularization, and Ours w norm is our algorithm with regularization of the norm.</caption><thead><tr><th rowspan="2">P<sub>e</sub></th><th colspan="2">SRNet</th><th colspan="2">JIN-SRNet</th></tr><tr><th>PNG</th><th>JPEG QF95</th><th>PNG</th><th>JPEG QF95</th></tr></thead><tbody><tr><td>Hu et al. [5]</td><td>0.47</td><td>0.48</td><td>0.45</td><td>0.47</td></tr><tr><td>Ours w norm</td><td>0.37</td><td>0.33</td><td>0.36</td><td>0.31</td></tr><tr><td>Ours wo norm</td><td>0.30</td><td>0.18</td><td>0.26</td><td>0.15</td></tr></tbody></table>

The evaluation of the security is performed by training the standard SRNet model but also by finetuning the steganographic detector JIN-SRNet [2] with 2,000 cover images and 2,000 stego images, split into a training set of 3,000 images and a validation set of 1,000 images. The resulting $P_e$ of the validation tests are presented in Table 2. Those results highlight the impact of the variance of the latent variables on the detectability of an image and, therefore, the need for regularization during the correction. Even though the security performances are still lower than the original, they remain in an acceptable range. Moreover, one could decrease the value of $\tau_r$, this would make the norm regularization more accurate, which would diminish the detectability, but it would make the error correction harder. Therefore, our algorithm allows a trade-off between detectability and capacity based on the threshold values.

## 5. CONCLUSIONS

Generative steganography is a promising yet challenging approach to steganography with high security potential. However, such approach needs to be robust to a noisy pipeline. We show that by including the knowledge of the inversion channel, it is possible to mitigate the influence the noise of the channel even for lossy image compression such as JPEG. Moreover, the inherent dimensional discrepancy of LDM between the latent space and the image space is limiting the payload of an image, even a capacity of 1 bit/sample would only be equivalent to 0.02 bit/pixel in the pixel space. Therefore, future work would need to focus on increasing the capacity of algorithms in order to close the gap between the capacity of traditional steganography and generative steganography.

<footnote n="2">²stabilityai/stable-diffusion-2-1-base</footnote>
# 6. ACKNOWLEDGEMENTS

This work received funding from the French Defense & Innovation Agency. This work was also supported by a French government grant managed by the Agence National de la Recherche under the France 2030 program, reference ANR-22-PECY-0011 and by the project referenced by ANR-23-IAS4-0004. This work was granted access to the HPC resources of the Lille University.

# 7. REFERENCES

[1] Jan Butora, Pauline Puteaux, and Patrick Bas. Errorless robust jpeg steganography using outputs of jpeg coders. *IEEE Transactions on Dependable and Secure Computing*, 21(4):2394–2406, 2023.

[2] Jan Butora, Yassine Yousfi, and Jessica Fridrich. How to pretrain for steganalysis. In *Proceedings of the 2021 ACM Workshop on Information Hiding and Multimedia Security*, pages 143–148, 2021.

[3] Scott Craver, Enping Li, Jun Yu, and Idris Atakli. A supraliminal channel in a videoconferencing application. In *International Workshop on Information Hiding*, pages 283–293. Springer, 2008.

[4] Jessica Fridrich. Steganography in digital media: principles, algorithms, and applications. Cambridge university press, 2009.

[5] Xiaoxiao Hu, Sheng Li, Qichao Ying, Wanli Peng, Xinpeng Zhang, and Zhenxing Qian. Establishing robust generative image steganography via popular stable diffusion. *IEEE Transactions on Information Forensics and Security*, 2024.

[6] Durk P Kingma and Prafulla Dhariwal. Glow: Generative flow with invertible 1x1 convolutions. *Advances in neural information processing systems*, 31, 2018.

[7] Etienne Levecque, Aurélien Noirault, Tomas Pevny, Jan Butora, Patrick Bas, and Rémi Cogranne. Targeted pooled latent-space steganalysis applied to generative steganography, with a fix. In *Submitted to ICASSP*, Barcelona, Spain, May 4–8, 2026.

[8] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models. In *Proceedings of the IEEE/CVF conference on computer vision and pattern recognition*, pages 10684–10695, 2022.

[9] Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. *arXiv preprint arXiv:2010.02502*, 2020.

[10] Théo Taburet, Patrick Bas, Wadih Sawaya, and Jessica Fridrich. Natural steganography in jpeg domain with a linear development pipeline. *IEEE Transactions on Information Forensics and Security*, 16:173–186, 2020.

[11] Anatol Z Tirkel, Charles F Osborne, and Ron G Van Schyndel. Image watermarking-a spread spectrum application. In *Proceedings of ISSSTA'95 international symposium on spread spectrum techniques and applications*, volume 2, pages 785–789. IEEE, 1996.

[12] Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shading: Provable performance-lossless image watermarking for diffusion models. In *Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition*, pages 12162–12171, 2024.

[13] Zhili Zhou, Yuecheng Su, Jin Li, Keping Yu, Q. M. Jonathan Wu, Zhangjie Fu, and Yunqing Shi. Secret-to-image reversible transformation for generative steganography. *IEEE Transactions on Dependable and Secure Computing*, 20(5):4118–4134, 2023.

[14] Jiahao Zhu, Zixuan Chen, Lingxiao Yang, Xiaohua Xie, and Yi Zhou. Plug-and-hide: Provable and adjustable diffusion generative steganography. *arXiv preprint arXiv:2409.04878*, 2024.