SlowGuess/NeurIPS_2023_OCR huggingface dataset:
The Roles of the Private and Public Keys in Our CRoSS Framework. In CRoSS, we found that these given conditions can act as keys in practical use. The private key is used to describe the content in the secret image, while the public key is used to control the content in the container image. For the public key, it is associated with the content in the container image, so even if it is not manually transmitted over the network, the receiver can guess it based on the received container image (described in Scenario#2 of Fig. 4). For the private key, it determines whether the receiver can successfully reveal the original image, so it cannot be transmitted over public channels.
The Process of Reveal Stage. In the reveal stage, assuming that the container image has been transmitted over the Internet and may have been damaged as  $\mathbf{x}_{cont}^{\prime}$ , the receiver needs to reveal it back to the secret image through the same forward and backward process using the same conditional diffusion model with corresponding keys. Throughout the entire coverless image steganography process, we do not train or fine-tune the diffusion models specifically for image steganography tasks but rely on the inherent invertible image translation guaranteed by the DDIM Inversion.
The Security Guaranteed by CRoSS. Some questions about security may be raised, such as: What if the private key is guessed by the receivers? Does the container image imply the possible hidden secret image? We clarify these questions from two aspects: (1) Since the revealed image is generated by the diffusion model, the visual quality of the revealed image is relatively high regardless of whether the input private key is correct or not. The receiver may guess the private key by exhaustive method, but it is impossible to judge which revealed image is the true secret image from a pile of candidate revealed images (described in Scenario#1 of Fig. 4). (2) Since the container image is also generated by the diffusion model, its visual quality is guaranteed by the generative prior of the diffusion model. Moreover, unlike cover-based methods that explicitly store clues in the container image, the container image in CRoSS does not contain any clues that can be detected or used to extract the secret image. Therefore, it is hard for the receiver to discover that the container image hides other images or to reveal the secret image using some detection method (described in Scenario#3 of Fig. 4).
Various Variants for Public and Private Keys. Our proposed CRoSS relies on pre-trained conditional diffusion models with different conditions  $\mathbf{k}_{pub}$ ,  $\mathbf{k}_{pri}$  and these conditions serve as keys in the CRoSS framework. In practical applications, we can distinguish different types of conditions of diffusion models in various ways. Here are some examples: (1) Prompts: using the same checkpoint
Figure 5: Deep steganalysis results by the latest SID [61]. As the number of leaked samples increases, methods whose detection accuracy curves grow more slowly and approach  $50\%$  exhibit higher security. The right is the recall curve of different methods under the StegExpose [7] detector. The closer the area enclosed by the curve and the coordinate axis is to 0.5, the closer the method is to the ideal evasion of the detector.
of text-to-image diffusion models like Stable Diffusion [49] but different prompts as input conditions; (2) LoRAs [23]: using the same checkpoint initialization, but loading different LoRAs; (3) ControlNets [74]: loading the same checkpoint but using ControlNet with different conditions.
Experimental Settings. In our experiment, we chose Stable Diffusion [49] v1.5 as the conditional diffusion model, and we used the deterministic DDIM [54] sampling algorithm. Both the forward and backward processes consisted of 50 steps. To achieve invertible image translation, we set the guidance scale of Stable Diffusion to 1. For the given conditions, which serve as the private and public keys, we had three options: prompts, conditions for ControlNets [74] (depth maps, scribbles, segmentation maps), and LoRAs [23]. All experiments were conducted on a GeForce RTX 3090 GPU card, and our method did not require any additional training or fine-tuning for the diffusion model. The methods we compared include RIIS [68], HiNet [26], Baluja [6], and ISN [35].
Data Preparation. To perform a quantitative and qualitative analysis of our method, we collect a benchmark with a total of 260 images and generate corresponding prompt keys specifically tailored for the coverless image steganography, dubbed Stego260. We categorize the dataset into three classes, namely humans, animals, and general objects (such as architecture, plants, food, furniture, etc.). The images in the dataset are sourced from publicly available datasets [1, 2] and Google search engines. For generating prompt keys, we utilize BLIP [32] to generate private keys and employ ChatGPT or artificial adjustment to perform semantic modifications and produce public keys in batches. More details about the dataset can be found in the supplementary material.
4.2 Property Study#1: Security
In Fig. 5, the recent learning-based steganalysis method Size-Independent-Detector (SID) [61] is retrained with leaked samples from testing results of various methods on Stego260. The detection accuracy of CRoSS increases more gradually as the number of leaked samples rises, compared to other methods. The recall curves on the right also reveal the lower detection accuracy of our CRoSS, indicating superior anti-steganalysis performance.
Our security encompasses two aspects: imperceptibility in visual quality against human suspicion and resilience against steganalysis attacks.
NIQE is a no-reference image quality assessment (IQA) model to measure the naturalness and visual
Methods	NIQE ↓	Detection Accuracy - 50 |
XuNet [67]	YedroudjNet [70]	KeNet [71]
Baluja [6]	3.43±0.08	45.18±1.69	43.12±2.18	46.88±2.37
ISN [35]	2.87±0.02	5.14±0.44	3.01±0.29	8.62±1.19
HiNet [26]	2.94±0.02	5.29±0.44	3.12±0.36	8.33±1.22
RIIS [68]	3.13±0.05	0.73±0.13	0.24±0.08	4.88±1.15
CRoSS (ours)	3.04	1.32	0.18	2.11
Table 1: Security analysis. NIQE indicates the visual quality of container images, lower is better. The closer the detection rate of a method approximates  $50\%$ , the more secure the method is considered, as it suggests its output is indistinguishable from random chance. The best results are red and the second-best results are blue.
Prompt1: a young cute chinese girl with long hair Prompt2: a baby with long hair
Prompt1: a young girl with blond hair Prompt2: a wrinkled elderly woman with white hair
Prompt11: Obama is giving a speech Prompt12: Biden is giving a speech
Prompt1: a cute rabbit Prompt2: a cute cat
Prompt1: a koala is sitting on a branch Prompt2: a baby raccoon cub is walking on a branch
Prompt1: a baby badger cub is walking through the grass Prompt2: a baby raccoon cub is walking through the grass
Prompt11: tomatoes hanging on tree Prompt21: green apples hanging on tree
Prompt1: a grey chair in the living room Prompt2: a grey sofa in the living room
Prompt1: a multi-layer hamburger Prompt2: a three-layer sandwich
Figure 6: Visual results of the proposed CRoSS controlled by different prompts. The container images are realistic and the revealed images have well semantic consistency with the secret images.
Figure 7: Visual results of our CRoSS controlled by different ControlNets and LoRAs. Depth maps, scribbles, and segmentation maps are presented in the lower right corner of the images.
security without any reference image or human feedback. In Tab. 1, the lower the NIQE score, the less likely it is for the human eye to identify the image as a potentially generated container for hiding secret information. Our NIQE is close to those of other methods, as well as the original input image (2.85), making it difficult to discern with human suspicion. Anti-analysis security is evaluated by three steganalysis models XuNet[67], YedroudjNet[70], and KeNet[71], for which lower detection accuracy denotes higher security. Our CRoSS demonstrates the highest or near-highest resistance against various steganalysis methods.
4.3 Property Study#2: Controllability
To verify the controllability and flexibility of the proposed CRoSS, various types of private and public keys such as prompts, ControlNets, and LoRAs† are incorporated in our framework. As illustrated in Fig. 6, our framework is capable of effectively hiding the secret images in the container images based on the user-provided “Prompt2” without noticeable artifacts or unrealistic image details. The container image allows for the seamless modification of a person’s identity information, facial attributes, as
The last row of Fig. 7 are generated via LoRAs downloaded from https://civitai.com/.
Figure 8: Visual comparisons of our CRoSS and other methods [68, 26] under two real-world degradations, namely "WeChat" and "Shoot". Obviously, our method can reconstruct the content of secret images, while other methods exhibit significant color distortion or have completely failed.
Methods	clean	Gaussian noise	Gaussian denoiser [62]	JPEG compression	JPEG enhancer [62]
σ = 10	σ = 20	σ = 30	σ = 10	σ = 20	σ = 30	Q = 20	Q = 40	Q = 80	Q = 20	Q = 40	Q = 80
Baluja [6]	34.24	10.30	7.54	6.92	7.97	6.10	5.49	6.59	8.33	11.92	5.21	6.98	9.88
ISN [35]	41.83	12.75	10.98	9.93	11.94	9.44	6.65	7.15	9.69	13.44	5.88	8.08	11.63
HiNet [26]	42.98	12.91	11.54	10.23	11.87	9.32	6.87	7.03	9.78	13.23	5.59	8.21	11.88
RIIS [68]	43.78	26.03	18.89	15.85	20.89	15.97	13.92	22.03	25.41	27.02	13.88	16.74	20.13
CRoSS (ours)	23.79	21.89	20.19	18.77	21.39	21.24	21.02	21.74	22.74	23.51	20.60	21.22	21.19
Table 2: PSNR(dB) results of the proposed CRoSS and other methods under different levels of degradations. The proposed CRoSS can achieve superior data fidelity in most settings. The best results are red and the second-best results are blue.
well as species of animals. The concepts of these two prompts can also differ significantly such as the Eiffel Tower and a tree, thereby enhancing the concealment capability and stealthiness of the container images. Meanwhile, the revealed image extracted with "Prompt1" exhibits well fidelity by accurately preserving the semantic information of secret images. Besides prompts, our CRoSS also supports the utilization of various other control conditions as keys, such as depth maps, scribbles, and segmentation maps. As depicted in Fig. 7, our methods can effectively hide and reveal the semantic information of the secret image without significantly compromising the overall visual quality or arousing suspicion. Our CRoSS can also adopt different LoRAs as keys, which is conducive to personalized image steganography.
4.4 Property Study#3: Robustness
Simulation Degradation. To validate the robustness of our method, we conduct experiments on simulation degradation such as Gaussian noise and JPEG compression. As reported in Tab. 2, our CRoSS performs excellent adaptability to various levels of degradation with minimal performance decrease, while other methods suffer significant drops in fidelity (over 20dB in PSNR). Meanwhile, our method achieves the best PSNR at  $\sigma = 20$  and  $\sigma = 30$ . Furthermore, when we perform nonlinear image enhancement [62] on the degraded container images, all other methods have deteriorations but our CRoSS can still maintain good performance and achieve improvements in the Gaussian noise degradation. Noting that RIIS [68] is trained exclusively on degraded data, but our CRoSS is naturally resistant to various degradations in a zero-shot manner and outperforms RIIS in most scenarios.
Real-World Degradation. We further choose two real-world degradations including "WeChat" and "Shoot". Specifically, we send and receive container images via the pipeline of WeChat to implement network transmission. Simultaneously, we utilize the mobile phone to capture the container images on the screen and then simply crop and warp them. Obviously, as shown in Fig. 8, all other methods have completely failed or present severe color distortion subjected to these two extremely complex degradations, yet our method can still reveal the approximate content of the secret images and maintain well semantic consistency, which proves the superiority of our method.
We propose a coverless image steganography framework named CRoSS (Controllable, Robust, and Secure Image Steganography) based on diffusion models. This framework leverages the unique
properties of diffusion models and demonstrates superior performance in terms of security, controllability, and robustness compared to existing methods. To the best of our knowledge, CRoSS is the first attempt to integrate diffusion models into the field of image steganography. In the future, diffusion-based image steganography techniques will continue to evolve, expanding their capacity and improving fidelity while maintaining their existing advantages.
[1] https://github.com/aisegmentcn/matting_human_datasets, 2019.
[2] https://www.kaggle.com/datasets/iamsouravbanerjee/animal-image-dataset-90-different-animals, 2022.
[3] Rameen Abdal, Yipeng Qin, and Peter Wonka. Image2stylegan: How to embed images into the stylegan latent space? In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2019.
[4] Alaa A Jabbar Altaay, Shahrin Bin Sahib, and Mazdak Zamani. An introduction to image steganography techniques. In 2012 International Conference on Advanced Computer Science Applications and Technologies (ACSAT), 2012.
[5] Shumeet Baluja. Hiding images in plain sight: Deep steganography. In Advances in Neural Information Processing Systems (NeurIPS), 2017.
[6] Shumeet Baluja. Hiding images within images. IEEE transactions on pattern analysis and machine intelligence (TPAMI), 2019.
[7] Benedikt Boehm. Stegsexpoe-a tool for detecting lsb steganography. arXiv preprint arXiv:1410.6656, 2014.
[8] Tim Brooks, Aleksander Holynski, and Alexei A Efros. Instructpix2pix: Learning to follow image editing instructions. arXiv preprint arXiv:2211.09800, 2022.
[9] Chi-Kwong Chan and Lee-Ming Cheng. Hiding data in images by simple lsb substitution. Pattern recognition, 2004.
[10] Yambem Jina Chanu, Kh Manglem Singh, and Themrichon Tuithung. Image steganography and steganalysis: A survey. International Journal of Computer Applications, 2012.
[11] Abbas Cheddad, Joan Condell, Kevin Curran, and Paul Mc Kevitt. Digital image steganography: Survey and analysis of current methods. IEEE Transactions on Signal Processing (TIP), 2010.
[12] Xuxin Cheng, Bowen Cao, Qichen Ye, Zhihong Zhu, Hongxiang Li, and Yuexian Zou. ML-lmcl: Mutual learning and large-margin contrastive learning for improving asr robustness in spoken language understanding. In Findings of the Association for Computational Linguistics (ACL), 2023.
[13] Xuxin Cheng, Qianqian Dong, Fengpeng Yue, Tom Ko, Mingxuan Wang, and Yuexian Zou. M 3 st: Mix at three levels for speech translation. In IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2023.
[14] Jooyoung Choi, Sungwon Kim, Yonghyun Jeong, Youngjune Gwon, and Sungroh Yoon. Ilvr: Conditioning method for denoising diffusion probabilistic models. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2021.
[15] Ingemar Cox, Matthew Miller, Jeffrey Bloom, Jessica Fridrich, and Ton Kalker. Digital watermarking and steganography. Morgan kaufmann, 2007.
[16] Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis. In Advances in Neural Information Processing Systems (NeurIPS), 2021.
[17] Laurent Dinh, David Krueger, and Yoshua Bengio. Nice: Non-linear independent components estimation. arXiv preprint arXiv:1410.8516, 2014.
[71] Weike You, Hong Zhang, and Xianfeng Zhao. A siamese cnn for image steganalysis. IEEE Transactions on Information Forensics and Security (TIFS), 2020.
[72] Jiwen Yu, Yinhuai Wang, Chen Zhao, Bernard Ghanem, and Jian Zhang. Freedom: Training-free energy-guided conditional diffusion model. arXiv:2303.09833, 2023.
[73] Kevin Alex Zhang, Alfredo Cuesta-Infante, Lei Xu, and Kalyan Veeramachaneni. Steganogan: High capacity image steganography with gans. arXiv preprint arXiv:1901.03892, 2019.
[74] Lvmin Zhang and Maneesh Agrawala. Adding conditional control to text-to-image diffusion models. arXiv preprint arXiv:2302.05543, 2023.
[75] Min Zhao, Fan Bao, Chongxuan Li, and Jun Zhu. Egsde: Unpaired image-to-image translation via energy-guided stochastic differential equations. In Advances in Neural Information Processing Systems (NeurIPS), 2022.
[76] Zhili Zhou, Huiyu Sun, Rohan Harit, Xianyi Chen, and Xingming Sun. Coverless image steganography without embedding. In Cloud Computing and Security: First International Conference (ICCCS), 2015.
[77] Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. In European Conference on Computer Vision (ECCV), 2018.
[78] Jun-Yan Zhu, Taesung Park, Phillip Isola, and Alexei A Efros. Unpaired image-to-image translation using cycle-consistent adversarial networks. In Proceedings of the IEEE International Conference on Computer Vision (ICCV), 2017.