MDDM: Practical Message-Driven Generative Image Steganography Based on Diffusion Models
Authors: ZiHao Xu
Dawei xu
Zihan Li
Chuan Zhang
Venue: ICML 2025 poster (2025)
Keywords: Generative image steganography
Diffusion Models
Primary area: deep_learning->generative_models_and_autoencoders

Abstract: Generative image steganography (GIS) is an emerging technique that conceals secret messages in the generation of images. Compared to GAN-based or flow-based GIS schemes, diffusion model-based solutions can provide high-quality and more diverse images, thus receiving considerable attention recently. However, previous GIS schemes still face challenges in terms of extraction accuracy, controllability, and practicality. To address the above issues, this paper proposes a practical message-driven GIS framework based on diffusion models, called MDDM. Specifically, by utilizing the Cardan grille, we encode messages into Gaussian noise, which serves as the initial input for image generation, enabling users to generate diverse images via controllable prompts without additional training. During the information extraction process, receivers only need to use the pre-shared Cardan grille to perform diffusion inversion and recover the messages without requiring the image generation seeds or prompts. Experimental results demonstrate that MDDM offers notable advantages in terms of accuracy, controllability, practicality, and security. With flexible strategies, MDDM can achieve accuracy close to 100\% under appropriate settings. Additionally, MDDM demonstrates certain robustness and potential for application in watermarking tasks.

MDDM: Practical Message-Driven Generative Image Steganography Based on Diffusion Models
Zihao Xu! Dawei Xu 12 Zihan Li Chuan Zhang?
Abstract
have become primary medium for covert data embedding (Bachrach & Shih, 2011: Subramanian et al., 2021; Mandal et al., 2022). Image steganography conceals information within images in a manner that prevents unauthorized access or detection. It is widely used in copyright protection (Al- taay et al., 2012) and covert communication (Juneja, 2014)
Generative image steganography (GIS) is an emerging technique that conceals secret mes- sages in the generation of images. Compared to GAN-based or flow-based GIS schemes, diffusion model-based solutions can provide high-quality and more diverse images, thus receiving consid- erable attention recently. However, previous GIS schemes still face challenges in terms of extrac- tion accuracy, controllability, and practicality. To address the above issues, this paper proposes a practical message-driven GIS framework based on diffusion models, called MDDM. Specifically, by utilizing the Cardan grille, we encode mes- sages into Gaussian noise, which serves as the ini- tial input for image generation, enabling users generate diverse images via controllable prompts without additional training. During the informa- tion extraction process, receivers only need to use the pre-shared Cardan grille to perform diffusion inversion and recover the messages without requir- ing the image generation seeds prompts. Exper- imental results demonstrate that MDDM offers notable advantages in terms of accuracy, control- lability, practicality, and security. With flexible strategies, MDDM can achieve accuracy close to 100% under appropriate settings. Additionally, MDDM demonstrates certain robustness and po- tential for application in watermarking tasks.
However, achieving provably secure image steganography remains major challenge. Traditional methods (van Schyn- del et al., 1994; Liao et al., 2020; Yang et al., 2020; Su et al., 2021: Chan & Cheng. 2004) usually embed secret data through cover image modification. These methods of- ten leave traces, making them susceptible to detection by steganalysis tools, and are therefore deemed empirically secure rather than provably secure (Hopper al., 2002).
Provable security in image steganography requires that the distributions of the normal and stego images be indistin- guishable (Weiming, 2023). Recently, the emergence of Artificial Intelligence Generated Content (AIGC) has pro- vided a more diverse and flexible steganographic environ- ment. Meanwhile, Al-generated data follows a controllable distribution. Leveraging this advantage, generative image steganography (GIS) has emerged and demonstrated strong resistance to typical steganographic attacks.
Compared with traditional methods, GIS schemes have bet- ter anti-detection performance against existing statistical feature-based steganalysis methods. GIS is mainly based on generative adversarial networks (GAN) (Yang et al., 2024b; Zhou et al., 2023a; Li et al., 2020; Su et al., 2024; You et al., 2022), flow-based models (such Glow) (Zhou et al., 2023b; Wei et al., 2022; Xu et al., 2022) and the latest dif- fusion models (DM) (Hu et al., 2024; Peng et al., 2023; 2024; Yu et al., 2024; Jois et al., 2024). Although GIS has achieved notable progress, still faces limitations in practical applications. For example, GAN-based methods require much training (Yang et al., 2024b), and are costly and difficult to control; flow-based methods require high computational resources during training and inference, es- pecially in high-resolution image generation tasks (Zhou et al., 2023b). Diffusion model-based methods have made breakthroughs in generation quality and provide a better steganographic environment due to their widespread ap- plication in image generation. However, they still suffer
1. Introduction
With the proliferation of the Internet and digital communica- tions, information security issues have become increasingly prominent. As a crucial technique, steganography offers secure and covert method of communication. With the in- creasing volume of image data on digital platforms, images
'Changchun University "Beijing Institute of Technology. Cor- respondence to: Chuan Zhang <cchannz @ bit.edu.en>>.
Proceedings of the nd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

MDDM: Practical Message-Driven Generative Image Steganography Based on Diffusion Models
10001101
10001101
-2.1364
Alice
2.7236
0,4289
Bob
Inversion
photograph astronaut riding horse"
DDIM Sampling
Diffusion Model
Figure The overall framework MDDM. The sender needs share the Cardan grille with receiver in advance determine the location of the information in the initial noise. The Cardan grille is randomly generated. For the same message and the same Cardan grille, the sender can use MDDM generate multiple images for selection.
from certain limitations. Specifically, diffusion- based gen- erative image steganography falls into two groups: image- translation methods and methods that exploit the generative process. Image-translation methods keep the stego image visually close to the secret image, which limits output di- versity (Yu et al., 2024; Yang et al., 2024a). Methods that exploit the generative process, aside from watermarking methods that usually hide only short messages, generally require reproducing the entire generation with the same seed and prompt (Peng et al., 2023; Jois et al., 2024; Peng et al., 2024); once these are shared, the sender's 's ability to produce arbitrary images constrained and may require additional coordination.
The main contributions of MDDM are follows:
Message-driven GIS Framework: We leverage the reversibility of DDIM to develop message-driven image steganography framework based on diffusion models. By utilizing a Cardan grille, we encode a secret message into the initial noise for image gener- ation. This enables MDDM to achieve imperceptible steganography.
Controllability and Practicality: MDDM uses con- trollable conditional prompts and random seeds as in- put to the diffusion model, following the standard gen- eration pipeline to produce high-quality, diverse stego images, while preserving secrecy and requiring no ad- ditional training. By adjusting the length of the secret message, MDDM can be flexibly applied to both infor- mation hiding and anti-counteffiiting watermarking.
To address these issues, we propose MDDM, practical, message-driven generative image steganography framework (see Figure 1). Using carefully designed encoding strategy, the sender generates Cardan grille and maps uniformly random binary message to Gaussian noise that follows the standard normal distribution. Then, the sender uses DDIM and a conditional prompt to generate a stego image start- ing from the initial noise. In this process, the sender may resample the noise while keeping the message and Cardan grille fixed, and vary the prompts to obtain diverse candidate images for selection. Because the procedure is identical to standard image generation, the stego images are indistin- guishable from regular ones. The receiver inverts the stego image to recover the noise and, using the pre-shared Car- dan grille, decodes the hidden message without the seed or prompt of image generation.
Security and Robustness: The images generated by MDDM are consistent with randomly generated im- ages in distribution, which is considered to be provably secure. At the same time, Cardan grille in MDDM has good resistance to exhaustive attacks. In addition, large number of experiments have shown that MDDM has certain robustness and can ensure a high extraction accuracy even under VAE compression and common image distortion conditions so that it can also be ap- plied to watermarking tasks.
2

---

MDDM: Practical Message-Driven Generative Image Steganography Based on Diffusion Models
2. Related Work
representative study. Compared flow-based methods, GAN-based research has been explored more extensively. For example, PARIS (Yang et al., 2024b) developed prov- ably secure method to image steganography and attached a noise module to the generator to improve robustness. Com- pared to GAN-based methods, diffusion models (Hu et al., 2024; Peng et al., 2023; 2024; Yu et al., 2024; Jois et al., 2024) have recently developed generative image steganog- raphy methods due to their advantages in generation quality and diversity. Currently, most research can be divided into two categories: image translation methods and methods that leverage the generative process. However, these methods still face challenges in computational efficiency, practical deployment, and steganographic capability.
The practice of image steganography has evolved consider- ably over time. With the advancement of digital technology, has undergone significant evolution. The techniques have evolved from simple pixel modifications to the application of complex algorithms and advanced encryption methods, becoming increasingly sophisticated. In recent years, re- search has focused on improving concealment, enhancing security, and increasing resistance to attacks. Additionally, the application of artificial intelligence has further promoted innovation in image steganography.
2.1. Cover Image Based Steganography
From early research to the present day, most studies on im- age steganography have focused on embedding information directly into images. The oldest and most classic embed- ded steganography scheme is LSB (van Schyndel et al., 1994; Chan & Cheng. 2004), which embeds information into the least significant bit of image pixels. Furthermore, re- searchers have proposed manually designed methods (Liao et al., 2020; Su et al., 2021) and neural network-based tech- niques (Yang et al., 2020) as adaptive methods to reduce image distortion caused by embedding. There are also fre- quency domain- based steganography methods, including DetDwt (AI-Haj. 2007) and DetDwitvv (Navas et al., 2008). In recent years, deep learning based steganography (Tancik et al., 2020; Guan et al., 2022; Lu et al., 2021; Xu et al., 2022; Jing et al., 2021; Zhu et al., 2018; Fadhil et al., 2023) has emerged. The first end-to-end trainable framework for data hiding, HIDDEN (Zhu et al., 2018), achieves embed- ding and extraction through autoencoders. Recent research on embedded steganography has largely focused on invert- ible neural networks (INNs) (Guan et al., 2022; Lu et al., 2021; Xu et al., 2022; Jing et al., 2021). For example, HiNet (Jing et al., 2021) is the first attempt to utilize invertible neural networks for image hiding tasks, where information hiding and extraction can be accomplished through a single network. However, the aforementioned embedded steganog- raphy schemes often leave modification traces on the image, which can still be detected (Fu et al., 2024).
2.3. Cardan Grille
The Cardan grille is a classical steganographic technique, typically used as a shared key between sender and receiver for hiding and extracting information, and has considerable security (Utepbergenov et al., 2013). Recently, some studies have also tried to apply it to generative image steganography. Most of these studies are based on the Cardan grille and use GAN to perform image restoration to generate stego images (Liu et al., 2018; Zhang et al., 2019c; Wang et al., 2021). Al- though these methods have demonstrated promising results, particularly in terms of security, there are still problems such as uncontrollable generation effects, low stego capacity, and poor versatility.
2.4. Diffusion Models
The rapid advancement of diffusion models has led to a surge in Al-generated images across the internet. Early diffusion models were primarily based on pixel-space diffu- sion like DDPM (Ho et al., 2020). However, in recent years, models based on latent diffusion, such as Stable Diffusion (Rombach et al., 2022), have become the dominant methods. DDIM (Song et al., 2020a), a widely used sampling method, has been applied both unconditional and conditional dif- fusion models. Notably, DDIM inversion techniques have recently been introduced, enabling fine- fine-grained editing of Al-generated images (Wallace et al., 2023; Zhang et al., 2025; Wang et al., 2024; Mokady et al., 2023).
2.2. Generative Image Steganography
Generative image steganography has gained traction and is generally considered more secure than traditional embedding-based methods (Yang et al., 2019). Generative image steganography, leveraging generative models, is com- monly divided into three main categories: flow-based (Zhou et al., 2023b; Wei et al., 2022; Xu et al., 2022), GAN- -bsed (Yang al., 2024b; Zhou et al., 2023a; Li et al., 2020; Su et al., 2024; You et al., 2022), and siffusion-based methods. Flow-based methods primarily exploit the reversible proper- ties of such models, with SR2IT (Zhou et al., 2023b) being
3. Method
We regard the message hiding process Gen as generating natural image from secret noise and the extraction process Ext as recovering the noise from a generated image:
Gen (sk, m) Istego> Ext (sk, Istego) = m.
(1)
where sk is the secret key, m is the secret message, and I ssegoo is the generated image.
3

---

MDDM: Practical Message-Driven Generative Image Sleganography Based on Diffusion Models
In the following paragraphs, provide detailed descrip- tion of our implementation of the message-driven diffusion model steganography (MDDM).
3.1. The Basics of MDDM
In our work, exploit the properties of DDIM (Song et al., 2020a) to construct the information hiding and extraction process. DDIM is an improved diffusion model that, unlike DDPM (Ho et al., 2020), defines non-Markov forward process. DDIM can improve the speed and quality of image generation and is always used as a sampling method. We exploit the following properties of DDIM design our MDDM.
Sampling
ZT
Z0
Figure 2. If the initial noise inputs are similar, then the images generated through deterministic sampling are also similar.
Deterministic Sampling. For steganography, we are partic- ularly interested in the backward process of DDIM, which a key distinction between DDIM and DDPM. We denote the number of diffusion steps as T, the initial noise as Tr, the indices of intermediate steps decrease progressively, and the final result of diffusion as zo. The sampling formula is follows:
Correlation between Generated Image and Initial Noise. DDIM sampling is deterministic process, which means that under the same conditions, ences will follow almost identical sampling trajectories, as shown Figure 2. Let x and 2:!2) denote two Gaussian noise inputs with small difference:
inputs with slight differ-
It VI a1c8 (1)
(2))
2t-1 = Va--1
Vas
(2)
|a (1)
(2) FT
1l2 R
(3)
V 1--a1-1 a--1
of 6B (x::)
(1)
where 5 represents small difference.
+ OzE..
Since the space of the input is continuous (Song et al., (1) and 2y will undergo similar sampling pro- 2020b), 2.
When or = 0, randomness disappears from the formula and this process becomes deterministic. The initial noise or completely determines the final result zo. which is a one- to-one relationship. In our work, we adopt deterministic DDIM sampling across various diffusion models.
cesses and thus yield similar output images x and x As illustrated in Figure 3, when the noise follows the stan- dard normal distribution, slight perturbations applied to se- lect regions of the initial noise do not significantly alter the content of the generated image. Meanwhile, by employing the inversion method mentioned previously, the bias in the inversion process is effectively eliminated. Consequently, similarity in initial noise inputs correlates with similarity in the generated images.
The Diffusion Inversion. To "reverse" the diffusion sam- pling process is known as inversion. In practice, inversion is primarily employed for image editing, image interpolation, and image restoration (Wang et al., 2024). Inversion aims to recover the initial noise corresponding to an image, and under ideal conditions, if this initial noise is used as the starting point of the sampling process, the original image can be reproduced. A representative method is DDIM inver- sion, which recovers the initial noise by deterministically adding noise to the image.
However, prior studies have shown that DDIM inversion typically performs well the unconditional case but un- reliable in the case of text-guided generation (Mokady et al., 2023; Wallace al., 2023; Wang et al., 2024). Although our primary objective is steganography, in editing workflows involving conditional image generation adopt exact in- version methods, such as EDICT (Wallace et al., 2023), which achieves exact diffusion inversion via coupled trans- formations. Notably, any inversion method is acceptable, as the choice of inversion method is not central to our study.
Original 0.1%
1.0%
2.5%
Figure 3. Images generated using DDIM sampling on DDPM (top row) and Stable Diffusion (bottom row). with different perturbation ratios applied the initial noise inputs.

---

MDDM: Practical Message-Driven Generative Image Steganography Based on Diffusion Models
The Information Loss Is Acceptable. The encoding and decoding process of an image inevitably leads to informa- tion loss, but our research shows that this loss is within acceptable range. We study the loss of conditional image generation based on the Stable Diffusion model (SD) and un- conditional image generation based on the Latent Diffusion Models (LDMs)' and DDPM. The original noise is called Ir, and the inverted noise is called 27y. In order to eval- uate the information loss, flatten the high-dimensional space into one-dimensional representation and calculate the absolute difference [i] xr( element by element, as shown in Figure 4. The results show that, whether based on the latent diffusion or the pixel-space diffusion, the abso- lute difference between the original noise and the inverted noise is smaller than that of random noise and most of them remain within 1.0. It is worth noting that the pixel-space diffusion model may be unstable, and the range of absolute differences is slightly larger than that of the latent diffusion models. Since image generation based on latent diffusion models is more widely used in practical applications, our method mainly focuses on latent diffusion models.
not contain the message itself, as shown in Figure 5. Using our encoding strategy, the binary message is mapped to noise that follows the standard normal distribution. Then, the pre-trained diffusion model can generate images using this noise. Since the entire process mirrors general image generation, the stego image remains indistinguishable from a normally generated image. The receiver uses the received stego image perform diffusion inversion, reconstructing the noise and recovering the hidden binary data through the pre-shared Cardan grille without requiring knowledge of the image generation seed or prompt. The benefit of MDDM is that the sender can generate multiple images without changing the secret information and Cardan grille and select the images with high information extraction aceuracy and good quality for transmission.
-1.26
-0.09
-1.21
0.02
0.89
-0.58
0.41
-1.02
-0.30
0.17
1.04
-0.64
0.26
0.80
0.74
-0.62
-0.33
1.05
0.07
0.47
0.42
-0.09
1.0
1.0
1.14
0.72
0.82
-0.22
0.16
1.10
1.22
1.06
0.04
0.8
0.8
0.6
0.6
-0.56
Initial Noise
-0.31
-1.09
Inverted Noise
-0.30
0.4
0.4
0.2
0.2
0.0
0.0
0.5
1.0
1.5
2.0
0.0
0.0
0.5
1.0
1.5
2.0
~ N(0.
Conditional (SD)
Unconditional (LDMs)
1.0
1.0
Figure 5. Visualization of the Cardan grille (blue grid arca), which serves as symmetric key and effectively preserves the distribution of the noise.
0.8
0.8
0.6
0.6
0.4
0.4
0.2
0.2
Message Hiding. In the hiding stage, considering that in- formation loss may reduce the accuracy of steganographic content extraction, we first determine the area suitable for steganography. As shown in Section 3.1, for both latent diffusion models and pixel-space diffusion models, the element-wise absolute difference between the initial noise and the noise recovered by diffusion inversion typically falls within [0, 1]. Therefore, in order to ensure that poten- tial errors do not affect the extraction accuracy, we define the highly robust area of steganography as data with the standard normal distribution in the range of (-oo- -1) and (1, +oc). Here, introduce the standard normal distribu- tion cumulative distribution function:
0.0
0.0
0.0
0.5
1.0
1.5
2.0
0.0
0.5
1.0
1.5
2.0
Unconditional (DDPM)
Random
Figure 4. Distribution of the clement-wise absolute difference be- tween the initial and the inverted noise under different conditions (x-axis: absolute difference; y-axis: proportion).
3.2. Framework of MDDM
MDDM requires no additional training and instead relies on multiple pre-trained modules. Specifically, it leverages either latent diffusion models (e.g., Stable Diffusion) or pixel-space diffusion models (e.g.. DDPM). together with DDIM scheduler and inversion methods (such as DDIM inversion and EDICT), all of which are readily available.
1
4(x)
dt.
(4)
V2T
In MDDM, the sender and receiver first share a randomly generated Cardan grille, equivalent to sk in Equation (1), which specifies the location of the hidden message but does
For a noise of size 1 1xcx x h x w (Batch x Channel x Height x Width), the amount of data in the highly robust area Tinax can be calculated by the following formula:
5

---

MDDM: Practical Message-Driven Generative Image Sleganography Based on Diffusion Models
Algorithm 1 Generate initial noise
Lmaa = 2x (1-4(1)) x x1xcxhx (5)
Input:
The noise size (1, c. h, w), secret message m with
length 1, Cardan grille CG, truncation threshold kt
For example, for noise of size 1 4 x 64 x 64, there are 5199 elements in the highly robust area. When we determine that the length 1 of the secret message m to be transmitted is less than Lmaz, we can calculate the truncation threshold k by the inverse function of (() as follows:
Output: Initial noise IT Function Fi E {0,1))
list ~ I0,
if n = 0 then
y/ = RandomChoice(wu u < -k, list)
else
y RandomChoice(u >> k, list)
A = Φ
2x 3x1xcxhxx
end if
Return
Next, the Cardan grille CG is list of length with unique elements, generated by randomly sampling from the integer set (1, ...,. ; 1 x c x h x w). Let [Gr) xxxxxxx elements of this integer set, then:
F Function F2(
list ~ (0.
denote the
y = RandomChoiceewu -k S u S ks u E list)
Return y
Init noise IT
CG = SandomSample((GG))..s 1
(7)
for < [ do [r[CG[[]] = Fi (mli)
end for
where RandomSample(; I) denotes selecting l distinct ele- ments at random.
for j < 1 x e x w do
if $ CG then
is worth noting that the secret message m is a uniformly distributed binary string formed by encryption or other means. Since this process can be implemented many ways and is not the focus of this article, this article does not describe how to generate uniformly distributed binary string in detail.
zrij = Fz()
end if
end for
resulting in the stego image Istego- Taking the Stable Dif- fusion model as example, the process be formulated
At this point, the preparatory steps are complete. We next generate the initial noise by performing truncated sampling from the standard normal distribution at the previously de- termined Cardan grille positions CG. In each iteration, we draw fresh batch of samples from (O, I) and partition them into three pools according to the truncation threshold k. For each bit of the secret message m, we then randomly sample from the (- - k] pool if the bit is O, or from the (k: +00) pool if the bit is 1, and insert the sampled values into the one-dimensional noise vector at the indices spec- ified by CG. After filling all message-beane bearing positions, the remaining entries are populated by sampling from the draw and placing
Isegoo D (DDIMSampling Text,
(8)
where D denotes the VAE decoder, DDIMSampling denotes the DDIM sampling process, S denotes the number of DDIM sampling steps, Tezt denotes the input prompt, and 2r ~ NO I) denotes the initial noise.
Message Extraction. and applies the inversion to quickly recover the inverted noise, without reconstructing the image. Using only the pre-shared Cardan grille, and without the need for any seeds or prompts, the receiver can sequentially extract the corre- sponding elements from the inverted noise and reconstruct the binary message based on whether each extracted value is greater than or less than zero:
The receiver obtains the stego image
truncated interval (-k, k|] for each them into the unused slots of the noise vector. Finally, we reshape this one- miedimensional vector to the diffusion model's required noise size X c x h x w. In Section 4, we demonstrate that the constructed noise is statistically indis- tinguishable from samples drawn from the standard normal distribution, thereby offering a provable security guarantee for method. Algorithm 1 details this procedure, and Appendix A presents optimized variant designed to ac- celerate noise generation for high-dimensiona inputs.
0, if o4 [CG S 0,
m'li]
(9)
1, if [CG 0.
After applying the above encoding rules to map the secret message m to the initial noise ær, the sender directly uses Fr for DDIM sampling, where the prompt can be arbitrary,
Ideally, the m' obtained by the receiver's 's inversion should be consistent with the secret message m hidden by the sender.
6

---

MDDM: Practical Message-Driven Generative Image Sleganography Based on Diffusion Models
Acc: 1.0000
Ace: 1.0000
Acc: 1.0000
Acc: 0.9990
Acc: 1.0000
Ace: 1.0000
Ace: 1.0000
Astronaut in A cat lying jungle, muted the bed colors
Lighthouse
girl with blond small island by hair, front view the sea
Van Gogh inspired landseape with swirling skies and vibrant colors
(a) Guidance Scale: 3.5
Acc: 1.0000
Acc: 0.9971
Acc: 0.9980
Acc: 0.9990
Acc: 1.0000
Ace: 1.0000
Acc: 1.0000
A cat lying jungle, muted the bed colors
Astronaut in
Lighthouse small island by the sea
girl with blond Van Gogh inspired landscape with swirling skies hair, front view
and vibrant colors
(b) Guidance Scale: 7.5
Figure The performance of MDDM under different guidance scales. The default guidance scale setting of can generally achieve better visual effects. The upper and lower images in each column are generated using the same seed.
4. Security Analysis
Since all samples are drawn independently, and the trunca- tion preserves the symmetry and local density properties of the original distribution, the resulting noise vector æт main- tains the overall statistical characteristies of the standard normal distribution. Moreover, because the Cardan grille positions are chosen uniformly at random and the embedded bits are uniformly distributed, the sampling strategy does not introduce any detectable structural bias. As such, the steganographic modification remains statistically indistin- guishable from standard noise under conventional detection methods. According Appendix B, MDDM is provably secure.
We first examine how MDDM steganography affects the distribution of generated images to demonstrate its provable resistance to steganalysis. To formally describe the sam- w 1xxexxxw denote the initial noise, and let CG from Equation (7) denote the set of indices corresponding the Cardan grille positions, whose size equals the length 1 of the binary string For each index i E CG, we embed one bit m|i] E {0, 1} by sampling the corresponding value z7 independently from a truncated
pling process, let IT E
(t)
standard normal distribution. Specifically, we define the conditional distribution for ZT as follows:
Next, we need to prove that the Cardan grille used by MDDM possesses privacy security. According to Ap- pendix C, even when reusing the Cardan grille for steganog- raphy across multiple images, a third party cannot obtain the ordering privacy information of the Cardan grille, thus unable to threaten the privacy security of the hidden infor- mation.
[NO, I) truncated to (k, 00), if m =1,
I), truncated (-oc, -k), m[1 =0
(10)
The value of threshold is chosen according to the ratio of the payload length to the total embedding capacity, such that larger payloads require smaller k to maintain coverage, while smaller payloads allow for more extreme truncation and thus potentially stronger security. For all remaining positions & CG, sample the values xt independently from the central region of the same distribution:
5. Experiments
Our experiments are conducted based on publicly avail- able pre-trained diffusion models. For unconditional image generation,
())
DDIM for sampling and apply DDIM inversion the inversion method. For conditional image generation, given that EDICT exhibits suboptimal sampling
I), truncated to (-k,k).
(11)

---

MDDM: Practical Message-Driven Generative Image Sleganography Based on Diffusion Models
Table Comparison of the robustness of MDDM and baseline methods in terms of extraction accuracy for 512 512 images. The evaluation includes results for the "PNG" image (i.e., no attack), along with various attacks such as "JPEG" (image compression with an image quality of 95%), "Resize" (image scaling by a factor of 0.5). "Gaussian Blur (GB)" (with radius of 1.0). "Drop" (randomly adding white square of 0.5% area), "Brightness" (with factor of 0.15), and "Rotation" (an angle of 0.3 degrees).
Capacity (Bits)
JPEG
Resize (0.5)
GB
Drop Brightness Rotation (0.005)
Method
Version
PNG
(95)
(1.0)
(0.15)
(0.3)
DwtDet (AI-Haj. 2007)
32
0.83
0.65
0.63
0.68
0.83
0.83
0.72
Dwt (Navas et al., 2008)
32
1.00
1.00
1.00
1.00
1.00
0.78
1.00
RivaGAN (Zhang al., 2019a)
32
0.99
0.99
0.99
0.99
0.99
0.99
0.99
LaWa (Rezaei et al., 2024)
SD-V1.4
48
1.00
1.00
1.00
0.99
1.00
1.00
1.00
MDDM-LC (Ours)
SD-V1.4
48
1.00
1.00
0.99
1.00
1.00
1.00
0.99
GS (Yang et al., 2024c)
SD-V2.1
256
1.00
1.00
1.00
1.00
1.00
1.00
1.00
MDDM-LC (Ours)
SD-V2.1
256
1.00
1.00
0.99
1.00
1.00
1.00
0.99
the image generation effect and message accuracy achieve high level. Based on this, in subsequent experiments based on Stable Diffusion, 7.5 by default to conditionally generate stego images. For conditional image generation, we also evaluate the impact of prompts, as detailed in Appendix D.1. Figure 10 provides additional examples of generated images, demonstrating that our results are of high quality and diversity. addition, we also evaluate the FID (Heusel al., 2017) on the generated images, as detailed in Appendix D.2.
Table Comparison of steganographic capability among three MDDM variants under varying truncation thresholds.
use the guidance scale of
Truncation
Accuracy Bedroom
Type
Bits
Threshold
Face
Cat
MDDM- PU3
2
8946
0.9847
0,9641
0,9816
256 x 256
62386
0.9221
0.8708
0.9581
MDDM-LU
2
559
0.9977
0.9951
256 x 256
1
3899
0.9890
0.9877
MDDM-I.C
2
745
0.9987
0.9973
0.9988
512 X 512
1
5199
0.9946
0,9920
0.9913
5.2. Steganographic Capability
We first evaluate the relationship between steganographic capacity and extraction accuracy (Acc) across three MDDM variants under varying truncation thresholds, as summarized in Table 2. Here, accuracy represents the correctness of the extracted message, while capacity reflects the amount of information that can be embedded. The specific settings of experiments are detailed in Appendix D.3. Experimen- tal results indicate that as the length of the secret message increases, extraction accuracy declines but remains at rea- sonable level. In addition, compared with the pixel-space diffusion models, the latent diffusion models achieve higher extraction accuracy. This further confirms our findings in Section 3.1. Therefore, our method is more suitable for im- age generation based on latent diffusion models. Moreover, we find that although variations in CPU and GPU configura- tions may yield differences in the initially generated noise, these variations have no significant impact on the overall performance of MDDM.
quality (Wang et al., 2024) and, under the standard genera- tive process, generations similar to DDIM (Wallace et al., 2023) while requiring more time, we therefore continue to use DDIM for sampling and adopt EDICT as the inversion method. The number of steps for both sampling and inver- sion is set to 50. All experiments are conducted on NVIDIA RTX 3090 GPUs
Based on the type of generation, MDDM can be categorized into three variants: MDDM-PU for unconditional image generation with pixel-space diffusion models, MDDM-LU for unconditional image generation with latent diffusion models, and MDDM-LC for conditional image generation with latent diffusion models. Specifically, MDDM-PU lever- ages the publicly available pre-trained DDPM model from Hugging Face?, MDDM-LU utilizes pre-trained LDMs, and MDDM-LC typically adopts Stable Diffusion v..5.
5.1. Image Generation
In Appendix D.4, we compare MDDM with the latest diffu- sion model-based generative image steganography methods under identical conditions. All compared methods involve hiding binary messages. The above experiments demon- strate the effectiveness of our proposed method.
Figure 6 compares conditional image generation results under different guidance scales. These images hide 1024 bits of information at size of 512 x 512. The visualization results indicate that at the default guidance scale of 7.5,
hhaps//hugginngfcc..o/
8

---

MDDM: Practical Message-Driven Generative Image Sleganography Based on Diffusion Models
5.3. Robustness
In Section 3.1, we demonstrate correlation between the similarity of the initial noise and the similarity of the final generated image. Consequently, when the final generated image remains largely unchanged, MDDM is not signifi- cantly affected, particularly by common image distortions such as JPEG compression. As shown in Table 1, MDDM resists various image-based attacks and offers more flexi- ble information capacity. Note that since DwtDet, DwtD- etSvd, and RivaGAN are not generative image watermark- ing methods, we use Stable Diffusion to generate cover images. To compare other generative image watermarking methods based on latent diffusion, we use prompts from 3. Results indicate that MDDM can, to some extent, serve as a watermarking method.
Zeu
Methods
SiaStegNet
XuNet
YeNer
StegNet
SRNet
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
Detection Rate
Figure 7. Results of detection using multiple advanced steganalysis methods.
(Ye al., 2017). StegNet (Deng et al., 2019) and SRNet (Boroumand al., 2018), shown in Figure 7. The results are generally around 50%, indicating that the distribution cannot be distinguished, which is consistent with the theo- retical analysis.
5.4. Controllability and Practicality
MDDM enables random image generation while keeping the secret message and Cardan grille unchanged, allowing the sender continuously generate diverse images for selection, shown in Figure 10. Table 5 in Appendix D.5 presents comparison of our method with other methods in terms of diversity, where diversity refers to the number of images that can be generated after a single communication and the sharing of a secret key or seed. Results show that existing inneerrationbbssee methods (Peng et al., 2023; Jois et al., 2024; Peng et al., 2024) require changing the noise seed if the generated image is unsatisfactory, which may lead to increased communication overhead and potential risks. In contrast, our method synchronizes the encryption key for the message and the random seed for the Cardan grille during initial setup. After that, subsequent exchanges no longer require direct point-to-po soopooint communication. For example, the sender can use the initial seed to generate the Cardan grille and then post the stego images their social media page. The receiver can then download these images and extract the information using the initial seed. For subsequent transmissions, the seed can be changed sequentially, and the receiver can do the same; thus, communication can proceed even asynchronously. In summary. with MDDM, each image sent by the sender is arbitrarily controllable, and multiple images can be generated for selection, which avoids arousing suspicion from potential attackers and ensures the accuracy of message extraction. This further demonstrates the safety and practicality of MDDM.
6. Conclusion
We propose MDDM, a practical message-driven generative image steganography method based on diffusion models. The process of generating stego images using MDDM is identical to the general image diffusion generation process, and MDDM performs well in terms of controllability, secu- rity, image quality, robustness, and extraction accuracy. In the future, we will introduce error-correcting codes and ex- plore the performance of MDDM other diffusion models.
Acknowledgements
This work is partially supported by the 111 Project under Grant B21044, the Sichuan Science and Technology Pro- gram under Grants 202 102IZDZX001. the National Natural Science Foundation of China under Grant 62376175 and 62472032, and the Young Elite Scientists Sponsorship Pro- gram by CAST (Grant No. 2023QNRC001).
Impact Statement
Generative image steganography (GIS) has recently emerged as a prominent research direction within broader field of steganography. The research presented in this paper not only advances the development of GIS but also demonstrates the potential for real-world applica- tions. For instance, the proposed MDDM is training- which may facilitate the rapid adoption of GIS technolo- gies. Overall, our work is anticipated to make an impact in domains such as information security and digital copyright protection.
5.5. Resistance to Steganalysis
We test MDDM ZhuNet (Zhang et al., 2019b), SiaSteg- Net (You et al., 2020), XuNet (Xu et al., 2016), YeNet
http://lnnggiiihcccoaaaseeeeoeos Diffussoon Prompts

---

MDDM: Practical Message-Driven Generative Image Sleganography Based on Diffusion Models
References
Ho, J., Jain, A., and Abbeel, Denoising diffusion proba- bilistic models. Advances in neural information process- ing systems, 33:6840-6851, 2020.
Al-Haj. A. Combined dwt-det digital image watermarking. Journal of computer science, ((9):740-740) 2007.
Hopper, N. J., Langford. J., and Von Ahn, L. Provably secure steganography. In Advances in Cryptology CRYPTO 2002: 22nd Annual International Cryptology Conference Santa Barbara, California, USA, August 18-22, 2002 Proceedings 22, pp. 77 97-92. Springer, 2002.
Altaay, A. A. J., Sahib. S. B., and Zamani, M. An intro- duction to image steganography techniques. In 2012 international conference on advanced computer science applications and technologies (ACSAT), pp. 122 126. IEEE, 2012.
Hu, X., Li, S., Ying, Q., Peng, W., Zhang, X., and Qian, Z. Establishing robust generative image steganography via popular stable diffusion. IEEE Transactions on Informa- tion Forensics and Security, 19:8094-8108, 2024. doi: 11..9//TFS..224.344444
Bachrach, M. and Shih, F. Y. Image steganography and steganalysis. Wiley Interdisciplinary Reviews: Computa- tional Statistics, 3(3):251-255) 2011.
Boroumand, M., Chen, M., and Fridrich, J. Deep residual network for steganalysis of digital images. IEEE Trans- actions on Information Forensics and Security, 14(5): 1181-1193, 2018.
Jing, J., Deng, X., Xu, M., Wang. J., and Guan, Z. Hinet: Deep image hiding by invertible network. In 2021 IEEE/CVE International Conference on Computer Vision (ICCV). pp. 4713-4722, 2021. doi: 10.1199/1C 0021.00469.
Cachin, C. An information- thheoretic model for steganogra- phy. In International Workshop Information Hiding, pp. 306-318. Springer, 1998.
Jois, T. M., Beck, G., and Kaptchuk, G. Pulsar: Secure steganography for diffusion models. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pp. 4703-4717, 2024.
Chan, C.-K. and Cheng, L.-M. Hiding data in images by simple lsb substitution. Pattern recognition, 37(3):469- 474, 2004.
Juneja, M. A covert communication model-based on im- age steganography. International Journal of Information Security and Privacy (IJISP) 8(1):19-37, 2014.
Deng, X., Chen, B., Luo, W., and Luo, D. Fast and effective global covariance pooling network for image steganalysis. In Proceedings of the ACM workshop on information hiding and multimedia security, pp. 230 234,,223,2200 2019.
Karras, T., Aila, T., Laine, S., and Lehtinen, J. Progres- sive growing of gans for improved quality, stability, and variation. arXiv preprint orXiv:/7100 170.119/0, 2017.
Fadhil, A. M., Jalo, H. N., and Mohammad, O. F. Improved security of a deep dearning-based steganography system with imperceptibility preservation. International journal of electrical and computer engineering systems, 14(1): 73-81, 2023.
Karras, T., Laine, S., and Aila, T. style-based generator architecture for generative adversarial networks. In Pro- ceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 4401 4410, 2019.
Fu. T., Chen, L.. Jiang, Y., Jia, and Fu, Z. Im- age steganalysis based on dual-path enhancement and fractal downsampling. IEEE Transactions on Infor- mation Forensics and Security, pp. 1-1, 2024. doi: 10.1 10.1109T 20W.IIS..222..43115
Li, J., Niu, K., Liao, L., Wang, L.., Liu, J., Lei, Y., and Zhang, M. A generative steganography method based on wgan- gp. Sun, X., Wang. J., and Bertino, E. (eds.), Artificial Intelligence and Security, pp. 386-397, Singapore, 2020. Springer Singapore. ISBN 978 981-15-8083-3.
Guan, Z., Jing, J., Deng, X., Xu, M., Jiang, L., Zhang, Z., and Li, Y. Deepmih: Deep invertible network for multiple image hiding. IEEE Transactions on Puttern Anulysis and Machine Intelligence, 45(1):372-390, 2022.
Liao, X., Yu, Y., Li, B., Li, Z., and Qin, Z. A new payload partition strategy in color image steganography. IEEE Transactions on Circuits and Systems for Video Technol- ogy, 30(3):685-66) 696, 2020. doi: 10.1109/TCSVT.2019, 2896270.
Heusel, M., Ramsauer, H., Unterthiner, T., Nessler, B., and Hochreiter, S. Gans trained by two time-scale update rule converge to local nash equilibrium. In Proceedings of the 31st International Conference on Neural Informa- tion Processing Systems, NIPS' 17, pp. 6629 6649, Red Hook, NY, USA, 2017. Curran Associates Inc. ISBN 97815108 7781500609664.
Liu, J., Zhou, T., Zhang, 7.., Ke, Y., Lei, Y., and Zhang, M. Digital cardan grille: A modern approach for information hiding. In Proceedings of the 2018 2nd International Con- ference on Computer Science and Artificial Intelligence, pp. 441 441-446, 2018
10

---

MDDM: Practical Message-Driven Generative Image Slcganography Based on Diffusion Models
Liu, Z.,, Luo, P., Wang, X., and Tang, X. Deep learning face attributes in the wild. In Proceedings of International Conference Computer Vision (ICCV), December 2015.
Su, W., Ni, J., Hu, X., and Fridrich, J. Image steganogra- phy with symmetric embedding using gaussian markov random field model. IEEE Transactions on Circuits and Systems for Video Technology, 31 31(3):1001-1015, 2021. doi: 10. 1111111CTTT22222000000000
Lu, S.-P., Wang, R., Zhong, T., and Rosin, P. L. Large- capacity image steganography based on invertible neural networks, In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 10816- 10825,200 2021.
Su, W., Ni, J., and Sun, Y. Stegastylegan: Towards generic and practical generative image steganography. In Proceed- ings of the AAAI Conference on Artificial Intelligence, volume 38, pp. 240-248, 2024.
Mandal, P. C., Mukherjee, I., Paul, G., and Chatterji, B. Digital image steganography; A literature survey. Infor- mation sciences, 609:1451-1440 2022.
Subramanian, N., Elharrouss, O., Al-Maadeed, S., and
Bouridane, A. Image steganography: A review of the recent advances. IEEE access, 0--23499-24422 2021.
Mokady, R., Hertz, A., Aberman, K., Pritch, Y., and Cohen- Or. D. Null-text inversion for editing real images us- ing guided diffusion models. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 6038-6047, 2023.
Tancik, M., Mildenhall, B., and Ng, R. Stegastamp: Invisi- ble hyperlinks in physical photographs. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 2117-2126, 2020.
Utepbergenov, I., Kuandykova, J., Mussin, T., and Sagy- ndykova, S. Creating program and research cryp- tosystem the basis of cardan grille. In 2013 Second International Conference on Informatics & Applications (ICIA), pp. 24-29. IEEE, 2013.
Navas, K., Ajay, M. C., Lekshmi, M., Archana, S., and Sasikumar, M. Dwt-det-svd based watermarking. In 2008 3rd international conference on communication sys- tems software and middleware and workshops (COM- SWARE'08), pp. 271-274. IEEE, 2008
van Schyndel, R., Tirkel, A., and Osborne, C. A digital wa- termark. In Proceedings of 1st International Conference on Image Processing, volume 2, pp. 86-90 vol.2, 1994. doi:
Peng. Y., Hu, D., Wang. Y. Chen, K., Pei, G., and Zhang, W. Stegaddpm: Generative image steganography based on denoising diffusion probabilistic model. In Proceedings of the 31st ACM International Conference on Multimedia, pp. 7113-7147711 2023.
Wallace, B., Gokul, A., and Naik, N. Edict: Exact diffusion inversion via coupled transformations. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition. pp. 22532-22554 2023.
Peng, Y., Wang, Y., Hu, D., Chen, K., Rong, X., and Zhang, W. Ldstega: Practical and robust generative im- age steganography based on latent diffusion models. In Proceedings of the 32nd ACM International Conference on Multimedia, pp. 3001-3009, 2024.
Wang, F., Yin, H., Dong, Y.JJ,, Zhu, H., Zhao, H., Qian, H., Li, C., et al. Belm: Bidirectional explicit linear multi-step sampler for exact inversion in diffusion models. Advances Neural Information Processing Systems, 37:46115 46159, 2024.
Rezaei, A., Akbari, M., Alvar, S. R., Fatemi, A., and Zhang, Y. Lawa: Using latent space for in-generation image watermarking. In European Conference on Computer Vision, pp. 118-136. Springer, 2024.
Wang, Y., Yang, X., and Liu, W. Generative image steganog- raphy based on digital cardan grille. In Security and Privacy in New Computing Environments: Third EAI In- ternational Conference, SPNCE 2020, Lyngby, Denmark, August 6-7, 2020, Proceedings 3, pp. 343-355. Springer, 2021.
Rombach, R., Blattmann, A., Lorenz, D., Esser, P., and Ommer, B. High- resolutooo image synthesis with latent diffuusin models. In Proceedings of the IEEE/CVF con- ference computer vision and pattern recognition, pp. 10684-10695, 2022.
Wei, P., Luo, G., Song, Q., Zhang, X., Qian, Z., and Li, S. Generative steganographic flow. In 2022 IEEE Interna- tional Conference on Multimedia and Expo (ICME), pp. 1-6, 2022. doi: 10. 10.1009ICME339990202288888
Song, J., Meng, C., and Ermon, S. Denoising diffusion im- plicit models. arXiv preprint arXiv:2010.02502 2020a.
Weiming, Z. Provable secure steganography: The- ory. application and prospects. Journal of Cy- bersecurity, 1(1):38, 2023.
Song, Y., Sohl-Dickstein, J., Kingma, D. P., Kumar, A., Er- mon, S., and Poole, B. Score- based generative modeling through stochastic differential equations. arXiv preprint 1rXiv:20/1.1344 2020b.
doi: null. URL
https://www. www.:/wwwwwaoloobeeese.ccm 2M/Y2023/v1/T1//3

---

MDDM: Practical Message-Driven Generative Image Slcganography Based on Diffusion Models
Xu, G., Wu, H.-Z., and Shi, Y.-Q. Structural design of convolutional neural networks for steganalysis. IEEE Signal Processing Letters, 23(5):708-712, 2016.
Yu, F,, Seff, A., Zhang, Y., Song, S., Funkhouser, T., and Xiao, Lsun:
Construction of large-scale image dataset using deep learning with humans in the loop. arXiv preprint 1ati:::5506003380 2015.
Xu, Y., Mou, C., Hu, Y., Xie, J., and Zhang. Robust invert- ible image steganography. In 2022 IEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR), pp. 7865-7874, 2022. doi: 10.1099CVVPS226882222 00772.
Yu, J., Zhang, X., Xu, Y., and Zhang, Cross: diffu- sion model makes controllable, robust and secure image steganography. In Proceedings of the 37th International Conference on Neural Information Processing Systems, NIPS '23, Red Hook, NY, USA, 2024. Curran Associates Inc.
Yang, J., Ruan, D., Huang, J., Kang, X., and Shi, Y.-Q. An embedding cost learning framework using gan. IEEE Transactions Information Forensics and Security, 15: 839-851, 2020. doi: 1A111///TFS.2219.2222220
Zhang, G., Lewis, J. P., and Kleijn, W. B. Exact diffusion inversion via bidirectional integration approximation. In European Conference on Computer Vision, pp. 19-36. Springer, 2025.
Yang, K., Chen, K., Zhang, W., and Yu, N. Provably secure generative steganography based on autoregressive model. In Yoo, C. D., Shi, Y.-Q., Kim, H. J., Piva, A., and Kim, G. (eds.), Digital Forensics and Watermarking, pp. 55-68, Cham, 2019. Springer International Publishing. ISBN 978-3-030-11389-1
Zhang, K. A., Xu, L., Cuesta- Infante, A., and Veeramacha- neni, K. Robust invisible video watermarking with atten- tion. arXiv preprint arXiv: 01285, 2019a.
Zhang, R., Zhu, F., Liu, J., and Liu, G. Depth-wise separa- ble convolutions and multi-level pooling for efficient spatial cnn-based steganalysis. IEEE Transactions on In- formation Forensics and Security, 15:1138- 150, 2019b.
Yang, Y., Liu, Z.,, Jia, J., Gao, Z.,, Li, Y., Sun, W., Liu, X., and Zhai, G. Diffistega: towards universal training-free free coverless image steganography with diffusion models. arXiv preprint arXiv:2407. 10459, 2024a.
Zhang, Z., Liu, J., Ke, Y., Lei, Y., Li, J., Zhang, M., and Yang. X. Generative steganography by sampling. IEEE access, 7:1 7:118586-118597 2019c.
Yang, Z., Chen, K., Zeng, K., Zhang, W., and Yu, N. Provably secure robust image steganography. IEEE Transactions Multimedia, 26:5040-5053, 2024b. doi: 10011090TM...2233330000
Zhou, Z., Dong, X., Meng. R., Wang. M., Yan, H., Yu, K., and Choo, K.-K. R. Generative steganography via auto-generation of semantic object contours. IEEE Trans- actions on Information Forensics and Security, 18:2751- 2765, 2023a.
Yang, Z., Zeng, K., Chen, K., Fang, H., Zhang, W., and Yu, N. Gaussian shading: Provable performance-lossles. image watermarking for diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 12162-12171, 2024c.
Zhou, Z., Su, Y., Li, Yu, K., Wu, Q. M. Fu, Z., and Shi, Y. Secret-to-image reversible transformation for genera- tive steganography. IEEE Transactions on Dependable and Secure Computing, (045):118-4133 2023b. doi: 10. 109/TDSC..002233116661
Ye, J. Ni, J., and Yi, Y. Deep learning hierarchical repre- sentations for image steganalysis. IEEE Transactions Information Forensics and Security, 12(11):2545-2557 2017.
Zhu, J., Kaplan, R., Johnson, J., and Fei-Fei, L. Hid- den: Hiding data with deep networks. In Computer Vision - ECCV 2018: 15th European Conference, Mu- nich, Germany, September 8-14, 2018, Proceedings, Part XV, pp- 682-697, Berlin, Heidelberg, 2018. Springer- doi: 10.1007/
You, W., Zhang, H., and Zhao, X. A siamese for image steganalysis. IEEE Transactions on Information Foren- sics and Security, 16:291-306 2020.
Verlag. ISBN 978-3-030-0126633. 978-3-030-01266--.444 URL https://doi.org
You, Z. Ying. Q. Li, S., Qian, Z. and Zhang, X. Im- age generation network for covert transmission in on- line social network. In Proceedings of the 30th ACM International Conference on Multimedia, MM '22, pp. 2834-2842, New York, NY, USA, 2022. Association for Computing Machinery. ISBN 9781450392037. doi: 10. 1145/3503161.35481133 URL attps: aooi.org/ 10.1145/35053 31.888139.
12

---

MDDM: Practical Message-Driven Generative Image Steganography Based on Diffusion Models
A. Improved Algorithm for Initial Noise Generation
Analogous to the original algorithm, the enhanced method still uses each uniformly drawn binary bit (0 or 1) to decide whether its associated sample should lie in the left tail (x S -k) or the right tail (a: k) of the standard normal distribution. The key innovation is the adoption of vectorized rejection sampling for the central region: a large batch of standard normal variates is generated in a single operation, values falling within the interval (-R, k] are identified via Boolean masking, and those accepted samples are filled sequentially into all non-tail positions. By avoiding element-wise loops for random-number generation, this method greatly improves overall execution efficiency. For the tail regions, the algorithm similarly generates multiple candidate variates in batches for each tail position, filters the subset satisfying the prescribed left or right tail condition, and randomly selects one. If no candidate meets the criterion in given batch, sampling continues iteratively until valid tail samples have been obtained for every position.
B. Provable Security of MDDM
Assume that the distribution of carrier data is Pc, the distribution of encrypted data is Ps, and the relative entropy between carrier data and encrypted data is P.), which is defined as:
Pc(9) Ps(9)
D(PollPs)
E lg
Polg)
(12)
gEΩ
If D(Pol = 0, the steganography system is said to be absolutely secure (Cachin, 1998; Weiming, 2023).
First, since the hidden message is not in the pixels of the image, it is impossible to find the hidden message through steganalysis the pixels. Second, since the hidden message does not change the distribution of the noise, it will not cause any characteristic difference between the stego images and other naturally generated images. To sum up. MDDM absolutely safe.
C. Security of the Cardan Grille in MDDM
In MDDM, the security of the Cardan grille is closely related to the steganographic communication protocol. Specifically, a new Cardan grille is used for each image, the distribution of the reversed noise for each image will be different, and third parties will not have sufficient information to infer whether an image contains hidden information. However, when multiple images share the same Cardan grille for steganography, the distribution patterns of their reversed noise will exhibit certain degree of similarity. Therefore, we evaluated the privacy security of the Cardan grille steganographic method under the scenario where the Cardan grille is used for only one communication and then reused in subsequent transmissions, across different messages. The diffusion model employed is Stable Diffusion v2.1, with image resolution set to 512 x 512 and an empty prompt. We assume that an attacker has access to the stego images and is aware of the diffusion model, the steganographic method, and even the number of Cardan grille positions (i.e., the message length). The attacker's 's objective is to infer the position distribution and the ordering of the Cardan grille.
The attacker extracts the inverted noise from multiple images and filters out the elements with larger absolute values, as positions with larger absolute values are more likely correspond to locations used by the Cardan grille. Two attack strategies are considered:
Union Strategy: For each image, the attacker selects the position elements with the largest absolute values from the inverted noise vector. The positions chosen across all images are then combined via a union operation to obtain the final set of selected locations.
Top Strategy: For each image, the attacker selects the I position elements with the largest absolute values from the inverted noise vector. Subsequently, among all the selected positions from all images, the positions that occur most frequently are chosen as the final set of selected locations.
The experimental results are shown in Figure 8. "Union" refers to the position hit rate of the first strategy; "Union Redundancy" represents the redundancy of the union set from the first strategy (calculated as the ratio of the number of Cardan grille positions to the number of elements the union set lower values indicate higher redundancy); and "Top"
13

---

MDDM: Practical Message-Driven Generative Image Steganography Based on Diffusion Models
refers the position hit rate of the second strategy. A high position hit rate in the Union strategy combined with low Union Redundancy indicates that the attacker has inferred significant portion of the Cardan grille's 's position distribution.
The experimental results show that when the Cardan grille is used only once or reused up to twice, neither strategy poses significant threat to the position distribution or ordering of the Cardan grille. When the Cardan grille is reused 3 to times, the Union strategy achieves higher hit rate, but the redundancy of the position set rapidly decreases, limiting the threat poses to the Cardan grille's position distribution. The Top strategy also sees a modest improvement in hit rate, but neither strategy able to compromise the ordering the Cardan grille positions. When the Cardan grille reused more than times, the hit rate of the Union strategy shows no substantial improvement, while the position decline, paradoxically reducing its threat the Cardan grille's 's positional information. The Top strategy shows only limited further improvement in hit rate, and neither strategy is ever able to compromise the ordering information of the Cardan grille.
redundancy continues
Since the Cardan grille is ordered, the brute-force computational complexity of guessing the order an n-position Cardan grille is (II), where
1! Rz 22 (
(13)
according to Stirling's approximation. Since the difficulty of brute-forcing the ordering of the Cardan grille increases exponentially with the number of positions, more secure strategy is to use longer messages. We therefore recommend that, in steganographic scenarios where the Cardan grille is reused, each image should carry at least 50 bits of hidden information.
100%
90%
Percentage
70%
Union-32 Bits
Union-32 Bits Redundancy
60%
Union-512 Bits
Union-512 Redundancy
50%
Union Redundamcy
Top-32 Bits
Top-512 Bits
40%
Top-4096 Bits
2
Steps
Figure 8. Simulated attacks against the MDDM that employs repeatedly used Cardan grille under varying message lengths based on Stable Diffusion v2.1. The pereentages in the chart represent the proportion of simulated attack hit positions rather than the proportion hit orders.
D. Experiments
D.1. Effects of Prompts Inversion in Conditional Image Generation
In this experiment, assess how prompts affect MDDM in conditional image generation, shown in Figure 9. We use three evaluation metries: (i) Case 1 quantifies the global discrepancy between the initial noise and the inverted noise using mean squared error (MSE); for comparability across metrics, we report - MSE. (ii) Case 2 computes, over all elements, the fraction indices at which the initial and inverted noise have the same sign (either both positive or both negative). by element- wise comparison. (iii) Case 3 applies the same element-wise comparison but only at positions specified by the Cardan grille mask, which directly reflects MDDM performance. We further compare these three cases under two inversion
14

---

MDDM: Practical Message-Driven Generative Image Sleganography Based on Diffusion Models
regimes: (a) inversion using null-text, and (b) inversion using the same prompt used during sampling. The results indicate that increasing the guidance scale drives the inverted noise further from the initial noise, while MDDM (Case 3) maintains high extraction accuracy. At the same time, inversion using null-text increases the discrepancy relative to the initial noise, yet MDDM remains consistently accurate, These findings suggest that, in conditional image generation, a receiver can reliably recover the hidden message solely via the Cardan grille without knowing the sender's 's prompt.
1.00
0.95
0.90
0.85
Casel (Null-text)
Casel (Prompt)
0.80
Case2 (Null-text)
Casc2 (Prompt)
0.75
Case3 (Null-text)
Case3 (Prompt)
0.70
Guidance Scale
Figure 9. Effects of prompts inversion in conditional image generation. Our method maintains high accuracy as the guidance scale increases.
D.2. Quantitative Evaluation of Image Quality
We compare MDDM with two GAN-based generative image steganography methods, StegaStyleGAN (Su et al., 2024) and CIS-Net (You al., 2022), on the CelebA dataset (Liu et al., 2015). The results are shown in Table 3. Due image size limitations of CIS-Net, all comparisons are conducted on images of size 32 x 32. Moreover, considering the instability often associated with GAN training, and to avoid potential bias from our own reimplementation, we cite the results of StegaStyleGAN and CIS-Net directly from their original papers.
To quantitatively evaluate the image quality of our proposed method, we employ the Fréchet Inception Distance (FID), a widely used metric that assesses the similarity between the distributions of generated and real images. it worth noting that FID scores influenced by various factors, such as image compression and cropping.
Experimental results show that our method achieves competitive performance not only in terms of steganography capacity and accuracy but also in image quality, with FID scores comparable to those of existing methods. This indicates good generalization ability. Unlike GAN-based steganographic models, MDDM does not require additional training. Consequently, the image quality depends on the generative quality of the original diffusion model, and using more advanced diffusion models further improves the image quality produced by MDDM.
Table 3. Comparison of our method with baseline GAN methods.
Method
Size
Capacity (Bpp)*
Accuracy
FID
CIS-Net (You et al., 2022)
32
32
0.03
0.98
6.20
StegaStyleGAN (Su et al., 2024)
32
32
0.06
1.00
3.74
MDDM-PU (Ours)
32
32
0.08
0.99
11.71
MDDM-PU3 (Ours)
32
32
0.08
1.00
Bpp means bits per pixel.
D.3. Detailed Experimental Setup for Steganographic Capability
For unconditional image generation, we use pre-trained diffusion models on the CelebA-HQ (face images) (Karras et al., 2017), ASSUN-Bedromm and LSUN-Cat (Yu et al., 2015) datasets. For conditional image generation, we use Stable Diffusion v1.5. The prompts for the Face, Bedroom, and Cat categories are "Portrait photo, best quality, masterpiece, ultra detailed, UHD 4K, photographic, Iiirl, face, looking at viewer, color photo, natural colors", "A photo of the bedroom", and "A cat", respectively.
15

---

MDDM: Practical Message-Driven Generative Image Sleganography Based on Diffusion Models
As described in Pulsar (Jois al., 2024), MDDM is also symmetric key scheme. The sender can easily know the accuracy of the information extracted from the generated image and can terminate and regenerate. key advantage of our method is that when the two parties communicate and determine the Cardan grille, the same secret message can be generated multiple times using different seeds without affecting the reception (see Appendix D.5 for details). Accordingly, we apply the MDDM-PU3 optimization strategy for unconditional pixel-space diffusion to mitigate potential instabilities (see Section 3.1) by selecting, from three consecutive samples, the image with the smallest information loss. This is completely feasible practical applications, because the improved algorithm Appendix A is used, each unconditional generation and extraction for 256 256 image takes only about 10 seconds on NVIDIA RTX 3090.
D.4. Quantitative Results Compared Other Generative Image Steganography Methods
We conduct a quantitative comparison between our method and baseline methods on the FFHQ (Karras et al., 2019), and LSUN- Cat (Yu al., 2015) datasets, as shown Table Since neither StegaDDPM nor L.Stega has made the experimental code seed public, the data of StegaDDPM and L.Sttega from the data in the paper L.DStega (Peng et al., 2024) for reference. For Pulsar, utilize its open-source code conduct tests. The specific experimental settings of MDDM-PUS M0D are described in Appendix D.3. Using MDDM-PU3 can be regarded as comparing the accuracy after each seed sharing.
Table 4. Comparison of extraction accuracy and capacity between MDDM and baseline methods.
Capacity (Bits)
Accuracy
Method
Type
Size
FFHQ
Bedroom
Cat
Pulsar (Jois al., 2024)
256 256
4500
0.9700
0.9300
0.9600
StegaDDPM (Peng et al., 2023)
256 256
4096
0.9345
0.9019
0.9081
LDStega (Peng et al., 2024)
GIS
256 256
4096
0.9865
0.9850
0.9848
MDDM-PU (Ours)
(Diffusion)
256 256
4096
0.9248
0.9379
0.9219
MDDM-PU3 (Ours)
256 x 256
4096
0.9865
0.9739
0.9989
MDDM-LU (Ours)
256 x 256
4096
0.9950
0.9868
"A cute dog is wearing hat"
"A photo of an astronaut riding a horse mars"
"Crispy fried chicken, high quality"
CG A, Msg
CG A, Msg
CG A, Msg 2
CG B, Msg
CG B, Msg
Random
Figure 10. Examples of images generated by Stable Diffusion v2.1 for various combinations of Cardan grilles, messages, and prompts (CG refers to the Cardan grille and Msg refers to the message). All images are 512 x 512 pixels with medden- length of 1024 bits. eexsago-n accuracy for every case 100%.
16

---

MDDM: Practical Message-Driven Generative Image Sleganography Based on Diffusion Models
D.5. Diversity of MDDM
Table 5 shows the comparison of method with other methods in terms of diversity, where diversity refers to the number of images that can be generated after single communication of a shared key. Figure 10 shows visualization of the generation effect of MDDM in various cases.
Table 5. Comparison of the diversity of MDDM and baseline methods.
Method
Hiding Type
Diffusion Type
Diversity (Number of Images)
StegaDDPM (Peng et al., 2023)
Binary
Pixel-Space
1
Pulsar (Jois et al., 2024)
Binary
Pixel-Space
1
1
LDStega (Peng et al., 2024)
Binary
Latent
CRoSS (Yu et al., 2024)
Image
Latent
Several"
MDDM (Ours)
Binary
Pixel-Space Latent
00
CRoSS can alter individual elements in the secret image but has difficulty changing the overall contents of the image.
17


Reviews:
[{"review_id": "2E9tJV2QKd", "reviewer": "Reviewer_fjGZ", "summary": "To address the issues with extraction accuracy, robustness, efficiency, and practicality in GIS, this paper proposes a practical and robust message-driven GIS framework, called MDDM. Although various experiments show the advantages of MDDM in accuracy, controllability, efficiency, and practicality, there still exist some issues:\n\n1)\tThe paper is poorly organized, illogical, and looks like a report, which is hard to follow.\n\n2)\tAlthough the paper states that it has three contributions, they are not solid. \n\n3)\tJust read the paper not long ago, “StegaStyleGAN: Towards Generic and Practical Generative Image Steganography”, and in this paper, I felt that I saw the shadow of StegaStyleGAN, but it didn't be mentioned in this paper or compare it with similar ones, such as “Image Generation Network for Covert Transmission in Online Social Network”.\n\n4)\tThe proposed MDDM is a generative method, but there are not any experiments on quality assessment of generated images.", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We are very grateful for your recognition of our work and believe that our work has great advantages in accuracy, controllability, efficiency and practicality. At the same time, we sincerely thank you for your valuable comments, which we think will significantly improve the quality of the paper. The following are the detailed responses to your questions.\n\n1. Regarding your question about \"unreliable contribution\", after careful consideration, the contributions of our work can be mainly divided into three aspects: efficiency, generation diversity and controllability, and security. Among them, **1) Efficiency**: The contribution of efficiency is mainly about no training. Traditional GAN-based generation methods, such as the StegaStyleGAN you mentioned, usually need to train the special models and modules to achieve good results, while our method can be directly carried out on the pre-trained diffusion model without any fine-tuning, which effectively reduces the cost and significantly improves efficiency. **2) Generation diversity and controllability**: The contribution of generation diversity and controllability is mainly reflected in the fact that our method can generate different images while transmitting the same information and using the same Cardan Grille, which has obvious advantages over generative steganography that requires fixed seeds. The experiments in Appendix B.2 have shown this contribution. **3) Security**: Security is mainly reflected in that our method can reduce the frequency of communication to resist steganalysis attacks, and our method is generally provably secure, that is, **the hidden information is not in the image and does not affect the distribution of the image**. We have conducted theoretical analysis and experimental explanations in Appendix A. The above contributions have comprehensively confirmed the practicality of our method.\n  \n2. Regarding your question about \"references and comparisons of StegaStyleGAN and CIS-Net\", we are very grateful for your reminder. We have conducted in-depth research on these two papers. Both of them are GAN-based methods and have achieved good results on low-resolution images. Due to the training cost, generating arbitrary high-resolution images is difficult. Moreover, both methods can only generate steganographic images unconditionally and are uncontrollable. Our solution is a training-free diffusion inversion-based framework for generative steganography at multiple resolutions which can generate any image in a controllable way. In addition, the above two works, or we say most GAN-based methods, hide and generate secret information in image textures and rely on trained convolutional networks for extraction. This is completely different from ours. The hidden information of our method is not in the image, but in the initial noise at the beginning, and the extraction also uses an inversion method instead of training an extractor. Furthermore, we also compare the CIS-Net and StegaStyleGAN in the table below. It can be seen that our scheme also has obvious advantages for low-resolution images. We will give a discussion of these two works and related experimental results in the final version.\n  \n  | Method | Image Size | bpp$\\uparrow$ | Acc$\\uparrow$ | SRNet (0.5 is the best) |\n  | --- | --- | --- | --- | --- |\n  | Ours (SD1.5-Gustavosta) | 512 $\\times$ 512 | 0.02 | 0.99 | 0.5 |\n  | Ours-U3 | 256 $\\times$ 256 | 0.06 | 0.99 | 0.5 |\n  | Ours-U3 | 32 $\\times$ 32 | 0.08 | 1.00 | 0.5 |\n  | StegaStyleGAN | 32 $\\times$ 32 | 0.06 | 1.00 | 0.5 |\n  | CIS-Net | 32 $\\times$ 32 | 0.03 | 0.98 | 1.0 |\n  \n3. Regarding your question about the \"lack of experiments to evaluate the quality of generated images\", we currently provide qualitative visualization results in the paper. You can see the images generated by our method in Figure 5. These are generated by our method using pre-trained StableDiffusion, with a size of 512$\\times$512. The Van Gogh-style images generated for the same prompt words and the same secret information on the right side of Figure 5 further illustrate the effect of MDDM image generation. Of course, our method also works well for the unconditional generation of datasets such as LSUN. As you mentioned, we can further use NIQE (Natural Image Quality Evaluator, the lower the better) for quantitative experiments. As shown in the table below, our method shows the better results.\n  \n  | Dataset | NIQE (StegaStyleGAN) | NIQE (Ours) |\n  | --- | --- | --- |\n  | Church | 40.245 | 39.980 |\n  | Cat | 55.546 | 42.966 |\n  | FFHQ | 64.551 | 58.815 |\n  \n\nFinally, regarding the writing problem you mentioned, we will reorganize the logic and language in the final version. Specifically, we will put the core content in the main text, put the content that does not affect the reading in the appendix, reorganize the content of the entire text, and make the language expression easier to read.", "claims_and_evidence": "The paper is poorly organized and illogical, which is hard to follow.", "methods_and_evaluation_criteria": "Partly", "theoretical_claims": "No", "experimental_designs_or_analyses": "The proposed MDDM is a generative method, but there are not any experiments on the quality assessment of generated images.", "relation_to_broader_scientific_literature": "N/A", "essential_references_not_discussed": "1. StegaStyleGAN: Towards Generic and Practical Generative Image Steganography\n\n2. Image Generation Network for Covert Transmission in Online Social Network", "other_strengths_and_weaknesses": "See Summary", "other_comments_or_suggestions": "See Summary", "questions_for_authors": "See Summary", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "6qEwK6MyYb", "reviewer": "Reviewer_MRbY", "summary": "This paper proposes a practical and robust message-driven generative image steganography framework, called MDDM. MDDM uses a carefully designed encoding strategy to encode the binary message and uses it as the starting point for diffusion, allowing users to generate diverse images through conditional text without additional training.\n\n## update after rebuttal\nThanks for the clarification. According to the novelty and writing quality, I will keep my score.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We are very grateful for your recognition of the innovativeness of our work and the thoroughness of our experiments. At the same time, we sincerely thank you for your valuable comments, which we think will significantly improve the quality of the paper. The following are the detailed responses to your questions.\n\nThank you for your reminder on the question \"the significance of calculating the probability from the distribution truncated position\" mentioned in **Claims And Evidence**. Our method supports secret messages of different lengths. Based on the size of the noise (such as 1$\\times$4$\\times$64$\\times$64), the length of the hidden information cannot be directly calculated from the truncated position, but the length of the hidden information can be calculated using the probability value.\n\nRegarding the \"insufficient security proof\" mentioned in your **Theoretical Claims**, as you said, we did consider the security issue. We currently have a theoretical description in Appendix A, and in the experimental part, we have experimentally verified it using a variety of state-of-the-art steganalysis methods. Thank you for your reminder. We will adopt your suggestion to provide a more rigorous proof that the noise generated based on message m in Algorithm 2 is indistinguishable from normal carrier noise, and further prove that embedding steganographic noise only in the Cardan Grille position will not change the distribution: 1. Message m is converted into a uniformly distributed binary string through encryption and other methods. 2. The probability of positive and negative symbols in the standard Gaussian distribution is uniform (50% each), but the distribution of values ​​is not uniform. 3. The Cardan Grille position is randomly generated according to the length of the uniformly distributed binary string. 4. Truncated independent sampling is performed at the Cardan Grille position and other points. For example, the sampling range for the Cardan Grille position is (-infinity, -1) ∪ (1, infinity), while the remaining range is independently and randomly sampled within (-1, 1). This ensures that the overall sampling is random and the distribution still satisfies the standard Gaussian distribution. Due to the limitations of this document, we will attach specific detailed proofs in the final version.\n\nRegarding the expression problem, you pointed out in **Other Comments Or Suggestions**, we thank a lot for your careful reading and kind correction. This is indeed an oversight in our writing. We will correct it in the final version.\n\nFinally, regarding the questions you mentioned in **Questions For Authors**, we are happy to discuss them with you. For the first question, we analyze the regional robustness of the noise before and after diffusion inversion and conclude that the edge distribution of the diffusion model is robust. Therefore, we prioritize the random determination of the location of the edge distribution of the noise to generate a robust embedding region. This is mentioned in \"The Information Loss is Acceptable\" in section 3.1 of the paper. For the second question, the difference arises because unconditional diffusion is typically implemented through pixel-space diffusion, with an initial noise size of 1$\\times$3$\\times$256$\\times$256 (corresponding to a generated image size of 256$\\times$256), whereas conditional diffusion is usually implemented via a latent diffusion model, such as Stable Diffusion, with a noise size of 1$\\times$4$\\times$64$\\times$64 (corresponding to a generated image size of 512$\\times$512). This distinction effectively addresses the issue you raised.", "claims_and_evidence": "In line 273 the authors suggest the absolute difference between the pre- and post-inversion values of any randomly sampled standard normal variable is generally within the range of -1 to 1. However, immediately after that, authors calculated that the probability of a value outside this range amounts to 0.32. Does this make sense?", "methods_and_evaluation_criteria": "Yes. It is indeed interesting to investigate how to improve the security and robustness of generative image steganography.", "theoretical_claims": "The proof of the security of the proposed method is insufficient; the authors should show that the noise generated in Algorithm 2 based on the message m is indistinguishable from the normal carrier noise, and additionally provide a proof that the practice of embedding the steganographic noise only in the CG position does not change the distribution.", "experimental_designs_or_analyses": "The experimental setup was clear and logical and the results were excellent.", "relation_to_broader_scientific_literature": "If the quality of image generated by LDStega (Peng et al., 2024) or is not satisfactory, it requires replacing the seed. The method proposed by this paper is aim to address this problem.", "essential_references_not_discussed": "None", "other_strengths_and_weaknesses": "Pros\n1. The method proposed in this article aims to address the problem of reducing the direct contact between the sender and the receiver in steganography by using Cardan Grille to reduce the frequent transmission of random seeds, which contributes to improving the security of existing image steganography methods.\n2. Good analysis of the diffusion model inversion process.\nCons:\n1. Lack of detailed description and analysis of CG. See Question 1.\n2. The rigor of the article writing needs to be improved. See the next column for details.", "other_comments_or_suggestions": "1. From Page 5 to Page 6, there are three (-infinity, 1) which in my opionions seems to be (-infinity, -1).\n2. In Algorithm 2, F1n should be F1(n); Missing equal sign or assignment symbol between x and RandChoice function; Missing space between Function and F2.", "questions_for_authors": "1. How does selecting embedding locations randomly according to probability achieve the effect of selecting robust regions as claimed by authors?\n2. What conditions govern the embedding rate of the methods? Why is there a huge difference in the embedding rate between unconditional and conditional?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "75Jphh6T1U", "reviewer": "Reviewer_eDLC", "summary": "This paper introduces a new message-driven generative steganography based on the diffusion model, MDDM, which is a novel framework that combines the diffusion implicit model (DDIM) with Cardan Grille to dynamically adjust between watermarking and steganography effectively, practically, and securely. MDDM encrypts the secret message and generates the stego image without training or passing a specific seed. This method can greatly improve the flexibility, security, and practicality of image steganography. The author conducted several experiments to verify the proposed method.\n\n## update after rebuttal\n\nI keep my judgement on the novelty, and therefore I choose to keep my scores.", "questions": "", "limitations": "", "rating": 5, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely thank you for your detailed review and valuable comments on our paper. Your in-depth analysis and constructive suggestions on our work not only reflect your rigorous attitude toward research but also provide important guidance for us to further improve the paper. We are very grateful for your positive feedback on the innovation, practicality, and experimental design of this paper, and we also cherish the room for improvement you pointed out. The following is our response to your questions and suggestions one by one, hoping to fully address your questions and reflect our commitment to improving the paper.\n\nRegarding the citation of the relevant literature on Cardan Grille you mentioned, thank you very much for pointing this out. We fully agree that introducing relevant references and briefly introducing them when the Cardan Grille is first mentioned will make the paper more rigorous and complete. In the revised manuscript, we will cite related studies (such as Digital Cardan Grille: A modern approach for information hiding) the first time the Cardan Grille is mentioned, and briefly explain its classic applications in the fields of steganography and encryption to enhance the historical background and academic relevance of this paper's methods. Thank you again for your detailed suggestions.\n\nRegarding the comparative conditions of \"diversity\" in Table A1 you mentioned, thank you for your attention and questions on this part. We currently explain the diversity compared with the conditional generative diffusion method. Specifically, in the case of conditional diffusion (e.g., using prompt) generative steganography, MDDM can still maintain high image diversity, thanks to the effective integration of Cardan Grille and diffusion models. To further clarify, we will revise the caption of Table A1 in the revised manuscript to clearly state that the diversity evaluation mainly focuses on conditional generation, and we will also explain the diversity of unconditional generation. Your suggestion helped us realize the need to present this part more clearly, and we are very grateful for this.\n\nRegarding the length of Algorithm 2 you mentioned, thank you very much for your suggestion on the presentation of the algorithm. The content of Algorithm 2 has been carefully reviewed, and it was agreed that its current form may appear lengthy and affect reading fluency. In the revised manuscript, we will refine and optimize the algorithm description, and appropriately convert some details into concise text descriptions, while retaining the clarity of the core steps. We will also consider merging repeated or minor descriptions to improve overall readability. Your suggestion is crucial for us to improve the expression of the paper, and we sincerely thank you for it.\nRegarding the premise of Section 4.4 \"Security of Cardan Grid\", thank you for pointing out the shortcomings in our security analysis. In the original paper, we only discussed security for a specific case (selecting a 32% Cardan Grid ratio), which may lead readers to misunderstand the security of the method in other cases. The Cardan Grid itself remains generally secure, and its security stems from its randomness and compatibility with the diffusion model. In the revised manuscript, we will correct the statement in Section 4.4, clearly state the security of the Cardan Grid in different scales and scenarios, and supplement the relevant analysis to eliminate potential ambiguity. Your feedback makes us aware of the shortcomings of this section, and we will seriously improve it.\n\nWe are very grateful for the details you pointed out, such as the spelling error of the \"guidance scale\" in Figure 5 and the insufficient explanation of the symbol \"δ\". These subtle but important suggestions helped us improve the professionalism of the paper. In the revised manuscript, we will unify the format of all figure titles and clearly explain the meaning of symbols such as \"δ\" in Section 3.1 to improve the readability and rigor of the paper.\n\nWe would like to express our sincere gratitude again for your comprehensive and insightful review of this article. We are encouraged by your affirmation, and your suggestions have pointed us in the direction of improvement. We have outlined the revision plan for all the comments in our responses and implemented these adjustments one by one in the revised manuscript. We believe that after this revision, the paper will be significantly improved in terms of clarity, rigor, and scientific contribution. If you have further comments or suggestions, we are very happy to continue to communicate and improve.", "claims_and_evidence": "The viewpoints and methods presented in the paper are supported.", "methods_and_evaluation_criteria": "The generative steganography proposed in the paper is easy to implement as it does not require training, sharing seeds, or prompt words, which can be flexibly used between steganography and watermarking, making it better suited for different needs.", "theoretical_claims": "The paper provides a derivation and proof of the correlation between latent space and pixel space. In addition, the paper also provides a clear description of security.", "experimental_designs_or_analyses": "The experimental part of the paper includes qualitative and quantitative experiments, ablation experiments, and comparative experiments (comparing the steganography ability and accuracy with steganography methods and comparing the robustness with watermarking methods).", "relation_to_broader_scientific_literature": "The method proposed in this article innovates based on existing research on generative steganography, introducing the Cardan Grille method on the basis of diffusion model-based generative steganography and achieving good integration without damaging the distribution. Compared with previous methods that require sharing seeds, more images can be generated based on the same category or prompt words, making it more diverse and secure.", "essential_references_not_discussed": "Cardan Grille is mentioned in the paper, and relevant papers should be cited and briefly introduced when first mentioned.", "other_strengths_and_weaknesses": "Advantages:\n1. This paper creatively applies exact inversion to the field of image steganography, and unlike previous generative steganography, it combines Cardan Grille to improve the random initial noise to obtain more flexible characteristics (this improvement does not destroy the distribution characteristics of the random noise itself, which is great!). This combination expands the practicality of generative image steganography and provides new ideas for subsequent research.\n2. This paper has a rich set of experiments, including qualitative, quantitative, ablation, and comparative experiments. As far as I know, since most image generation applications are based on potential diffusion, such as stable diffusion, the method in this paper can be applied to most scenarios.\n3. The method in this paper can not only achieve high-capacity steganography but also has a certain degree of robustness (for watermarking). It can effectively embed and extract information without providing the original generation conditions (such as seeds or prompt words), which is practical.\n \nWeaknesses:\n1. Under what circumstances is the Diversity in Table A1 compared, unconditional or conditional? Can you provide more detailed explanations?\n2. Is the part of Algorithm 2 too long? Can some algorithms be considered for appropriate text descriptions or merging?\n3. \"Safety at Cardan Grille\" in Section 4.4 lists the number of Cardan Grilles when selecting 32%. It should be explained that the introduction of Cardan Grille itself is still safe in other cases.", "other_comments_or_suggestions": "Some details, such as the \"guidelance scale\" in Figure 5, \"g\" is not capitalized. The first letter of the caption of other pictures is capitalized. The use of some symbols should also be explained, such as \"δ\" in Section 3.1.", "questions_for_authors": "Please address the weaknesses listed above.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This paper focuses on generative image steganography. The authors propose an encoding strategy to embed binary information, which serves as the starting point for diffusion, enabling users to generate diverse images. The binary data can be recovered through inversion. Following the rebuttal, all reviewers acknowledge that their concerns regarding technical issues have been addressed. However, they consistently note issues with the paper's writing and presentation. One reviewer leans toward rejection, emphasizing that the writing quality needs improvement. Though the reviewer provides limited details in terms of how should authors improve the presentation.

AC has reviewed all the submitted reviews and the rebuttal. Given the novelty of this work, AC recommends acceptance. However, the authors must fulfill their commitment to significantly improve the writing in the final version.
Decision: Accept (poster)