Efficient and Separate Authentication Image Steganography Network
Authors: Junchao Zhou
Yao Lu
Jie Wen
Guangming Lu
Venue: ICML 2025 spotlightposter (2025)
Keywords: Image Steganograhy
Invertible Neural Network
Authentication Mechanism
Primary area: applications->computer_vision
TL;DR: An efficient and separate authentication image steganography network based on Conditional Invertible Neural Network

Abstract: Image steganography hides multiple images for multiple recipients into a single cover image. All secret images are usually revealed without authentication, which reduces security among multiple recipients. It is elegant to design an authentication mechanism for isolated reception. We explore such mechanism through sufficient experiments, and uncover that additional authentication information will affect the distribution of hidden information and occupy more hiding space of the cover image. This severely decreases effectiveness and efficiency in large-capacity hiding. To overcome such a challenge, we first prove the authentication feasibility within image steganography. Then, this paper proposes an image steganography network collaborating with separate authentication and efficient scheme. Specifically, multiple pairs of lock-key are generated during hiding and revealing. Unlike traditional methods, our method has two stages to make appropriate distribution adaptation between locks and secret images, simultaneously extracting more reasonable primary information from secret images, which can release hiding space of the cover image to some extent. Furthermore, due to separate authentication, fused information can be hidden in parallel with a single network rather than traditional serial hiding with multiple networks, which can largely decrease the model size. Extensive experiments demonstrate that the proposed method achieves more secure, effective, and efficient image steganography. Code is available at https://github.com/Revive624/Authentication-Image-Steganography.

Efficient and Separate Authentication Image Steganography Network
Junchao Zhou
Yao Lu
Jie Wen
Guangming Lu'
Abstract
(a) Other methods
g Sender
Bidin INN
Image steganography hides multiple images for multiple recipients into a single cover image. All secret images are usually revealed without authen- tication, which reduces security among multiple recipients. It elegant to design an authentication mechanism for isolated reception. We explore such mechanism through sufficient experiments, and uncover that additional authentication infor- mation will affect the distribution of hidden in- formation and occupy more hiding space of the cover image. This severely decreases effective- ness and efficiency in large-capacity hiding. To overcome such challenge, we first prove the au- thentication feasibility within image steganogra- phy. Then, this paper proposes image steganog- raphy network collaborating with separate au- thentication and efficient scheme. Specifically, multiple pairs of lock-key are generated during hiding and revealing. Unlike traditional meth- ods, our method has two stages to make appro- priate distribution adaptation between locks and secret images, simultancously extracting more reasonable primary information from secret im- ages, which can release hiding space of the cover image to some extent. Furthermore, due to sepa- rate authentication, fused information can be hid- den in parallel with a single network rather than traditional serial hiding with multiple networks, which largely decrease the model size. Exten- sive experiments demonstrate that the proposed method achieves more secure, effective, and ef- ficient image steganography. Code is available at https://gitub..com/eeee wwwm/eevvve22///uueeeeeioo. Stegnogtggan.....y..
oover
stego
Revealing LNN
Rovealing INN
Revealing
INN
Receiver-1 1
Recelver-2
Hacker
(b) Our AIS
g
Anthenii alio-I
Hidlng I'N
Sender
slego rebestani
Revsuling
e Receiver-2
Recealing
Revealay INS
ENN Receiver-1
INN
Hacker
Figure I. Overview of our AIS compared with traditional methods. (a) shows the process of other traditional methods. Secret images are revealed without certification.
(b) shows the process of our method. Correct keys required reveal the secret images.
1. Introduction
1.1. Overview and problems
Image steganography involves embedding secret images within a cover image. The recipients can reveal hidden images from the stego image. For effective image steganog- raphy, the stego image should closely resemble the cover im- age, and recovered images must closely match the original secret images. Due to confidentiality. image steganography has been widely employed in digital watermarking (Zhang et al., 2024; Wang al., 2023), Internet of Things (IoT) (Khari et al., 2020), military communications (Pratik et al., 2022), quantum computing (Bharatwaj & Hasabnis, 2024), healthcare (Issac & Kumar, 2023), and various domains.
Learning-based image steganography has become main- stream. Deep Neural Networks (DNNs) (Baluja, 2017; 2019; Zhang et al., 2020a) are introduced image steganog- raphy, hiding secret images in a cover image. Some GANs- based methods (Hayes & Danezis, 2017: Chen al., 2022: Kishore et al., 2022; Li et al., 2023) are proposed with a gen- erator for hiding and a discriminator for identifying. Some methods (Jing et al., 2021: Lu et al., 2021; Guan et al., 2022) regard concealing and revealing as a pair of reversible pro- cesses, and introduce Invertible Neural Networks (INNs) to hide and reveal images with shared parameters. Recently,
Yao Lu and Jie Wen are corresponding authors. 'Department of Computer Science and Technology, University of Harbin In- stitute of Technology (Shenzhen). Guangdong, China. Cor- respondence to: Yao Lu <luyao2021 @ii..edu.cn>>, Jie Wen <jiewen_pr@@ 126.com>.
Proceedings of the 4nnd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

Efficient and Separate Authentication Image Steganography Network
ceffuusion-based models (Yu al., 2024; Yang et al., 2024) have provided secure and robust steganography. However, current methods still suffer from three major defects.
Poak Sigral to Moise Ratio
350
(1) Lack of authentication. As shown in Figure I, all secret images are revealed at once, without verifying the identity of recipients. This defect among multiple recipients can lead to unauthorized access and serious information leakage, which fails to meet practical application requirements.
330-
325
x
Atherkal buxce
68-
Atbertear brew
223
0223
Jensen-Shannon Divergence
33aM
(2) Low quality when hiding multiple images. Large- capacity hiding methods (Lu et al., 2021; Guan et al., 2022) hide all secret images in the limited space of a cover image. When the space is insufficient to accommodate more secret information, the network may either sacrifice the space of the cover image or lose secret information, both reducing transmission effectiveness.
(a)
Figure 2. (a) Comparisons of JS Divergence and PSNR between cover and stego images of authentication frreee and authentication- based methods. (b) Comparisons of PSNR, SSIM, JS Diver- gence and model parameters between authentication-free and authentication-base methods on average.
(3) Large increase in model size and computational cost. For traditional methods of serial hiding (Guan et al., 2022; Zhou et al., 2024), multiple networks are required to be assembled to hide secret images. This results in a linear growth in model size and computational cost as the number of secret images increases.
ical challenges for building authentication-bast image steganography, which further motivates our improvement on embedding lock information.
(1) Embedding authentication information while main- taining the quality of stego and revealed secret images. Due to the inconsistent distribution of secret images and locks, the embedded information usually occupies consid- erable hiding space of the cover image, resulting in great drop in the quality of both stego and revealed secret images and reducing the transmission effectiveness.
1.2. Exploration and Challenges
In order to address non-authentication and achieve isolated reception, it elegant to introduce an authentication mech- anism. Following IIS (Zhou et al., 2024), establish an authentication- image steganography network. Through embedding additional lock information in the cover image, a corresponding key is required to recover the secret images. Furthermore, an authentication-free network is built, which removes authentication while preserving the hiding network. Based on the above two methods, we con- duct comparison experiments to evaluate the effectiveness of authentication and its influence on hiding process DIV2K dataset.
(2) Integrating authentication while limiting the model size. Compared to authentication-fres method, the param- eter number of authentication-baat 16.3M to 19.9M, shown in Figure 2 (b). The extra parame- ters bring additional computational cost and severely reduce transmission efficiency.
method grows from
1.3. Solution
To overcome the challenges of existing methods, we propose an Efficient and Separate Authentication Image Steganogra- phy Network (AIS) with two collaborative stages, consisting of an Invertible Authentication Network (IAN) and an In- vertible Hiding Network (IHN), respectively.
In such comparison, through a large number of samples and lots of statistics, Sensen-Shannov (JS) divergence and Peak Signal-to-Noise Ratio (PSNR) are calculated to quantify the global and local differences between cover and stego method (blue)
images generated by authentication-basee and authentication-fiit variant (red), as shown in Figure 2. From (a). blue spots show a general distribution of higher overall JS divergence and lower PSNR. This indicates that authentication-bant based method may cause more significant alterations the global distribution and also reduce the local similarity to the cover images. From (b). authentication- based method shows great decline in PSNR and SSIM average, indicating that the additional lock information will decrease the similarity between cover and stego images.
In the first stage, IAN introduces authentication mech- anism. The mechanism embeds locks in secret images to ensure that only recipients with correct keys can access the hidden secret images. Locks and keys are generated from a dynamic lock-key generation strategy by learning features of both the cover and secret images. What is more, different from traditional one-stage methods, our IAN fuses the locks and secret images. Then, such fused information will be embedded in the cover image in the second stage (IHN). This will produce a better distribution adaptation and may free up space for hiding information. Additionally, IAN extracts more reasonable primary information from secret images. This reduces the secret information to be hidden.
Based on the insights gained from the results, our explo- ration of authentication mechanism highlights nwo crit-
2

---

Efficient and Separate Authentication Image Steganography Network
All above strategies can both achieve isolated reception and produce high-quality stego and revealed secret images.
2.2. Authentication-Basel Image Steganography
Image steganography with certification is challenging, it requires embedding authentication information while min- imizing the impact on stego and revealed secret images. Kweon et al. (Kweon et al., 2021) proposed key mech- anism based on an encoder-decoder structure. IIS (Zhou et al., 2024) dynamically generated global and local keys for each image, embedding fused keys into stego images via an INN structure for authentication. DiffStega (Yang et al., 2024) achieved coverless steganography through diffusion models, where an image prompt serves private key guiding the revealing, Although these methods enable au- thentication, the authentication information often degrades the quality of hiding and recovery, reducing transmission effectiivnesss. Furthermore, these methods typically have large model sizes, struggling to balance verifiability and efficiency in large-capacity hiding.
In the second stage, IHN utilizes the fused lock and secret information with better distribution adaptation in the hiding process to produce high-quality stego images. Furthermore, due to separate authentication, IHN can hide all secret im- ages in parallel. This approach only requires training a single hiding network, unlike serial hiding methods that require an extra network for each secret image. The main contributions of our method are summarized as follows:
We propose an Authentication Invertible Steganogra- phy (AIS) collaboratively consisting of an Invertible Authentication Network (IAN) and an Invertible Hid- ing Network (IHN). The network enables isolated re- ception and enhances security among multi-recipients.
The proposed IAN can generate pairs of lock-key and fuse the locks and secret images to make distribution adaptation. This will decrease the locks occupation of the hiding space in cover images.
2.3. Invertible Neural Networks
Invertible Neural Networks (INNs) establish a bijective map- ping between data distribution pa, and latent distribution pz- Dinh al. (Dinh et al., 2015; 2017) introduced coupling layers in generative flow models. Gilbert et al. (Gilbert et al., 2017) explored the reversibility of INNs. Kingma et al. (Kingma & Dhariwal, 2018) improved generative flow models using invertible x convolutional layers. Xiao et al. (Xiao & Liu, 2020) proposed matrix exponential coupling layers for improved density estimation performance. Ardiz- zone et al. (Ardizzone al., 2019) proposed Conditional Invertible Neural Networks (CINNs), where condition guides the generation. Koehler et al. (Koehler et al., 2021) theoretically explored the depth and condition of normaliz- ing flows, which highlights the trade-off between authenti- cation and generation quality in image steganography.
The proposed IAN also contains learnable mappings to extract more reasonable primary information from se- cret images, producing high-quality stego and revealed secret images on the basis of isolated reception.
The proposed IHN employs the fused secret and lock information to produce stego images. IHN also allows for efficient parallel hiding of secret images, requir- ing only single network to be trained, significantly reducing the model size and computational cost.
2. Related Work
2.1. Authentication-Free Image Steganography
To address these challenges, we propose distribution adapta- tion and secret information extraction. This enables isolated reception while ensuring high quality for both stego and revealed secret images. Separate authentication promotes parallel hiding, thereby reducing the model size.
Image steganography aims to conceal secret images within a single cover image, allowing recipients to accurately reveal the hidden information. Baluja (Baluja, 2017: 2019) pro- posed the first deep neural network for image steganography. HiNet (Jing et al., 2021) used INNs for reversible hiding and revealing in frequency domain. ISN (Lu et al., 2021) extended INNs to parallel processing in spatial domain for multiple secret images. DeepMIH (Guan et al., 2022) ex- plored a serial hiding strategy with an importance map for optimized spatial utilization. MnHMI (Chen al., 2024) achieved large-capacity hiding by splicing multiple images into single secret image. Recently, CRoSS (Yu et al., 2024) explored DDIM Inversion to transform secret images into stego images without a cover image. However, these methods do not support recipient verification and reveal all secret images simultancously. This increases the risk of unauthorized access and reduces practical flexibility.
3. Method
In this part, we first demonstrate the feasibility of incor- porating authentication in our two-stage image steganogra- phy. Then, we detail the structure of our proposed Efficient and Separate Authentication Image Steganography Network (AIS), consisting of an Invertible Authentication Network (IAN) and an Invertible Hiding Network (IHN), as shown in Figure 3. IAN embeds locks in secret images and verifies keys during the revealing process, while extracting more reasonable primary information of secret images. IHN hides extracted information in the cover image and reveals it from
3

---

Efficient and Separate Authentication Image Steganography Network
Parallel
saling
Abrellbett
Extract
Hila Bilock
Ro
LNVE
Secret
R
1123
Dynamic
Lec
Shared Parameters
Cover
J
Shared Parameters
Stego
Lock-Key Gen
Krr
Paralle
Hlrr Epurrpllee
Alnefliek
Almshikk
R123
HlnofBook
RevCover
Stego
recdiver
Reveat1.2
RevExtrace
Ry
Invertible A utheetiictionn Network (IAN)
Invertible Hiding Network (IHN)
Figure 3.
The detail structure of Invertible Authentication Network (IAN) and Invertible Hiding Network (THN). @ represents Hadamard
seinent-wwieeeee product. + represents element- wise addition. C represents channel concatenation. S represents channel split.
the stego image. Locks and keys for IAN are generated by a dynamic generation module, simplified UNet structure (Ronneberger et al., 2015). Further details are provided in Appendix B.
Through training, can be shifted away from the distribu- tion of when given the wrong key, while can approx- imate the distribution detailed proof is provided in Appendix A.2.
when given the correct key.
3.1. Feasibility of Authentication
3.2. Overall framework
Image steganography involves hiding and revealing pro- cesses, which be modeled normalizing flow f (Dinh al., 2015). denotes the data domain of secret images and denotes the latent domain. The probability distribution Pa (x) of the secret images can be derived via the change-of-variable formula:
In the forward hiding process, IAN first generates locks with the dynamic lock-key generation module. Then, locks and secret images fused to make distribution adaptation. Meanwhile, IAN extracts more reasonable primary informa- tion from the secret images. The cover image is transformed into the frequency domain to match the extracted informa- tion in size. Both the cover image and extracted information are fed into the IHN produce the stego image, while re- dundant information is omitted during transmission. In the backward revealing process, following IIS (Zhou al., 2024), redundancy is restored using a Redundancy Predic- tion Module to better fit the latent distribution. The primary information is recovered through the reverse process of IHN, Then, a key is generated by the dynamic keyk-key genera- tion module, and used in the IAN for verification, gradually decoupling the complete secret image.
( dr
p= (==;;())p((f((())) det
where (-)(-) denotes the determinant. Given data samples {x* ) the parameters can be optimized by maximizing log likelihood loss:
Σ (Log)):((o(()))) det (
(fo(2'))
Lg
(2)
Ozt
To incorporate authentication information, we adopt the conditional normalizing flow framework (Ardizzone al., 2019; 2021; Wen et al., 2023). The lock and key denoted by and c', respectively. The forward mapping is defined as: z (z, e) and the backward mapping is defined as: fo(2, c'). The change-of-variable formula is:
3.3. Invertible Authentication Network
IAN comprises several authentication invertible blocks, a Haar Downsampling Module and a Haar Upsampling Mod- ule. To enable isolated reception, each secret image is pro- cessed independently rather than as a combined input.
(ejo(x(c) p=(oo e)) |det ( (0fo(s)))
del
In the forward hiding process, the Haar Downsampling Module transforms RGB secret image S,ER Bx3x from the spatial domain to the frequency domain SXER)x12xx(//21)(WWW)) Sy then decomposed into a
Through the flow, the distribution the secret images is influenced by the authentication information of the lock.

---

Efficient and Separate Authentication Image Steganography Network
low-frequency component S|ERBx33(H//XX(//) and high-frequency component 5 which are fed into the authentication invertible blocks. The trans- formation in the jth block is described by:
are fed into the invertible blocks. The computation within the ith invertible block is described as:
x = x² + a(y'), -² exp(3(x(+1)) + ((xtt)),
(6)
x ++ = x² + aly'),
(4)
yf1 = @o exp(3(eft), ()) + 7(x't) I.),
where and y represent the cover and secret information, respectively. The functions a--), (()) and 7(-) share the same structure as those in the IAN. The forward process
where I and y represent the low-frequency and high- frequency components, L denotes the lock, @ is Hadamard product, exp(.) is exponential function. The functions a(-), 8()) and 7(-) are learnable mappings based DenseNet structures (Huang al., 2017). Unlike general INNs, IAN concatenates 2 and the lock L along the channel dimen- sion as inputs to these mappings. Through these learnable mappings, IAN makes distribution adaptation between locks and secret images, outputting the extracted information Se with 3 channels and redundant information Rn-
produces a stego image Ty and redundant information Ro and T is restored to the spatial domain T via IWT.
In the backward revealing process, following (Zhou et al., 2024), Redundancy Prediction Module (RPM) is em- ployed to ensure reversibility and enhance the quality of revealed secret images. RPM is a learnable module with a residual structure as described in (Mou et al., 2023). adapts an auxiliary variable Rp from the stego image T to closely approximate R., This ensures the reversibility of the invertible blocks and preserves high fidelity in the revealed secret images. Using Rp and the frequency-doman stego image T,, the reverse computation is defined as:
In the backward revealing process, since R2 in the for- ward process is omitted, auxiliary variable is intro- duced. Following (Xiao et al., 2023), a latent variable R2 (X. is sampled from a Gaussian dis- tribution. The invertible blocks iteratively recover the secret images from this latent variable under the key K for verifi- cation. The reverse transformation is given by:
y' = (y+t1 -((((11) & exp(- x² - - -ay'),
y² -gy²t > K)) @ exp(-B(x* K)), x² -==a0 -=x+t-aap
where the invertible blocks gradually decouple the extracted information from the stego image. Channel split outputs the revealed extracted information Sre-
(5)
where represents the revealed extracted information, y de- notes the auxiliary latent variable. The parameters of ax-)), )., 3(.) and 7(-) are shared between the forward and backward processes. The key K must closely match the embedded lock L for accurate decoupling of the secret image. Oth- erwise, deviations in the key will introduce errors, causing the revealed secret image diverge from the original secret image. Given the correct key, the revealed secret image Sro is reconstructed using the Haar Upsampling Module.
3.5. Loss Functions
Stego images should closely resemble the cover images. The hiding loss defined as:
La = C2 T) C2(Ci,
(8)
where Le represents the Mean Square Error (MSE) loss, Ti and Ct are the low-frequency components of T and C. after DWT. The low-frequency loss part enhances visual similarity and improves resistance to steganalysis (Guan et al., 2022).
3.4. Invertible Hiding Network
The Invertible Hiding Network (IHN) consists of several hiding invertible blocks, Discrete Wavelet Transformation (DWT) module and an Inverse Discrete Wavelet Transfor- mation (IWT).
Revealed secret images should closely match the original secret images for effective transmission. Thus, the revealing loss consists of:
In the forward hiding process, the RGB cover image Cx3RBx3xxxXV XxW is transformed from the spatial domain to via DWT. This transformation not only aligns C₁ with S. in dimen- sions, but also enhances hiding quality and robustness against steganalysis (Guan et al., 2022). Thanks to sep- arate authentication in IAN, IHN can hide secret images in parallel. The secret image components 2!. are concate- nated along the channel dimension and, together with Cj,
N
L =
Σ
L2 Sic)
the firqueecy domain CyeR Xx12xx1222
1=1
(9)
N
L, = Σ
C2 Σ JS(S Std),
where JS denotes Jensen- Shannon Divergence loss, which further improves the quality of Sro (Chen al., 2024).
5

---

Efficient and Separate Authentication Image Steganography Network
Table 1. Comparisons between our method and baselines hiding 2, 3, 4, secret images, on DIV2K dataset and ImageNet dataset.
DIV2K
IMAGENOT
N
METHOO
PAKANI
PLOPS
CONER-STIGO
SECRITI- REVSAL
COVER-STSO0
PSNRT
SSIM
1.PISS]
PSNRT
SSIM
LPPPS]
PSNRT
SSIMI
LPPIS]
PSNR"
SSIM
[PPPS]
ISN
3.17M
14
$4.661
0.545
0.502
53.734
0.474
14
0.533
0.355
33.470
0.835
0,516
DEarMU
12.42M
826.56
105-4M5
$7,400
01871
0.209
35. 969
0.910
0.206
37.20V
0.303
0.364
33.725
0.385
0.756
22.30M
718.93
180.4MS
34.619
0.545
0.592
53.521
34.751
0.854
0.525
38.106
0,900
0.278
AISOOUS))
5.57M
036.03
69.5MS
42.141
0.913
0.130
$8,088
0.944
0.201
41.345
0.917
0.176
35. 30.802
0.911
0,455
ISN
3.34M
436.451
525
0.576
0.891
DEEMMIH
19.40M
676.4G
157.1M5
31226
0.708
1.089
27.298
0.832
2.260
33.945
0.819
0.365
29,560
02321
0.949
0.821
AIS(ouas)
5.70M
192.1G
87.5MM
34.731
0.984
0.396
34.761
0.983
0.420
33.334
0.349
0,511
32,035
0.854
0.798
ISN
3.51M
50.4M1
22.555
0.712
1.188
29.562
1.251
0.11
0.618
20.26.
0.307
1,091
DEEEMH
26.46M
926. 141
218, 3545
28,975
0.682
1.438
23.581
0.740
4.702
51. 786
0.776
0.948
76. 066
0.768
5.063
44.51M
1434.7G
344,
27.121
0.746
4.107
29.970
3.230
27.708
0.699
1,929
27,920
0.769
2.514
AIStouas)
5.95M
198.20
102.354
34.947
0,857
9.608
34,100
0.908
0.591
31.711
0.863
0.915
31,048
0.841
0
ISN
0.790
DEEEMIH
13.45M
1176.16
269. 1Ms
29:437
0,692
1.594
22.189
0.716
5,350
12.507
0.792
0.815
26,308
0.786
3,069
115
55.62M
1793.00
439. 5045
26.576
0.741
3.194
28.676
2.147
24:345
0.650
3.927
26.293
0.747
2,817
AIS(OURS)
6.15M
204,
121.1MS
36.149
0.857
0.334
$0.765
0.854
1.141
52.767
0.841
0.585
30,060
0.833
1,055
Due to strict authentication, keys should closely match the generated locks. This is represented by the key loss:
Dea
AiSbour)
LA = Σ LLL,
(10)
where Li represents the Mean Absolute Error (MAE) loss.
The authentication mechanism requires that entering wrong key should cause the revealed information to diverge from the secret image. This is enforced by the triplet loss:
Werds
N L mar S( L2(S,, Spm) marginn),
(11) where S.n is a negative sample generated using random key during the revealing process, and margin is a constant set to 1 (Schroff et al., 2015).
Figure 4. The visual results of experiment of our AIS method and baselines DIV2K dataset, hiding 5 secret images.
Following literature (Zhou et al., 2024), redundancy loss defined to ensure similarity between the predicted redun- dancy and the forward output of the redundant information:
et al., 2024) in terms of PSNR, SSIM and LPIPS, on DIV2K dataset and ImageNet dataset. The training settings and details are provided in Appendix C.
N
Lp
Σ C2 RD))
(12)
4.1. Quality Analysis
Quantitative Results. Table 1 presents quantitative com- parisons. The results for the revealed secret images are reported as averages. For clarity, LPIPS values are scaled by 103 On DIV2K dataset, our AIS achieves superior performance across all metrics. For stego images, PSNR, SSIM, and LPIPS show improvements of 5.062 dB, 0.096. and 0.512, respectively. For the revealed secret images, PSNR, SSIM, and LPIPS are optimized by 2.063 dB, 0.046. and 0.047, respectively. On ImageNet dataset, our AIS achieves SSIM improvements of 0.043 and 0.026 for stego images and revealed secret images, respectively. Similar enhancements are observed in PSNR and LPIPS.
The overall training loss is the weighted sum of the above losses:
L A1La + AgLre + AzLn + La + Le + Lps where λ1, X2, As are hyper-parameters that balance the contribution of each loss term.
(13)
4. Experiments
We compare our method with three baselines: ISN (Lu
et al., 2021), DeepMIH (Guan et al., 2022) and IIS (Zhou
6

---

Efficient and Separate Authentication Image Steganography Network
ISN
Dvephtiit
A1Siumm
lury
OLGNUXED
OLEMUIND
resihaa
Figure 5. The visual results of experiments on the effectiveness of the authentication mechanism. Different forms of wrong keys are used to verify the uniqueness of the correct key.
Figure 6. Visual results on ManTraNet among baselines and our AIS method.
Table Detection accuracy on SRNet and ZhuNet among basc- lines and AIS method.
ACCURACY (%)
METHODS
SRNET
ZHUNET
LWENET
ISN
73.50
67.80
67.30
DEEРМIH
60.95
generated keys is almost meaningless among unauthorized recipients.
11S
61.70
81.75
62.20
AIS(OURS)
$2.80 (8.15%)J 61.40(6.40%
$1.75(10.45%
These results imply that the authentication mechanism ef- fectively identifies recipients. Secret images are restored independently with correct keys. When using a forged key, the revealed secret images become severely corrupted. This enhances the system's security against attacks and provides flexibility in sending different images to different recipients.
Figure 4 presents the visual compar- isons between our method and other baselines. Residual errors, amplified by factor of 10, are used to emphasize dif- ferences between the generated images and the ground-truth images. From the results, significant color distortions appear in the stego images and revealed secret images from other methods. This indicates that a single cover image cannot effectively accommodate information from multiple secret images, leading to color loss. In contrast, our AIS method, which hides only extracted information, narrows the gap between the stego and cover images while preserving the fine details of the secret images.
Qualitative Results.
4.2.2. RESISTANCE AGAINST STEGANALYSIS
Steganalysis methods aim to detect hidden information in stego images. A robust steganography method must per- form well in both quality and resistance to steganalysis. Otherwise, attackers can easily identify stego images, com- promising transmission confidentiality and integrity.
The above results demonstrate that our AIS method signifi- cantly improves both the stego and revealed secret images. Our method effectively extracts more reasonable primary features of secret images, reducing the information needed for hiding and revealing. Meanwhile, our AIS integrates the lock with the secret images, partially avoiding embed- ding information that has an inconsistent distribution in the cover image. This may reduce the occupation of hidden space. Both allow single cover image accommodate more secret images, while preserving sufficient information for high-quality restoration.
Detection of Stego Image. We test our method against three state-of-the- the--rt steganalysis methods, SRNet (Boroumand et al., 2019), ZhuNet (Zhang et al., 2020b), and LWENet (Weng et al., 2022). 1000 cover-stego image pairs are gen- erated using baselines and our AIS on ImageNet dataset. Table 2 shows that our AIS achieves the lowest detection accuracy among all methods, decreasing by 8.15%, 6.40 % and 10.45%. This improvement is due to the proposed TAN in our method, which reduces the amount of hidden informa- tion, making stego and cover images harder to distinguish.
Detection of Secret Information. To evaluate potential in- formation leakage we employ ManTraNet (Wu et al., 2019), a method designed to detect the locations of hidden data within an image. The white regions in the mask highlight detected anomalies. Figure 6 shows fewer abnormal ar- eas detected by ManTraNet in stego images of our method. While the white areas detected in other methods reveal con- tours of hidden secret images, those detected in our AIS hardly reveal any meaningful information. These results demonstrate superior security of our method in preventing information leakage.
4.2. Security Analysis
4.2. EFFECTIVENESS OF AUTHENTICATION
To demonstrate the effectiveness of our proposed authen- tication mechanism, we simulate attempts to reveal secret images using random keys on DIV2K dataset. As shown in Figure 5, we use incorrect keys, such as all zeros, all ones, Gaussian distribution, uniform distribution, and a key of another secret image. The restored images are almost indis- tinguishable. Clearly, information revealed using randomly
7

---

Efficient and Separate Authentication Image Steganography Network
Table Ablation experiments on the channel number of extracted information in the proposed IAN.
COVER-STEGU
ESCRET-REVEAL
two-stagge
CHANNELS
PSNR1
SSIM1
LPIPS.
PSNRT
SSIM
LPIPSL
33.488
0.876
0.639
27.846
0.790
2.542
lock
secrol
primary
roweal
9
30.568
0.845
1.2322
27.751
0.819
3.079
(a)
(b)
29.472
0.798
1.548
26.767
0.791
3.094
3(OURS)
36.149
0.887
0.334
30.765
0.854
1.141
Figure 8. (a) Example of hiding process of one-stage method and our two-stage AIS method. (b) Comparisons information en- tropy of hidden information and PSNR of revealed secret images
4.3. Efficiency Analysis
between one-stage method and our two-stage AIS method.
Table 1 summarizes parameter number, Floating-point Op- erations (FLOPs), and inference time. Across all settings of N, our AIS uses fewer parameters than IIS and DeepMIH. Notably, when N = 5, AIS requires only 6.15M parame- ters, far fewer than IIS (55.62M) and DeepMIH (33.48M). In terms of FLOPs, our AIS shows superior computational efficiency, saving an average of 252.35G compared to ISN. Additionally, our method significantly reduces inference time compared DeepMIH and IIS. Due to the superior design of AIS, parallel hiding significantly reduces model size and computational cost. As the number of secret images increases, our method retains its efficiency advantage. This scalability demonstrates its suitability for large-capacity steganography applications.
scenarios with more channels.
4.4.2. EFFECTIVENESS OF DISTRIBUTION ADAPTATION
To demonstrate the IAN's effectiveness of distribution adap- tation in our AIS method (blue), we compare it with an authentication-free variant (red) modified from AIS and one-stage authentication method on DIV2K dataset. As illustrated in Figure 7 (a), our method achieves a lower overall JS Divergence and higher PSNR and SSIM. This suggests that distribution adaptation partially avoids embed- ding information with inconsistent distribution in the cover image. Moreover, due to parallel hiding, only a small num- ber of parameters has been increased. (b) shows the mean and standard deviation to compare the information distribu- tion between the one-stage method and our two-stage AIS method. In one-stage method, the distribution of locks (or- ange) and secret images (green) is inconsistent, whereas our AIS (purple) achieves a more consistent distribution. This indicates that the proposed IAN adapts secret images and locks to fused information with a consistent latent distribu- tion. Through such adaptation, AIS may avoid the additional lock information to occupy the hiding space, enhancing the quality of both stego and revealed secret images.
4.4. Ablation Studies
1.4.1. EXTRACTION CHANNELS
The proposed IAN extracts features of 3 channels from secret images, focusing on retaining the primary information. To assess the performance among different channel numbers, DIV2K dataset. The results summarized in Table 3 show that 3 channels yield the best quality for both stego and revealed secret images. This indicates that increasing the channel number intensifies recovery errors caused by the proposed IHN, leading to significant information loss and degraded image quality in
conduct ablation experiments
4.4.3. EFFECTIVENESS OF PRIMARY INFORMATION
To evaluate the effectiveness the primary information ex- tracted by the proposed IAN, we compare our method with one-stage method without extraction DIV2K dataset. (a) shows the difference of the hiding and revealing processes between one-stage method and our two-stage AIS. This in- stance displays that the secret image can be restored from the primary information. In (b), a boxplot compares infor- mation entropy between extracted information (blue) and secret images (red), and another boxplot compares PSNR of revealed secret images between one-stage method (red) and our AIS (blue). Compared one-stage method, AIS decreases the average information entropy by 1.85, but improves the average PSNR by 2.086 db. The results indi- cates that our method may filter the redundant information to some extent, and contains less redundant information, extracting more reasonable primary information while pre-
Standere Devisson Vellies
digg WITH
sigralltoo Hoboe
jersen-Shanmon Divergence
Mean Values
(a)
(b)
Figure 7. (a) Comparisons of PSNR, SSIM, IS Divergence and model parameters between authentication-ffer free method and our AIS. (b) Comparisons of mean and standard deviation between secret images and locks in one-stage method and extracted information in our method.
8

---

Efficient and Separate Authentication Image Steganography Network
serving the quality of the revealed secret images.
lion: 42nd DAGM German Conference, DAGM GCPR 2020, pp. 373-387, 2021.
5. Conclusion
Baluja, S. Hiding images in plain sight: Deep steganography.
In Advances in Neural Information Processing Systems, volume 30, 2017.
This paper demonstrates the feasibility of an authentication mechanism and proposes an Efficient and Separate Authen- tication Image Steganography (AIS) method. AIS embeds locks in secret images. Distribution adaptation partially releases the space in cover images and extracts primary in- formation for hiding, enhancing the quality of both stego and secret images. A correct key is needed to recover the secret image, achieving isolated reception among different recipients. Due to separate authentication, only a single network needs to be trained, significantly limiting the model size. The specially designed two-stage method enables se- cure, effective, efficient, and flexible image steganography.
Baluja, S. Hiding images within images. IEEE transactions on pattern analysis and machine intelligence, 42(7))1668- 1697, February 2019.
Bharatwaj, A. K. and Hasabnis, A. R. Steganography in the quantum era. In 2024 International Conference on Emerging Smart Computing and Informatics, pp. 1-5, 2024.
Boroumand, M., Mo, C.,, and Fridrich, J. Deep residual network for steganalysis of digital images. IEEE transac- tions on information forensics and security, 14(5):1181- 1193, May 2019.
Impact Statement
This paper presents work whose goal is to advance the field of Machine Learning. There are many potential societal consequences of our work, none which we feel must be specifically highlighted here.
Chen, H., Song, L.., Qian, Z., Zhang, X., and Ma, K. Hiding images in deep probabilistic models. In Advances in Neural Information Processing Systems, volume 35, pp. 36776-36788, 2022.
Chen, Z., Liu, T., Huang, J., Zhao, W., Bi, X., and Wang, M. Invertible mosaic image hiding network for very large capacity image steganography.
Acknowledgments
IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 4520 2024.
This work was supported in part by the NSFC fund (NO. 62206073, 62176077), in part by the Shenzhen Key Technical Project (NO, JSGG20220830092800000 166G20000100315588000000
JCCG2002203311055000000 KIZDD202309231151110033,, KJZZD2024090310071022
Dinh, L., Krueger, D., and Bengio, Y. Nice: Non-linear independent components estimation. In International Conference on Learning Representations, 2015.
in part by the Guangdong International Science and Tech-
nology Cooperation Project (NO. 2023A0505050108) in part by the Shenzhen Fundamental Research Fund (NO. ICY2202002413221002), and in part by the Guang- dong Provincial Key Laboratory of Novel Security In- and
Dinh, L., Sohl-Dickstein, J., and Bengio, S. Density esti- mation using real nvp. In International Conference on Learning Representations, 2017.
telligence Technologies (NO. 1022B121201000 in part by the Natural Science Foundation of Shenzhen General Project under Grant JCYJ2024081311 0114408811100001100 in part by the Natural Science Foundation of Guang- dong Province under Grant 2023A1515010893, in part by the Shenzhen Doctoral Initiation Technology Plan under Grant RCBS2022 100809322201,, in part by the Shenzhen Pengcheng Peacock Startup Fund.
Gilbert, A. C., Zhang, Y., Lee, K., Zhang, Y., and Lee, H. Towards understanding the invertibility of convo- lutional neural networks. In Proceedings of the Inter- national Joint Conference on Artificial Intelligence, pp. 1703-1710, 2017.
Guan, Z., Jing, J., Deng, Xu, M., Jiang, L., Zhang, Z., and Li, Y. Deepmih: Deep invertible network for multiple image hiding. IEEE Transactions on Pattern Analysis and Machine Intelligence, 45(1):372-390, January 2022.
References
Ardizzone, L., Lüth, C., Kruse, J., Rother, C., and Köthe, U. Guided image generation with conditional invertible neural networks. arXiv preprini arXiv: (xXiv/9907002322 2019.
Hayes, J. and Danezis. G. Generating steganographic im- ages via adversarial training. In Advances in Neural Information Processing Systems, volume 30, 2017.
Huang, G., Liu, Z., Van, D. M. L., and Weinberger, K. Q. Densely connected convolutional networks. In Proceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 4700-4708, 2017.
Ardizzone, L.,, Kruse, J., Lüth, C., Bracher, N., Rother, C., and Köthe, U. Conditional invertible neural networks for diverse image-to-image translation. In Pattern Recogni-

---

Efficient and Separate Authentication Image Steganography Network
Issac, B. M. and Kumar, S. Steganography for health care and military applications. In Intelligent Computing, Smart Communication and Network Technologies, pp. 69, 2023.
Medical image computing and computer-assisted inter- vention, pp. 234-241, October 2015.
Schroff, F,, Kalenichenko, D., and Philbin, J. Facenet: A unified embedding for face recognition and clustering, In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.
Jing. J., Deng, X., Xu, M., Wang, J., and Guan, Z. Hinet: Deep image hiding by invertible network. In Proceedings of the IEEF/CVF Conference on Computer Vision and Pattern Recognition, pp. 4733-4742, 2021.
2015.
Wang, Z.., Byress O., Wang, H., Sun, R., Ma, C., Chen, H., Wu, Q., and Xue, M. Data hiding with deep learning: A survey unifying digital watermarking and steganography. IEEE transactions on computational social systems, 10 (6):1-15, December 2023.
Khari, M., Garg, K., Gandomi, A. H., Gupta, R., Patan, R., and Balusamy, B. Securing data in internet of things (iot) using cryptography and steganography techniques. IEEE transactions on systems, man, and cybernetics: Sys- tems, 50(1):7334)) (7,8))8,,0.000 January 2020.
Wen, J., Ahmad, R., and Schniter, P. A conditional normal- izing flow for accelerated multi-coil mr imaging. In In- lernational Conference on Machine Learning, pp. 36926- 36939, 2023.
Kingma, D. and Dhariwal, P. Glow: Generative flow with invertible Ixl convolutions. In Advances in Neural Information Processing Systems, volume 31, 2018.
Weng, S., Chen, M., Yu, L.,, and Sun, S. Lightweight and effective deep image steganalysis network. IEEE Signal Processing Letters, 29:1 19:1888-48 1092-189222 August 2022.
Kishore, V., Chen, X., Wang. Y., Li, B., and Weinberger, K. Q. Fixed neural network steganography: Train the images, not the network. In International Conference on Learning Representations, 2022.
Wu, Y., Abdalmageed, W., and Natarajan, P. Mantra-net: Manipulation tracing network for detection and local- ization of image forgeries with anomalous features. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, June 2019.
Koehler, F., Mehta, V., and Risteski, A. Representational aspects of depth and conditioning in normalizing flows. In International Conference on Machine Learning, pp. 1628-5636, 2021.
Xiao, C. and Liu, L. Generative flows with matrix exponen- tial. In International Conference on Machine Learning. pp. 10452-10461, 2020.
Kweon, H., Park, J., Woo, S., and Cho, D. Deep multi- image steganography with private keys, Electronics, 10 (16):1906, August 2021.
Xiao, M., Zheng, S., Liu, C., Lin, Z., and Liu, T. Invert- ible rescaling network and its extensions. International Journal of Computer Vision, 131(1):134-15) January 2023.
Li, G., Feng, B., He, M., Weng, J., and Lu, W. High-capacity coverless image steganographic scheme based on image synthesis. Signal Processing: Image Communication, 111:116894, February 2023.
Xu, Y.. Mou, C., Hu, Y., Xie, J., and Zhang, J. Robust invertible image steganography. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 7875-7884, 2022.
Lu, S., Wang, R., Zhong. T., and Rosin, L. Large-capacity image steganography based on invertible neural networks. In Proceedings of the IEEE/CVF Conference on Com- puter Vision and Pattern Recognition, pp. 10816-10825, 2021.
Yang, Y., Liu, Z., Jia, J., Gao, Z., Li, Y., Sun, W., Liu, X., and Zhai, G. Diffstega: Towards universal training-frr free coverless image steganography with diffusion models. In Proceedings of the International Joint Conference on Artificial Intelligence, pp. 1579-1587 2024.
Mou, C., Xu, Y.. Song. J., Zhao, C., Ghanem, B., and Zhang, Large-capacity and flexible video steganography via in- vertible neural network. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 22606-22615, 2023.
Yu, J., Zhang, X., Xu, Y., and Zhang, J. Cross: Diffu- sion model makes controllable, robust and secure image steganography. In Advances in Neural Information Pro- cessing Systems, volume 36, 2024.
Pratik, W., Anuja, N., Sneha, S., Aishwarya, S., and Archana, J. Secret communication using multi-image steganography for military purposes. International Jour- nal of Advanced Research in Science, Communication and Technology. pp. 683-691, July 2022.
Zhang, C., Benz, P., Karjauv, A., Sun, G., and Kweon, I. S. Udh: Universal deep hiding for steganography, watermarking, and light field messaging. In Advances in Neural Information Processing Systems, volume 33, pp. 10223-10234, 2020a.
Ronneberger, O., Fischer, P., and Brox, T. U-net: Convolu- tional networks for biomedical image segmentation. In
10

---

Efficient and Separate Authentication Image Steganography Network
Zhang, R., Zhu, F., Liu, J., and Liu, G. Depth-wise separa- ble convolutions and multi-level pooling for an efficient spatial cnn-based steganalysis. IEEE transactions in- formation forensics and security, 15: 138-1138,0 August 2020b.
Zhang, X., Li, R., J., Xu, Y., Li, W., and Zhang, Editguard: Versatile image watermarking for tamper lo- calization and copyright protection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pullern Recognition, pp. 11964-11974, 2024.
Zhou, J., Lu, Y., and Lu, G. Individualized image steganog- raphy method with dynamic separable key and adaptive redundancy anchor. Knowledge-Baud -Based Systems, 309: 112729, November 2024.

---

Efficient and Separate Authentication Image Steganography Network
A. Derivations
A.I. Derivation Equation (2)
In Maximum Likelihood Estimation (MLE), the likelihood function L(0|z) can be calculated as:
L(0 p(x 0).
(14)
Taking the logarithm on both sides, we have the log likelihood loss Lg:
La log (Tg((((((zr))
log(E(a;(0)
log II p(z110)
(15)
N
(0g(p(x110)
(og(p=(fo<z')) + log det (Ofo(z²))
dri ))
For KL Divergence, we have:
DRI(Pollem) = f pa (x)o) p=(#) dx
Po (r: 0)
(16)
= / (a(r))oog(
(1;
As the former part is constant, minimizing KL Divergence is equivalent maximizing the latter part. We use samples {x'),, lim1 (2( to estimate the expectation of this part of the formula:
1
Lg
Σ
log Pa (xt;0)
(17)
N
Omitting 1 and with Equation (1), we have:
Lg = Σ (og((s(fo(x>))) + log det
(fo(aa)) ))
(18)
Oar
1=1
The above derivation proves that maximizing Lg is equivalent to minimizing KL Divergence, aligning with the goal of approximating (x)) with (z)..
A.2. Validation of Condition c as Key
In this part, we try to prove the feasibility of adding a condition e as the key for verification. The process can be formulated as fa c) and for c'). This implies two requirements: (a) & ~ (x) when e' is consistent to c. (b) Maximizing the distance between d and x when c' is inconsistent We start from Equation (3):
@ffe c) dx
Pate (z) Pajo (fol2, det
(19)
12

---

Efficient and Separate Authentication Image Steganography Network
Case (a): With d' = C, we have:
/ (xldd O)de'
(r(1;))
/ Pelo(fo(I, c)lc)
/ect (0lobenc1) de
)
òx
/ P=jo(zl() det OSo (2)(2,))) ) det
(0fo(2,c) Ox
(20)
de
Oz
/ P=lc(#]c)de
= Pz(x))
This indicates that with e' consistent to we have &t ~ (2()).
Case (b): To represent inconsistency between d' and c, we assume that randomly sampled, independent from c. The distribution Po (x; () modified as:
/ (alo(
Pa (x;
/ (=(e()((x,))ld) det (Dfo(z,e)
) de'
dx
(21)
-=((f((,c)) det (oSola,c))
Ox
= P=(x)) del
Oʃ (3,6)) )| del ( (ffo(a,))
Oz
dr
Deriving from Equation (4), we have:
[0f((z,)) c)
05L
831
det
02
dez
Ox
0ag
1
Da
(22)
dag
(z)
08
+
0x
(((a)))) + 2
0o
0r. da
0z
021
D2y
0zg
Dzy Drg
e M(1..))
With Equation (5), we have:
08 (2,11)
del
-((s,ec)
(23)
Oz
Thus, (2; can be further simplified to:
(x; = pz(2) (
(24)
where 0 can be trained to make the distribution of à away from the distribution of x when is inconsistent with c.
B. Structure of the Dynamic Generation Module
Traditional static keys pose security risk, the compromise of single key could expose all secret images. To mitigate this, we introduce a dynamic generation strategy that dynamically generates lock-key pairs, ensuring that the lock and key for each secret image are unique. As result, even if the key for one image is intercepted, the security of other images remains unaffected.
In the forward hiding process, as outlined in Table 4, we utilize several convolutional layers and a max max-poooling layer to generate a global lock from the cover image and a local lock from the designated secret image. The fusion lock is then
13

---

Efficient and Separate Authentication Image Steganography Network
Table The detail structure of our proposed Lock-Key Generation Module, which is composed of convolutional layers and an optional MaxPool layer.
INPUT
Co (H x W 3)
St (H x W 3)
T x 5%c (H122 x W/2
CONV (3x3, RELU
CONV (3x3, 64) RELU
CONV (3x3, RELU
CONY (3x3, 64) RELU
MAXPOOL (2x2) CONY (3x3, 64) RELU
MAXPOOL (2x2)
CONY (3x3, 64) + RELU
CONY (3x3, 3) + RELU
CONY (3x3, 3) RELU
OUTPUT
L' (8/2 W/2
K (8/2 x W/2
Table 5. The results of hiding 6, 8 secret images with our AIS method.
COVER-STEGO
RBCRET-REVEAL
N
DATASETS
PSNR
SSIM
LPIPS.
PSNR1
SSIM
LPIPS
DIV2K
33.822
0.869
0.430
26.030
0.737
2.690
IMAGENET
33.205
0.856
0.729
28.274
0.791
1.957
DIV2K
33.733
0.864
0.332
25.751
0.728
2.447
IMAGENET
34.606
0.864
0.396
27.588
0.769
1.614
DIV2K
29.072
0.708
1.373
25.140
0.736
3.564
IMAGENET
30.838
0.812
1.394
27.287
0.765
2.763
obtained through linear combination, formulated as: L' a f(C.)+ f(S)), where f represents learnable function, and a, B are user-defined coefficients.
In the backward revealing process, a similar structure employed to generate the corresponding key from the stego image and the revealed compressed secret image, as described by: K = a x g(T) + x ((()))), where a and B are shared with the forward process, and g' and g share the same parameters. However, the max max-pooling layer is excluded in g' since Sre half the size of T. Both the global key and local key must match the corresponding lock ensure that only the intended recipient reconstruct the correct key.
C. Training Details
The proposed Efficient and Separate Authentication Image Steganography Network is trained and tested on the DIV2K and ImageNet datasets. The DIV2K dataset consists of 800 training images cropped to 144x 144 and 100 test images cropped to x024x 1024. For ImageNet dataset, we randomly select 20,000 training images cropped 144x 144 for finetuning and 5,000 test images cropped to 256x256. Training is performed for 100K iterations using the Adam optimizer with 31 0.9 and B2 0.999. The initial learning rates set to 2 10-4 for IAN, and 10 for IHN and Dynamic Generation Module, with CosineAnnealinn R scheduler for dynamic adjustment. The hyperparameters X,, X2 and X are set to 2, 4, and 3, respectively. All experiments are conducted on a Nvidia RTX 4090 GPU.
For the three baselines, ISN is reproduced based on the original paper, while DeepMIH and IIS are retrained using open- source codes. Performance is evaluated using Peak Signal-to-Noise Ratio (PSNR) and Structural Similarity (SSIM), where higher values indicate better quality, and Learned Perceptual Image Patch Similarity (LPIPS), where lower values suggest superior quality.
D. More Experiments
D.I. Very Large Capacity
To explore hiding with very large capacity, we conduct experiments on hiding more secret images with our proposed AIS. From the results shown in Table and Figure 9, AIS achieves high performance even hiding secret images in a single cover image. This indicates the superior effect of our proposed IAN, which integrates distribution adaptation and primary
14

---

Efficient and Separate Authentication Image Steganography Network
Cover
seart
stego
reveals
residual
residua
PAAUSS
MON
CON
I 10:50:1
TENEAAA
MON
stee
10:50
residual
Figure 9. The visual results of hiding 8 secret images with our AIS method.
information extraction. Through embedding less authentication information and hiding only primary secret information, more secret images can be hidden and revealed in high quality.
D.2. Visualization of Distribution Adaptation
To better demonstrate the effectiveness of distribution adaptation in the proposed AIS, we visualize the adapted primary information generated by IAN in Figure 10. For comparison, also visualize the secret images and lock information in the traditional one-stage method. From the result, the distribution of secret images and lock information is significantly inconsistent. When attempting to embed both the secret information and the lock information, such consistency may occupy a large space, which reduces the quality of the stego images. Our proposed AIS makes distribution adaptation, integrating the secret information and lock information into representation with consistent distribution. This may release some space for hiding more information some extent.
D.3. Model of Redundancy Prediction Module
In the forward process of IHN, redundant information generated, which can not be transmitted through the public channel. Therefore, auxiliary redundancy is required reveal the secret information. Traditional methods (Jing et al., 2021: Lu et al., 2021; Guan al., 2022) randomly samples case-agnostic variable from the Guassian distribution, which is inconsistent with the distribution of the original redundant information. This weakens reversibility of the network to some extent. The Redundancy Prediction Module is employed to learn case-specific auxiliary redundancy with consistent distribution. IIS (Zhou et al., 2024) has proved the effectiveness of residual blocks on this target, for the residual structure can learn deep features.
We conduct experiments on replacing the residual blocks with other model structure, such as UNet, Vision Transformer
15

---

Efficient and Separate Authentication Image Steganography Network
spardts
locks
(a) O ne-stage method
primary
(b) O ur Pro-stageAI5
Figure 10. The visual comparison between and lock information of other methods and distribution adapted primary information of our AIS.
Table 6. Comparison of different model structure Redundancy Prediction Module.
COVER-STEGO
RECRET-REVEAL
MODEL
PARAMS
PSNR1
SSIM
LPIPS.
PSNR1
SSIM
LPIPS./
UNET
1.933M
34.039
0.898
0.821
35.036
0.909
0.666
VIT
129.8M
35.758
0.920
0.414
34.318
0.879
0.498
CBAM
0.001 M
35.762
0.918
0.440
34.546
0.888
0.540
GUASSIAN SAMPLING
29.229
0.81
1.499
30.516
0.819
1.049
RESBLOCK(OURS)
0.013M
34.721
0.904
0.396
34.761
0.903
0.420
(ViT), Convolutional Block Attention Module (CBAM). Considering the lightweight design of the module, we use simple form of UNet with only a single downsampling and upsampling. ViT a simplified implement with only one layer. An additional convolutional layer is added CBAM to match the number of output channels. We also include the traditional Gaussian sampling strategy in the experiments. From the results shown in Table residual blocks generate stego and revealed secret images with the best LPIPS. Compared to other model structure, residual blocks achieve more balanced performance between stego images and revealed secret images, while keeps the model size small.
D.4. Resistance against Real Scene Disturbance
We have conducted experiment DIV2K dataset, hiding secret images, under the perturbations of Guassian noise, Poisson noise, and JPEG compression, respectively, We visualize some samples of revealed secret images under different perturbation scales. From the results shown in Figure 1, our proposed AIS can withstand noise within certain range. When the a of Guassian noise set to I and the scale Poisson noise is set to 1, the revealed secret image is almost not affected. When the scale grows, contour information is still preserved, though noise can be observed visually. For JPEG compression, our method can still reveal the contour information of the secret images, while the color distortion and detail information loss are severe.
The result is mainly because our proposed AIS focus the security of authentication mechanism. This requires that when the key is different from the lock, the revealed information is far from the original secret images. Through such target, the Invertible Authentication Network is trained to be sensitive to minor disturbances. This guarantees that the key should be as similar as possible to the corresponding lock. Otherwise, random information is introduced to the revealed information to cover the secret information by the network. Sensitivity makes a trade-off between security and robustness. While the authentication mechanism is effective, also makes the network sensitive real-world scene disturbances.
16

---

Efficient and Separate Authentication Image Steganography Network
Gussiia Noise
=1
2
4 f 5
Polsson Noise
scale 1
scale 3
scale 5
scale = 8
scale 10
secret
JPEG Compression
Q = 999
Q 95
Q 90
Q 85
Q 80
Figure The visual result resistance against real-world scene disturbance.
In future work, for better robustness, we suggest adding an enhancement module to enhance the key information under JPEG compression, as well as noise-guided module to reduce the disturbance of specific noise. Such a method has been partly researched in (Xu al., 2022) and can be applied to our proposed AIS. To balance robustness and security, an additional attention block may need to be added focus on the difference between the key and the lock catch slight changes.
17


Reviews:
[{"review_id": "3eFbVmIooZ", "reviewer": "Reviewer_Y3wr", "summary": "This paper makes a substantial contribution to secure multi-recipient image steganography by addressing the critical yet under explored challenge of authentication. The proposed AIS framework elegantly integrates authentication through a novel two-stage architecture—IAN for lock-key generation and distribution adaptation, and IHN for parallelized hiding—demonstrating rigorous theoretical grounding in normalizing flows. The authors provide compelling empirical evidence, including JS divergence analysis and PSNR/SSIM metrics across DIV2K datasets, to validate their claim that distribution adaptation mitigates spatial conflicts between authentication locks and secret images. Particularly noteworthy is the method’s ability to reduce model parameters, which addresses a longstanding efficiency-quality trade-off in high-capacity steganography. The discussion of dynamic lock-key generation’s resistance to brute-force attacks adds practical security insights. This research may set a promising foundation for authentication-aware steganography, but still with some minor clarifications.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you very much for your valuable comments. We hope that the explanations on the questions can help you better understand our proposed method.\n\nQ1: Could the authors clarify whether the dynamic lock-key generation strategy considers potential adversarial attacks on key generation?\n\nA1: The security of locks and keys is ensured through several special designs. (1) Dynamic generated rather than static. In AIS, we generate different pairs of locks and keys for each secret image with a trainable Dynamic Generation Module. These pairs are generated through feature fusion between cover images and corresponding secret images. Unlike traditional static key, our method ensures specific locks and keys for each recipient, thereby mitigating adversarial attack risks through reduced key exposure predictability. (2) Generated by trainable networks rather than specific cryptographic patterns. Traditional cryptographic methods rely on a predefined pattern, which is easy to be attacked by cryptanalysis techniques. In AIS, we train a lightweight network with linear and nonlinear transformations. This approach establishes security dependence on network parameter confidentiality, which is hard to crack. (3) Two stage revealing. In the revealing process, the recipient should first reveal primary information with IHN. Then a key is generated for authentication and reconstructing the original secret images from the primary information. This indicates that attackers should obtain both the primary information and the key to fetch the secret images. Since IHN is a more complex Invertible Neural Network, it can be very hard for effective adversarial attacks.\n\nQ2: The JS divergence analysis in Figure 2 is insightful. Would including KL divergence metrics further strengthen the distribution comparison?\n\nA2: In Figure 2, we calculate JS divergence to indicate the distribution differences between cover and stego images of authentication-based and authentication-free methods. JS divergence is calculated by $JS(p,q)=1/2* KL(p,q)+1/2*KL(q,p)$, which includes KL divergence and is capable of indicating the distribution differences. According to your suggestion, we also calculate KL divergence. For authentication-free method, the value is 0.0444. For authentication-based method, the value is 0.0697. Since higher KL divergence indicates greater inconsistency between the two kinds of distribution, the result implies that stego images generated in authentication-based method may contain more information with inconsistent distribution, resulting in low quality. This is consistent with our discovery in the paper.\n\nQ3: In Section 3.1, the mathematical formulation of authentication feasibility could benefit from expanded derivations for reproducibility.\n\nA3: The expanded derivations are in Appendix A. We have provided necessary derivation processes and explanations. In the proof, $x$ denotes data domain of secret images. $z$ denotes latent domain after the secret images transformed by an invertible network flow, denoted as $f$. $p(x)$, $\\hat{p}(x)$, $p(z)$ denote the distribution of secret images, revealed secret images and latent information, respectively. $c$ and $c’$ denotes lock and key, respectively. Our goal is to prove that when the distribution of $c$ and $c’$ are consistent, $\\hat{p}(x)$ is consistent to $p(x)$. When $c$ and $c’$ are inconsistent, $\\hat{p}(x)$ has to be away from $p(x)$. This ensures revealing of meaningless information when the key is wrong. Equation 1 is a general form of the change-of-variable formula. This indicates the calculation of $\\hat{p}(x)$ through $p(z)$. $det(·)$ denotes the Jacobian determinant. Equation 2 is the log likelihood loss derived from Maximum Likelihood Estimation (MLE). We give the detailed derivation in Appendix A.1. Equation 3 is an extended form of Equation 1, adding the lock and key. It can be simply inferred from the conditional distribution. Based on Equation 3, we prove that $\\hat{p}(x)=p(x)\\cdot e^{β(z, c)-β(z, c’)}$ by expanding the Jacobian determinant, where $\\beta$ is a trainable network. The derivation process is detailed in Appendix A.2. This means that the network can be trained to make $\\hat{p}(x)$ away from $p(x)$ when $c$ and $c’$ are inconsistent, which is in line with our goal.\n\nQ4: Could runtime metrics (e.g., inference speed) be added to assess practical efficiency?\n\nA4: We have compared the inference time in the original paper, which is shown in Table 1, Column Time. From the result, AIS spends shorter inference time compared to traditional serial hiding methods. Especially when hiding 5 images, AIS only requires 121.1ms, shorter than DeepMIH(269.1ms) and IIS(439.6ms). Though ISN achieves inference time of 51.7ms, the hiding quality(30.522) and revealing quality(29.077) are lower than AIS(32.767 and 30.060). The results indicate that AIS achieves a better balance between quality and inference speed.", "claims_and_evidence": "It is clear and convincing.", "methods_and_evaluation_criteria": "Yes.", "theoretical_claims": "Correct.", "experimental_designs_or_analyses": "Yes, they are reasonable.", "relation_to_broader_scientific_literature": "This paper provides a promising approach for independence recovery for multiple image steganography.", "essential_references_not_discussed": "The references are enough.", "other_strengths_and_weaknesses": "Please see the questions.", "other_comments_or_suggestions": "Please see the questions.", "questions_for_authors": "1. Could the authors clarify whether the dynamic lock-key generation strategy considers potential adversarial attacks on key generation?\n2. The JS divergence analysis in Figure 2 is insightful. Would including KL divergence metrics further strengthen the distribution comparison?\n3. In Section 3.1, the mathematical formulation of authentication feasibility could benefit from expanded derivations for reproducibility.\n4. Could runtime metrics (e.g., inference speed) be added to assess practical efficiency?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "RxG9j5tPfm", "reviewer": "Reviewer_Afwk", "summary": "The paper presents AIS, an authentication-based steganography framework that leverages invertible networks for distribution adaptation and parallel hiding. The two-stage design and focus on security and efficiency are commendable, and comprehensive experiments demonstrate the framework’s advantages. While the paper is well-structured and the core contributions are promising, a deeper analysis of key design choices and broader applicability would strengthen the work’s overall impact.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you very much for your valuable comments. We hope that the explanations on the questions can help you better understand our proposed method.\n\nQ1: The distribution adaptation mechanism is central to reducing lock-induced artifacts. Could the latent distributions of locks and secrets before and after adaptation be visualized to quantitatively demonstrate alignment?\n\nA1: Figure 7(b) shows mean and standard deviation of 1000 samples to generally indicate consistent distribution of adapted information. According to your suggestion, we visualize some locks, secret images and adapted information (https://s1.imagehub.cc/images/2025/03/26/edfaea8efa039b0ebef270cecd585a39.png). From the result, the distribution of secret images and locks is significantly inconsistent. AIS makes distribution adaptation to get a representation with consistent distribution. The above content will be added to the paper.\n\nQ2: While Table 5 (Appendix D) reports results for N = 8, the main text focuses on N = 2–5. Including results for N = 6–7 could provide insight into performance degradation trends.\n\nA2: We show results of N=8 to indicate AIS’s superior performance in large capacity. To highlight very large capacity, we didn’t show results of N=6,7. On DIV2K dataset, hiding 6 secret images, cover-stego achieves (33.822, 0.869, 0.430) of (PSNR, SSIM, LPIPS), and secret-reveal achieves (26.030, 0.737, 2.690). When hiding 7 secret images, results are (33.733, 0.864, 0.332) and (25.751, 0.728, 2.447). Following your suggestion, the complete results will be added to the paper.\n\nQ3: The RPM module in IHN uses a residual structure for redundancy prediction. How does this compare to alternative prediction architectures, such as transformers? Ablation studies on RPM’s design would strengthen the claims.\n\nA3: RPM is employed to learn an auxiliary variable with consistent distribution to redundancy, which improves reversibility. Many traditional models of extracting features can achieve this. Residual structure has fewer parameters and can extract deeper features. Following your suggestion, we conduct experiments on structures of UNet, Vision Transformer(ViT), Convolutional Block Attention Module(CBAM) and traditional Gaussian sampling strategy (https://s1.imagehub.cc/images/2025/03/27/3c23350577d0befe5b36a40be11b2a32.jpeg). Compared to UNet and ViT, residual blocks achieve a balance between quality and model size. Compared to CBAM, residual blocks reveal secret images of higher quality. The above content will be added to the paper.\n\nQ4: The invertible blocks (Eq. 4–7) share parameters between forward and backward passes. Does this limit flexibility compared to non-shared designs? A discussion of the trade-offs would clarify the design rationale. \n\nA4: For image steganography task, non-shared design will not improve flexibility. Hiding and revealing are a pair of reversible processes. In forward process, network receives cover and secret images, and outputs a stego image and redundancy. In backward process, stego image and auxiliary variable are input to get the revealed secret images. Through RPM, auxiliary variable has a consistent distribution with redundancy. In this case, shared parameters can ensure one-to-one correspondence between input and output, improving reversibility and quality. In contrast, non-shared design has disadvantages of (1) double number of parameters. (2) poor reconstruction quality due to accumulation of errors. (3) unstable training due to higher complexity.\n\nQ5: Some equations have formatting issues. A thorough review and correction are recommended.\n\nA5: We check the paper again and fix some formatting and grammar issues. (1) Wrong format of exp in Equation 5,6. (2) Wrong punctuation in Equation 12. (3) Wrong punctuation in Equation 24. (4) Word error “CIS” in caption of Table 2. Other grammar issues have also been solved.\n\nQ6: How does AIS handle real-world scenarios such as JPEG compression or noise perturbations? Testing under such conditions would better demonstrate the framework's practicality.\n\nA6: Robustness is another important task in the field of image steganography, aiming to reduce interference of real-world noise and compression. Experiments of such conditions are typically conducted under this task. AIS focuses on security and capacity, with a different target from robustness. Due to this target, AIS is sensitive to minor changes of keys to guarantee similarity of keys and locks. Sensitivity makes a trade-off between security and robustness. While the authentication mechanism is effective, it also makes AIS sensitive to disturbance. It is a good suggestion to consider robustness in large-capacity image steganography with authentication. In future work, we suggest adding an enhancement module to resist compression, and a noise-guided module to reduce disturbance of noises. An attention block may be added to catch slight changes for security. The above contents will be added in new version of the paper.", "claims_and_evidence": "Yes, they are supported.", "methods_and_evaluation_criteria": "Yes, they make sense and are widely used in this area.", "theoretical_claims": "I have reviewed the proof of Theorem 14 in the appendix, and it appears to be correct.", "experimental_designs_or_analyses": "I have reviewed the soundness and validity of the experimental designs and analyses, and they are accurate.", "relation_to_broader_scientific_literature": "The method relates to authentication-based steganography designed for multiple users.", "essential_references_not_discussed": "The related works are essential for understanding the key contributions of the paper and are appropriately cited and discussed.", "other_strengths_and_weaknesses": "Strengths: The proposed AIS framework elegantly integrates authentication with invertible networks, achieving secure and efficient multi-image steganography. The two-stage design and distribution adaptation strategy are innovative, contributing to improved performance and robustness. The paper is well-structured and presents comprehensive experimental results.\n\nWeaknesses:\na) The distribution adaptation mechanism is central to reducing lock-induced artifacts. Could the latent distributions of locks and secrets before and after adaptation be visualized to quantitatively demonstrate alignment?\nb) While Table 5 (Appendix D) reports results for N = 8, the main text focuses on N = 2–5. Including results for N = 6–7 could provide insight into performance degradation trends.\nc) The RPM module in IHN uses a residual structure for redundancy prediction. How does this compare to alternative prediction architectures, such as transformers? Ablation studies on RPM’s design would strengthen the claims.\nd) The invertible blocks (Eq. 4–7) share parameters between forward and backward passes. Does this limit flexibility compared to non-shared designs? A discussion of the trade-offs would clarify the design rationale.\ne) Some equations have formatting issues. A thorough review and correction are recommended.\nf) How does AIS handle real-world scenarios such as JPEG compression or noise perturbations? Testing under such conditions would better demonstrate the framework's practicality.", "other_comments_or_suggestions": "Although the paper is well-structured and presents some new ideas, there are several issues that need clarification and resolution (refer to the weaknesses). If these concerns are addressed in the rebuttal phase, I may reconsider my decision.", "questions_for_authors": "Please refer to the weaknesses.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "MxwFYzOx1P", "reviewer": "Reviewer_sPRs", "summary": "This work advances adaptive steganography by redefining secure multi-user communication through the integration of invertible networks and dynamic authentication. A key innovation lies in decoupling authentication from secret data via distribution adaptation, a conceptual leap that reimagines information hiding in constrained spaces. The parallel hiding architecture further exemplifies strong engineering intuition, achieving parameter reduction without compromising quality. Beyond its forward-looking contributions, the paper also addresses a pressing challenge in privacy-preserving multi-user steganography.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you very much for your valuable comments. We hope that the explanations on the questions can help you better understand our proposed method.\n\nQ1: The dynamic lock-key module employs a \"simplified UNet.\" Providing ablation studies on alternative architectures or clarifying the rationale for this choice would strengthen the justification.\n\nA1: Dynamic Lock-Key Generation Module is employed to extract features from the cover image and each secret image to dynamically generate locks and keys. By feature extraction, the locks for secret images are different from each other, ensuring security among multiple recipients. Many traditional models of extracting features can achieve this. In AIS, we employ a simplified UNet due to two reasons. (1) Multiscale feature fusion. UNet can extract features of different scales through symmetric downsampling-upsampling structure and skip connection. It can extract detailed information such as edges and textures in shallow layers, and capture abstract semantics in deep layers. This makes the generated locks and keys have richer representation, thus improving security. (2) Lightweight. The simplified UNet requires only 77K parameters and 0.395G FLOPs, ensuring efficiency.\n\nQ2: In Figure 3, clearer annotations for the lock/key propagation paths would enhance the workflow diagram’s clarity.\n\nA2: We have modified Figure 3 (https://s1.imagehub.cc/images/2025/03/26/d4d07474bef137e5714acdbd5c45b36b.png). The annotations of output lock and key have been added. Additionally, the paths of inputs have been added. Locks are generated from cover and secret images. Keys are generated from stego images and revealed primary information.\n\nQ3: The term \"primary information extraction\" requires a more precise and well-supported explanation.\n\nA3: Primary information is the part of information that is more important for restoring the original image. On the one hand, the space of a cover image for hiding secret is limited. With more information hidden in the cover image, the quality of the generated stego image will be lower. On the other hand, sufficient information needs to be hidden in the cover image for revealing. With less information hidden in the cover image, the quality of revealed secret images will be lower. The steganography network is optimized to achieve a balance between the quality of stego and revealed secret images. Based on this, a spontaneous idea is to hide part of the secret information. Xiao et al.[1] pointed out that for a 12-channel frequency domain RGB image, the low-frequency information of 3 channels is sufficient to restore the original image of high quality. Motivated by this, we set the number of reserved channels as 3. By jointly optimizing stego images and revealed secret images, IAN is trained to extract information which is more important for revealing. We call this more primary information. This part of information can enhance revealing while hiding less information in the cover image, improving the quality of both stego and revealed secret images, which meets the goal of joint optimization.\n\n[1] Xiao, M., Zheng, S., Liu,C., Lin,Z., and Liu,T. Invertible rescaling network and its extensions. International Journal of Computer Vision, 131(1): 134–159, 2023.\n\nQ4: The proposed method could potentially be extended to video steganography. Could the authors suggest how to transfer the adaptation strategy to video steganography with temporal consistency requirements?\n\nA4: It’s a good idea to apply distribution adaptation to video steganography. When hiding secret information into a cover video, inconsistent distribution of the secret information may cause visual discontinuity between adjacent frames, which degrades temporal consistency. We suggest a module similar to IAN being introduced to video steganography. This module receives the input of secret information, along with a cover video as the condition. With similar transformation, the secret information is decomposed into more primary information with consistent distribution. At the same time, the transformation may pay attention to the cover video condition, and guide the generation of the primary information. With more primary and consistent information hidden, the stego video may release some space for hiding more information, while keeps consistent distribution between frames.\n\nQ5: Minor grammar issues should be addressed for improved readability.\n\nA5: Thank you for your suggestion. We check the paper again and make some correction. (1) “requirement” in page 1 is modified to “requirements”. (2) “CIS” in Table 2 is modified to “AIS” for consistency. (3) The font of “exp” in Equation 5 and 6 is modified to be consistent with Equation 4 and 7. (4) “low-” in page 4 is modified to “low-frequency” for correct hyphenation. (5) “$T$” in page 5 is modified to “$T_f$” to correctly denote the frequency stego image. In addition, other grammar issues have also been solved in the revised paper.", "claims_and_evidence": "Yes. The claims are well-supported with clear evidence.", "methods_and_evaluation_criteria": "Yes. The methods and evaluation criteria are appropriate.", "theoretical_claims": "Yes, I have checked all the proofs.", "experimental_designs_or_analyses": "Yes, I have checked all the experimental designs or analyses.", "relation_to_broader_scientific_literature": "The methods in this paper can well address the problems within the practical engineer, and gives a new direction for multi-user privacy security in this area.", "essential_references_not_discussed": "Yes, the cited works sufficiently contextualize the paper’s key contributions.", "other_strengths_and_weaknesses": "Several aspects of the paper could be improved:\n1. The dynamic lock-key module employs a \"simplified UNet.\" Providing ablation studies on alternative architectures or clarifying the rationale for this choice would strengthen the justification.\n2. In Figure 3, clearer annotations for the lock/key propagation paths would enhance the workflow diagram’s clarity.\n3. The term \"primary information extraction\" requires a more precise and well-supported explanation.\n4. The proposed method could potentially be extended to video steganography. Could the authors suggest how to transfer the adaptation strategy to video steganography with temporal consistency requirements?\n5. Minor grammar issues should be addressed for improved readability.", "other_comments_or_suggestions": "See \"Other Strengths And Weaknesses\".", "questions_for_authors": "See \"Other Strengths And Weaknesses\".", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "JY6CaOKnqb", "reviewer": "Reviewer_JeET", "summary": "This paper presents a novel authentication-based image steganography framework (AIS) with separate invertible networks for authentication and hiding. The approach addresses critical challenges in multi-recipient security and large-capacity hiding. The experiments demonstrate significant improvements in stego/revealed image quality and computational efficiency.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you very much for your valuable comments. We hope that the explanations on the questions can help you better understand our proposed method.\n\nQ1: The comparison in Table 1 shows superior performance over baselines. However, recent diffusion-based steganography methods are not included. Although they are not in the same class, could the authors discuss how your method compares to diffusion models in terms of security and computational overhead?\n\nA1: We compare our method with diffusion-based models. (1) Capacity. Diffusion-based models can only hide 1 secret image once, which limits flexibility. AIS can hide up to 8 secret images in a cover image. (2) Quality. The average PSNR of revealed secret images of diffusion-based models is typically below 25. AIS achieves PSNR of over 25 even when hiding 8 secret images. (3) Security. Diffusion-based models ignore the problem that keys cannot be transmitted through public channel. AIS can restore keys through Lock-Key Generation Module, ensuring security of keys. (4) Computational overhead. Diffusion-based models typically require billions of parameters and a long inference time to generate images. AIS only requires millions of parameters and time below 0.2s. These comparisons indicate that AIS performs better in large-capacity steganography.\n\nQ2: The dynamic lock-key generation module is critical. Could you clarify how the \"linear combination\" of global and local locks ensures uniqueness across multiple secret images?\n\nA2: Through extracting multiscale features of cover and secret images, Dynamic Lock-Key Generation Module generates a global lock from cover image and a local lock from each secret image. This means within the same batch, global lock is the same, while local lock for each secret image is different from each other. For different batches, global lock is different from each other. Linear combination integrates global locks and local locks with two coefficients to control the strength of the two lock components. Higher coefficient before global locks focuses on the uniqueness among different batches. Higher coefficient before local locks enhances uniqueness among different secret images within the same batch.\n\nQ3: The paper claims parallel hiding reduces model size, but Table 1 shows AIS still requires ~6M parameters for N=5. Could you provide FLOPs/parameter ratios relative to baselines to better illustrate efficiency gains?\n\nA3: We have compared FLOPs and inference time in the original paper, which are shown in Table 1, Column FLOPs and Time. For FLOPs, AIS has the least FLOPs among all the baselines. For inference time, AIS spends shorter inference time compared to traditional serial hiding methods. The results indicate that AIS achieves a better balance between quality and efficiency.\n\nQ4: Some formatting inconsistencies exist. Please proofread for hyphenation and notation consistency.\n\nA4: We check the paper again and make some correction. (1) “CIS” in Table 2 is modified to “AIS” for consistency. (2) The font of “exp” in Equation 5 and 6 is modified to be consistent with Equation 4 and 7. (3) “low-” in page 4 is modified to “low-frequency” for correct hyphenation. (4) “$T$” in page 5 is modified to “$T_f$” to correctly denote the frequency stego image. Other grammar issues are also solved in the revised paper.\n\nQ5: The security analysis evaluates resistance to SRNet and ZhuNet. Have you tested against more advanced steganalysis tools to further validate robustness?\n\nA5: We have added experiments on resistance against LWENet[1], a more advanced steganalysis method. The detection accuracy is 67.30%(ISN), 89.55%(DeepMIH), 62.20%(IIS) and 51.75%(our AIS). This means the stego images generated by AIS confuse the steganalysis model, which improves security against the attackers. The results will be added to the paper.\n\n[1] Weng S, Chen M, Yu L, Sun S. Lightweight and effective deep image steganalysis network. IEEE Signal Processing Letters, 29:1888-92, 2022.\n\nQ6: The IAN extracts \"primary information\" from secret images. How is the 3-channel design justified compared to other feature reduction strategies (e.g., PCA or attention-based compression)?\n\nA6: (1) The design of reversibility in IAN can reveal the original secret image without extra modules. In the backward process, the original secret images can be revealed from the primary information through the reverse process of IAN with shared parameters. In contrast, other strategies can only extract critical information. They require additional modules to reveal the original secret images. (2) Invertible Neural Network implies a prior that the data distribution can be decomposed into a simple distribution through learnable transformations. This enables IAN to model the other information into a simple distribution. Through a prior of Gaussian distribution, part of the other information can be restored. This improves the quality of revealed secret images, making IAN suitable for reconstruction tasks.", "claims_and_evidence": "Yes, they are clear and have convincing evidence.", "methods_and_evaluation_criteria": "Yes, they are promising.", "theoretical_claims": "All the proofs for theoretical claims have been checked.", "experimental_designs_or_analyses": "All the experimental designs or analyses have been checked.", "relation_to_broader_scientific_literature": "The paper addresses critical challenges in multi-recipient security and large-capacity hiding. This will have a broader study topics such as multi-recipient security, large-capacity hiding, video hiding.", "essential_references_not_discussed": "N/A", "other_strengths_and_weaknesses": "The paper contains the following weaknesses:\n1) The comparison in Table 1 shows superior performance over baselines. However, recent diffusion-based steganography methods are not included. Although they are not in the same class, could the authors discuss how your method compares to diffusion models in terms of security and computational overhead?\n2) The dynamic lock-key generation module is critical. Could you clarify how the \"linear combination\" of global and local locks ensures uniqueness across multiple secret images? \n3) The paper claims parallel hiding reduces model size, but Table 1 shows AIS still requires ~6M parameters for N=5. Could you provide FLOPs/parameter ratios relative to baselines to better illustrate efficiency gains?\n4) Some formatting inconsistencies exist. Please proofread for hyphenation and notation consistency.", "other_comments_or_suggestions": "None.", "questions_for_authors": "1) The security analysis evaluates resistance to SRNet and ZhuNet. Have you tested against more advanced steganalysis tools to further validate robustness?\n2) The IAN extracts \"primary information\" from secret images. How is the 3-channel design justified compared to other feature reduction strategies (e.g., PCA or attention-based compression)?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: To improve effectiveness and efficiency in large-capacity hiding, this paper proposes an image steganography network collaborating with separate authentication and efficient scheme, and demonstrates the authentication feasibility within image steganography. All reviewers give 'weak accept' or 'accept' scores. The idea of the paper is interesting. And the paper is well-structured and presents comprehensive experimental results.
Decision: Accept (spotlight poster)