SSHR: More Secure Generative Steganography with High-Quality Revealed Secret Images
Authors: Jiannian Wang
Yao Lu
Guangming Lu
Venue: ICML 2025 poster (2025)
Keywords: image steganography; Generative stegandgraphy; Secure; Key
Primary area: applications->computer_vision
TL;DR: We systematically propose a novel generative steganography method joints the Reference Images with the adaptive keys to govern the entire process, enhancing the naturalness of stego images, recovery quality and secret image security

Abstract: Image steganography ensures secure information transmission and storage by concealing secret messages within images. Recently, the diffusion model has been incorporated into the generative image steganography task, with text prompts being employed to guide the entire process. However, existing methods are plagued by three problems: (1) the restricted control exerted by text prompts causes generated stego images resemble the secret images and seem unnatural, raising the severe detection risk; (2) inconsistent intermediate states between Denoising Diffusion Implicit Models and its inversion, coupled with limited control of text prompts degrade the revealed secret images; (3) the descriptive text of images(i.e. text prompts) are also deployed as the keys, but this incurs significant security risks for both the keys and the secret images.To tackle these drawbacks, we systematically propose the SSHR, which joints the Reference Images with the adaptive keys to govern the entire process, enhancing the naturalness and imperceptibility of stego images. Additionally, we methodically construct an Exact Reveal Process to improve the quality of the revealed secret images. Furthermore, adaptive Reference-Secret Image Related Symmetric Keys are generated to enhance the security of both the keys and the concealed secret images. Various experiments indicate that our model outperforms existing methods in terms of recovery quality and secret image security.

SSHR: More Secure Generative Steganography with High-Quality Revealed Secret Images
Jiannian Wang'
Yao Lu
Guangming Lu'
Abstract
1. Introduction
Due to the demand of privacy, security, and data protec- tion in the era of digital communication and Al develop- ment, steganography has emerged as an essential technology. Steganography embeds diverse types of secret messages into container medium in an undetectable manner, which has broad applications across fields (Vyas et al., 2023; Wouters, 2024; Feng et al., 2024; Liu & Bu, 2024).
Image steganography ensures secure information transmission and storage by concealing secret messages within images. Recently, the diffusion model has been incorporated into the generative image steganography task, with text prompts be- ing employed to guide the entire process. How- ever, existing methods are plagued by three prob- lems: (1) the restricted control exerted by text prompts causes generated stego images resem- ble the secret images and seem unnatural, rais- ing the severe detection risk; (2) inconsistent in- termediate states between Denoising Diffusion Implicit Models and its inversion, coupled with limited control of text prompts degrade the re- vealed secret images; (3) the descriptive text of images(i.e. text prompts) are also deployed as the keys, but this incurs significant security risks for both the keys and the secret images. To tackle these drawbacks, we systematically propose the SSHR, which joints the Reference Images with the adaptive keys to govern the entire process, en- hancing the naturalness and imperceptibility of stego images. Additionally, we methodically con- struct an Exact Reveal Process to improve the quality of the revealed secret images. Further- more, adaptive Reference-Secrel Image Related Symmetric Keys are generated to enhance the security of both the keys and the concealed secret images. Various experiments indicate that our model outperforms existing methods in terms of recovery quality and secret image security.
Currently, image steganography techniques are primarily di- vided into cover-based and generative steganography meth- ods. Cover-based methods, such as LSBM (Mielikainen, 2006), HUGO (Pevný et al., 2010). UNIWARD (Sameer & Naskar, 2018), and deep learning based methods (Baluja, 2017; 2019; Lu et al., 2021; Jing et al., 2021; Guan et al., 2022), embed secret messages within the cover images. Compared to cover-based methods, generative steganog- raphy methods generating the suitable stego images directly from the secret images via neural network without using the cover images, such as CycleGAN (Zhu et al., 2017) and encoder-decoder models (Zhou et al., 2015). Recently, the diffusion model(Ho et al., 2020) has been incorporated into the generative image steganography task, such as CRoSS (Yu et al., 2024) and DiffStega (Yang et al., 2024), with text prompts, which are the descriptive text of images, being employed to guide the entire conceal and reveal processes.
However, existing diffusion model- baaed generative meth- ods still face several challenges, as illustrated in Figure 1. Firstly, constrained by the restricted control over specific semantic regions via text prompts, the generated stego im- ages closely resemble the secret images, particularly in the background. Occasionally, the generated stego images seem weird and unnatural, raising the severe detection risk from third parties. Additionally, owing to the inconsistency of intermediate states between Denoising Diffusion Implicit Models (DDIM) (Song et al., 2021) and its inversion, cou- pled with the restricted control exerted by text prompts (Hertz et al., 2023; Zhang et al., 2024; Wang et al., 2024), the quality of the revealed secret images has been signifi- cantly declined, posing substantial challenges for practical applications. Finally, text prompts, also utilized as crypto- graphic keys to enhance steganography security, are vulner- able to being guessed due to their essence of descriptive text
'Department of Computer Science and Technology, University of Harbin Institute of Technology (Shen- zhen). Shenzhen, Guangdong. China. Correspondence to: Yao Lu <luyao2021 @e100221@hitee @hit.edu.cn>, Guangming Lu <luguangm @ hii..edu.cn>.
Proceedings of the 42nd International Conference Machine Learning, Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

SSHR:
More Secure Generative Steganography with High-Qualit, Revealed Secret Images
Praccn
BOCUUS
IN DetTig
Figure/ 1. The pipeline comparison of (a) CRoSS, (b) DiffStega, and (c) our method, with main differences highlighted in red dotted boxes. Our approach enables significant modifications to the secret image while enhancing the quality revealed images. Additionally, We use a Reference-Secret Image Related Symmetric Key (kaym) as the cryptographic key, rather than text prompt used in previous methods.
for images, creating serious security risks for both the keys and concealed secret images.
2. Related work
2.1. Cover-based Image Steganography
To address these problems, this paper systematically pro- poses secure generative steganography method, SSHR, based on the diffusion model. Given the inadequate con- generative
Traditional cover-based image steganography conceals se- cret data within a cover image, either in the spatial domain using techniques like Least Significant Bits (Mielikainen, 2006) or in the transform domain, such as Discrete Fourier Transform. Baluja (Baluja, 2017; 2019) initially proposed deep learning method to conceal full-size image within another. Universal Deep Hiding (UDH) (Zhang et al., 2020) introduced a universal pipeline for image steganography that contrasts with the pipeline in (Baluja, 2017; 2019). ISN (Lu et al., 2021) pioneered the use of Invertible Neural Networks (INN), setting a benchmark by utilizing INN's reversible properties for conceal and reveal, showcasing superior capa- bilities. Following this, models such as HiNet (Jing et al., 2021), DeepMIH (Guan et al., 2022), and other INN-based approaches have been proposed to further explore INN's potential in image steganography.
trol exerted by text prompts in diffusion steganography models, this paper substitutes text prompts with reference images as guiding conditions. The abundant semantic information inherent in reference images facili- tates superior control of stego images generation. Distinct from cover-based methods, our model treats these reference images as guides for stego images generation, rather than as simple containers for concealed secret images. An exact reveal process is performed to minimize damage to the re- vealed secret images. Furthermore, the adaptive keys, which will be joined with the reference images to guide the en- generated to compensate for the absence of keys after removing text prompts. Experimental results indicate that our method achieves notable improvements in effectiveness and security over existing models. Our main contributions are:
tire process,
The reliance on cover images limits the applicability of these methods, and their stability and detection resistance need enhancement. In contrast, our model utilizes reference image to guide stego image generation rather than serving as a container for the secret image.
We systematically propose a novel generative steganog- raphy method joints the Reference Images with the adaptive keys govern the entire process, enhancing the naturalness and imperceptibility of stego images.
2.2. Generative Steganography
We methodically construct Exact Reveal Process to precisely reverse the conceal process, diminishing the errors in the reveal process and enhancing the quality of the revealed secret images.
Generative steganography climinates the reliance on cover images by directly generating stego images from the se- cret images using neural networks, such as CycleGAN (Zhu et al., 2017) and encoder-decoder models (Zhou et al., 2015). Wei et al. (Wei et al., 2022) established a bi-directional mapping between stego images and secret data, integrat- ing the generator and extractor within single Flow-based network. Distinguished from these methods, Generative Steganography Diffusion (GSD) (Wei et al., 2023) leverages the advanced capabilities of diffusion models. Additionally, CRoSS ( (Yu et al., 2024) and DiffStega (Yang et al., 2024), both diffusion-basee models with text prompts being em- ployed to guide the entire process, demonstrate excellent controllability and resilience against attacks.
We propose Reference-Seeree Image Related Sym- metric Key (RSRK) generation module to generate the keys, enhancing the security of both the keys and the concealed secret images.
We conduct extensive experiments to demonstrate that our model surpasses existing methods in terms of stego images quality and security, as well as the quality of the revealed secret images.
2

---

SSHR: More Secure Generative Steganography with High-Quality Revealed Secret Images
Sender
Sanci Iongeegg-.oo
Syee
Patego
Stage knage-Aurge
Reveal W With Wrong Key Kurry
DWT
Kurg
Conoial Prozess
Reyes
CIGH
Revall Pronzi
Kprlis
Com
rk sym
Attacker
Kyrt
Reference Nevvet loage
Couditon Infinnationn
Relatel Syavosirs Kay
Givlance Middle
"
Retternce teaig For!
Intere
Stgar treas
Revesled Luogt Year
Faican
Hiding With Symmetric Key ksym
Kym
MLP
Erev
Peym
Ocycie
Kettago
Sigar Ireas
Poai
DepuxefCCC
Uncor beer
D'ATT
Reveal
Pait
Weigl at
Pars
NVuia loy
Nv
Kiig'e poicuro
Reveal With Correct Key ksym
Receiver
aad
Figure 2. The overall structure of our SSHR model. In the conccal stage, the secret image Isee and reference image Tref jointly generate the symmetric key kaym first. Guided by kaym and Tref, the secret image will be gradually encrypted and ultimately generate the stego image T Tatego. In the reveal stage, both kaym and Tref are fed into the model simultaneously to accurately reveal the secret image Waee.
Nevertheless, the limited control over text prompts, coupled with inconsistency between DDIM and its inversion, sig- nificantly damage the quality of stego and revealed secret images. This drives us to replace the text prompts with images and construct the exact reveal process. Furthermore, adaptive keys compensate for the absence of keys after re- moving text prompts.
1997), the diffusion step Equation (2) aligns with gradient descent step to minimize the following energy function:
N P(z)= = Σ Σ SEZ,9 p=1
pl(k * 2))))
where the functions p the penalty function, h; denotes two-dimensional convolution filter kernel and signifies the convolution operation. It is noteworthy that the matrix- vector product (=(=) can be interpreted as 2D convolution of with the linear filter k2 = [-1, 1)". Similarly, V, E R N corresponds to the linear filter ky = [-1,1]²
2.3. Perona-Malik model
The Perona-Malit (PM) model (Perona & Malik, 1990) which has demonstrated strong performance in various im- age processing tasks, is nonlinear diffusion model and formulated by the following partial differential equation:
This paper systematically presents a novel and secure gen- erative steganography model. Motivated by the limited control of text prompts, this paper introduces a secondary image with more intuitive and effective approach. The exact reveal pro- cess is conducted to mitigate the inconsistency between the conceal and reveal process in existing methods. Moreover, the absence of keys after removing text prompts will be compensated with the adaptively generated symmetric keys. These keys will be integrated with reference images, serving guiding elements throughout the process and enhancing security beyond conventional text prompts.
dz (g( V2 Vz), 81
(I)
==|-0=1 =
identity, replacing the text prompt for
where V represents the gradient operator, 1 denotes the time, ff represents the initial image and is the diffusion function (Weickert et al., 1998). The discrete version of the PM model is derived through an explicit finite difference scheme and represented as:
Ze+1 1 Zt
Σ (E3.y)
V Vi
At
(V)))
3. Proposed Methods
1E
3.1. Framework
where & is the influence function (Black et al., 1997) or flux function (Weickert et al., 1998). As demonstrated in previ- ous works (Scherzer& Weickert, 2000; Zhu & Mumford,
This paper proposes SSHR, a novel and secure generative steganography model, with the overall framework presented
3

---

SSHR: More Secure Generative Steganography with High-Quality Revealed Secret Images
in Figure 2. Building on the exceptional performance of prior work (Jing al., 2021), our steganography process is conducted in the frequency domain. Specifically, the secret image seec is first accepted as imput and transformed into the latent space as Zsee using discrete wavelet transform (DWT). Subsequently, the see is encrypted with the symmetric key ksym and the reference image dref, which is pre- processed with the condition information guidance module (CIGM). This step generates the latent representation Estego of the stego image Isttgg The final stego image Zatego is obtained through inverse wavelet transform (IWT). The reveal process follows the exact inverse of the conceal process, ultimately yielding the revealed secret image Trev-
Dyfioiio Term
Condinoe Reaction Term
Figure 3. Illustration of (a) the Diffusion Term (DT) and (b) the Condition Reaction Term (CRT).
offers enhanced performance and parameter efficiency, The weights of Rep-DWConv, given by Wre-e (Meer(((S
are dynamically generated using the symmetric key keym to ensure security. Con- sequently, this module referred to as Conditional Re- parameterization Convolution (CRC). In line with (Chen & Pock, 2016), tions(GRBFs)) to parameterize of for E {1, 21,2.... Nu The overall pipeline for the Diffusion Term (DT) and the Condition Reaction Term (CRT) is illustrated in Figure 3.
Conceal process. To meet the specific requirements of our steganography task, we introduce a condition term R22, ksym, c) into the original PM diffusion model. Re- ferred to the condition reaction term following the termi- nology in (Chen& & Pock, 2016), this term serves to guide the generation process. Consequently, Equation (3) is modified as follows:
63 Gaussian radial basis func-
Inspired by the coupling function and affine coupling layer introduced in (Dinh et al., 2014; 2016), we define an aux- iliary variable y/ that satisfies y/ 24. Consequently, the iteration step in Equation (6) is transformed into:
F Palks Rsymu) + XR(2, c)ym, (4)
where kaym denotes the Reference-Secree Image Related Symmetric Key, which is utilized to strengthen the security of both the key and the concealed secret images, with ad- ditional details provided later. N₂ represents the amount of the filters. is the condition infused into the condition reaction term to regulate the generated stego images and en- hance their naturalness and imperceptibility.. In model, is set to the reference images by default. Equation (4) results in Nonlinear Diffusion Model incorporating the condition reaction term, depicted as a forward-basd barkwdd step at 2--1 of the energy functional, expressed as:
yt = Zt
N Σ
hi (1 Ut, kaym)
2++1
-xxp (ye, keym: c).
Therefore, y141 is calculated as:
Ut+1 = 21+1
N₂
k Okt ye, keym)
=
N₂
Aupe(tte kisym; c)
(8)
E'(x) = Σ (2, kigg) + R2, c), (5)
N2
y kj 0¹ (kt * 22, keym)
where (2, keym)) 2 (((KK2)) kegm). By applying
Axpe(Ee, kisyin c).
explicit finite difference scheme, we derive the following discretized iteration law, with the initial input set as 20 =
By combining the equation above with the second equation in Equation (7), we obtain:
Sseci
Σ kg * (k ye, kaym)
24-1 = 2t
N
2+1 2z
(k * ze, kigga)
- -xpr kaym; c), No
(6)
(9)
Σ kt 6i Za, ksym)
Xypo kismmee) c).
V-+1 = yt
-xp keym:: c)-
To perform the convolution K 2n, we substitute tradi- tional convolution with Re-parameterization Depthwise Convolution (Rep-DWConv) (Tu et al., 2024), which
To accelerate model convergence and drawing inspiration from the Gauss-Seide method, we use 21-1 instead of 2, as
4

---

SSHR: More Secure Generative Steganography with High-Quality Revealed Secret Images
the input of the second equation, leading to:
In practice, the calculation steps of z and y in both the conceal and reveal process are executed alternately, ensuring symmetrical transformation between the two sequences.
Σ ki * (f( * yee kaym)
Z++1 = zt
(Ve, Ksym; C), yo+1 Vv M h (i * 2141, keym)
(10)
3.2. Reference-Secret Image Related Key
Ensuring the security of the secret image hidden within the stego images is of paramount in image steganography, The concept of the key, originally from cryptography and first introduced to steganography in (Mou et al., 2023), is well-suited to address this requirement. However, existing methods do not fully guarantee key security and vulner- able to key guessing. In (Mou et al., 2023), the key is merely single numeric value; in CRoSS (Yu et al., 2024), the private and public keys correspond to the descriptive text of the secret and stego images, respectively. Similarly, DiffStega (Yang et al., 2024) employs pre-determined password-related reference image, alongside a text prompt as the public key. In contrast, and drawing inspiration from the Elliptic Curve Heffie-Hellman Ephemeral (ECDHE) key exchange algorithm, our model introduces dynamically generated symmetrie key that is adaptively derived from the reference-secret image pair, significantly boosting security.
-Xip (2e+1, kxgm: c).
Following the recommendation in (Wallace et al., 2023), we introduce a learnable parameter E [0.90, 1.0] to enhance robustness. Additionally, intermediate mixing layers are applied after each gradient descent step to compute weighted averages of and y, defined as:
mir p 2 (1-p) p).
(11)
In summary, the conceal process of the proposed SSHR, with the input =o see and final output zT = Estegor can be formulated as:
N₂
min 2
Σ
k * ( ye, ksym)
(yee Raym, c),
Inspired by the principle of ECDHE, we treat each steganog- raphy task as an independent encryption session, where the symmetric key is adaptively generated based on the secret and reference images. The process begins by extracting fea- tures F, and F, from the secret and reference image, respec- tively, using pre- pre-trained neural network, with AlexNet em- ployed as the default model. Next, a MLP is applied to gen- erate the private key, defined as kprs- = LPP(P.) i E r,s, where kpri-, and kpri-s represent the private keys of the reference and secret images, respectively. The public key is then derived using specific parameter matrix W, for- mulated as kpub- W kpri-s, where represents the Hadamard product.
No
Mi41
min
1/- Σ k (k) #tt1 ksym)
mir
(12)
mér Ax 1 Ksym, C)2
2++1 = p- min + (1 -1--7 p) 1/++1
11++1 p mai + (1 p) 1
Exact reveal process. To minimize errors in the reveal pro- cess and enhance the quality of the revealed secret images, we deterministically reverse the conceal process, ensuring a reliable reveal process in the proposed model. Equa- tion (11) represents an invertible affine transformation, with the inversion process defined as follows:
Following the principles of the ECDHE algorithm, the sym- metric key kaym utilized in our model is derived as:
mir (1 p)
p) 9)/p.
(13)
k Kaym = (WL + Ws) kpri-s " kppi-r
(15)
Thus, reveal Equation (12) and the exact reveal process of our model is calculated, with input 2т Estega and output 20= Zrev. as follows:
(W + Ws) kpriir kpri-s,
where Ws denotes the weight matrix generated based on the secret image, and the overall framework is illustrated in Figure 2. Based on the above equation, the parameter matrix W used for public key generation is defined as W = Wz + Ws. Thus, for each unique pair of images, a distinct symmetric key generated and used in both the conceal and reveal processes. During transmission, only the public key is shared, ensuring strict protection of both the private keys and the symmetric key. This approach significantly enhances the security of the secret images concealed within the stego images.
3/41 (y141 - (1-p) 2.11)pp.
mir
= (24+1 - (1-p) voirr) )/p,
2++1
Nu
y/ = vtt1 +
Σ ki * of
att1 ksym)
mén
(14)
+ (
mán keyms c),
mén
ks (k) yes koym)
21
21+1
+ Axpelue,koe ksym, c).
When transmitting the stego image Fstegas the public key
5

---

SSHR: More Secure Generative Steganography with High--uality Revealed Secret Images
kpub-s associated with the secret image is sent alongside it. Upon receiving the public key of the secret image, the receiver can use the same pipeline outlined in Equation (15) to generate the symmetric key keym, as the sender did during the conceal process. With this symmetric key, the receiver can accurately reveal the secret image and complete the reveal process. Further details are provided in the Supple- mentary. To the best of our knowledge, this is the first exploration to integrate key exchange protocols into image steganography.
where N is the Transformer block illustrated in Figure 3.
3.4. Loss function
Our loss function comprises frequency loss and perceptual loss, which we will describe in detail below.
Frequency loss. The steganography process intends to generate the stego image Jstego based on the secret image ssec. For security purposes, the frequency content of the stego image Estego should elosely match that of the reference image Fref. making them indistinguishable. In the reveal phase, is essential that the frequency profile of the revealed image Zrev closely aligns with that of the original secret image Sxee- To enforce these constraints, we define the frequency loss as follows:
Subsequently, the symmetric key Keym is utilized to generate the weights for CRC, denoted as Wre-e= as well as the modulation parameters a, 33, y in CRT. This design ensures that the symmetric key plays a crucial role in the conceal and reveal process.
LF = [a(ee Astego) + (Z Zrev),
(19)
3.3. Condition Information Guidance Module
where 1, represents the I or l2 norm, serving as a measure of the difference between two images, In our experiments, we use the l norm as the default.
We aim to progressively enerypt the secret images, allow- ing the stego images to gradually improve in quality and increasingly resemble the reference images over time. To achieve this, we first pre-process the reference images us- ing the Condition Information Guidance Module (CIGM) before generating the modulation parameters. This ensures that the input to AdaLN- Zero (Peebles & Xie, 2023) varies across different timesteps, thereby enabling the stego im- ages to incrementally converge toward the reference images. The CIGM is analogous to transformer block and com- prises a separate linear transformation((LTT) (Lu et al., Forward
Perceptual loss. To ensure that the stego image Istegos generated during the conceal process, closely resembles the reference image Fref, and that the revealed image Trev visually aligns with the secret image Isees we introduce a perceptual loss. This loss function quantifies the high- level perceptual differences between these image pairs. The perceptual loss is defined as follows:
Lr =Ipled A (Astego)) + +lplod A (Iree)),
2024), followed by a Re- parameteriization RR et al., 2024). The SLT serves a func- tion similar to that of the attention module in a transformer block and can be formulated as follows:
(20)
where e/ is the pre-trained AlexNet (Krizhevsky al., 2012), used to extract high-level features from the images, and lp measures the difference between these features.
O (cte(c) = ((1)) c 02.c+ 03,
(16)
Total loss. The total loss function Crotal is defined as the weighted sum of the frequency loss LF and perceptual loss Lp , formulated as:
where 0, E R BBXOxHxW 02 E BBXxIIX 0g E R Bxxxixl and is the input of it. The (())) is a convo- lution layer, expressed as W(1)) = Conv (O)LU The Re-FFN is structured with two pointwise convolution layers and a Rep-Conv layer, as illustrated in Figure 2.
LT XIFF + XaCr.
(21)
where λ and X2 are trade-off parameters set to 2.0 and 1.0, respectively, to balance the different losses.
Subsequently, the modulation parameters a, 3,, 7 are gener- ated based on the output of CIGM, denoted as OcrPM (c), along with the parameter matrix WA. The parameters WA derived from the symmetric key kaym via MLP layer. The overall pipeline is formulated as:
4. Experiments
4.1. Experimental Setting
a, B, 7 = =p(it(((ccar(()) - WA) = (O(ia(()))))))) Mkeem)))).
Datasets and settings. Our model is implemented with PyTorch and trained on the DIV2K (Agustsson & Timofte, 2017) training dataset. The evaluation is performed on the DIV2K (Agustsson & Timofte, 2017) test dataset (100 images), COCO (Lin et al., 2014) (5000 images), ImageNet (Russakovsky et al., 2015) (10,000 images), and UniStega (Yang et al., 2024) (100 images) at resolution of 256 x 256. Additional details are presented in the Supplementary.
(17)
Subsequently, they are incorporated into the CRT to guide the generation process and encrypt the secret image.
In summary, the output of CRT OCRT(2. Kaym c) is:
(2 c) = 7 N( (1 a1+ 9), 1), (18)
6

---

SSHR: More Secure Generative Steganography with High-Quality Revealed Secret Images
Sccret Groun Truth
Enerypiad Imsgge
Revealed with Correct
Refernce Image
Rovcalal with Weong Key
CRuse
DiffSeege
Our
CiteS
Difiiiega
Ours
Difiiiega
Ours
Di Diillligg
Ouss (Cuussian)
Oles (Constant)
Cars Pubii key)
Prompt mun cane top DDfSStiSoo
Pronpe cane top
Sieiila
Prompe (CRoSS) frce of (DirSSegNNNee Proopee 2:a face of
Skyl4 gronge
Prompt 1: (CRoSS) a black and white car yellow yellow
(DirrSieuu)Noee Prompe 2: painting the style Pixar
Figure 4. Visual comparisons of our model with generative steganography models on the UniStega datasct across three different prompts. These prompts are utilized in CRoSS and DifiStega, whereas model functions without text prompts. The reference image is used the image condition in both DiffStega and our model. More comparison results are presented in the Supplementary.
Table 1. Numerical comparisons of secret/revealed image pairs with cover-based steganography methods across various datasets, high- lighting the best results in red and the second-best in bold.
METHon
ПIV/K
COPo
IMAGINNF
PSNR1
SS1M
MAEL
RMSEL
PSNRT
551M1
MAEЛ]
RMSE.
PSNR1
SSIMT
MAEI
RMSEE
BALUSA
0,5377
0:9247
5.37
WENG ET.43.
51.24
0.8483
5.84
6.32
33.05
0.8921
4.80
6.05
15:34
0.8921
4.50
5.06
UDII
55.23
0.8035
6.05
4.78
15.07
0.8220
3:77
4.87
15.30
018252
3.73
4-58
ISN
0.8672
2:30
4.30
3.04
3.74
HINET
46.64
QURS
48.96/1.921)
0.9985(8.08221)
6.748.1911
0.97(0.34))
47.6763.6211
0.3000332)) 1.8800.62))
49.52/2.7411
0.9086118009))
(.6819.44)) 0.8810835
tural Similarity Index Measure (SSIM) (Wang et al., 2004), Root Mean Square Error (RMSE), and Mean Absolute Er- ror (MAE) as performance metries. addition, we use the
Table Numerical comparisons with generative steganography methods the UniStega dataset.
SYuGo INAGES
KEY
Waose KEYICUNTTNNT
Naturalness Image Quality Evaluator (NIQE) (Mittal et al., 2012) to evaluate the naturalness of the stego images.
PSNR
SSIM:
PSNR1
551M1
PSNR]
SSIM]
CRoSS
19.03
0.66
21.25
0.71
0.39
21.29
8/77
17.53
0.54
20.08
(9619.65)
0.110848))
47.00125.121)
0.9000300)
5.7831885)
8,2400.0
4.2. Quality Analysis
Quantitative results. We compare the proposed method against existing models, with numerical results presented in Table and Table 2. Table presents quantitative com- parison between the proposed SSHR model and other cover- based models on the DIV2K, COCO, and ImageNet datasets. Notably, on the ImageNet dataset, our model demonstrates a PSNR gain of 2.74 dB and SSIM improvement of 0.39 %. Meanwhile, MAE and RMSE reduced by 0.44 and 0.35, respectively. Similarly, on the DIV2K and COCO datasets, the proposed SSHR model outperforms other cover-based models, achieving PSNR/SSIM gains of 1.92 dB/0.22 % and 3.62 dB/0.33 %. respectively, along with lower MAE and RMSE. These results illustrate that SSHR significantly enhances the quality of revealed secret images compared to existing cover-based steganography methods.
Table 3. NIQE scores for various models.
ORIGINAL IMAGE
ISN
HINET
CROSS
DIESSTIGG
OURS
NIQEI
11.28
Benchmarks. To comprehensively evaluate our method's effectiveness, we compare against state-of-the-art (SOTA) steganography methods, including cover-based based methods: Baluja et al. (Baluja, 2017), HiDDeN (Zhu, 2018), UDH (Zhang et al., 2020), Weng al. (Weng al., 2019), ISN (Lu et al., 2021), HiNet (Jing et al., 2021); and generative methods: CRoSS (Yu et al., 2024), DiffSttea (Yang et al., 2024). To maintain objectivity, we re-trained the cover- based models with the same training dataset as ours.
Evaluation Metrics. To assess the quality of secret/revealed pairs, we utilize Peak Signal-to-Noise Noise Ratio (PSNR), Strue-
Table 2 presents the quantitative results in comparison with generative methods on the UniStega dataset. Specifically,

---

SSHR: More Secure Generative Steganography with High-Quality Revealed Secret Images
Table 4. The detection accuracy (%) detected by SRNet and XuNet.
COVER-BASED
GENERATIVE METHOD
WENG
UDH
ISN
HINEY
CRoSS
DIRSIEGA
OURS
US
BS4
SKM SRNAT XUNNT
81.47
76.34
54.86
53.52
51.73
51.68
50.64(1.044)
85.31
79.88
55.68
55.54
52.10
52.03
51.05(0.988)
86.24
80.26
53.12
50.93(1.93()
Scru Yrag
1154
Figure 5. Visual comparisons of stego images(top) and revealed secret images(bottom) for our model and various cover-based steganography models on the DIV2K dataset.
0.5
Trus Positvve Rate
065
0.4
Hiher 1S4 6.78)
our model achieves an impressive 24 dB gain in PSNR and 20% improvement in SSIM for correct recovery/secret pairs, indicating a substantial enhancement, For secret/stego im- age pairs, the proposed model reduces PSNR by 9.65 dB and SSIM by 48% compared to other generative methods, effectively diminishing the resemblance between stego and their corresponding secret images. Additionally, lower simi- larity scores for incorrect recovery/secret image pairs, with notable 11.83 dB decrease in PSNR and 30% reduction in SSIM, demonstrate the proposed model effectively bolsters security for recovery attempts with incorrect key. Evidently, the SSHR excels in encryption and decryption compared to other generative steganography models, offering high- quality revealed secret images and enhanced security.
1mit (wea-
Weng 985)
Citsss qusa +0.00
nattings +0.52
Ouaa (ars B.3)
2.5
04
666
False Posilive Rate
Figure 6. Security performance detected by StegExpose.
the proposed model outperforms other generative steganog- raphy models in terms of naturalness and imperceptibility.
Steganographic analysis. The anti-steganalysis ability is crucial for evaluating the security of image steganography, as measures the likelihood that stego images can be dis- tinguished from reference images using steganalysis tools. Following the common practices in the cover-based and generative steganography task (e.g., ISN (Lu et al., 2021). I), HiNet (Jing et al., 10, CRoSS (Yu et al., 2024), DiffStega (Yang et al., 2024)), we employ the open source steganalysis tool StegExpose (Boehm, 2014), hand-crafted feature-based steganalyzer SRM (Fridrich & Kodovsky, 2012) and two steganalysis networks: SRNet (Boroumand et al., 2018) and XuNet (Xu et al., 2016), to systematically evaluate the anti- steganalysis capabilities of the proposed model alongside other methods. Lower detection accuracy and a smaller area under curve (AUC) indicates better security performance. The evaluate results are presented in Figure 6 and Table respectively. These steganalysis results indicate that the proposed SSHR model outperforms other SOTA methods in terms of anti-steganalysis performance.
The qualitative comparison outcomes for the stego and recovery images of our model and other models are presented in Figure 4 and Figure 5. Figure 4 illustrates comparisons between our SSHR model and other generative steganography models on the UniStega dataset. The results demonstrate that the proposed model generates stego images that are distinctly different from the secret images, while simultaneously producing higher-quality re- vealed secret images. Additionally, the SSHR model shows enhanced security when the image is revealed with three types of incorrect keys. Figure 5 showcases the visual performance of our model in comparison to various cover- based steganography methods. The figure highlights the superior performance the proposed method in terms of se- cret/reveal image pairs, well as the comparative results for cover/stego image pairs. These results clearly demonstrate that the proposed model achieves significant improvements in effectiveness and security over existing SOTA models.
Qualitative Results.
Effect of the Symmetric Key. The RSRK is designed to se- cure both the key and the concealed secret image. We tested the model with the correct symmetric key, alongside three types of incorrect keys: random Gaussian noise, a constant value, and the public key of the secret image (which could be intercepted by attackers during transmission). As shown in Figure and Figure 4, only the correct key enables accu- rate recovery of the secret image. Figure uses a constant key as the incorrect key, and Table provides numerical results for revealing the secret image with a constant key. Both numerical and visual results consistently show that an
4.3. Security Analysis
Naturalness and Imperceptibility. We apply the NIQE to evaluate the naturalness and visual security of the images against human suspicion without the assistance of reference images or human feedback. The results in Table show a 12 reduction in NIQE value for SSHR model compared to other generative steganography models. This indicates that
8

---

SSHR:
More Secure Generative Steganography with High-Quality Revealed Secret Images
Table Effectiveness of PM, Wavelet Lansform,Rep-Comm and
CIGM.
PM
WOOKERT TRASRORS
Rre-Cow
CROM
BASSE
X
K
16.37
30.25
5.7852
2.3250
8.37
7337
9.23
7.80
$5.97
11.36
0.9489
0.9534
1.25
2.15
2.43
4.23
Sana
37.90
2.8318
2.09
3.57
42.24
3,9229
1.59
2:38
59.92
39650
2:16
2.81
15.19
0.9338
0.68
1.45
01.32
8.4697
1.13
18.56
0.988
6.14
6.47
Figure 7. The CIGM facilitates the achievement of progressive encryption.
Table 6. Quantitative results of revealed images on the UniStega dataset when stego images undergo various distortion.
exact reveal process to improve the quality of the revealed secret images. Additionally, we propose RSRK genera- tion module that strengthens key security by dynamically linking them to both the reference and secret images, signifi- cantly enhancing the overall security of the concealed secret images. Extensive experiments demonstrate that SSHR out- performs SOTA generative steganography methods in both effectiveness and security.
Memson CLRAN
GAUSSIAN BLIE
GAUSSIAN Norss
JPEG COMPRISIINN
PorssON
HINaT
46.55
9,97
10.13
10.29
CRoss
21.25
30.00
18.97
20.30 20
10:27
23.29
28,85
18.62
21.16
28.15
OUKS
47.04
24.01(3.1611
23.95/6.8871
24.74(3.881)
25.9613.1113
attacker cannot retrieve the secret image with an incorrect key. These findings underscore the essential role of the pro- posed RSRK and key generation module in enhancing the security of both the key and the concealed secret image.
A Acknowledgements
Effectiveness of various setting, As indicated in Table 5, the various settings we employed significantly improve the quantitative metrics for both stego and revealed images, enhancing performance in both the conceal and reveal pro- cesses. For example, the introduced PM model leads PSNR gain of 5.12 dB for reference/stego pairs and 3.59 dB for secret/recovery pairs. Figure 7 illustrates the encryption and decryption process, showcasing how the SSHR model achieves secure, stepwise encryption and decryption of se- cret images with reference image guidance. These results demonstrate that the proposed model effectively reduces the similarity between the stego and secret images, while producing high-quality revealed secret images, validating the module's 's effectiveness and overall model performance.
This work was supported in part by the NSFC fund (NO. 62206073, 62176077), in part by the Shenzhen Key Technical Project (NO. JCYI20241202123778888 ISCG2020081102285509, ISGG2022083 JSGG202201003155882200 KIZD20230923111117000 KJZD22044000300072200 in part by the Guangdong In-
NO.
ternational Science and Technology Cooperation Project (NO. A02340505050008) in part by the Shenzhen Funda- mental Research Fund (NO. JCYJ202103241 122100222, and in part by the Guangdong Provincial Key Labora- tory of Novel Security Intelligence Technologies (NO. 2022B121 121 1210000055, in part by the Guangdong Shenzhen joint Youth Fund under Grant 2021A15151 1074, and in part by the Natural Science Foundation of Shenzhen General Project under Grant JCYJ202408131 10007010, in part by the Natural Science Foundation of Guang- dong Province under Grant 2023A15150108993, in part by the Shenzhen Doctoral Initiation Technology Plan under Grant RCBS20021008099222000 in part by the Shenzhen Pengcheng Peacock Startup Fund.
Performances on Various Distortions. To assess the ro- bustness of our SSHR model, we test it under various degra- dations, including Gaussian blur, Gaussian noise, JPEG compression and Poisson noise. The results, presented in Table in terms of PSNR, indicate that the proposed SSHR model outperforms other SOTA models. These re- sults demonstrate the favorable robustness of the proposed SSHR against attacks. Additional details on the distortions are provided in the Supplementary.
Impact Statement
This paper delves into an exploration of generative image steganography technology, with the objective of generat- ing the stego images from secret images. Through a suc- cession of innovative algorithmic designs and meticulous experimental analyses, it has significantly boosted the se- curity and effectiveness of generative image steganography methods. The integration of the key-exchange algorithm has effectively forged an initial connection between image steganography and cryptology. This linkage not only en- riches the theoretical framework of image steganography
5. Conclusion
This paper presents SSHR, an innovative steganography method based the PM diffusion model, designed to over- come the limitations of existing generative steganography approaches. The proposed model uses reference images to guide stego image generation, ensuring outputs are visually natural yet highly dissimilar to the secret images, thereby enhancing concealment effectiveness. We also establish an

---

SSHR: More Secure Generative Steganography with High-Quality Revealed Secret Images
but also endows cryptology with new application scenarios.
Hertz, A., Mokady, R., Tenenbaum, J., Aberman, K., Pritch, Y., and Cohen-or, D. Prompt-to-prompt image edit- ing with cross-attention control. In The Eleventh In- ternational Conference on Learning Representations, 2023. URL https:: /open///eeeeeeeeeeeeeeeeeeeeeeee wtteeeewwwwweweeeeeeeeeeeeeeeeee forum? id= _t=_Diizzkeebb
References
Agustsson, and Timofte, R. Ntre 2017 challenge on single image super-resolution: Dataset and study. In Proceedings of the IEEE Conference Computer Vision and Pattern Recognition Workshops, pp. 126-135, 2017.
Ho, J., Jain, A., and Abbeel, P. Denoising diffusion proba- bilistic models. Advances in neural information process- ing systems, 33:6840-6855, 2020.
Baluja, S. Hiding images in plain sight: Deep steganography. Advances in Neural Information Processing Systems, 30,
2017.
Jing, J., Deng, X., Xu, M., Wang. J., and Guan, Z. Hinet: Deep image hiding by invertible network. In Proceedings of the IEEE/CVF International Conference Computer Vision, pp. 4733 4742, 2021.
Baluja, S. Hiding images within images. IEEE Transac- tions on Pattern Analysis and Machine Intelligence, 42 (7):1685-1697, 2019.
Krizhevsky, A., Sutskever, I., and Hinton, G. E. Imagenet classification with deep convolutional neural networks. Advances in Neural Information Processing Systems, 25, 2012.
Black, M., Sapiro, G., Marimont, D., and Heeger, D. Robust anisotropic diffusion and sharpening of scalar and vector images. In Proceedings of International Conference on Image Processing, volume 1, pp. 263-266. IEEE, 1997.
Boehm, B. Stegexpose-a tool for detecting Isb steganogra- phy. arXiv preprint 14006666, 2014.
Lin, T.-.,, Maire, M., Belongie, S., Hays, J., Perona, P., Ra- manan, D., Dollár, P., and Zitnick, C. L. Microsoft coco: Common objects in context. In Computer Vision-ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13, pp. 740- 755. Springer, 2014.
Boroumand, M., Chen, M., and Fridrich, J. Deep residual network for steganalysis of digital images. IEEE Trans- actions on Information Forensics and Security, 14(5): 1181-1193, 2018.
Liu, Y. and Bu, Y. Adaptive text watermark for large language models. In Forty-first International Confer- ence on Machine Learning, 2024. URL https:// openreview net ftr/mmormm/////////// wtw.ummmdddmmmmss555e..
Chen, Y. and Pock, T. Trainable nonlinear reaction diffu- sion: A flexible framework for fast and effective image restoration. IEEE Transactions Pattern Analysis and Machine Intelligence, 39(6):1256-127)) 2016.
Lu, S.PP., Wang, R., Zhong, T., and Rosin, P. L. Large- capacity image steganography based on invertible neural networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Patlern Recognition, pp. 108 10816- 10825, 2021.
Dinh, L., Krueger, D., and Bengio, Y. Nice: Non-linear independent components estimation. arXiv preprint arXiv:1410.8516 2014.
Dinh, L., Sohl-Dickstein, J., and Bengio, S. Density esti- mation using real nvp. arXiv preprint arXiv: / 088003 2016.
Lu, Y., Jiang, B., Lu, G., and Zhang, B. Implicit prompt learning for image denoising. In Proceedings of the Thirty-Third International Joint Conference on Artificial Intelligence, pp. 4678-4686, 2024.
Feng, W., Zhou, W., He, J., Zhang, J., Wei, T., Li, G., Zhang, T., Zhang, W., and Yu, N. AqualoRA: Toward white-box protection for customized stable diffusion mod- els via watermark loRA.
Mielikainen, J. Lsb matching revisited. IEEE signal pro- cessing letters, 13(5):285 228,7,2,8 2006.
Forty-first International Conference on Machine Learning, 2024. URL https: //openreview. net
wwt.wvwwwwweeweeee.e/e forum 11ddd=xxxii (tt.rrrmmiiixxxxx22222222
Mittal, A., Soundararajan, R., and Bovik, A. C. Making "completely blind" image quality analyzer. IEEE Signal processing letters, 20(3):209-22 212, 2012.
Fridrich, and Kodovsky, J. Rich models for steganalysis of digital images. IEFF Transactions on information Forensics and Security, 7(3):868-8855 2012.
Mou, C., Xu, Y., Song. J., Zhao, C., Ghanem, B., and Zhang, J. Large-capacity and flexible video steganography via in- vertible neural network. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 22606-22615 2023.
Guan, Z., Jing, J., Deng, X., Xu, M., Jiang, L., Zhang, Z., and Li, Y. Deepmih: Deep invertible network for multiple image hiding. IEEE Transactions on Pattern Analysis and Machine Intelligence, 45(1):372-390, 2022.
10

---

SSHR: More Secure Generative Steganography with High-Quality Revealed Secret Images
Peebles, W. and Xie, S. Scalable diffusion models with transformers. In Proceedings of the IEEE/CVF Interna- tional Conference Computer Vision, pp. 4195-4205, 2023.
Wang, Z., Bovik, A. C., Sheikh, H. R., and Simoncelli, E. P. Image quality assessment: from error visibility to structural similarity, IEEE Transactions Image Processing, 13(4):600-614 2004.
Perona, P. and Malik, J. Scale-space and edge detection using anisotropic diffusion. IEEE Transactions on Pattern Analysis and Machine Intelligence, 12(7):629-639, 1990.
Wei, P., Luo, G., Song, Q.. Zhang, X., Qian, Z., and Li, S. Generative steganographic flow. In 2022 IEEE Inter- national Conference on Multimedia and Expo, pp. 1-6. IEEE, 2022.
Pevný, T., Filler, T., and Bas, P. Using high-dimensional im- age models to perform highly undetectable steganography. In Information Hiding: 12th International Conference, IH 2010, Calgary, AB, Canada, June 28-30, 2010, Revised Selected Papers 12, pp. 161-177. Springer, 2010.
Wei, P., Zhou, Q. Wang. Z., Qian, Z., Zhang, X., and Li, S. Generative steganography diffusion. arXiv preprint WrXiv:2305.03422 2023.
Weickert, J. et al. Anisotropic diffusion in image processing, volume 1. Teubner Stuttgart, 1998.
Russakovsky, O., Deng, J., Su, H., Krause, J., Satheesh, S., Ma, S., Huang, Z., Karpathy, A., Khosla, A., Bernstein, M.. et al. Imagenet large scale visual recognition chal- lenge. International Journal of Computer Vision, 115: 211-252, 2015.
Weng, X., Li, Y., Chi, L., and Mu, Y. High-capacity con- volutional video steganography with temporal residual modeling. In Proceedings of the 2019 on International Conference on Multimedia Retrieval, pp. 87-95, 2019.
Sameer, V. U. and Naskar, R. Universal wavelet relative dis- tortion: A new counter-forensic attack photo response non-uniformity based source camera identification. In Information Security Practice and Experience: 14th Inter- national Conference, ISPEC 2018, Tokyo, Japan, Septem- ber 25-27, 2018, Proceedings 14, pp. 37-49. Springer, 2018.
Wouters, B. Optimizing watermarks for large language mod- els. In Forty-first International Conference on Machine Learning, 2024. URL https: //tppp:://ppeeee opwnrevieeeeeeeeeeeeeeee net/ forum? ? i ddQ@AAeRRRG....
Xu, G., Wu, H.-Z., and Shi, Y.-.. Structural design of convolutional neural networks for steganalysis. IEEE Signal Processing Letters, 23(5):708- 712, 2016.
Scherzer, O. and Weickert, J. Relations between regular- ization and diffusion filtering. Journal of Mathematical Imaging and Vision, 12:43-66 04443-63,220 2000.
Yang. Y., Liu, Z., Jia, J., Gao, Z., Li, Y., Sun, W., Liu, X., and Zhai, G. Diffstega: Towards universal training- free coverless image steganography with diffusion models. In 33rd International Joint Conference on Artificial Intelli- gence (IJCAI), 2024.
Song, J.. Meng, C., and Ermon, S. Denoising diffusion implicit models. In International Conference on Learning Representationss 2021. ht.ts: /ttp:///ppeeeeeeeeeeeeeee net/ htt:://rrdddiigiiiiaaa
Yu, J., Zhang, X., Xu, Y., and Zhang, J. Cross: Diffu- sion model makes controllable, robust and secure image steganography. Advances in Neural Information Process- ing Systems, 36, 2024.
Tu, Z., Du, K., Chen, H., Wang. H., Li, W., Hu, and Wang. Y. I2t-v2: Efficient image processing transformer using hierarchical attentions. arXiv preprini arXiv:2404.000 00633, 2024.
Zhang, C., Benz, P., Karjauv, A., Sun, G., and Kweon, I. S. Udh: Universal deep hiding for steganography, water- marking, and light field messaging. Advances in Neural Information Processing Systems, 33: 10223-102244, 2020.
Vyas, N., Kakade, S. M., and Barak, B. On provable copyright protection for generative models. In Inter- national Conference on Machine Learning, pp. 35277- 35299. PMLR, 2023.
Zhang, G., Lewis, J. P., and Kleijn, W. B. Exact diffusion inversion via bi-directional integration approximation. ECCV, 2024.
Wallace, B., Gokul, A., and Naik, N. Edict: Exact diffuuson inversion via coupled transformations. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 22541,2 2023.
Zhou, Z., Sun, H., Harit, R., Chen, X., and Sun, X. Cover- less image steganography without embedding. In Cloud Computing and Security: First International Conference, ICCCS 2015, Nanjing, China, August 13-15, 2015. Re- vised Selected Papers 1, pp. 123-132. Springer, 2015.
Wang, F., Yin, H., Dong, Y.-J., Zhu, H., Zhang, C., Zhao, H., Qian, H., and Li, C. BELM: Bidirectional explicit linear multi-step sampler for exact inversion in diffusion models. In The eighty Anmual Conference on Neu- ral Information Processing Systems, 2024. URL ht tttp:: //openrevies eew nwe.ee//eeeeeeeeeeee..eee.ee www.eee/ffnnn forum? i d4 EmwL.b.
Zhu, J. Hidden:
hiding data with deep networks. arXiv preprint I 2018

---

SSHR: More Secure Generative Steganography with High-Quality Revealed Secret Images
Zhu, J.-Y., Park, T., Isola, P., and Efros, A. A. Unpaired image-to-image translation using cycle-consistent adver- sarial networks. In Proceedings of the IEEE international Conference on Computer Vision, pp. 2223-2232, 2017.
Zhu, S. C. and Mumford, D. Prior learning and gibbs reaction-diffusion. IEEE Transactions on Puttern Analy- sis and Machine Intelligence, (2L1)):123-115555 1997.
12

---

SSHR: More Secure Generative Steganography with High-Quality Revealed Secret Images
A. Security of the symmetric key
The ECDHE algorithm, widely used in the Transport Layer Security (TLS) handshake, an effective key exchange method based on elliptic curves. Inspired by this, we treat each steganography task as an independent encryption session, adaptively generating symmetric keys linked to both the secret and reference images using the Reference-Secrt Image Related Symmetric Key Generation (RSRK) module. This approach enhances the security of both the keys and the concealed secret images during the conceal and reveal processes.
We model each steganography task as an independent encryption session, where the secret image and reference image function as the client and server, respectively. Initially, features F, and Fr are extracted from the secret and reference images using AlexNet. An Multilayer Perceptron (MLP) then used to generate the private keys, formulated as kpri-- = (F.) i E r, 8, where kgri-r and kpri-s are the private keys of the reference and secret images, respectively. These private keys are securely stored to maintain their integrity. Using specific parameters W, analogous to the base point G in the ECDHE algorithm, we derive the public keys for the reference image kpuò-r and secret image kpub- follows:
kipub = W kppi-r;
(22)
kpub- = W kipiis::
where denotes the Hadamard product, which is commutative and satisfies the necessary conditions for the subsequent operations in the ECDHE algorithm.
After obtaining the private and public key for the secret and reference image, we follow the principle of the ECDHE
algorithm to derive the symmetric key ksym utilized our model, expressed as follows:
kaym kppub- x -kprr-r
(W,, + -Ws) kyriis Ripri-r
(23)
= (WL + Ws) kpri-r Kpri-o
= -kpubrr Kipri-s:
where Ws represents the weight generated based on the secret image, ensuring that the weight used to generate the symmetric key is dynamically tied to the secret image. This operation guarantees that different parameters are used to derive the public key kpub-s and the symmetric key kaym when concealing different secret images, analogous to selecting specific base points G and clliptic curves E in the ECDHE algorithm. This not only aligns the symmetric key generation process with the principles and procedures of the ECDHE algorithm but also enhances the security of the symmetric key. Following the above equation, the parameters W are used for generating the public key and are defined as W WT Wg. As result, for each unique combination of images, distinct symmetric key ksym is generated and used in both the conceal and reveal process.
In practical application, we assume that the sender and receiver share the same reference image and employ the same image preprocessing methods. Additionally, the model parameters used for generating the private key are common to both parties. Therefore, when using the same reference image, both the sender and receiver can derive the same private key kpri-r corresponding to the reference image.
When transmitting the stego image Ustego the public key kpub-s associated with the secret image is sent alongside it. Upon receiving the public key of the secret image, the receiver can use the same pipeline outlined in Equation (23) to generate the symmetric key keym. as the sender did during the conceal process. With this symmetric key, the receiver can accurately reveal the secret image and complete the decrypt process.
The stego image I Estego and public key kpub- can be intercepted by an attacker during transmission. In existing generative steganography methods, the security of the keys is not guaranteed, exposing the secret image Usec to potential risk. In contrast, in our method, even if an attacker intercepts the stego image and the public key, they cannot obtain the correct symmetric key ksym the private key kpri-, of the reference image Zref is never transmitted. Without the correct symmetric key, the attacker is incapable of revealing the secret image &sen from the stego image. This ensures the security of the key and significantly enhance the protection of the concealed secret image.
The proposed key generation process, grounded in robust, well-established algorithms, mitigates potential theoretical vulner- abilities. Specifically, the symmetric key generation method employs the Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) algorithm. The security of key exchange protocols (e.g. RSA, ECDH) is mathematically grounded in computationally hard
13

---

SSHR:: More Secure Generative Steganography with High-Quality Revealed Secret Images
problems like integer factorization for RSA, and elliptic curve discrete logarithm problem for ECDH and so on. These foundational problems guarantee the computational infeasibility of deriving private keys shared secrets from publicly available parameters. This ensures strong theoretical security guarantees, safeguarding the symmetric key's generation and protection.
10 x/Socret-
Stego
Correctkey
Revealed]
Constant
Public Key
Figure 8. Visual results on DIV2K dataset. The secret images are revealed with four types of keys: correct keys, constant, random noise and the public keys tied to secret images.
B. Implementation Details
Experimental Setting. The model is implemented in PyTTrrch and trained on the DIV2K (Agustsson & Timofte, 2017) training dataset. Training images are randomly cropped to 256 x 256 and augmented with random horizontal and vertical flips. Evaluation is performed on DIV2K (Agustsson Timofte, 2017) (100 images), COCO (Lin et al., 2014) (5000 images), ImageNet (Russakovsky et al., 2015) (10,000 images), and UniStega (Yang al., 2024) (100 images). Comparatively, images in the DIV2K dataset are center-cropped, while in the other datasets, the images are resized 256 256. The AdamW optimizer with an initial learning rate of 10-4 1 is used for training. All experiments conducted Nvidia 4090 GPU.
Degradation setting. To evaluate the robustness of our SSHR model, we test it under variety of degradations, including Gaussian blur, Gaussian noise, JPEG compression, and Poisson noise. For Gaussian blur, we apply a Gaussian kernel with = 0.1 x std to blur the stego images via convolution with a kernel size of 3, where std denotes the standard deviation of stego images. In case of Gaussian noise, we generate the noise with = 0.1 x sld. addition, we set the quality factor Q 75 for JPEG compression our experiments.
C. Additional Results
Table provides a numerical comparison of the reference/stego image pairs with cover-based steganography methods across the DIV2K, COCO, and ImageNet datasets. For instance, on the ImageNet dataset, our model achieves a PSNR improvement of 1.81 dB and an SSIM enhancement of 0.64%. Additionally, both MAE and RMSE are reduced by 0.37 and 0.35, respectively. Similarly, on the DIV2K and COCO datasets, the SSHR model outperforms other cover-based methods,
14

---

SSHR: More Secure Generative Steganography with High-Quality Revealed Secret Images
Table 7. Numerical comparisons of reference/stego image pairs with cover-based steganography methods across various datasets, high- lighting the best results in red and the second- best in bold.
ReferencelSiego
Method
DIV2K
COCO
Imsaemet
PSIK
SSIMI
MAEL
RMSEL
PSNK
SSIM
MAE,
RMSEI
PSNK1
SSIM?
MAE
RMSEE
HiDDeN
35.21
0.98
36.71
0.9676
0.58
5.73
34.79
6.12
7.33
Baluja
36.77
0,9645
3.79
5.02
36.38
0,9563
5.98
7.43
36,59
0:9520
5.61
5.41
Weng ct.al
37.34
0,3244
3.03
3.57
37.68
0,3323
2.82
3.42
38.20
0.9368
2.68
3.24
UDH
38.78
0,905M
38.90
0.9650
2.77
2.90
38,96
0,9624
2.75
2:88
ISN
39.25
2.34
2.91
37.95
0.9751
2.76
3.23
40.13
1.95
2.51
HiNet
39.53
0.9866
2,0N
2.87
39.01
0,9844
2,09
2.96
44.61
0.9927
1.52
1.63
Ours
41.03(1.501)
0.989199.00261
1.65:0.33))
1.93/0.94.)
40.21(1.01)
0.9885(0.00411)
1.630.666)
1.90(1.06.)
46.42(1/81)) 0.9991000004")
1.15(0,37L)
1.28(0335))
with PSNR/SSIM improvements of 1.50 dB/00.26% % and 1.20 dB/0.41 %. respectively, alongside lower MAE and RMSE values. These results demonstrate that the SSHR model substantially enhances the quality and imperceptibility of stego images.
Figure 8 shows the visual results on the DIV2K dataset. The results clearly indicate that when the correct keys are used, the SSHR model successfully reveals high-quality secret images. The residual map, which is nearly entirely black, suggests minimal divergence from the ground truth. However, when an attacker uses incorrect keys, the system's 's security is evident, as meaningful information be extracted from the stego images. Even if the attacker intercepts the public key during transmission and attempts to decrypt the secret image, the model's security remains intact. Moreover, the model preserves the naturalness and imperceptibility of the stego images. These results collectively show that the suggested approach provides high security and efficacy.
Figure 9 illustrates the performance of our SSHR model compared to other generative steganography models on the UniStega dataset, using three different prompts. When compared to CRoSS (Yu al., 2024) and DiffStega (Yang et al., 2024), our SSHR model significantly improves the naturalness and imperceptibility of the stego images. It also facilitates substantial modification of the secret image content, guided by the reference image, to minimize the similarity between the stego and secret image pairs. When incorrect keys are used during the reveal process, the security of our model is evident, as the exposed image differs drastically from the secret image and contains minimal secret information. Moreover, an attacker cannot recover any useful data if they attempt to expose the secret image using the intercepted public key. Additionally, our model almost perfectly recovers the secret image, as demonstrated by the near-black residual map between the recovered image and the ground- truth secret image, in stark contrast to the larger residuals found in CRoSS (Yu et al., 2024) and DifiStega (Yang et al., 2024). Visual results confirm that our SSHR model surpasses previous state-of-the-ard (SOTA) models in terms of both effectiveness and security.
Effectiveness of Wavelet Transform. Following the success of prior work (Jing et al., 2021), we adopt Wavelet Transform to perform steganography in the frequency domain, converting the image from the spatial domain to the frequency domain. As shown in Table 5, Wavelet Transform significantly enhances our model, yielding a 2.59 dB improvement for reference/stego image pairs and a 0.88 dB improvement for revealed/secret image pairs. These results suggest that Wavelet Transform boosts performance at both the concealment and reveal stages, enhancing the quality of stego images while preserving the integrity of revealed secret images.
Effectiveness of Rep-Conv. As shown in Table 5, the Rep-Conv module significantly improves the quantitative metrics for both the stego and revealed images, with a 1.96 dB improvement for reference/stego image pairs and 2.95 dB improvement for revealed/secret image pairs. These enhancements positively affect both the concealment and reveal stages, demonstrating that the Rep-Conv module effectively boosts the performance of the proposed model.
Effectiveness of CIGM. The CIGM preprocesses the reference images to optimize the generation process and gradually encrypts the secret images over time. As indicated in Table the CIGM leads substantial improvements in the quantitative metrics, providing a 1.4 dB improvement for reference/stego image pairs and 3.37 dB improvement for revealed/secret image pairs. This enhancement enhances both the concealment and reveal stages. The results highlight that the CIGM reduces the similarity between the stego and secret images, while the high-quality recovered secret images further confirm the module's effectiveness and the overall performance of the model.
15

---

SSHR: More Secure Generative Steganography with High--ualliy Revealed Secret Images
Enurypied linape
Revezled walt Correct Key
Revealed with Wronp Key
Ground Truth
CReSS
DittStog
Curs
CRoSS
DittSleg
Okzs
Dhitbblgg
Outs CGrusai
COnd
Ihiblic
Image
Secret Revelldd
DifiSieg
Curs
CRoSS
Content prompts
Proupt (CRu5S) trsir. travnzing dowan tndke Bhrouht Gread (iiSSiegt)Nnns
Pronyi 2: bus taveling down the coud through forest
Procrpt (CRsSS) standing
(enco((LiffSeeee Prompt
Similar prompts
Phonpe 1: (C (CRoSS) thea of (Ditsnngi Pronitt 2: faca ofa worton
Procppe 1n (C CoSSS face presumyDiffSiegni 'orre
Prompt
Jaco of yourg MORTE
sssee poouioon
Prompt I: (CRoSS) a small dog leytng in grees hurness DiTSSeegoNoon
Prompt 2: aclfporteec by Frida Kallo
Prompt 1: (CRo8S) a cai laying on coush with a flnwzred Dinteg Prompe painting by Vincent Willem var Gigh
model and other generative steganography models the UniStega dataset These prompts are utilized in CRoSS and DiffStega, whereas our model functions without text prompts. The reference image is used as image condition in both DiffStega and our model. The secret images are revealed with four types of keys: correct keys, constant, random noise and the public keys tied to secret images.
Figure Visual contrast
three different prompts.
16


Reviews:
[{"review_id": "SJYiRpZYAY", "reviewer": "Reviewer_iwX7", "summary": "This paper proposed a targeted solution to some drawbacks in diffusion model-based generative steganography with text prompts. Although various experiments indicate the proposed model can outperform existing methods in terms of recovery quality and secret image security, there still exist some issues：\n\n1)\tIn theory: Although the authors state that SSHR is a generative steganography model, it introduces an additional reference image, and the goal of the model is to make the generated stego image similar to that reference one. Thus, its essence is hiding image in image, and it is not strictly coverless generative steganography.\n\n2)\tIn technology: The proposed SSHR builds on previous work (Jing et al., 2021) and differs in that it is conducted in the frequency domain only. As for the innovations in generative modeling, it only introduce a condition term R(z, ksym, c) into the original PM diffusion model. In addition, the symmetric key is generated at the sender's end, so how does it be securely transmitted to the receiver? \n\n3)\tIn experiments: Although the authors have conducted a comprehensive experimental validation of the quality assessment of the generated images, the experimental aspects regarding steganographic security are problematic. Since the method is essentially hiding image in image, the reference image should be used as a COVER and the containing image should be used as a STEGO. In addition to using the deep learning-based steganalysis tools in the paper, a handcrafted feature-based steganalyzer should be considered for \ndetection.\n\n4)\tIn writing: There are some typos: “Peivate”, “within within”,…", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We greatly appreciate your valuable feedback and sincerely hope our response adequately addresses your points and restores your confidence in our work. \n\nA1: Fundamental Disparities from Cover-based Steganography.  We clarify that the proposed method effectively bridges the gap between cover-based steganography and coverless generative steganography, markedly diverging from cover-based methods that directly embed secret data into cover images. The proposed method adheres to a generative steganography pipeline, with reference images serving as guidance for generating stego images. It offers a hybrid solution that unites cover-based steganography and coverless generative steganography. Unlike coverless methods, the proposed method exploits reference images to boost stego images' naturalness and imperceptibility. \n\nA2: (1) Fundamental Disparities from HiNet. The proposed model presents a significant departure from HiNet (Jing et al., 2021), a cover-based method. The key distinctions are: a) Generative steganography vs Cover-Based steganography. The proposed method follows a generative steganography pipeline, with reference images serving as guidance for the generation of stego images. This distinguishes the proposed method from HiNet, which directly embeds secret data into cover images; b) Key Management. The proposed model dynamically derives secret-specific symmetric keys through public key exchange and shared symmetric key generation module. Conversely, HiNet lacks mechanisms for key management; c) Role of Auxiliary Images. Although both the proposed method and HiNet utilize auxiliary images, the functional roles differ fundamentally. In the proposed method, the reference images serve as image prompts and guide the stego images generation process, whereas HiNet treats secondary images as secret data containers.\n\n(2) Main Contributions. The proposed method addresses several fundamental challenges in image steganography, including naturalness and imperceptibility, quality of the revealed secret images and security. Unlike modular approaches that rely on isolated components, our method integrates three main contributions: a) We systematically propose a novel generative steganography method joints the reference images with the adaptive keys to govern the entire steganography process, enhancing the naturalness and imperceptibility of the stego images; b) We methodically design an Exact Reveal Process to precisely reverse the conceal process, minimizing errors in the reveal phase and improving the quality of the revealed secret images; c) We propose a Reference-Secret Image Related Symmetric Key generation module for dynamic symmetric keys generation, bolstering the security of both the keys and the secret images. It is important to note that these challenges cannot be adequately resolved with any singular modular component operating in isolation. The proposed model achieves optimal performance only through the synergy of these contributions.\n\n(3) Key Transmission. The symmetric key is not transmitted directly to the receiver. Only the public keys associated with the secret images are delivered. a) Public Key Exchange. The sender generates a public-private key pair and transmits the public key to the receiver alongside the stego image; b) Symmetric Key Derivation. The receiver uses the received public key within the shared symmetric key generation module to derive the symmetric key. This process decouples the symmetric key transmission from public key distribution and ensures key consistency without transmitting the symmetric key. Please refer to Section $\\textbf{\\textit{Reference-Secret Image Related Key}}$ and the supplementary materials $\\textbf{\\textit{Security of the Symmetric Key}}$ for detailed specifications of the transmission of keys and symmetric key derivation.\n\nA3:  (1) Experimental Setting. The proposed model presents a novel generative steganography method, distinguishing itself from cover-based methods. It bridges cover-based steganography and coverless generative steganography, and utilizes reference images as guidance for stego images generation rather than containers as in cover-based models. This fundamental divergence shapes the experimental design, which integrates elements of both cover-based and generative steganography, providing a unique and comprehensive evaluation framework.\n\n (2) Steganalysis. We have employed the handcrafted feature-based steganalyzer to assess the anti-steganalysis capabilities of the proposed model. We utilize StegExpose, an open-source steganalysis tool integrates four handcrafted feature-based steganalyzers (Sample Pairs, RS Analysis, Chi-Square Attack and Primary Sets), for assessment. The experimental results, detailed in Section $\\textbf{\\textit{Steganographic Analysis}}$, demonstrate that the proposed model exhibits excellent resistance to steganalysis. \n\nA4: Thanks for mentioning the typos in our manuscript. We will review and polish the entire manuscript.", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "Partly", "theoretical_claims": "No", "experimental_designs_or_analyses": "Although the authors have conducted a comprehensive experimental validation of the quality assessment of the generated images, the experimental aspects regarding steganographic security are problematic. Since the method is essentially hiding image in image, the reference image should be used as a COVER and the containing image be used as a STEGO. In addition to using the deep learning-based steganalysis tools in the paper, a handcrafted feature-based steganalyzer should be considered for detection.", "relation_to_broader_scientific_literature": "N/A", "essential_references_not_discussed": "No", "other_strengths_and_weaknesses": "See Summary", "other_comments_or_suggestions": "No", "questions_for_authors": "See Summary", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "EhDvduFliJ", "reviewer": "Reviewer_c4WS", "summary": "The paper presents a novel generative steganography method, SSHR, which incorporates the diffusion model to address challenges in image steganography. It replaces the traditionally used text prompts with reference images and adaptive symmetric keys to generate stego images, providing greater control over the image generation process and enhancing the security and naturalness of the generated images. SSHR uses an Exact Reveal Process to improve the quality of revealed secret images and introduces a Reference-Secret Image Related Symmetric Key (RSRK) generation module to enhance the security of both the keys and the concealed secret images.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We greatly appreciate the very detailed feedback and your recognition of our contributions! We sincerely hope our response below will further enhance your confidence in our work.\n\n A1: (1) Reference Image Selection and Model Performance. The selection of the reference image does not significantly impact the model’s performance. Reference images used for generative guidance in the proposed framework are randomly selected during both the training and testing phases. This stochastic selection mechanism ensures that the model demonstrates robust generalization across diverse reference images, maintaining effective steganographic performance even when the textures of the reference images are irrelevant or conflict with those of the secret images.\n\n(2) Model Performance. The proposed model continues to produce high-quality stego-images and ensures secure secret recovery. The stochastic selection mechanism guarantees robust generalization across various reference images, preserving high-fidelity stego-image synthesis and secure secret recovery, even when the reference images contain irrelevant or conflicting visual features in relation to the secret data.\n\nFurthermore, your insightful question holds significant value and highlights an important avenue for advancement. We plan to systematically investigate this direction to identify optimal reference image selection strategies that strike a balance between creative flexibility and security guarantees for generative image steganography frameworks in future work.\n\nA2: (1) Symmetric Key Security. The symmetric key’s security is rigorously maintained during data transmission. In the proposed framework, only the public key required for symmetric key derivation is exchanged, eliminating the risk of exposing the private key. This design ensures that the symmetric key's confidentiality is upheld by securely storing the private key, thereby significantly enhancing the overall security of the system. \n\n(2) Theoretical Security. The proposed cryptographic key generation process, grounded in robust, well-established algorithms, mitigates potential theoretical vulnerabilities. Specifically, the symmetric key generation method employs the Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) algorithm. This choice ensures strong theoretical security guarantees, safeguarding the symmetric key’s generation and protection. \n\n(3) Experimental Results. a) Evaluation on Various Datasets. We evaluated the proposed model on four distinct real-world datasets: the DIV2K test dataset (100 images), COCO (5,000 images), ImageNet (10,000 images), and UniStega (100 images). These datasets, sourced from real-world scenarios, were chosen to assess the model’s performance and generalization across a variety of image types. The results highlight the model’s outstanding performance, demonstrating its robustness and adaptability in diverse real-world scenario applications. \n\nb) Evaluation on Various Keys. The proposed model was also tested with several types of keys, including constant keys, random Gaussian noise, the public key transmitted to the receiver, and the correct symmetric key. Experimental findings confirmed that third parties could not extract secret images from stego images when using incorrect keys. This result underscores the high level of security provided by the proposed key generation process in real-world scenarios.\n\nA3: Datasets. The proposed model was evaluated on a diverse range of real-world image datasets that cover various scenarios and challenging conditions, such as varying lighting, resolution differences, and environmental factors. To ensure a thorough assessment and facilitate a comprehensive comparison with other steganography approaches, including both cover-based and generative methods, we adhered to prior steganography methods. The model was tested across four distinct real-world datasets: the DIV2K test dataset (100 images), COCO (5,000 images), ImageNet (10,000 images), and UniStega (100 images). These datasets encompass a variety of image resolutions, scenarios, and visual contexts, providing a robust foundation for evaluating the model's performance under different conditions.", "claims_and_evidence": "Clear and convincing.", "methods_and_evaluation_criteria": "Yes.", "theoretical_claims": "Correct.", "experimental_designs_or_analyses": "Yes, the experiments are reasonable.", "relation_to_broader_scientific_literature": "The paper addresses a significant problem in generative steganography, where the quality and security of secret images are at risk. The innovative integration of reference images and adaptive keys improves both the imperceptibility and security of the generated stego images, making this method highly relevant for modern image privacy and security applications.", "essential_references_not_discussed": "The references are efficient.", "other_strengths_and_weaknesses": "The approach introduced by the authors is highly original. The shift from text prompts to reference images for guiding stego image generation is a unique and creative solution. Additionally, the Exact Reveal Process and adaptive key generation offer new ways to improve the recovery of secret images and prevent unauthorized access.", "other_comments_or_suggestions": "N/A", "questions_for_authors": "1. How does the proposed SSHR model perform when the reference images used for generation contain irrelevant or conflicting features with the secret images? Does the model still maintain high-quality stego images and secure secret recovery?\n2. Has the symmetric key generation process been tested against potential vulnerabilities, such as key leakage in real-world scenarios? Are there any theoretical risks to this approach in terms of cryptanalysis?\n3. While the exact reveal process is claimed to improve the quality of revealed images, has this been verified for large-scale datasets with real-world complexities (e.g., varying lighting conditions, image compression, etc.)?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "HGd1yMggSI", "reviewer": "Reviewer_JH66", "summary": "This paper proposes an image steganography method based on the diffusion model. By introducing a reference image and adaptive keys, it solves the problems of \"limited control of text prompts\" and \"insufficient key security\" in current methods, improves the quality of the revealed secret images, and enhances the system security. Experimental results show that the method proposed in this paper outperforms existing methods in terms of image quality and security.\n\n## update after rebuttal\nThanks for authors' response; I will keep my score.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We greatly appreciate your thorough feedback and the time you've dedicated to reviewing our work. We sincerely hope that our clarifications will address your concerns and strengthen your confidence in our work.\n\nA1: (1)  Conceal and Reveal Process. In the proposed model, the secret image $x_{sec}$ is initially taken as input and transformed into the latent space as $z_{sec}$  using the discrete wavelet transform. The latent representation  $z_{sec}$ is then encrypted with the symmetric key $k_{sym} $ and the reference image $x_{ref}$, which has been pre-processed through the condition information guidance module. The conceal process follows Equation (12), with the input $z_0 = z_{sec}$ and the output $z_T = z_{stego}$, generating the latent representation $z_{stego}$ of the stego image $x_{stego}$. The final stego image $x_{stego}$ is then obtained by applying the inverse wavelet transform. The reveal process mirrors the conceal process, following Equation (14) with input $z_T = z_{stego}$ and output $z_0 = z_{rev}$, ultimately yielding the revealed secret image $x_{rev}$. \n\n(2) Symmetric Key Usage. The symmetric key is employed to generate the weights for the Conditional Re-parameterization Convolution and the modulation parameters  $\\alpha$, $\\beta$, $\\gamma$ in the Condition Reaction Term. This design ensures that the symmetric key plays a crucial role in the conceal and reveal process. \n\nYour constructive comments are both sincerely valued and deeply appreciated, and we will re-organize and add more clearer description in the future version. \n\nA2: The outcome of this model is influenced by: the removal of the text prompt and the design of the model’s training objectives. \n\n(1) The removal of the text prompt in the proposed model contributes to reducing the risk of semantic misalignment and improves control over specific semantic regions. The proposed model eliminates the text prompts entirely, relying solely on the reference images to guide the generation of stego images. This architectural simplification facilitates more natural stego images generation, reduces the risk of semantic misalignment and removes the need for balancing multi-modal prompts. In contrast, the DiffStega model integrates both reference images and text prompts to steer the generation of stego images. With the dual-modal guidance, DiffStega generates stego images that align with the constraints of text prompts and the visual features of the reference images. However, text prompts in generative steganography models offer inadequate control, leading to the trade-off between the two types of prompts.  \n\n(2) The design of the training objective plays a crucial role in achieving the results outlined in this question, aligning with the discussed design choices. The framework’s focus on reference-image guidance and its simplification of the generative process contribute significantly to the system’s overall efficacy. \n\nA3: (1) Dataset Resolution. Both the training and test datasets are utilized at a resolution of 256$\\times$256, as documented in the manuscript. To improve clarity and readability, the manuscript will be reorganized to provide a more structured presentation of the information. \n\n(2) Steganalysis Protocol. The deep learning steganalysis architecture follows the training protocol established by SRNet (Deep Residual Network for Steganalysis of Digital Images). After training the deep steganalysis network, we assess the anti-steganalysis capabilities of various methods with the trained network. This enables a comprehensive assessment of the model's anti-steganalysis capabilities. Our experimental setup aligns with common practices used in existing steganography research, guaranteeing the objectivity of the results. We aim to explore more effective experimental settings in future work to further enhance the evaluation of different steganography models.\n\nA4: This question closely resembles the first one of the second reviewer. With respect to the concerns you've raised, we will now provide a renewed explanation of this issue. \n\n(1) Reference Image Selection. We would like to clarify that the selection of reference images does not significantly affect the model's performance. During both training and testing, reference images are randomly selected, which enhances the model's generalization ability, ensuring excellent performance across various types of reference images. This makes the proposed model more adaptable to different visual contexts. \n\n(2) Model Performance. The proposed model consistently delivers high-quality stego-images and secure secret recovery, regardless of whether the reference images are real-world images or generated images. \n \nYour insightful question presents a promising avenue, selection of reference images in generative steganography,  for future exploration. We intend to investigate this aspect in future work to enhance the effectiveness and adaptability of generative steganography techniques.", "claims_and_evidence": "Yes, the claims in the paper are supported by clear experimental results.", "methods_and_evaluation_criteria": "It is meaningful. The method proposed in this paper can significantly improve the image quality of steganography using diffusion models without the need for complex training. At the same time, this paper provides a new idea for the application of cryptography in steganography.", "theoretical_claims": "This paper does not involve theoretical proofs.", "experimental_designs_or_analyses": "The experimental design and analysis in this paper are reasonable.", "relation_to_broader_scientific_literature": "This paper focuses on the steganography scenario of hiding images within images using diffusion models. Compared with previous related papers, it achieves higher image quality and system security.\nIn the papers of CRoSS [1] and DiffStega [2], text prompts are used as private keys. However, due to the limited control of text prompts, the quality of stego images is poor. This paper uses reference images and adaptive keys to avoid above problem, resulting in stego images with higher quality. \n[1] Yu, Jiwen, et al. \"Cross: Diffusion model makes controllable, robust and secure image steganography.\" Advances in Neural Information Processing Systems 36 (2023): 80730-80743.\n[2] Yang, Yiwei, et al. \"DiffStega: towards universal training-free coverless image steganography with diffusion models.\" arXiv preprint arXiv:2407.10459 (2024).", "essential_references_not_discussed": "None. All the major works in this field have been cited and discussed in this paper.", "other_strengths_and_weaknesses": "Strengths\n(1) Novel method design: This paper innovatively uses adaptive keys to control the conceal and exact reveal processes. Compared with previous methods relying on text prompts, it can improve the security of stego images.\n(2) Excellent experimental results: Compared with other steganography methods based on diffusion models, the method proposed in this paper significantly improves the image quality.\n\nWeaknesses\n(1) Insufficiently clear description of the conceal process: In the description of the \"Conceal process\" section, this paper uses a large number of formulas but lacks deep explanations, which may cause reading difficulties for readers.\n(2) Unclear experimental settings for steganalysis: In the \"Steganographic analysis\" experiment, there is a lack of explanations about the sample size of the experimental data and the steganographic covers.", "other_comments_or_suggestions": "(1) A large number of formulas are unfriendly to readers. The authors should provide clear explanations for each process.\n(2) What information needs to be shared between the sender and the receiver in advance? By reading the supplementary materials, it can be inferred that both parties share the same reference image, and the public key related to the secret image also needs to be sent together with the stego image. Such important information should be presented in the main paper rather than in the supplementary materials.", "questions_for_authors": "(1) Regarding Weakness 1, what processing steps does the secret image undergo after the DWT transformation? How exactly is the symmetric key used for encryption during the processing? \n(2) In Paper [2], reference images were also used. However, in the experimental results, the stego images in [2] are significantly different from the reference images, while the stego images in this paper are almost indistinguishable from the reference images. Which designs in SSHR contribute to achieving the above results? Please provide a detailed analysis.\n(3) Regarding Weakness 2, in the steganalysis experiment, the sample sizes of the training data and the test data are crucial and need to be stated in the experimental setup. Meanwhile, training a steganalysis detector requires \"cover - stego\" pairs. In generative steganography, it is necessary to clarify what the cover is (for example, in CRoSS [1], the stego image is directly generated from the secret image without a cover. So, what is the cover used in steganalysis?).\n(4) In - depth discussion on reference images. In this paper, does the selection of reference images have a significant impact on the results? For example, are there obvious differences between the experimental results when the reference image is a real - world image and when it is a generated image?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This paper proposes a generative steganography method to address challenges in image steganography. The paper originally received 1xWeakReject, 1xWeakAccept, and 1xAccept. The main concerns include limited novelty, insufficient experiments, symmetric key security, unclear statements, etc. The authors have provided rebuttals. Afterward, all reviewers keep their ratings. In the discussion phase, Reviewer iwX7 still keeps negative about the security of the public key transmission and evaluation framework. The authors have clarified these concerns in their second rebuttal. Although Reviewer iwX7 does not respond, the authors’ rebuttal addresses the reviewer’s concerns. Considering the rebuttal and discussions from all reviewers, ACs recommend accepting this paper. The authors are suggested to carefully revise the paper and incorporate newly conducted experiments according to the comments and discussions.
Decision: Accept (poster)