Neural Cover Selection for Image Steganography
Authors: Karl Chahine
Hyeji Kim
Venue: NeurIPS 2024 poster (2024)
Keywords: Image Steganography
Watermarking
Generative Models
Primary area: machine_learning_for_other_sciences_and_fields

Abstract: In steganography, selecting an optimal cover image—referred to as cover selection—is pivotal for effective message concealment. Traditional methods have typically employed exhaustive searches to identify images that conform to specific perceptual or complexity metrics. However, the relationship between these metrics and the actual message hiding efficacy of an image is unclear, often yielding less-than-ideal steganographic outcomes. Inspired by recent advancements in generative models, we introduce a novel cover selection framework, which involves optimizing within the latent space of pretrained generative models to identify the most suitable cover images, distinguishing itself from traditional exhaustive search methods. Our method shows significant advantages in message recovery and image quality. We also conduct an information-theoretic analysis of the generated cover images, revealing that message hiding predominantly occurs in low-variance pixels, reflecting the waterfilling algorithm's principles in parallel Gaussian channels.

Neural Cover Selection for Image Steganography
Karl Chahine & Hyeji Kim
Department of Electrical and Computer Engineering University of Texas at Austin Austin, TX 78712 (karlchahine, hyeji (ame)estexaa...m edu
Abstract
In steganography, selecting optimal cover image-rees referree to cover selec- tion- is pivotal for effective message concealment. Traditional methods have typically employed exhaustive searches to identify images that conform to specific perceptual or complexity metrics. However, the relationship between these met- ries and the actual message hiding efficacy of image is unclear, often yielding less-than-ideal steganographic outcomes. Inspired by recent advancements gen- erative models, introduce novel cover selection framework, which involves optimizing within the latent space of pretrained generative models to identify the most suitable cover images, distinguishing itself from traditional exhaustive search methods, Our method shows significant advantages in message recovery and image quality. We also conduct an information-theoree images, revealing that message hiding predominantly occurs in low-variance pixels, reflecting the waterfilling algorithm's 's principles in parallel Gaussian channels. Our code can be found at Image- Shage--teganngrappyy.
analysis of the generated cover
Chahhnne/eeurll-Coeerrr Seleer-Selection-for
Introduction
Image steganography embeds secret bit strings within typical cover images, making them impercep- tible the naked eye yet retrievable through specific decoding techniques. This method widely applied in various domains, including digital watermarking (Cox et al. (2007). copyright certification (Bilal al. )2014),, e-commerce (Cheddad al. (2010), cloud computing (Zhou et al. (2055). and secure information storage (Srinivasan et al. (004]).
Traditionally, hiding techniques such as modifying the least significant bits have been effective for embedding small data volumes up to 0.5 bits per pixel (bpp) (Fridrich et al. [2001]). Leveraging advancements deep learning, recent approaches employ deep encoder-decoder networks to embed and extract up to 6 bpp, demonstrating significant enhancements in capacity (Chen et al. (2022). [Bauja| 2017). Zhang al. (2019). The encoder takes as input a cover image x and a secret message m, outputting steganographic image s that appears visually similar to the original x. The decoder then estimates the message from s. The setup illustrated in Fig. (left).
The effectiveness of steganography is significantly influenced by the choice of the cover image x. process known cover selection. Different images have varying capacities conceal data without detectable alterations, making cover selection a critical factor in maintaining the reliability of the steganographic process (Baluja [2017). Yaghmace and Jamzad (0100).
From a theoretical standpoint, numerous studies have employed information-theoreee analyses to investigate selection and determine the capacity limits of information-hide hiding systems, thereby identifying the maximum number of bits that can be embedded (Moulin et al.) (2000), [000),Coox et al. [199)].
Moulin and O' O'Slliian (203)). For instance, in Moulin and O' O'Sullivan 2003), the steganographic
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

Initial
m
Encoder
Error: 2.26%
Baror: 0.42%
Erro:: 2.44%
Optimized x
f
Decoder
Eiroe: 0.74%
Ervor: 0.11%
Ervor: 0.85%
Figure 1: Left: Image steganography framework: the encoder takes as input the cover image x and a secret binary message m and outputs the steganographic image The decoder then estimates i from s. Right: Randomly sampled cover images from the ImageNet dataset before and after optimization using our framework (described in Section 3). These optimized images demonstrate significantly reduced error |m m| while maintaining high image quality.
setup is conceptualized as communication channel where the cover image x acts as side information. However, such models based impractical assumptions: firstly, the steganographic process is additive- where the message m is simply added to the cover x; and secondly, it presupposes that the cover elements adhere a Gaussian distribution.
From a practical standpoint, existing techniques for cover selection predominantly rely on exhaustive searches to identify the most suitable cover image. These methods evaluate variety of image metrics to determine the best candidate from a database. Some strategies include counting modifiable discrete cosine transform (DCT) coefficients to select images with higher coefficient count for covers (Kharrazi et al. (2066). ) assessing visual quality to determine embedding suitability (Evsutin al. 2018)), and estimating the embedding capacity based image complexity metrics (Yaghmaee Wang and Zhang (2019).
and Jamzad 2010
Traditional methods for selecting cover images have three key limitations: (i) They rely on heuristic image metrics that lack a clear connection to steganographic effectiveness, often leading to suboptimal message hiding. (ii) These methods ignore the influence of the encoder-decoder pair on the cover image choice, focusing solely on image quality metries. (iii) They are restricted selecting from fixed set of images, rather than generating one tailored to the steganographic task, limiting their ability to find the most suitable cover.
Recent progress in generative models, such as Generative Adversarial Networks (GANs) Goodfellow al. 2020 and diffusion models (Song et al. 22200), Ho et 2020 have ignited significant
interest in the area of guided image generation (Shen et al. 22200. Avrahami et al. [2022], Brooks
al. [2023] Gafni et al. [2022] Kim al. [2022] ). Inspired by these innovations, we propose a novel
approach that addresses the aforementioned limitations by treating cover selection an optimization
problem.
In our proposed framework, a cover image x first inverted into latent vector, which is then passed through pretrained generative model reconstruct the cover image. This image processed by neural steganographic encoder to embed secret message, followed by decoder to recover the message. We optimize the latent vector to generate an enhanced cover image x", minimizing message recovery errors while preserving the visual and semantic integrity of the image. Fig. | (right) presents message recovery errors for randomly selected images before and after optimization. Our approach of optimizing the cover image uncovers a novel way to analyze the transformation from to x", revealing that the encoder embeds messages low-variance pixels, analogous algorithm in parallel Gaussian channels. To the best of our knowledge, this is the first work that examines neural steganographic encoders by framing cover selection guided image reconstruction problem.
water-filling

---

Our contributions are outlined as follows:
1. Framework. We describe the limitations of current selection methods and introduce a novel, optimization-drive framework that combines pretrained generative models with steganographic encoder-decoder pairs. Our method guides the image generation process by incorporating a message recovery loss, thereby producing cover images that are optimally tailored for specific secret messages (Section B).
2. Experiments. We validate our methodology through comprehensive experimentation on public datasets such as CelebA-HOQ ImageNet, and AFHQ. Our results demonstrate that the error rates of the optimized images are an order of magnitude lower than those of the original images under specific conditions. Impressively, this optimization not only reduces error rates but also enhances the overall image quality, as evidenced by established visual quality metrics. We explore this intriguing phenomenon by examining the correlation between image quality metrics and error rates (Section 3.3).
3. Interpretation. We investigate the workings of the neural encoder and find hides messages within low variance pixels, akin the water-filling algorithm in parallel Gaussian channels. Interestingly, we observe that our cover selection framework increases these low variance spots, thus improving message concealment (Section
4. Practical considerations. We extend our guided image generation process to practical applications, demonstrating its robustness against steganalysis and resilience to JPEG compression, as detailed in Section
Related work. Recent research has explored the use of generative models in steganography. Zhang al. [2019] introduced training framework where steganographic encoders and decoders are trained adversarially, similar to GANs. Yu et al. [2024) harness the image translation capabilities of diffusion models to transform a secret image directly into a steganographic image, bypassing the embedding process, a framework known as coverless steganography (Qin et al. (2019). [Shi et al. [2018) is notably relevant, as they created a GAN framework designed to produce images robust against steganalysis. However, there are three key distinctions: (i) they overlooked message error rates, focusing solely on evading detection, compromising the effectiveness of cover images for message recovery; (ii) they trained their GAN from scratch, failing to leverage the advantages of existing pretrained models; and (iii) the images generated were randomly sampled and not user-selectable, limiting application flexibility.
Preliminaries
Image steganography aims to hide a secret bit string m (0,1)" into a cover image /
x E [0. 7 x3 where the payload B denotes the number of encoded bits per pixel (bpp) and H, W denote the image dimensions. As depicted in Fig. (lef)) the hiding process is done using steganographic encoder Enc, which takes as input x and m and outputs the steganographic image which looks visually identical to x. decoder Dec recovers the message, m Dec(s) with minimal llm-m
еттог rate HxWxB.
Cover selection involves generating the ideal cover image x, to achieve three primary objectives: (i) minimize the error rate defined above, (ii) ensure that the steganographic image visually resembles x as closely as possible, and (iii) maintain the integrity of the cover image x using established perceptual quality metrics.
Denoising Diffusion Implicit Models (DDIMs) (Song 2220 are class of generative models that learn the data distribution by adopting a wwo-phase mechanism. The forward phase incorporates noise into a clean image, while the backward phase incrementally removes the noise. The formulation for the forward diffusion in DDIM is presented as:
x Vaaxx-111 + VI aje, e~ c(,,).
(1)
where x, the noisy image at the I-th step, 04 is a predefined variance schedule, and spans the discrete time steps from 1 to T.. The DDIM's backward sampling equation is:
3

---

Ag
Forward
Weight
initialization
Backward Diffusion
Enooder
m
x;
Loss
Latento
Figure 2: DDIM-based cover selection framework overview. The input cover image is first converted to the latent space Xy via forward diffusion. Then, guided the message recovery loss, the latent space is fine-tuned, and the updated cover image is generated via the reverse diffusion process. The DDIM model as well as the steganographic encoder-decoder pair are pretrained.
X,-1 (xx;,(( + v ā. () fx(x,,t) Xr vI āg
V
where N(O, 0r II as, and fo is denoising function reliant the pretrained noise estimator cg-
This sampling allows the use of different samplers by changing the variance of the noise o,, Especially, by setting this noise to O, the DDIM backward process becomes deterministic, defined uniquely by the initial variable
This initial value can be seen latent code, commonly utilized in DDIM inversion, a process that utilizes DDIM to convert an image to latent noise and subsequently reconstruct it to its original form (Km et al. 2022
(0200) are another type generative model designed to learn the data distribution p(x) of target dataset through min-max game between two networks: a generator (G) and a discriminator (D). The generator creates synthetic samples (zz) from random noise vector drawn from simple distribution p(z) such standard normal. The discriminator evaluates samples receives-eilee
Generative Adversarial Networks (GANs) GGoddfello
real data x from p(x) or fake data from G-dnd tries to accurately classify them real or fake. The objective of G' is to generate data that mistakes as real, while D aims to distinguish between actual and generated data effectively.
Methodology
We propose two cover selection methodologies using pretrained Denoising Diffusion Implicit Models (DDIM) and pretrained Generative Adversarial Networks (GAN) (Sections 3.1 3.2 and compare the performances of the two approaches (Section 3.3). Detailed descriptions of the training procedures are Appendix [ Broadly speaking, starting with a cover image x randomly selected from the dataset, we gradually optimize this image to minimize the loss | mll. Intriguingly, while our primary focus on reducing the error rate, we observe that all three objectives of cover selection outlined in Section 2 are concurrently achieved. We investigate this phenomenon in Section
3.1 DDIM-based cover selection
As depicted in Fig. inversion, which refers to the process of using DDIM to achieve the conversion from an image to a latent noise and back the original image (Kim al. (2022)).
DDIM approach consists of two steps. We get inspired from DDIM
Step I: latent computation. The initial cover image Xo (where the subscript denotes the diffusion step) goes through the forward diffusion process described in Eq. to get the latent xT.

---

X++1 Va t) + /1 (x+160(x,,t)
(3)
Step 2: guided image reconstruction. We optimize Xy minimize the loss ||m ml| Specifically, Xy goes through the backward diffusion process described in Eq. 2 generating cover images that minimize the loss. We evaluate the gradients of the loss with respect to xT using backpropagation and use standard gradient based optimizers to get the optimal X after some optimization steps.
We pretrained DDIM (parametrized by 8), and pretrained LISO, the state-of-the-arr stegano- graphic encoder and decoder from Chen et al. [022], also described in Appendix [A] The weights of the DDIM and the steganographic encoder-decoder are fixed throughout xy 's optimization process.
The idea is based on the approximation of forward and backward differentials in solving ordinary differential equations (Song et al. (2020).. In the case of deterministic DDIM (a, = O), Eq. _ can be used to perform the forward and backward process (Kim et al. [2022] and achieve accurate image reconstruction. Instead of adopting fully deterministic DDIM, we find that having a deterministic
forward process (Eq.. with stochastic backward process (Eq. 2 yields better results for our setup.
3.2 GAN-based cover selection
In the GAN-based approach, we start with a latent vector z randomly initialized from a Gaussian distribution, which serves as input to the generator G. The objective is to identify an optimized x such that the cover image G(z²) minimizes the loss |mm m|. i.e.:
z argmin (neDee((En(GGu) m) - m||
Where Enc, Dec and are the steganographic encoder, decoder and secret message respectively as described in Section 2 We evaluate the gradients of the loss with respect to z using backpropagation and use standard gradient based optimizers to get the optimal z" that minimizes the loss. All other modules (Enc, Dec, G) are differentiable, pretrained and fixed during the optimization. We utilize BigGAN's pretrained conditional generator (Brock et al. (2018), and a pretrained LISO steganographic encoder-decoder pair (Chen et al. 2022
Note: To achieve consistency with the DDIM approach described in Section 3.1 instead of starting
with randomly generated latent vector z, we can begin a cover image x and apply established GAN inversion techniques to map it to its corresponding latent space (Xia et al. [0022]
3.3 Performance comparison: DDIM & GAN
We compare the performance of the approaches from Sections 3.1 and 3.2 in Table [ We show the results of 10 randomly selected classes from the ImageNet dataset (Russakovsky et al. 20155). Following Chen et al. [2022). we assess error rate defined as ||m lim-m/l
7 the structural similarity index (SSIM) and peak tignal-to-noise ratio (PSNR) (Wang et al. [2004] to measure changes between cover and steganographic images. We further evaluate the generated cover image quality using the no-reference BRISQUE metric (Mittal et al. (2012). ). Our methods outperform traditional exhaustive search techniques detailed in Section] [] which are omitted from the table for brevity.
Methods: For the DDIM-hased cover selection, we generate a batch of 500 cover images, denoted
(1) 500 and apply the cover selection framework to each image independently (Section 3.1 as (xx()) 1i=1
Similarly, for the GAN-based cover selection, we produce a batch of 500 randomly initialized latent vectors, represented as (z(1) 500 and independently run the cover selection framework for each vector (Section 3.2h. We train steganographic mncodrrddeoodrr pair using 1000 training images from each class, adhering to the method used in Chen et al. [2022). We then use this trained model, in addition to diffusion model and BigGAN's conditional generator, both pretrained on ImageNet. We consider a payload of B = 4 bpp (we explore different payloads in Section 3.II.. The secret messages random binary bit strings, sampled from independent Bernoulli distribution. We use the binary cross enosspy loss to optimize message recovery. For a comprehensive explanation on our hyperparameter selection, please refer Appendix B
Observation I: As shown in Table the optimized images produced by both DDIM and GAN exhibit significantly lower error rates compared to the original images by over 50% for some classes.
5

---

Table 1: Comparative performance of GAN-based and DDIM-based cover selection techniques on the ImageNet dataset, with payload B = 4 bpp. DDIM-opumizzd images achieve significant gain over the original images and GAN-optimized images both error rate reduction and image quality.
Brror (%))
BRISQUEL
SSIMT
PSNKT
Osiginal
DIIM
Original
GAN
Original
GAN
DDIM
Original
GAN
BDIM
Robin
2.48
1.01
27.8
18,95
19.81
0.72
0.68
0.64
22.34
23.38
23.85
Snow Leopurd
0.84
0.36
0.55
23.71
18.28
17:26
0.75
0.74
0.72
23.71
24.54
24.96
Daisy
144
9.79
0.61
Drilling Platfomm
2.29
1.85
25,08
25.85
0.41
0.39
0.37
21.56
21.41
Harthhesst
0.21
0.15
0.12
16.97
16.17
13.63
0.55
11.55
0..56
24.83
25.27
26.34
American Eigeet
0.95
0.77
0.78
24.4
22.9
12.03
0.63
0.63
0.64
22.72
22.87
24.49
Chihuabua
0.79
0.59
0.55
18.45
17.92
14.33
0.58
03.56
00.59
25.13
23.55
24.44
Chostah
2,15
2.02
1.53
41.2
40.53
35.01
0.56
0.53
0.43
21.46
21.61
21.75
Sligger
0.17
22.53
11.13
0.71
0.76
26.13
Surprisingly, although our training objective for cover selection focused solely on minimizing the error rate, we observed improved image quality as evidenced by BRISQUE, SSIM, and PSNR scores. This intriguing relationship between higher image quality and lower error rates further explored in Appendix H In summary, our analysis reveals that certain image complexity metries, including edge density and entropy, negatively correlate with both error rates and BRISQUE scores. This suggests that our cover selection framework modifies features such as edges and entropy during optimization, resulting in enhancements to both image quality and error reduction.
Observation 2: DDIM-based optimization consistently outperforms GAN-based methods across all metrics, aligning with previous findings on DDIM's superior image generation capabilities (Dhariwal and Nichol ). We further explore and compare the outputs of both methods, presenting sample steganographic images before and after optimization in Appendix G Notably, DDIM maintains the semantic integrity of images, preserving key elements like object positions and orientations- as bird's unchanged gaze. contrast, GANs may significantly modify an image's composition, even altering a bird's gaze from left to right, which impacts its semantic content.
For the remainder of the paper, we will utilize the DDIM-based approach, due to its enhanced performance in both error reduction and image quality.
4 Analysis
In this section, we explore the reasons behind the enhanced performance achieved by our framework. Initially, we analyze the behavior of the pretrained steganographic encoder (Section 4.1. Our observations indicate that the encoder preferentially embeds messages within pixels of low variance. To validate these findings, we compare the encoder's 's behavior with the waterfilling technique applied to parallel Gaussian channels (Section 4.2) Lastly, we demonstrate that the cover selection optimization effectively increases the presence of low variance pixels. This adjustment equips the encoder with greater flexibility to hide messages, thereby improving overall performance (Section We present the results for the ImageNet Robin class with payload of B 4 bpp. Additional results for various classes and datasets are presented in Appendix D
4.1 Encoding in low-variance pixels
We begin by investigating the underlying mechanism of the pretrained steganographic encoder (Chen al. ) ). We hypothesize that the encoder preferentially hides messages in regions of low pixel variance. To test this hypothesis, we structure our analysis into two steps.
Step 1: variance analysis. In Fig. (top), we illustrate the variance of each pixel position for the three color channels, calculated across a batch of images and normalized to a range between and 1, detailed in Appendix [ The plot reveals significant disparities in variance, with certain regions displaying notably lower variance compared to others.
Step 2: residual computation. Using the same batch of images, we pass them through the stegano- graphic encoder to obtain the corresponding steganographic images. We then compute the residuals by calculating the absolute difference between the cover and steganographic images and averaging

---

Red Charre Verlance
Crean Oharad Veriece
Dax Charnel Var
53
50
68
130
100
100
222
02
212
200
100
200
300
200
250
Channel Secduu
Green
Dice Coaroel ctal
33
28
132
100
100
152
150
150
100
200
320
320
300
230
Figure 3: Normalized pixel variances (top) and residuals (bottom) calculated across batch of 500 Robin images for each color channel, before optimization.
these differences across the batch. This process yields three maps, one for each color channel, which are subsequently normalized to a range between 0 and 1. Those maps are plotted in Fig. 3 (bottom).
As shown in Fig. 3 we observe correlations between the variance and the magnitude of the residual values; where pixels with lower-variance tends to have higher residual magnitudes. To quantify this observation, we introduced a threshold value of 0.5. In the residual maps (from Step 2), locations exceeding this threshold are classified as "high-message regions" and assigned value of 1. Conversely, locations in the variance maps (from Step 1) falling below this threshold are defined as "low-variance regions", also set to 1. We discovered that 81.6% % the high-message regions coincide with low-variance pixels. This substantial overlap confirms our hypothesis and underscores the encoder's tactic of utilizing low-variance areas to embed messages, which is a highly desired and natural behavior. We highlight that are the first make this observation, despite there being several relevant works on learning-die -riven steganography: none of these prior studies conducted an interpretation analysis of the encoder to uncover this behavior.
Interestingly, we find that the learned message embedding behavior closely aligns with the water- filling strategy, the theoretically optimal embedding strategy for parallel Additive Gaussian Noise channels, a fundamental concept communication theory (Cover (1999). This strategy involves embedding more messages in lower-variance pixel positions, which increases message recovery accuracy. Surprisingly, steganography methods tend to adopt this strategy implicitly, without explicit training to do so. In the subsequent section, we delve deeper into this analogy and further demonstrate the relationship between these two processes.
4.2 Analogy to waterfilling
To validate the findings presented in Section 4.1 we draw parallels between our analysis and the waterfilling problem for Gaussian channels. We conceptualize the process of hiding secret messages as transmitting information through N parallel communication channels, where N corresponds the number of pixels in an image. In this analogy, each pixel operates as an individual communication link, with the secret message functioning as the signal to be hidden and later recovered. The cover image, which embeds the hidden message, serves as noise unknown to the decoder.
We consider simple additive steganography scheme: 8; x, + Ym, for 1,2, ...,, where N = H x W x 3 is the image dimension. m, = 1[ indicates the i-th message to be embedded, % its corresponding power, I; and s; represent the i-th element of the cover and steganographic images respectively. We assume power constraint /' that restricts the deviation between the cover and steganographic images: [ x,)2 P.
This formulation is similar to the waterfilling solution for N parallel Gaussian channels (Cover 1999)), where the objective is to distribute the total power among the N channels so as to maximize the capacity C, which is maximum rate at which information can be reliably transmitted
7

---

over channel, defined as: C C=E:= log (1+ 2いt where of is the variance of 24. The problem can be formulated as a constrained optimization problem, where the optimal power allocation is given where (z)+ max(z, 0) and À chosen satisfy the power constraint.
by 7,- [ of
We calculate {o?] [o?] using batch of images, and find the optimized {1t i=1 approach described above. We plot the 's for each color channel in Fig.
using the
Nol Uharnd Matert
Suen Churnd Wabe
#1 Charee Woord
27
25
03
250
250
750
Figure 4: Power coefficients 7/3 for each color channel, calculated using batch of 500 Robin images.
We observe a degree of similarity when comparing with Fig. 3 (bottom). To quantitatively assess this resemblance across color channels, we quantize the three matrices by setting values greater than 0.5 and values less than 0.5 to For each channel, the similarity is calculated using the
equation E., 1(W(() ((())
where w(() and R are the (i.j)-th pixels of the quantized waterfilling and residual matrices, respectively. for the channel k. The computed similarity scores are 81.8% % for red, 65.5% for green, and 74.9% for blue, revealing varying degrees of resemblance with the waterfilling strategy across the color channels. The variation underscores that the waterfilling strategy implemented more effectively in some channels than in others.
256x256
4.3 Impact of cover selection
natural question becomes: what is the cover selection optimization doing? We plot the variance maps of the optimized cover images in Fig. 5
Weaichene ol Seriane
ExerO Uiawedd Wriees
Maat Lhunnel Vy
100
24
253
250
750
Figure 5: Normalized pixel variances batch of 500 Robin images for each color channel, after optimization.
We notice that the number of low variance spots significantly increased as compared to Fig. 3 (top). meaning that the encoder has more freedom encoding the secret message. Quantitatively. we find that 92.4% % of the identified high-message positions are encoded in low-variance pixels, as compared to 81.6% before optimization. Given that the encoder preferentially embeds data in these low variance areas, this increase provides greater flexibility for data embedding, thereby explaining the performance gains observed our framework.
5 Practical settings
In this section, we adapt our framework for practical considerations. We evaluate its performance across different payloads (Section 5.1) adapt for JPEG compression (Section 5.2), and confirm
security against steganalysis (Section 5.3). Computational times are detailed in Appendix [ We use
two datasets, CelebA-HQ (Karras al. (017)) and AFHQ-Dog (Choi al. (2020). ) using the same
settings described in Section! 3.3

---

Table Performance comparison across AFHQ- and CelebA-HQ across various payloads. We observe that the error rates of DDIM-optimized images are significantly lower than original images.
Error Rate (%)
BRISQUE
SSIM
PSNR T
Payload
Original
DDIM
Original
DDIM
Original
DDIM
Original
DDIM
CelebAA 110
bpp
1.5--05
0.94
bpp
2.3E-03
9E-04
9.7
0.92
31.82
32.46
bpp
0.011
0.002
9.95
9.83
0.87
32.16
33.88
hpp
0.081
0.019
11.91
11.04
0.81
0.83
30.91
32.46
AFHQ Dog
hpp
8F.05
0.00
12.14
12.11
0.94
0.93
36.84
36.87
hpp
8E-04
6.8F-00
4.12
7.19
0.93
0.94
35.1
34.4
bpp
0.007
0.002
10.34
6.87
0.86
0.85
32.5
32.6
bpp 0.11
0.09
13.49
13.42
0.75
0.76
28.97
28.99
5.1 Payload impact on performance
We explore different payload capacities B, highlighted in Table 2
We show the results for B = 1, 2, 3, 4 bits per pixel (bpp). DDIM-optimized images show error rates significantly lower than originals, with image quality metries like BRISQUE, SSIM, and PSNR largely preserved, though some quality decline was noted at lower bpp levels in CelebA-HQ and AFHQ-Dog We include sample generared cover images generated using the DDIM framework in Appendix E Despite experi- menting with various regularization techniques aimed at maintaining image quality, no noticeable improvement observed (Appendix C). Considering this, extending our framework explore novel regularization techniques for such payload capacities is an interesting future direction. We also provide example cover and steganographie images generated by the LISO framework under different payload values in Appendix
5.2 JPEG compression
Robustness against lossy image compression is crucial for steganography. We extend our framework to accommodate JPEG compression (Wallace [199T].. FollowingAAthalye et al. (2018). we implement an approximate JPEG layer where the forward pass executes standard JPEG compression, while the backward pass operates as an identity function. Once the encoder-decoder pair is trained, we generate JPEG-compliant cover image following the framework described in Section 3.1 augmented by adding a JPEG layer post-encoding. In Table 3 we demonstrate that our framework achieves improved error rates for B 1 bpp, thereby validating approach's capability to optimize cover images under JPEG compression constraints. In addition, we show robustness results to Gaussian
noise in Appendix K
Table 4: Steganalysis results AFHQ-
Error Rate (%) I
XuNet Det. (%)
Payload B
Table 3: JPEG results for B hpp.
Original
DDIM
Original
DDIM
Eiror Rate 1
PSNR
Socnario 2 Secnario I
hpp
81-05
0.00
37.1
37.5
Dataset
Original
DDIM
Original
DDIM
hpp
81.04
6.8E-05
31.34
15.42
CelcbA-HQ
0.12
0.06
21.09
21.53
bpp
0.007
0.002
20.39
34.82
AFHQ-Dog
0.15
0.11
19.34
19.63
bpp
0.11
0.09
97.37
97.35
bpp
0.0026
2E-05
0.0
0.0
bpp
0.0024
1E-04
0.0
0.0
bpp
0.01
0.003
3.2
2.1
hpp
0.23
0.22
9.2
5.3 Steganalysis
Steganalysis systems designed detect whether there is hidden information within images. As these tools evolve, neural steganography techniques now integrate these systems into their end-to-end pipelines to create images that can bypass detection (Chen et al.) [2022]. [Shang on on the AFHQ-Dos dataset. Following the approach in Chen et al. [2022), we evaluate the security of our optimized images by measuring the detection rate using the steganalysis tool XuNet (Xu et al. (0166) and also record message recovery error rates. The image quality metrics, such as BRISQUE, SSIM. and PSNR, are comparable to those listed in Table 2 and have therefore been omitted for brevity. We explore two different scenarios:
[2020)) We show
our results in Table

---

Scenario 1:
In this scenario, the experimental setup remains the same as described in Section 3.1 and illustrated in Fig. 2 The steganographic encoder-decoder pair trained without regularizers to evade steganalysis detection. The DDIM-optimize images exhibit comparable detection rates at payloads of and B 4, superior performance B 2, and inferior performance at = 3, all while achieving significantly lower error rates. While it is puzzling that detection rates do not consistently decrease with lower payload size, this phenomenon also observed in LISO Chen et al. 2022]. on which our framework is built. We provide more detailed discussion in Appendix
We leverage the differentiability of XuNet as described Chen al. 2022 During the optimization of the steganographic encoder-decoder pair, we introduce an additional loss term to account for steganalysis. This adjustment leads notable reduction in detection rates across all payload sizes, while maintaining consistently low error rates for both original and DDIM-optimizz images. Notably, DDIM-optimized images exhibit even lower detection and error rates compared to the original images, demonstrating superior performance.
Scenario 2:
Further implementation details, along with results using an alternative steganalysis method, SRNet (Boroumand et al. (2018), are provided in Appendix
Conclusion
We propose novel cover selection framework for steganography leveraging pretrained generative models. We demonstrate that by carefully optimizing the latent space of these models, we generate steganographic images that exhibit high visual quality and embedding capacity. Additionally, our information-thhoreee analysis shows that message hiding predominantly occurs in low-variance pixels, reflecting the waterfilling algorithm's 's approach to parallel Gaussian channels. Our framework is versatile, allowing for the incorporation of further constraints to produce JPEG-resistant stegano- graphic images or evade detection by particular steganalysis systems. For future work, we aim to expand our analysis (Section 4.2p to draw similarities with correlated Gaussian channels, moving beyond the independent channels considered in this work.
Acknowledgments
This work was partly supported by ARO Award W91 W91 ONR Award N000142412542. and the 6G@UT center within the Wireless Networking and Communications Group (WNCG) at the University of Texas at Austin.
References
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give false sense of security: Circumventing defenses to adversarial examples. In International conference on machine learning, pages 274-283. PMLR, 2018
Omri Avrahami, Dani Lischinski, and Ohad Fried. Blended diffusion for text-driven editing of natural images. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 18208-18218, 2022.
Shumeet Baluja. Hiding images in plain sight: Deep steganography. Advances in neural information processing systems, 30, 2017.
Ifra Bilal, Rajiv Kumar, Mahendra Singh Roj, and PK Mishra. Recent advancement audio steganography. In 2014 International Conference on Parallel, Distributed and Grid Computing, pages 402-405. IEEE, 2014.
Mehdi Boroumand, Mo Chen, and Jessica Fridrich. Deep residual network for steganalysis of digital images. IEEE Transactions on Information Forensics and Security, 1815)11 2018.
Andrew Brock, Jeff Donahue, and Karen Simonyan. Large scale gan training for high fidelity natural image synthesis. In International Conference Learning Representations, 2018.
10

---

Tim Brooks, Aleksander Holynski, and Alexei A Efros. Instructpix2pix: Learning to follow image editing instructions. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 18392-18402, 2023.
Tu Bui, Shruti Agarwal, Ning Yu, and John Collomosse. Rosteals: Robust steganography using autoencoder latent space. In Proceedings of the IEEE/CVF Conference on Computer Vision and Patter Recognition, pages 933 33-992,,7 2023.
Abbas Cheddad, Joan Condell, Kevin Curran, and Paul Mc Kevitt. Digital image steganography: Survey and analysis of current methods. Signal processing, 90(3y:727-752, 2010.
Xiangyu Chen, Varsha Kishore, and Kilian Q Weinberger. Learning iterative neural optimizers for image steganography. In The Eleventh International Conference on Learning Representations,
2022.
Yunjey Choi, Youngjung Uh, Jaejun Yoo, and Woo Ha. Stargan v2: Diverse image synthesis for multiple domains. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 8188-8197, 2020.
Thomas M Cover. Elements of information theory. John Wiley Sons, 1999.
Ingemar Cox, Matthew Miller, Jeffrey Bloom, Jessica Fridrich, and Ton Kalker. Digital watermarking and steganography. Morgan kaufmann, 2007.
Ingemar Cox, Matthew L Miller, and Andrew L McKellips. Watermarking as communications with side information. Proceedings of the IEEE, 87(7):1127-114) 1999.
Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans image synthesis. Advances in neural information processing systems, 34:8780-8794, 2021.
Oleg Evsutin, Anna Kokurina, and Roman Meshcheryakov. Approach to the selection of the best cover image for information embedding in jpeg images based on the principles of the optimality. Journal of Decision Systems, 27(uup ):256-2266 2018.
Jessica Fridrich, Miroslav Goljan, and Rui Du. Detecting lsb steganography in color, and gray-scale images. IEEE multimedia, 8(4):22-28 28, 2001.
Oran Gafni, Adam Polyak, Oron Ashual, Shelly Sheynin, Devi Parikh, and Yaniv Taigman. Make- a-scene: Scene-based text-to-image generation with human priors. In European Conference Computer Vision, pages 89-106. Springer, 2022.
Leon A Gatys, Alexander S Ecker, and Matthias Bethge. A neural algorithm of artistic style. arXiv preprint arXiv:1508.08 06576, 2015.
Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial networks. Communications of the ACM, 63(11):139-144 2020.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840-6851, 2020.
Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of gans for improved quality, stability, and variation. arXiv preprint 17Xivv/710.101900 2017.
Mchdi Kharrazi, Husrev T Sencar, and Nasir Memon. Cover selection for steganographic embedding. In 2006 International Conference on Image Processing, pages 117-120. IEBE, 2006.
Gwanghyun Kim, Taesung Kwon, and Jong Chul Ye. Diffusionclip: Text-guided diffusion models for robust image manipulation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 2426-2435, 2022.
Varsha Kishore, Xiangyu Chen, Yan Wang, Boyi Li, and Kilian Q Weinberger. Fixed neural network steganography: Train the images, not the network. In International Conference on Learning Representations, 2021.

---

Anish Mittal, Anush Krishna Moorthy, and Alan Conrad Bovik. No-reference image quality as- sessment in the spatial domain. IEEE Transactions on image processing, (((1)):469547000 2012.
Pierre Moulin and Joseph A O'Sullivan. Informmation-theoreiic analysis of information hiding. IEEE Transactions on information theory, 49(3):563-593,, 2003.
Pierre Moulin, Mehmet Kivanç Mihcak, and Gen-Iu Lin. An iotoommmtiionthhorree model for image watermarking and data hiding. In Proceedings 2000 International Conference on Image Processing (Cat. No. 00CH37101), volume 3, pages 667-670. IEEE, 2000.
Pietro Perona and Jitendra Malik. Scale-space and edge detection using anisotropic diffusion. IEEE Transactions pullern analysis and machine intelligence, 12(7):629-639 1990.
Jiaohua Qin, Yuanjing Luo, Xuyu Xiang, Yun Tan, and Huajun Huang. Coverless image steganogra- phy: a survey. IEEE access, 7:17 7:171372-171394 2019.
Leonid Rudin, Stanley Osher, and Emad Fatemi. Nonlinear total variation based noise removal algorithms. Physica D: nonlinear phenomena, 60(1-4):259 2688,,9266611 1992.
Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma. Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet large scale visual recognition challenge. International journal of computer vision, 115:211-2533 2015.
Yueyun Shang, Shunzhi Jiang, Dengpan Ye, and Jiaqing Huang. Enhancing the security of deep learning steganography via adversarial examples. Mathematics, 8(9):1446, 2020.
Yujun Shen, Jinjin Gu, Xiaoou Tang, and Bolei Zhou. Interpreting the latent space of gans for semantic face editing. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 9243-9252, 2020.
Haichao Shi, Jing Dong, Wei Wang, Yinlong Qian, and Xiaoyu Zhang. Ssgan: Secure steganography based generative adversarial networks. In Advances in Multimedia Information Processing- PCM 2017: 18th Pacific-Rim Conference on Multimedia, Harbin, China, September 28-29, 2017, Revised Selected Papers, Part I 18, pages 534 544. Springer, 2018
Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In Interna- tional Conference on Learning Representations, 2020.
Yeshwanth Srinivasan, Brian Nutter, Sunanda Mitra, Benny Phillips, and Daron Ferris. Secure transmission of medical records using high capacity steganography. In Proceedings. 17th IEEE Symposium on Computer-Bant Based Medical Systems, pages 122-127. IEEE, 2004.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv: 2013.
Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical pho- tographs. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pages 2117-2126, 2020.
Gregory K Wallace. The jpeg still picture compression standard. Communications of the ACM, 34(4): 30-44. 44, 1991.
Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Fero P Simoncelli. Image quality assessment: from eтror visibility structural similarity. IEEE transactions on image processing, 13(4):600-612. 2004.
Zichi Wang and Xinpeng Zhang. Secure cover selection for steganography. IEEE Access, 7:57857- 57867, 2019.
Weihao Xia, Yulun Zhang, Yujiu Yang, Jing-Hao Xue, Bolei Zhou, and Ming-Hsuan Yang. Gan inversion: survey. IEEE transactions on puttern analysis and machine intelligence, 45(3): 3121-3138, 2022.
12

---

Guanshuo Xu, Han Zhou Wu, and Yun Qing Shi. Structural design of convolutional neural networks for steganalysis. IEEE Signal Processing Letters, 23 2016.
Farzin Yaghmaee and Mansour Jamzad. Estimating watermarking capacity gray scale images based on image complexity. EURASIP Journal Advances in Signal Processing, 2010:1-9, 2010,
Jiwen Yu, Xuanyu Zhang, Youmin Xu, and Jian Zhang. Cross: Diffusion model makes controllable, robust and secure image steganography. Advances in Neural Informaion Processing Systems, 36, 2024.
Kevin Alex Zhang, Alfredo Cuesta- Infaate, Lei Xu, and Kalyan Veeramachaneni. Steganogan: High capacity image steganography with gans, arXiv preprint arXiv:1901.03892 2019.
Zhili Zhou, Huiyu Sun, Rohan Harit, Xianyi Chen, and Xingming Sun. Coverless image steganog- raphy without embedding. Cloud Computing and Security: First International Conference, ICCCS 2015, Nanjing, China, August 13-15, 2015. Revised Selected Papers I, pages 123-132. Springer, 2015.
13

---

A Learned Iterative Steganography Optimization (LISO)
LISO (Chen et al. 2022 advances the method established in Kishore al. 202 which is centered around Optimization-brn based Image Steganography. Leveraging differentiable decoder equipped with either randomly initialized pretrained weights (as referenced in the preceding paragraph), Kishore itt al. [021] formulates the steganography encoding as an optimization task for each sample. This approach is similar the generation of adversarial perturbations discussed Szegedy et al. [2013) Specifically, the technique described in Kishore et al. [222]] seeks to compute a steganographic image by addressing a constrained optimization problem that ensures the perturbed image remains within the bounds of the [0, 1] 1|"> W x hypercube.
min 8E(0.1| #xxxx
Laae (Dec(s), m) + Auyuass, x)
(5)
where
Lucel ( m) == (m, log m) + ((1 - m), log(1 - -m)
(6)
1
-|x Lqua (s. x) == N
where represents the secret message, m is the decoded message, is the cover image, and the steganographic image. The operation (-) signifies the dot product, À is a scaling factor, and N H W x represents the total number of pixels in the image, with H and W being the height and width of the image, respectively. The accuracy loss, Lnce(m, m, m), is calculated using binary cross entropy minimize the distance between the estimated and actual messages, while the quality loss, (s, employs mean squared eπror to ensure the steganographic image closely resembles the cover image. This objective function is represented f(x, m). To solve the optimization problem outlined above, various solvers can be utilized and as shown in Algorithm 1, with iterative, gradient- based algorithms.
Algorithm 1, 7 > the step size, and g(-) describes the update function specific to the optimization method used. The perturbation 5 is iteratively adjusted to minimize the loss é while adhering the pixel constraints of the image.
Algorithm 1 Iterative Optimization
1: 6n + 0
to T do 3: 8, +- 61-1 + (Vol(x ()),,
2: for
4: end for
5: + ôT
In LISO, The function g(-) in Algorithm is approximated using fully convolutional network designed around a gated recurrent unit (GRU). The complete LISO framework, which includes the iterative encoder, decoder, and critic, undergoes end-to-end training diverse image dataset. Similar to the training process of Generative Adversarial Networks (GANs), the training of LISO alternates between optimizing the critic and the encoder-decoder networks. Throughout this training phase, losses for all intermediate updates are calculated with exponentially increasing weights (n T' step 1). With intermediate predictions denoted m......; Dr the loss is:
T
Lurin Σ 1 T-I
[ (m, m,) + AL (x, (x, 8t) + pobeiit (x, St)],
1=1
where 7 E 1) is a decay factor and Lun denotes the critic loss to generate real-looking images (with weight > 0).
B Training details
B.1
GAN-based cover selection
In our GAN-based cover selection method, we utilize the BigGAN generator (Brock et al. (2088) and a LISO encoder-decoder pair (Chen et al. (2022). both pretrained the ImageNet dataset
14

---

(Russakovsky et al. (005]). Specifically, the BigGAN generator receives latent vector 128- dimensional vector initialized from truncated normal distribution with truncation set at 0.4, and class index c. It then produces the cover image x E [0, 1 x3 'he LISO encoder processes along with the secret message m E {0. 1) HxWx x create the steganographie image s, while the LISO decoder attempts to recover m from s. We consider a payload B 4. To optimize the latent vector z, we minimize the binary cross-entropy loss BC (m, r using the Adam optimizer with learning rate of 0.01 over 100 epochs. Both the GAN generator and the LISO encoder-decoder are configured with the same architecture and parameters as described in their respective original publications.
To replicate the results presented in Table we optimize a batch of 500 latent vectors (2(*) 500 ===1 for each class. These vectors are randomly initialized and subsequently optimized. We then report several metries: the average eтror rate between the original message m and the estimated message m, the average BRISQUE scores of the cover images to assess their naturalness, and both the SSIM (Structural Similarity Index) and PSNR (Peak Signal-to-Noise Ratio) values to evaluate the similarity and quality between the cover and steganographic image pairs.
B.2 DDIM-based cover selection
In our cover selection method based on Denoising Diffusion Implicit Models (DDIM), we employ three DDIM models alongside LISO encoder-decoder pairs, each pretrained on different datasets: ImageNet (Russakovsky al. (213]), AFHQ-Dog (Choi al. (2020)), and CelebA-HQ (Karras ct al. [2017]).
we initiate the process by sampling random image Xp. We then execute the deterministic forward DDIM process over T steps, with each step defined as follows:
Following the procedure outlined in Section 3.1
X++1 Vol-1ff 11- xx+1co(x;,
8
After obtaining the latent representation Xy, initiate the stochastic reverse DDIM process, which spans E epochs. Within each epoch, we perform the reverse DDIM process on the acquired latent for N iterations. Each iteration proceeds follows:
X vāl-if V āc-1 ofea(xi,t) off
Where Eg a pretrained network, fe a function of cg. of = 10.5 ((1
Br
1- - I I-as
and
(O.
We configure our model with the following parameters: = 50 epochs, T = 40 time steps, and N iterations per epoch. For optimization,
employ the Adam optimizer with learning rate of 2F 06. The variance schedule that determines on and (;,1, as well as the DDIM architectures, are consistent with those described in Kim et al. 2022)
C Regularization effect
Despite testing several regularization methods intended preserve image quality-including total variation (Rudin et al. ),92), edge preservation (Perona and Malik (190)), feature matching with pre-trained VGG network (Gttys et al. (2015)), and a classic I distance between the original and updated cover images we observed no significant enhancements. These results are shown in Table
D Encoding operation analysis: additional results
In this section, we further describe the encoder's strategy of embedding messages in regions with low pixel variance, described in Section 4.1
15

---

Table Performance results with regularization on CelebA-HQ with a payload 2 bpp. We show the resuls for edge preservation (EP), I distance between original and updated cover images (11), total variation (TV), and VGG feature matching (VGG).
Error Rate (%)
BRISQUE,
SSIM
PSNR1
Method
Original
DDIM
Original
DDIM
Original
DDIM
Original
DDIM
EP
2E-03
7E-04
11.62
13.25
25.57
25.65
0.85
0.85
4 2E-03
1E-03
11.94
13.45
25.65
25.7
0.85
0.85
TV
2E-03
7E-04
11.58
13.43
25.48
25.57
0.85
0.85
VGG
2.1E-03
7.5E-04
11.32
13.65
25.59
25.65
0.85
0.85
We calculate the variance for each pixel position across a batch of 500 images, separately for each of the three color channels. This results in three variance maps, each of shape 256x256 (corresponding to the dimensions of the images). These variance maps are normalized to a range between and to facilitate subsequent analysis.
present variance and residual maps three additional ImageNet classes: Daisy (Fig. 6). Yellow Lady's Slipper (Fig. 7 and American Egret (Fig. (). These visualizations validate that the encoder predominantly conceals messages within areas low variance. Further analysis includes the CelebA- HQ dataset with payload of B the encoder distinctly favors low variance pixels for message concealment. Intriguingly. in the Green channel, regions such the eyes, nose, and mouth preferred for embedding messages. Investigating the underlying reasons for this selective use is an interesting open problem.
bpp. illustrated in Fig. [ Notably, in the Blue channel,
Redi Crannel Varfance
Green Channel
Blue Channel Vartance
130
121
250
150
150
205
Channel Residual
Grezn Channei dual
uu Channcl Residual
385
250
Figure 6: Normalized pixel variances (top) and residuals (bottom) across a batch of 500 images for the ImageNet Daisy class.
16

---

Crannel Variance
Green Channel
Blue Channel Variance
249
316
Residual
Grean Channel dual
Channel Residual
280
150
150
Figure 7: Normalized pixel variances (top) and residuals (bottom) across a batch of 500 images for the ImageNet Yellow Lady's Slipper class.
Red Channel Verience
Green Channel Veriance
Blue Charnel Verience
332
150
150-
201
Channel Residual
Green Chonnel Res dual
Bue Channel Residual
250
200
Figure 8: Normalized pixel variances (top) and residuals (bottom) across a batch of 500 images for the ImageNet American Egret class.
17

---

Variance
Green Channel
Charnel Varlance
30
Residual
Grean Channel dual
Channel Residual
300
Figure 9: Normalized pixel variances (top) and residuals (bottom) across a batch of 500 images for the CelehA-HQ dataset.
E DDIM sample cover images
In this section, we present optimized cover images generated by our DDIM cover selection framework. Samples from both the CelebA-HO and AFHQ-Dog datasets are displayed, showcasing variations for different payload capacities with B 1, 3, 4 bits per pixel (bpp).
Original
Optimized (1 bpp) Optimized (2 bpp) Optimized (3 bpp) Optimized (4 bpp)
p ac
ace
P
Cace
P
aace
P
ace
Figure 10: Generated DDIM cover images for different message payload values.
18

---

Sample steganographic images
In this section, we present a selection of randomly sampled cover images from CelebA-HQ and
AFHQ alongside their steganographic counterparts generated using the LISO framework (Chen et al. (0222). The results are demonstrated for various payload capacities, ranging from B to 4 bits pixel (bpp).
Cover image
bpp
bpp
3 bpp
4 bpp
Figure 11: Covers and their corresponding steganographic images.
G
Sample steganographic images: DDIM vs GAN
compare the outputs both methods, presenting sample steganographic images before and after optimization in Fig 12 for payload B 4 bits per pixel. DDIM conserves the semantic essence of images, maintaining critical aspects such as the positions and orientations of objects for instance, bird's gaze remains consistent. In contrast, GANs can substantially alter image's structure, potentially changing a bird's gaze direction, thus affecting its semantic meaning.
H Image complexity metrics
In this section, we explore the intriguing observation that optimizing for error rate not only preserves image quality but, in some instances, even enhances it. This occurs despite the fact that our primary focus is not directly on image quality optimization.
We assess various complexity metrics-entropee entropy, edge density, compression ratio, and color diver- sity across dataset of 500 images from the AFHQ-Dog collection, each embedded with a payload of B bits pixel. Our analysis investigates how these metrics correlate with the message emror rate, as depicted in Figure [3 Furthermore, we investigate the relationship between these complexity metrics and the BRISQUE image quality score, shown in Figure [4
19

---

DDIM-opuimize steganographic image
GAN-optimized steganographic image
Steganographic image
Cover image
Figure 12: Generated steganographic images: GAN vs DDIM.
The entropy of an image measures the randomness of intensity values and is calculated as -Ee P; log, Pt, where p; is the probability of occurrence of the jth intensity value, calculated over a batch images. The probabilities C, where the grayscale conversion simplifies the entropy calculation by focusing on the luminance information while discarding color details.
determined from the grayscale version of each image
The edge density of an image measures the proportion of pixels that are part of edges the total number of pixels in the image. This is typically calculated by first applying an edge detection algorithm, such as the Sobel or Canny operator, to identify edge pixels. The edge density is then quantified as N. where ne is the number of edge pixels identified, and N is the total number of pixels in the image.
The compression ratio of an image is a measure of the efficiency of a compression algorithm, defined as the ratio of the original file size to the compressed file size. Mathematically, it can be expressed as Suviginal
Scompressed where Sorigsnal is the original file size in bytes, and Scomprezsed is the size of the file after compression. A higher compression ratio indicates more effective compression, reducing storage and transmission resource requirements.
The color diversity in an image refers to the variety and distribution of colors present within the image. It can be quantified by analyzing the image's 's color histogram, which represents the frequency of each color in the image. Color diversity is often measured using metrics such as the number of distinct colors, the evenness of their distribution. A common approach is calculate the Shannon diversity index, expressed as Σ p(c.) loga p(G),, where p(c;) denotes the proportion pixels of color and & is the total number of unique colors in the histogram. High color diversity indicates a rich variety of colors, which typically contributes to the visual complexity and aesthetic quality of the image.
20

---

0.2
135
020
0.3
0.18
018
630
20
006
Me
(a) Entropy
(b) Edge Detection Density
2000
(c) Compression Ratio
(d) Color Diversity
Figure 13: Image complexity metrics error rate
6.30
175
132
Entropy
(b) Edge Detection Density
1233
ERGGUE
(c) Compression Ratio
(d) Color Diversity
Figure 14: Image complexity metrics BRISQUE
While we do not observe perfect correlation across all metrics, we note consistent trends with certain measures such as entropy and edge density. Specifically, as entropy and edge density increase, both the error rate and BRISQUE scores tend to decrease. We hypothesize that optimizing for error rate influences certain image characteristics, such as entropy and edge density, which are also associated with BRISQUE scores. This relationship may partially explain why we observe improved BRISQUE scores even though our primary focus on minimizing error rate. For the other metrics, namely compression ratio and color diversity, the patterns are not clear.
I Computational time
We show the average time required to optimize images using the DDIM-based cover selection method Table for both the CelebA-HQ and AFHQ-Dog datasets. We calculate computation time by determining the number of DDIM backward sampling steps required to achieve the lowest message recovery error, and then multiplying that number by the average duration of each step. As anticipated, for the -- dataset, the average computation time increases with the payload size. A similar
21

---

trend is observed in the AFHQ-Dog dataset; however, exception occurs at payload of B = 4 bpp. This anomaly can be attributed the fact that, as shown in Table 2 the DDIM-optimized images for this payload do not exhibit significantly lower error rate compared to the original images. All experiments were conducted using NVIDIA A-100 GPU.
Table 6: Average computation time of DDIM-based cover selection (in seconds) for different payload values.
Dataset
bpp
2 bpp
3 bpp
4 bpp
CelebA-HQ
0.69
6.85
11.52
24.83
AFHQ-Dog
0.04
0.91
5.33
0.34
J Steganalysis: detailed settings and additional experiments
We adopt the simulation settings outlined in Chen et al. 2022 for our experiments. In Scenario 1, the steganography model M is trained without specific techniques to avoid detection by steganalysis. We assume the attacker, who performs steganalysis, knows the architecture of M but has access to its weights, training data, or hyperparameters. However, the attacker can train a surrogate model M' to generate their steganographic images. To simulate this scenario, trained a steganalysis model on the CelebA dataset and used it to detect steganographic images generated from the AFHQ- Dog dataset. Interestingly, detection rates did not consistently decrease with lower payload sizes, a phenomenon also noticed in LISO Chen et al. [2022), on which our framework is based. We hypothesize this behavior arises from the distributional mismatch between training and testing data, as discussed earlier. In scenario 2. We leverage the fact that neural steganalysis methods are entirely differentiable, and that LISO uses gradient-
optimization. This allows us reduce security risk
by incorporating an additional loss term from the steganalysis system into the LISO optimization process. Specifically, during evaluation, value of the steganographic class to the loss function.
image identified as steganographic, we add the logit
In addition XuNet (Xu et al. (0166),
compute the steganalysis results of SRNet, another state- of-the-art steganalysis system (Boroumand et al. [2018). The results of both schemes are compared in Table 7 Our observations indicate that the images generated by framework effectively resist steganalysis by SRNet. This is evidenced by the significant drop in detection rate when transitioning from scenario scenario As reminder, in scenario we exploit the differentiability of the steganalyzer (SRNet) and incorporate an additional loss term to account for steganalysis.
Table 7: Steganalysis results with SRNet and XuNet.
SRNet Det. (%)
XuNet Det. (%)
Payload B
Original
DDIM
Original
DDIM
Scenario I
bpp
15
13
37.1
37.5
bpp
14.5
32.5
31.34
15.42
bpp
61.5
55.5
20.39
34.82
Scenario SicarrooSeeeee
bpp
76
76
97.37
97.35
bpp
0.0
0.0
0.0
0.0
bpp
0.0
0.0
0.0
0.0
bpp
0.0
0.0
3.2
2.1
bpp
1
9.2
8.6
K Robustness to Gaussian noise
In this section, we evaluate the robustness of our DDIM-based approach to Gaussian noise. The experimental setup remains the same as described in Section 3. and illustrated in Fig. 2 with the only modification being the injection of Gaussian noise, distributed as (O, 3), into output of the steganographic encoder. The decoder subsequently processes the noisy steganographic image to estimate the embedded message. Results of this experiment are presented in Table g Our findings demonstrate that the proposed framework produces cover images resilient to Gaussian noise,
22

---

Table 8: Robustness Gaussian noise for payload B bpp on CelebA-HO
Error Rate (8)
BRISQUE +
SSIM 1
PSNR
Variance J
Origina
DDIM
Original
DDIM
Original
DDIM
Original
DDIM
0.01
2.2
1.9
12.1
12.8
0.62
0.63
26.85
27.6
0.02
7.1
6.5
15.98
14.33
0.57
0.56
25.75
26.34
0.03
12.3
11.8
15.01
14.38
0.56
0.58
25.73
26.32
achieving lower error rates while preserving high visual quality. This is confirmed by visual quality metrics such as BRISQUE, SSIM, and PSNR, which remain comparable to those of the original images. An intriguing future direction is extend this setup handle perturbations beyond Gaussian noise. One approach could involve pretraining the LISO steganographic encoder-decoder pair under such conditions before applying steganographic frameworks other than LISO, particularly those explicitly designed to handle image perturbations, such as Tancik et al. 2020)
framework. Alternatively. our method could be applied to
and Bui et al. 2023
23

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
The claims made in the introduction and abstract, such advantages in message recovery and image quality, as well as the analogy to the waterfilling algorithm are all described in Sections 3.3
Justification:
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results
be expected to generalize other settings.
It is fine to include aspirational goals as motivation long it is clear that these goals are not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification: We discuss two limitations of our work: 1) we noticed some image quality decline at lower bpp levels in CelebA-HQ and AFHQ-Dog. and discussed some regulariza- tions methods that we tried (Section 5.1 I and Appendix C 2) In the conclusion, we mention that we focused on independent Gaussian channels in Section and that we would like to extend the setup to correlated channels in future work.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model vell-specifiiattin, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested few datasets with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.

---

3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer:
[NA]
Justification:
No theoretical results.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: Yes, we described detailed training procedures in Section and Appendix
Guidelines:
The answer NA means that the paper does not include experiments. If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of model checkpoint, other means that appropriate to the research performed.
also be provided via detailed
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm. (b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (c.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (c.g., to registered users), but it should possible for other researchers to have some path to reproducing verifying the results.
25

---

5. Open access to data and code
Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [No]
Justification: We mention all the datasets and pretrained models that we used. Our code will made public upon acceptance.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.co cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" an acceptable answer. Papers cannot be rejected simply for including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https
//nips //ipsscc/pput pttps//cccclicguuddeeeeeeeeseees guides wwtp/oeeeiiiiiiinnnooooooooo Pollccy for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental Setting/Details
Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Question:
Answer: [Yes]
Justification: Yes, we described all the training details and hyperparameters in Section 3 and Appendix B
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core the paper to a level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [No]
Justification: Error bars were not reported for computational reasons and time constraints.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emoor bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
26

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative еπτог rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: We describe the time required for our method as well as the resources in Appendix !
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https::/neurips..om / http://wwwppppccooooo....cccctaa
Answer: [Yes]
Justification: Our research follows the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: We discuss the main uses of Steganography in Section 1 and the benefits of our cover selection approach under practical settings in Section 5
Guidelines:
The answer NA means that there is no societal impact of the work performed.
27

---

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: Our work doesn't pose such risks.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g.. code, data, models), used in the paper, properly credited and the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification:
Yes, we cite all the existing assets throughout the paper.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URI.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
28

---

If assets are released, the license, copyright information, and terms of use in the thcode. has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
package should be provided. For popular datasets, paperswi
batasets.papersstt
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is available online, the authors encouraged to reach out the asset's s creators.
13. New Assets
Question: Are assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: Yes, deseribe our algorithm in Section and Appendix Our code will be released upon acceptance.
Guidelines:
The answer NA means that the paper does not release assets.
Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: Our work didn't involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: our work does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
29

---

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
30


Reviews:
[{"review_id": "xGsQoHdK0i", "reviewer": "Reviewer_kQa7", "summary": "This paper presents a novel framework for cover selection in image steganography to enhance the message recovery performance, which optimizes the latent code. The effectiveness of this approach is validated through intensive experiments. Additionally, the paper empirically analyzes intriguing behaviors occurring during the message hiding process inside the message encoder.", "questions": "* Why the authors do not compare with others steganography frameworks such as StegaStamp [1], RoSteALS [2], UDH [3], or StegaStyleGAN [4]\n* Can the authors show more qualitative results between the original and encoded images? Is there any effect of the optimization on the orignal images?\n* Can the authors explain why the percentages of the identified high-message positions are encoded in low-variance pixels will affect the flexibility for data embedding ? \n \n[1] Tancik, Matthew, Ben Mildenhall, and Ren Ng. \"Stegastamp: Invisible hyperlinks in physical photographs.\" Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2020. \\\n[2] Bui, Tu, et al. \"Rosteals: Robust steganography using autoencoder latent space.\" Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2023. \\\n[3] Zhang, Chaoning, et al. \"Udh: Universal deep hiding for steganography, watermarking, and light field messaging.\" Advances in Neural Information Processing Systems 33 (2020): 10223-10234. \\\n[4] Su, Wenkang, Jiangqun Ni, and Yiyan Sun. \"StegaStyleGAN: Towards Generic and Practical Generative Image Steganography.\" Proceedings of the AAAI Conference on Artificial Intelligence. Vol. 38. No. 1. 2024.", "limitations": "The authors adequately addressed the limitations, and broader impact in this paper.", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "* Introducing a novel approach for cover selection in image steganography aimed at minimizing error rates. \n* This straightforward approach optimizes the latent code by minimizing message loss, yet yields promising results.\n* The proposed method is thoroughly validated, demonstrating strong performance across various metrics including message recovery, robustness, and security (steganalysis).", "weaknesses": "* The optimization of latent variables reduces recovery errors but alters the original image content (Fig. 1), making it impractical for real-world use. Additionally, as depicted in Figure 10 (Appendix E), steganographic images may exhibit unnatural visual characteristics, potentially leading to easy detection.\n* While the inclusion of an additional loss term for steganalysis is pivotal for setting 2, the author fails to address this point. Moreover, the results in setting 1 are puzzling: why does detection increase with 1bpp but not with 2bpp, despite the increased payload?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We express our gratitude to the reviewer for their valuable feedback, and we will address each point in detail.\n\n**Weaknesses**:\n\n- **Image alteration:** We acknowledge the concern regarding the alteration of the original image content due to the optimization of latent variables. However, it is important to highlight that such modifications are not only common but also well-founded in the literature.\n\n  **a) Established practice in research:** Our approach of altering the cover image is in line with established practices in the field of cover selection. For example, studies such as [1] and [2] analyzed different cover images and selected the most suitable ones to improve the robustness and accuracy of message extraction. These works provide concrete evidence and justification for the alteration of cover images, demonstrating that such modifications are beneficial for enhancing performance in steganographic applications. \n\n    [1] Farzin Yaghmaee and Mansour Jamzad. Estimating watermarking capacity in gray scale images based on image complexity.  EURASIP Journal on Advances in Signal Processing, 2010:1–9, 2010. \n\n    [2] Zichi Wang and Xinpeng Zhang. Secure cover selection for steganography. IEEE Access, 7:57857– 57867, 2019.\n\n  **b) Preservation of image semantics:** While our algorithm alters the cover image to minimize decoding error, it does not change its meaning or semantics. In semantic communications, these modifications are acceptable as the focus is on accurately transmitting essential information, not preserving the exact original image content.\n\n- **Unnatural visual characteristics (Fig. 10), potentially leading to easy detection**: We want to clarify that the algorithm's detection accuracy remains intact. Table 4 of the manuscript demonstrates that XuNet's detection rate with the AFHQ dataset stays consistent or even decreases after applying our framework, showing that our method does not compromise security performance. \n\n- **Loss term for steganalysis:** Our paper addresses the inclusion of an additional loss term for steganalysis, as outlined in Section 5.3 (lines 304-306). We incorporate the steganalyzer’s logit output into the loss function. Our results in Table 4 show that, when embedding 4 bits per pixel, detection accuracy drops from 97.35% to 8.6% after incorporating the loss, indicating improved resistance to steganalysis. We will clarify this further in the main text.\n\n- **Unexpected decline in detection rate:** Indeed, it is puzzling that detection decreases despite the increased payload. This effect is not related to our introduced method but is inherent to the LISO framework on which our method is based. As shown in Table 5 of the LISO manuscript [1], they also observe this unexpected behavior where the detection rates do not increase consistently with higher payloads. This phenomenon is not fully understood. \n\n  We chose to use LISO because it is a state-of-the-art steganographic framework. However, we recognize that this reliance on LISO also means inheriting some of its unexplained behaviors. Future work could explore approaches combining LISO with other frameworks or develop novel techniques to address detection rate inconsistencies with different payloads. We will highlight this in our paper and acknowledge the need for further research to understand and improve the framework. \n\n  [1] Xiangyu Chen, Varsha Kishore, and Kilian Q Weinberger. “Learning iterative neural optimizers for image steganography.” In International Conference on Learning Representations, 2023.\n\n**Questions:**\n\n- **Comparisons to other schemes:** While related, the mentioned frameworks are designed for different settings than those we used. The approaches in [1, 2] involve networks that learn algorithms **robust to image perturbations** between the encoder and decoder, whereas our settings assume **no such perturbations**. In [3], the focus is on hiding secret **images** within cover images, unlike our method, which hides secret **binary messages**. Lastly, [4] deals with coverless steganography, mapping secret messages to latent vectors for a generative adversarial network, which then generates **random cover images**. In contrast, our settings involve embedding secret messages into **given cover images** using a dedicated encoder.\n\n- **Additional qualitative results:** We have included additional qualitative results comparing the original and encoded images in Fig. 1 of the supplementary material.\n\n- **Effect on optimized images:**\n  1. **Relationship with Image Complexity Metrics:** We would like to refer the reviewer to Fig. 12 of Appendix G, where we conducted extensive simulations to answer this important question. In our experiments on the AFHQ dataset, we analyzed the relationship between the decoding error and various image complexity metrics: entropy, edge density, compression ratio, and color diversity. Our results show a negative correlation between the decoding error and the first three metrics, and a positive correlation with color diversity. We conjecture that optimizing for decoding error is affecting these image complexity metrics. While these findings are encouraging, more research is needed to fully understand the effects of optimization on the original images.\n\n  2. **Increase in Low-Variance Pixels:** As discussed in Section 4.3 of the main text, the optimization process increases the number of low-variance pixels in the images from 81.6% to 92.4%. This is related to our discussion about the algorithm hiding data in low-variance spots. When the number of low-variance pixels increases, the encoder has more flexibility and options for data hiding, resulting in better performance.\n\n   We will include more details of this discussion in the manuscript to highlight the need for further investigation.\n\n- **Clarification, encoding in low-variance pixels:** We would like to refer the reviewer to part (3) of the global response. We hope this description addresses the question.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "FjMC4OkyEG", "reviewer": "Reviewer_XM9B", "summary": "This paper introduces an innovative cover selection framework that optimizes within the latent space of pretrained generative models to identify the most suitable cover images, distinguishing it from traditional exhaustive search methods. This approach offers significant advantages in both message recovery and image quality. Furthermore, the paper presents an information-theoretic analysis of the generated cover images, revealing that message hiding predominantly occurs in low-variance pixels, consistent with the waterfilling algorithm principles in parallel Gaussian channels. Extensive experiments validate the superior performance of this framework.", "questions": "1.You mentioned a JPEG layer in section 5.2, and I suggest that you add a brief description of this JPEG layer in your paper.\n2.In Figure 11 of Appendix F, I observe that the subgraphs in the third row and third column are fuzzier than the other subgraphs in the third row. What do you think is the reason for this?\n3.You selected the BigGAN network and DDIM network (Kim et al. 2022) in the experimental part of the paper. What are the advantages of these two networks?\n4.What is the role of weight initialization in Figure 2?\n5.In the introduction, I did not find this article in the references (Evsution et al. 2018), please check your references carefully.", "limitations": "The author has proposed an improved algorithm to address the limitations of current steganography methods, which has partially alleviated these constraints. It is recommended that in future work, the author focuses on enhancing image quality without compromising the algorithm's security performance.", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1.This paper describes the limitations of current cover selection methods and introduces a novel, optimization-driven framework that combines pretrained generative models with steganographic encoder-decoder pairs.\n2.The results demonstrate that the error rates of the optimized images are an order of magnitude lower than those of the original images under specific conditions. Impressively, this optimization not only reduces error rates but also enhances the overall image quality, as evidenced by established visual quality metrics.\n3.This paper investigates the workings of the neural encoder and finds it hides messages within low variance pixels, akin to the water-filling algorithm in parallel Gaussian channels. In addition, the authors observe that this selection framework increases these low variance spots, thus improving message concealment.", "weaknesses": "We observed that the quality of the images used in the experimental section of the paper was generally not high, whether original or algorithmically generated. This may be due to the limitations of the dataset itself. Therefore, future experiments with high-quality images are necessary to further verify the effectiveness of this framework.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We appreciate the reviewer's recognition of our work, including (a) identifying limitations of existing cover selection methods, (b) integrating pretrained generative models with steganographic encoder-decoder pairs, and (c) demonstrating that our neural encoder hides messages within low variance pixels, similar to the water-filling algorithm. Our approach yields lower error rates and enhanced image quality, confirmed by visual metrics, and increases low variance pixels, further improving message concealment.\n\nWe would like to provide pointers to the experiments and key results in the manuscript and appendix that we strongly believe address the main weaknesses and limitations identified in the review. \n\n1. **Experiments with high-quality images:** We agree that this is an important aspect and would like to emphasize that we conducted extensive experiments using high-quality images from the CelebA-HQ dataset at 1024x1024 resolution and Animal Faces-HQ (AFHQ) dataset at 512x512 resolution. The qualitative results can be found in Fig. 10 of the appendix, with additional results shown in Fig. 1 and Fig. 2 of the supplementary material. These figures illustrate the high quality of the CelebA-HQ and AFHQ images. The effectiveness of our framework is further validated by the metrics presented in Table 2 of the main text, including Error Rate, BRISQUE, PSNR, and SSIM. These results indicate that we achieve similar improvements compared to the baselines for both high-quality and low-quality images. \n\n2. **Enhancing image quality without compromising the algorithm's security performance**: We would like to clarify that the algorithm's security performance is not compromised. As shown in Table 4 of the manuscript, XuNet's detection rate using the AFHQ dataset (high-quality 512x512 images) remains similar, if not lower, before and after applying our framework, indicating that our approach maintains security performance. Additionally, the high quality of our AFHQ images is validated in Table 2, measured by metrics such as BRISQUE, SSIM, and PSNR.\n\nPerhaps these setups were not clear, and we will clarify them in the revised manuscript. We kindly ask the reviewer to consider these results in their review. \n\nWe provide answers to the questions and suggestions below. \n\n1. **JPEG layer description:** Thanks for the suggestion. We agree that a brief description of the JPEG layer in Section 5.2 will enhance the clarity of our paper. We will include this in the revised manuscript. \n\n2. **Fig. 11 third row third column fuzziness:** The subgraph in the third row and third column does appear fuzzier than the others. This issue is an outlier and has not been observed in CelebA-HQ, AFHQ, or other ImageNet classes. It arises due to the LISO framework, on which our method is built. LISO is the state-of-the-art steganographic encoder-decoder, which is why we chose to build our method on it. However, training LISO on ImageNet is challenging because of the vast number of classes. To address this, we fine-tuned LISO using additional owl images obtained through data augmentation techniques such as rotation and flipping, and achieved a slightly better-quality image, as shown in Fig. 3 of the supplementary material.\n\n   We would also like to emphasize that the main focus of this work is to design a cover selection algorithm, not the steganographic encoder and decoder. While we have made improvements to the owl image, further investigation into enhancing LISO’s performance on ImageNet would be necessary for even better results, which was beyond the scope of the main paper.\n\n3. **Advantage of BigGAN network and DDIM network (Kim et al. 2022):**  BigGAN and the diffusion model from Kim et al. (2022) are among the state-of-the-art generative models, known for their high-quality image generation capabilities. Both models are open-sourced, making them accessible for replication. Additionally, the papers introducing these models are highly cited, indicating their significant impact and validation within the research community. We would also like to note that our approach is applicable to other generative models as well.\n\n4. **Clarification on the role of weight initialization in Fig. 2:** As described in Section 3.1 of the manuscript, our process consists of two steps. In step 1, the initial cover image goes through the forward diffusion process to get the latent $x_T$. This serves as the initialization for the next step. In step 2, we optimize the already initialized elements of $x_T$ such that when it goes through the backward diffusion process, the output image minimizes the message reconstruction loss. In other words, we treat $x_T$ as a learnable weight matrix initialized from step 1, and its weights are updated via step 2 using gradient descent. We hope this addresses your question, and we will add more details to this section to make it clearer.\n\n5. **Reference pointer (Evsutin et al. 2018):** We have carefully checked our references, and the article by Evsutin et al. (2018) is included (lines 350-352). If there are any specific concerns or if you need further clarification, please let us know.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Xf7Ui8iDAD", "reviewer": "Reviewer_DaKE", "summary": "This paper presents a steganographic cover optimization framework that can be used to enhance existing steganographic methods. The authors use a pre-trained DDIM to reconstruct the cover image, optimizing the latent in the process and thus reducing the message extraction error. Meanwhile, the authors deeply analyze the working principle of steganographic encoder and verify it experimentally and theoretically. The experimental results demonstrate that the method proposed in this paper reduces the message extraction error rate while improving the quality of stego images.", "questions": "(1) Unifying the term robustness, resistance to steganalysis should not be called robustness. In the field of steganography, robustness usually refers to the ability to resist channel perturbations, such as resistance to JPEG compression, resistance to Gaussian noise, and so on. The ability to resist steganalysis is often called security. For the definition of robustness, you can refer to the following articles:\n\n1. Zeng, K., Chen, K., Zhang, W., Wang, Y., & Yu, N. (2023). Robust steganography for high quality images. IEEE Transactions on Circuits and Systems for Video Technology, 33(9), 4893-4906.\n2. Zeng, K., Chen, K., Zhang, J., Zhang, W., & Yu, N. (2024). Towards Secure and Robust Steganography for Black-box Generated Images. IEEE Transactions on Information Forensics and Security.\n\n(2) In Section 5.3, the settings of steganalysis experiments should be given, e.g., how many samples are used for training and how many samples are used for testing. In addition, experiments for resisting the more advanced steganalyzer SRNet should be added.\n\n(3) In section 3.1 detail how to implement the description of latent optimization, is the message extraction loss ‖m-m ̂‖ used to update the pre-trained DDIM?\n\n(4) The work in this paper is to invert the cover image to make it more suitable for steganography. Since this process does not involve \"selection\", I think it is not appropriate to call it \"cover selection\", you can consider modifying it to \"cover generation\" or \"cover reconstruction\".\n\n(5) In Section 5.3, the performance index for evaluating resistance to XuNet is \"detection rate\", and the detailed definition of \"detection rate\" should be given here. Meanwhile, to evaluate the performance of resisting steganalysis, we usually use the index of \"error rate\", which is defined as error rate = N_false/N_test, where N_false is the number of classification errors and N_test is the total number of samples. The closer the error rate is to 50%, the better the performance is.", "limitations": "The authors have addressed the limitations.", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "(1) From the perspective of steganographic cover optimization, the authors propose to use DDIM to adjust the cover image, which not only reduces the message extraction error rate, but also improves the quality of the stego image. Different from previous cover selection methods, the cover optimization method proposed in this paper has stronger interpretability.\n\n(2) The authors deeply analyze the mechanism of steganographic encoder and conclude that \"the encoder prefers to encode messages at pixel positions with smaller variance\", which is verified by \"waterfilling problem for Gaussian channels\".", "weaknesses": "(1) The method framework description is not detailed enough. This paper implements the training of the whole steganography method by optimizing the message extraction loss. However, the framework in the paper contains two models: the pre-trained DDIM and the pre-trained LISO. Readers will naturally have questions: which of these two models are fixed? And which are trainable? Based on the contextual reading, I presume that the DDIM model parameters are updatable, while the LISO model is fixed. The authors should elaborate on these settings in Section 3.1.\n\n(2) The experiment on steganalysis is not comprehensive enough. In Section 5.3, the authors evaluate the performance of the proposed steganography method to resist steganalysis. However, only the experiment of resisting the steganalysis network XuNet is designed, and the experiment of resisting the more advanced steganalysis network SRNet should be added to make the experimental results more convincing. Also, Section 5.3 lacks a detailed description of the experimental setup.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We appreciate the reviewer's recognition of our contributions. Our work advances steganographic cover optimization by using DDIM to adjust the cover image, reducing extraction errors and improving stego image quality. Unlike previous methods, our approach offers stronger interpretability. We show the encoder prefers low-variance pixels for message encoding, verified by the waterfilling algorithm for Gaussian channels. \n\nWe address the two weaknesses as follows. \n\n1. **Clarification on fixed vs. trainable components**: The DDIM and LISO models are pre-trained and remain fixed throughout the process. The latent vector $x_T$  generated by the DDIM's forward pass is the only component optimized by minimizing the extraction loss $||m-\\hat{m}||$ (lines 141-142). This method is both practical and efficient, as it avoids the need for costly fine-tuning of DDIM. We will clarify this point in the revised manuscript. \n\n2. **Additional experiments using SRNet**: We conducted experiments using SRNet, and the results are presented in Table 1 of the supplementary material. Our observations indicate that the images generated by our framework effectively resist steganalysis by SRNet. This is evidenced by the significant drop in detection rate when transitioning from scenario 1 to scenario 2. As a reminder, in scenario 2, we exploit the differentiability of the steganalyzer (SRNet) and incorporate an additional loss term to account for steganalysis . We will ensure this information is clearly presented in the manuscript. \n\nBelow, we provide a detailed, line-by-line response to each of the questions.\n\n1. **Security and robustness terminology**: Indeed; it makes more sense to use \"security\" for resistance to steganalysis and \"robustness\" for resistance to channel perturbations. We will update the terminology in the manuscript accordingly.\n\n2.  **Steganalysis settings**: Regarding the settings of the steganalysis experiments, we adhered to the default values specified in the LISO paper. We will add detailed information about the number of samples used for training and testing in the revised manuscript.\n\n3. **Latent optimization description**: Thank you for your suggestion, we will make this process clearer in the text. The DDIM is pre-trained and fixed during the entire process, as is the LISO model. The latent vector $x_T$ ​ produced by the DDIM’s forward pass is the only entity being optimized by minimizing the extraction loss $||m-\\hat{m}||$ (lines 141-142). This approach is practical and efficient, as it avoids the costly fine-tuning of the DDIM.\n\n4.  **Reconsidering terminology, replacing “Cover Selection”**: Thanks for the suggestion. We are considering several options such as \"cover reconstruction,\" \"cover fine-tuning,\" or \"cover re-generation\" to better describe our process.\n\n\n\n5. **Clarification on detection and error rates in steganalysis**: Thank you for your feedback. We define the detection rate as detection rate=N_true/N_test. We will include this definition in the revised manuscript. Our use of this definition follows the steganographic framework presented in LISO [1]. We will also clarify its connection to the \"error rate\" as you described, noting that the closer the error rate is to 50%, the better the performance in resisting steganalysis. We will ensure these definitions and their implications are clearly explained. \n\n   [1] Xiangyu Chen, Varsha Kishore, and Kilian Q Weinberger. “Learning iterative neural optimizers for image steganography.” In International Conference on Learning Representations, 2023.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
1. We thank all the reviewers for acknowledging our contributions and providing constructive feedback. Our ***key contributions***  include (a) identifying limitations of existing cover selection methods, (b) integrating pretrained generative models with steganographic encoder-decoder pairs for cover fine-tuning to minimize the error extraction loss, and (c) conducting theoretical studies to shed light on the inner workings of learning-driven steganography methods, drawing analogies to the water-filling algorithm in signal processing.

2. We conducted ***additional experiments*** to address the reviewers' concerns, including: (1) steganalysis results on SRNet (requested by Reviewer DaKE), (2) additional qualitative comparisons between the original and encoded images (requested by Reviewer kQa7), and (3) an experiment to enhance image quality, addressing the concern raised by Reviewer XM9B. The results to these experiments are included in the ***attached PDF***.

3. We also clarify an important question raised by Reviewer kQa7 regarding our analysis of the inner workings of the steganographic encoder and its analogy to the water-filling algorithm:

   - ***Analogy:*** We view the process of hiding secret messages as sending information through N parallel communication channels, where N represents the number of pixels in an image. In this analogy:

     - Each pixel functions as an individual communication link.
     - The secret message to be hidden and eventually recovered acts as the signal.
     - The cover image, which hosts the hidden message, introduces noise that is unknown to the decoder.

   - ***Advantage of low variance pixels in hiding messages:*** The analogy above immediately helps understand the role of pixel variances within a cover image in hiding messages. Intuitively, low-variance pixels within a cover image indicate low noise, reducing uncertainty for the decoder and enhancing message recovery. 

   - ***Key Observation. High-message positions are highly aligned with low-variance pixels:*** In Section 4.1, we make an observation that the high-message positions are highly aligned with low-variance pixels, meaning the steganographic encoder actively utilizes the low-variance pixel positions for hiding the messages, which is a highly desired and natural behavior. Our findings show that **81.6%** of high-message regions align with low-variance pixels, leveraging lower noise to enhance recovery accuracy. **We highlight that we are the first to make this observation, despite there being several relevant works on learning-driven steganography; none of these prior studies conducted an interpretation analysis of the encoder to uncover this behavior, as also acknowledged by Reviewers XM9B and DaKE.**

   - ***Theoretical Reasoning behind our Key Observation:*** Interestingly, we find that the learned message embedding behavior closely aligns with the waterfilling strategy, the theoretically optimal embedding strategy for parallel Additive Gaussian Noise channels. This strategy involves embedding more messages in lower-variance pixel positions, which increases message recovery accuracy. Surprisingly, steganography methods tend to adopt this strategy implicitly, without explicit training to do so, as discussed in Section 4.2. To the best of our knowledge, this is the **first instance where theoretical studies are used to shed light on the inner workings of learning-driven steganography methods.**



   - ***How is this discussion relevant to our cover selection/fine-tuning problem?*** In Section 4.3, we observe a significant increase in the number of low-variance pixels within a cover image after applying our framework. Our findings demonstrate that **92.4%** of high-message regions now align with low-variance pixels, compared to **81.6%** before the optimization of the cover image. This indicates a significant enhancement in the encoder's performance, as it efficiently leverages the low-variance pixel positions to conceal the messages.

Meta-review: This paper was reviewed by three experts in the field and got mixed recommendations. Both reviewers kQa7 and DaKE initially rated Borderline Accept. The authors addressed most of their concerns in the rebuttal and discussion, except for missing quantitative evidence proving the generalization of the proposed algorithm to work with other steganography techniques. Hence, reviewer DaKE raised his score to Weak  Accept, while reviewer kQa7 kept his core unchanged. Reviewer XM9B  initially rated Borderline Reject, and he did not provide any update after the rebuttal. The ACs checked and found the rebuttal well-addressed the reviewer's concerns.

Based on the observation above, the decision is to recommend the paper for acceptance to NeurIPS 2024. The authors should include the discussions and experimental results from the rebuttal in the camera-ready version. Some notable suggested modifications include clearer writing (Reviewer DaKE), three additional qualitative and quantitative, clarification on the analysis of the inner workings of the steganographic encoder and its analogy to the water-filling algorithm (Reviewer kQa7), and discussion on unexpected outcomes related to the LISO framework (Reviewers kQa7 and XM9B). The authors are also encouraged to add an extra experiment showing the robustness of the proposed method when combined with other steganographic frameworks like RoSteALS and StegaStamp.

We congratulate the authors on the acceptance of their paper!
Decision: Accept (poster)