CRoSS: Diffusion Model Makes Controllable, Robust and Secure Image Steganography
Authors: Jiwen Yu
Xuanyu Zhang
Youmin Xu
Jian Zhang
Venue: NeurIPS 2023 poster (2023)
Keywords: Diffusion models
image steganography
Stable Diffusion
coverless steganography

Abstract: Current image steganography techniques are mainly focused on cover-based methods, which commonly have the risk of leaking secret images and poor robustness against degraded container images. Inspired by recent developments in diffusion models, we discovered that two properties of diffusion models, the ability to achieve translation between two images without training, and robustness to noisy data, can be used to improve security and natural robustness in image steganography tasks. For the choice of diffusion model, we selected Stable Diffusion, a type of conditional diffusion model, and fully utilized the latest tools from open-source communities, such as LoRAs and ControlNets, to improve the controllability and diversity of container images. In summary, we propose a novel image steganography framework, named Controllable, Robust and Secure Image Steganography (CRoSS), which has significant advantages in controllability, robustness, and security compared to cover-based image steganography methods. These benefits are obtained without additional training. To our knowledge, this is the first work to introduce diffusion models to the field of image steganography. In the experimental section, we conducted detailed experiments to demonstrate the advantages of our proposed CRoSS framework in controllability, robustness, and security.

CRoSs: Diffusion Model Makes Controllable, Robust and Secure Image Steganography
Jiwen Yu'
Xuanyu Zhang' Peking University Shenzhen Graduate School
Youmin Xu
Jian Zhang
2 Peng Cheng Laboratory
Abstract
Current image steganography techniques are mainly focused cover-based meth- ods, which commonly have the risk of leaking secret images and poor robustness against degraded container images. Inspired by recent developments in diffu- sion models, we discovered that two properties of diffusion models, the ability to achieve translation between two images without training, and robustness to noisy data, can be used to improve security and natural robustness in image steganogra- phy tasks. For the choice of diffusion model, we selected Stable Diffusion, type of conditional diffusion model, and fully utilized the latest tools from open-source communities, such as LoRAs and ControlNets, to improve the controllability and diversity of container images. In summary, propose novel image steganog- raphy framework, named Controllable, Robust and Secure Image Steganography (CRoSS), which has significant advantages in controllability, robustness, and secu- rity compared to cover-based image steganography methods. These benefits are obtained without additional training. To our knowledge, this is the first work introduce diffusion models to the field of image steganography. In the experimental section, conducted detailed experiments demonstrate the advantages of our proposed CRoSS framework in controllability, robustness, and security. Code is available
Introduction
With the explosive development of digital communication and AIGC (Al-generated content), the privacy, security, and protection of data have aroused significant concerns. As a widely studied technique, steganography [0] aims to hide messages like audio, image, and text into the container image an undetected manner. its reveal process, it is only possible for the receivers with pre- defined revealing operations to reconstruct secret information from the container image. It has wide range of applications, such as copyright protection [.. digital watermarking [5], e-commerce [[], anti-visual detection 344] spoken language understanding 212 [ and cloud computing (76).
For image steganography, traditional methods tend transform the secret messages in the spatial or adaptive domains 227. such as fewer significant bits [ or indistinguishable parts. With the development of deep neural networks, researchers begin to use auto-encoder networks 5 or
invertible neural networks (INN) 35 26 to hide data, namely deep steganography.
The essential targets of image steganography are security, reconstruction quality, and robustness [9] (7) Since most previous methods use cover images to hide secret images, they tend to explicitly retain some secret information artifacts local details in the container image, which poses a risk of information leakage and reduces the security of transmission. Meanwhile, although previous works can maintain well reconstruction fidelity the revealed images, they tend to train models in noise-free simulation environment and can not withstand noise, compression artifacts, and non-linear transformations in practice, which severely hampers their practical values and robustness
30
1 CCoresponding author. This work was supported by National Natural Science Foundation of China under Grant 62372016.
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

To address security and robustness concerns, researchers have shifted their focus toward coverless steganography. This approach aims to create container image that bears no relation to the secret information, thereby enhancing its security. Current coverless steganography methods frequently employ frameworks such as CycleGAN [78 and encoder-decoder models [76), leveraging the principle of cycle consistency. However, the controllability of the container images generated by existing coverless methods remains limited. Their container images are only randomly sampled from the generative model and cannot be determined by the user. Moreover, existing approaches [47] tend to only involve hiding bits into container images, ignoring the more complex hiding of secret images. Overall, current methods, whether cover-based coverless, have not been able to achieve good unity in terms of security, controllability, and robustness. Thus, our focus is to propose a new framework that can simultancously improve existing methods in these three aspects.
has been very popular, with various unique properties such as the ability to perform many tasks in zero-shot manner [36 28
Recently, research on diffusion-basee generative models 22
55
56
64
X
37 20), strong control over the generation process 16
49
74 40
19
50) natural robustness
to noise in images [64] 28
65], and the ability to achieve mmage-to-image translation 77 8 20
39
57
14
20 37 We were pleasantly surprised to find that these properties perfectly match the
goals we mentioned above for image steganography: (I) Security: By utilizing the DDIM Inversion technique [54] for diffusion based image translation, we ensure the invertibility of the translation process. This invertible translation process enables coverless steganography framework, ensuring the security of the hidden image. (2) Controllability: The powerful control capabilities of conditional diffusion models make the container image highly controllable, and its visual quality is guaranteed by the generative prior of the diffusion model; (3) Robustness: Diffusion models are essentially Gaussian denoisers and have natural robustness noise and perturbations. Even if the container image is degraded during transmission, we can still reveal the main content of the secret image.
We believe that the fusion of diffusion models and image steganography is not simply a matter of mechanically combining them, but rather an elegant and instructive integration that takes into account the real concerns of image steganography. Based these ideas, we propose the Controllable, Robust and Secure Image Steganography (CRoSS) framework, a new image steganography framework that aims to simultancously achieve gains in security, controllability, and robustness.
Our contributions can be summarized as follows:
We identify the limitations of cxisting image steganography methods and propose unified goal of achieving security, controllability, and robustness. We also demonstrate that the diffusion model seamlessly integrate with image steganography to achieve these goals using diffusion-basee invertible image translation technique without requiring any additional training.
We propose a new image steganography framework: Controllable, Robust and Secure Image Steganography (CRoSS). To the best of our knowledge, this is the first attempt apply the diffusion model to the field of image steganography and gain better performance.
We leveraged the progress of the rapidly growing Stable Diffusion community to propose variants of CRoSS using prompts, LoRAs, and ControlNets, enhancing its controllability and diversity.
We conducted comprehensive experiments focusing on the three targets of security, controllability, and robustness, demonstrating the advantages of CRoSS compared to existing methods.
2 Related Work
2.1 Steganography Methods
Cover-based Image Steganography. Unlike cryptography, steganography aims to hide secret data in host to produce an information container. For image steganography, a cover image is
required to hide the secret image in it [3) Traditionally, spatial- -ased 24 41
46] methods
utilize the Least Significant Bits (LSB), pixel value differencing (PVD) 43 histogram shifting (60), multiple bit-planes [4 and palettes (24 42 to hide images, which may arise statistical suspicion and are vulnerable to steganalysis methods. Adaptive methods [45] 31 decompose the steganography into embedding distortion minimization and data coding, which is indistinguishable by appearance but limited in capacity. Various transform-han based schemes [10 27 including JSteg [46] and DCT
steganography [21 also fail to offer high payload capacity. Recently, various deep learning-

---

schemes have been proposed to solve image steganography. Baluja [5] proposed the first deep- learning method hide full-size image into another image. Generative adversarial networks (GANs) 1 are introduced to synthesize container images. Probability map methods focus on
generating various cost functions satisfying minimal-distortion embedding 45
59]. . [69] proposes
generator based U-Net. [58] presents an adversarial scheme under distortion minimization.
Three-player game methods like SteganoGAN [73] and HiDDeN [77] learn information embedding and recovery by auto-encoder architecture adversarially resist steganalysis. Recent attempts (66] to
introduce invertible neural networks (INN) into low-level inverse problems like denoising, rescaling, and colorization show impressive potential over auto-encoder, GAN [3) and other learning- -based architectures. Recently, [35 26 proposed designing the steganography model as an invertible neural
network (INN) [77 [8
to perform image hiding and recovering with single INN model.
Coverless Steganography. Coverless steganography is an emerging technique in the field of information hiding, which aims to embed secret information within medium without modifying the cover object [47. Unlike traditional steganography methods that require a cover medium (e.g., an image audio file) to be altered for hiding information, coverless steganography seeks to achieve secure communication without introducing any changes to the cover object [33]. This makes it more challenging for adversaries to detect the presence of hidden data, there are no observable changes in the medium's 's properties [38]. To the best of our knowledge, existing coverless steganography
methods [34] still focus on hiding bits into container images, and few explorations involve hiding images without resorting to cover images.
2.2 Diffusion Models
are a type of generative model that is trained to learn the target image distribution from a noise distribution. Recently, due to their powerful generative capabilities, diffusion models have been widely used in various image applications, including image generation [16] 48
Diffusion models [22 55 56
49), restoration [52 22 644, translation [14 29 (5), and more. Large-scale diffusion model communities have also emerged on the Internet, with the aim of promoting the development of AIGC(Al-generated content)-related fields by applying the latest advanced techniques.
In these communities, the Stable Diffusion [49] community is currently one of the most popular and thriving ones, with large number of open-source tools available for free, including model checkpoints finetuned on various specialized datasets. Additionally, various LoRAs (23) and ControlNets (74) are available in these communities for efficient control over the results generated by Stable Diffusion. LoRAs achieve control by efficiently modifying some network parameters in a low-rank way, while ControlNets introduce an additional network modify the intermediate features of Stable Diffusion for control. These mentioned recent developments have enhanced our CRoSS framework.
3 Method
3.1 Definition of Image Steganography
Before introducing our specific method, we first define the image steganography task as consisting of three images and two processes (as shown in Fig. [T] the three images refer the secret image Xsee, container image Xconts and revealed image Xrev, while the two processes are the hide process and reveal process. The secret image x is the image we want to hide and is hidden in the container image Xcont through the hide process. After transmission over the Internet, the container image Xcont may become degraded container image X from which we extract the revealed image Xyev through the reveal process. Our goal is to make our proposed framework have the following properties: (1) Security: even if the container image Xcont is intercepted by other receivers, the hidden secret image Xsec cannot be leaked. (2) Controllability: the content the container image X.ont can be controlled by the user, and its visual quality is high. (3) Robustness: the reveal process can still generate semantically consistent results (Xrev xsec) even if there is deviation in the xoont compared to the Xcont (Xoot d(xcomt), d(-) denotes the degradation process). According to the above definition,
X sec
X Xcont
Hide Process
Transmission
Reveal Process
X reev
X cont
degraded, resulting
Figure 1: Illustration used to show the definition of image steganography.
3

---

Translation
Deterministic
Porward
Diffusion Forward
Diffusson
Backward
Determintstic
Bacloward
prompt
Invertible?
prompt: "figer"
(a) Image Translation using Different Conditions
(b) DDIM Inversion
Figure 2: In part (a), Conditional diffusion models can be used with different conditions to perform image translation. In this example, use different prompts ("cat" and "tiger") to translate a cat image into tiger image. However, a critical challenge for coverless image steganography is whether we can reveal the original image from the translated image. The answer yes, and we can use DDIM Inversion (shown in part (b)) to achieve dual-direction translation between the image distribution and noise distribution, allowing for invertible image translation.
we can consider the hide process as a translation between the secret image Xsee and the container image Xcont. and the reveal process as the inverse process of the hide process. In Sec. 3.2 will introduce how to use diffusion models to implement these ideas, and in Sec. 33. we will provide a detailed description of our proposed framework CRoSS for coverless image steganography.
3.2 Invertible Image Translation using Diffusion Model
Diffusion Model Defined by DDIM. A complete diffusion model process consists two stages: the forward phase adds noise to a clean image, while the backward sampling phase denoises it step by step. In DDIM (54), the formula for the forward process is given by:
X /a + v1 OrC, E~ (O,
where x, denotes the noisy image in the 1-th step, denotes the randomly sampled Gaussian noise, Oe is predefined parameter and the range of time step t is [1, The formula of DDIM for the backward sampling process is given by:
x, V Vā, (xe,t) V a. cx ase, fo(x,, () X v1 (x ()
Vāx
where e NO I) is randomly sampled Gaussian noise with oī as the noise variance, fo f) is denoising function based on the pre-trained noise estimator Eø(,,t). and ā, II Qç DDIM does not require the two steps in its sampling formula to be adjacent (i.e., = s + 1). Therefore, s and t can be any two steps that satisfy < t. This makes DDIM popular algorithm for accelerating sampling. Furthermore, if o, in Eq 2 is set to O, the DDIM sampling process becomes deterministic. In this case, the sampling result is solely determined by the initial value xy, which can be considered as a latent code. The sampling process can also be equivalently described as solving an Ordinary Differential Equation (ODE) using ODE solver (54) In work, choose deterministic DDIM to implement the diffusion model and use the following formula:
X ODESolve(xT: Te
represent the process of sampling from X7 to Xo using pretrained noise estimator Eg.
Image Translation using Diffusion Model. A large number of image translation methods 75
g
20
29 37 based diffusion models have been proposed. In our method, we will adopt a simple approach. First, we assume that the diffusion models used in our work are all conditional diffusion models that support condition as input control the generated results. Taking the example shown in Fig. 2 (a), suppose we want to transform an image of cat into an image of a tiger. We add noise the cat image using the forward process (Eq. [T] obtain the intermediate noise, and then control the backward sampling process (Eq. (2) from noise by inputting a condition (prompt="tiger") resulting in new tiger image. general, the sampling condition is set c, our conditional sampling process can be expressed based on Eq. Baas as follows:
39
14
X ODESolve (XT; 60, c, T,O))
For image translation, there are two properties that need to be considered: the structural consistency of the two images before and after the translation, and whether the translation process is invertible.

---

Xare
Hide Process
c
O Co. Kpri, U.T
ODL Ninder : co. Raub, 1.0)
Private Key Kyri
Public Key Kynnh
Transmission
DDEoovve mnisn Co. Kyr T.0)
ODESolve "amnt Co. Keuat O.T)
Private Key Kyri
Public Key Kynb
Xyeu
Reveal Processs
Figure 3: Our coverless image steganography framework CRoSS. The diffusion model we choose is a conditional diffusion model, which supports conditional inputs to control the generation results. We choose the deterministic DDIM as the sampling strategy and use the two different conditions (kpri and kpbb) given to the model as the private key and the public key.
Algorithm 1 The Hide Process of CRoSS.
Input: The secret image xsec which will be hidden, a pre- pre- trained conditional diffusion model with noise estimator ép, the number I' of time steps for sampling and two different conditions Kpri and Kpub which serve as the private and public keys.
Output:
The container image Xcont used to hide the secret image Xsecs
Xnoise = ODESolve(xsec) Eg. Kpri. 0.
Xcont ODESolve Xnoisei Eg. Kpub T, 0)
return Xcont
Structural consistency is crucial for most applications related to image translation, but for coverless image steganography, ensuring the invertibility of the translation process is the more important goal. To achieve invertible image translation, we utilize DDIM Inversion based on deterministic DDIM.
DDIM Inversion Makes Invertible Image Translation. DDIM Inversion (shown in Fig. (b)), as the name implies, refers to the process of using DDIM to achieve the conversion from an image latent noise and back to the original image. The idea is based on the approximation of forward and backward differentials in solving ordinary differential equations (54] [2]. Intuitively, in the case of deterministic DDIM. allows and in Eq. to be any two steps (i.e., allowing < and >> t). When s < f. Eq performs the backward process, and when > t. Eq. performs the forward process. As the trajectories of forward and backward processes are similar, the input and output images are very close, and the intermediate noise Xy can be considered as the latent variable of the inversion. our work, we use the following formulas:
(5) to represent the DDIM Inversion process from the original image to the latent code xr and from the latent code Xy back the original image Xo (the output image denoted as x') and x1 R Xg). Based on DDIM Inversion, noises. As long as we use deterministic DDIM to construct the image translation framework, the entire framework achieve invertibility with two DDIM Inversion loops. It is the basis of our coverless image steganography framework, which will be described in detail in the next subsection.
XT ODESolve(Xo: ca. O, X/= = ODESooov(xx:: co. c, T,0),
have achieved the invertible relationship between images and latent
3.3 The Coverless Image Steganography Framework CRoSS
Our basic framework CRoSS is based on a conditional diffusion model, whose noise estimator is represented by 6g, and two different conditions that serve as inputs to the diffusion model. In our work, these two conditions can serve as the private key and public key (denoted as kpri and k pput), as shown Fig with detailed workflow described in Algo T and Algo. 2 We will introduce the entire CRoSS framework in two parts: the hide process and the reveal process.
The Process of Hide Stage. In the hide stage, we attempt to perform translation between the secret image Xsec and the container image Xcont using the forward and backward processes of deterministic DDIM. In order to make the images before and after the translation different, we use the pre-trained conditional diffusion model with different conditions in the forward and backward processes respectively. These two different conditions also serve as private and public keys in the CRoSS framework. Specifically, the private key Kpri is used for the forward process, while the
5

---

Algorithm 2 The Reveal Process of CRoSS.
The container image Xoont that has been transmitted over the Internet (may be degraded from Xcont), the pre-trained conditional diffusion model with noise estimator Eg, the number T of time steps for sampling, the private key kprs and public key kpub.
Input:
Output:
The revealed image Xyev.
x
Xnoise ODESolve(x' cont Eo. Kyub, 0, T)
Xyer = ODESolve(x noise: Eo, Kpris T, 0)
return Xyev
Transmitted Container Image
Reveal Backward
Reveal Forward
Social Media Internet
Candidate Revealed Images
Transmission
Scenarloff1
Scenario#t2
Possible Private Keys the private may something releted aninals, leapard. try these keys to generate some condidates, but I do not know which one true
Guessed Public Key "What the secnet image bahind the just tiger in container image. Maybee can Take this word as public key to try."
Scenarioft
Security for
Detection etteendenen mossseenie conieneeenee re
8
"I got this from social media and there are no evidencer for me to judge if this image is a container. The visual quality of this image high and difference between this and other natural images""
privane
Recevvr
find any
Figure 4: Further explanation of the CRoSS framework. We simulated the possible problems that a receiver may encounter in three scenariss during the reveal process.
public key knub used for the backward process. After getting the container image Xcont, it will be transmitted over the Internet and publicly accessible to all potential receivers.
The Roles of the Private and Public Keys in Our CRoSS Framework. In CRoSS, we found act as keys in practical use. The private key is used to describe
that these given conditions the content in the secret image, while the public key is used to control the content in the container image. For the public key, it is associated with the content in the container image, even if it is not manually transmitted over the network, the receiver can guess it based on the received container image (described in Scenariof2 of Fig. 4. For the private key, it determines whether the receiver can successfully reveal the original image, so it cannot be transmitted over public channels.
The Process of Reveal Stage. the reveal stage, assuming that the container image has been transmitted over the Internet and may have been damaged as Xcone- the receiver needs to reveal it back to the secret image through the same forward and backward process using the same conditional diffusion model with corresponding keys. Throughout the entire coverless image steganography process, we do not train or fine-tume tune the diffusion models specifically for image steganography tasks but rely the inherent invertible image translation guaranteed by the DDIM Inversion.
The Security Guaranteed by CRoSS. Some questions about security may be raised, such as: What if the private key is guessed by the receivers? Does the container image imply the possible hidden secret image? We clarify these questions from two aspects: (1) Since the revealed image is generated by the diffusion model, the visual quality of the revealed image is relatively high regardless of whether the input private key is correct not. The receiver may guess the private key by exhaustive method, but it is impossible to judge which revealed image is the true secret image from a pile of candidate revealed images (described in Scenario#1 of Fig. 4.. (2) Since the container image is also generated by the diffusion model, its visual quality is guaranteed by the generative prior of the diffusion model. Moreover, unlike cover- based methods that explicitly store clues in the container image, the container image in CRoSS does not contain any clues that can be detected or used to extract the secret image. Therefore, it is hard for the receiver to discover that the container image hides other images or to reveal the secret image using some detection method (described in Scenarioff3 of Fig, 4..
Various Variants for Public and Private Keys. Our proposed CRoSS relies on pre-trained con- ditional diffusion models with different conditions kyuh, kpri and these conditions serve as keys in the CRoSS framework. In practical applications, we can distinguish different types of conditions of diffusion models in various ways. Here are some examples: (1) Prompts: using the same checkpoint

---

16
90
Baluja
ISN
80
IiNNet
True Positíve Rale
RUS
Accuracy
CRoSS
60
70
Bulaja
62
HiNet
CRoSS
100
130
200
Number of Leaked Samples
False Positive Rate
E.
Figure 5: Deep steganalysis results by the latest SID 61 As the number leaked samples increases, methods whose detection accuracy curves grow more slowly and approach 50% exhibit higher security. The right the recall curve of different methods under the StegExpose [7] detector. The closer the area enclosed by the curve and the coordinate axis is to 0.5, the closer the method is to the ideal evasion of the detector.
of text-to-image diffusion models like Stable Diffusion 49 but different prompts input condi- tions; (2) LoRAs [23]: using the same checkpoint initialization, but loading different LoRAs; (3) ControlNets 74] loading the same checkpoint but using ControlNet with different conditions.
4 Experiment
4.1 Implementation Details
Experimental Settings. In our experiment, we chose Stable Diffusion 499 v1.5 as the conditional diffusion model, and used the deterministic DDIM [54] sampling algorithm. Both the forward and backward processes consisted of 50 steps. To achieve invertible image translation, we set the guidance scale of Stable Diffusion public keys, we had three options: prompts, conditions for ControlNets 774 (depth maps, scribbles. segmentation maps), and LoRAs (23] All experiments were conducted on a GeForce RTX 3090 GPU card, and our method did not require any additional training fine-tuning for the diffusion model. The methods we compared include RII (68), HiNet [26]. Baluja (6, and ISN (35)
For the given conditions, which serve as the private and
Data Preparation. To perform a quantitative and qualitative analysis of our method, we collect benchmark with a total of 260 images and generate corresponding prompt keys specifically tailored for the coverless image steganography. dubbed Stego260. We categorize the dataset into three classes, namely humans, animals, and general objects (such as architecture, plants, food, furniture, etc.). The images in the dataset are sourced from publicly available datasets 2 and Google search engines. For generating prompt keys, we utilize BLIP (32 generate private keys and employ ChatGPT or artificial adjustment to perform semantic modifications and produce public keys in batches. More details about the dataset can be found in the supplementary material.
4.2 Property Study#l: Security
In Fig. [ the recent learning- beaning-bassed steganalysis method Siize-Independent-Deeeeee Deteecttr (SID) 61 retrained with leaked samples from testing results of various methods on Stego260. The detection accuracy of CRoSS increases more gradually the number of leaked samples rises, compared to other methods. The recall curves on the right also reveal the lower detection curacy of our CRoSS, indicating superior anti- steganalysis performance.
Methods
Desection
50j
Balgg
341:008
45 M9
411222218
46.86:22.17
351
2.822002
5.14
$.221.19
294-0.02
522-
3,1240.38
8.351
3.132005
48811.15
(ours)
3.04
2.11
Table Sccurity analysis. NIQE indicates the vi- sual quality of container images, lower is better. The closer the detection rate of a method approxi- mates 50%, the more secure the method is consid- ered, as it suggests its output is indistinguishable from random chance. The best results are red and the second-best results are blue.
Our security encompasses two aspects: imper- ceptibility in visual quality against human suspi- cion and resilience against steganalysis attacks.
NIQE is no-reference image quality assessment (IQA) model to measure the naturalness and visual

---

Secret
Container
Revealed
Secret
Container
Revealed
Secret
Container
Revealed
Premerts Edffal under the
Prenctti Sydwey Opens House Pronatii beet
Prompit learng Tower piaa
Pr & free undar the Llke sky
Fromphi lightouss with ned flay
Phampit Obams giving apeech 2 di operch
Promjtioa yours cute: chisese with long hor with long hair
Prompiu yourg pirt Sland heir Frongeis
Prongniie cutle mobiat Pranignt
Peomyrti o kooko is cirting on branch
Promphis Endger as lang throush the grazr Prompti baby walking threigh grars
Pro wilking
Pronprio Samphoss honginng ng on
Phomptte 0 oray capir living raom
Prongtiic mrott-loyer honbunger
Figure 6: Visual results of the proposed CRoSS controlled by different prompts. The container images are realistic and the revealed images have well semantic consistency with secret images.
Secret
Container
Revesled
Secret
Container
Revealed
Secret
Container
Revealed
ControiNets
LoRAs
Figure 7: Visual results of our CRoSS controlled by different ControlNets and LoRAs. Depth maps, scribbles, and segmentation maps presented in the lower right corner of the images.
security without any reference image or human feedback. In Tab. 1 the lower the NIQE score, less likely it is for the human eye identify the image potentially generated container for hiding secret information. Our NIQE is close those of other methods, as well the original input image (2.85), making it difficult to discern with human suspicion. Anti-analysis security is evaluated by three steganalysis models XuNet[67], YedroudjNe:(70) and KeNet for which lower detection accuracy denotes higher security. Our CRoSS demonstrates the highest near-highest resistance against various steganalysis methods.
4.3 Property Study#2: Controllability
To verify the controllability and flexibility of the proposed CRoSS, various types of private and public keys such as prompts, ControlNets, and LoRAs are incorporated in our framework. As illustrated in Fig. [6] our framework is capable of effectively hiding the secret images in the container images based on the user-provided "Prompt2" without noticeable artifacts or unrealistic image details. The container image allows for the seamless modification of person's 's identity information, facial attributes, as
The last of Fig. 7 are generated via LoRAs downloaded from https::/cvvittai..o

---

WeCbat
Shoot
WeCbat
Shoot
WeChot
Shoot
Hite
Socret image
RIS
Revealed image
Figure 8: Visual comparisons of our CRoSS and other methods 668
26 under two real-world
degradations, namely "WeChat" and "Shoot". Obviously, our method reconstruct the content of secret images, while other methods exhibit significant color distortion or have completely failed.
Methods
clean
10
Gaussian noise
a= 20
=00
a=
Gaussian denoiser
10
a = 20
30
=
JPBG compression
Q= 10
==
80
Q
JPEG enhancer
Q=
Q= 80
Balugi [6]
34.24
10.30
7.31
6.92
7.97
6.10
3.49
6,59
8.33
11.92
5.21
6.9%
9.35
ISN 85
HiNer 26
42,98
12.91
11.54
10.23
11.87
9.32
6.87
7.03
9.78
13.23
5.59
8.21
11.88
RUS [8]
43.78
26.03
18,89
15.85
20.89
15.97
13.92
22.03
25.41
27.02
13,88
16.74
20.13
(ouns)
21.89
18.77
21.24
23.51
20.60
Table 2: PSNR(dB) results of the proposed CRoSS and other methods under different levels of degradations. The proposed CRoSS can achieve superior data fidelity in most settings. The best results are red and the second-best results are blue.
well as species of animals. The concepts of these two prompts can also differ significantly such as the Eiffel Tower and a tree, thereby enhancing the concealment capability and stealthiness of the container images. Meanwhile, the revealed image extracted with "Promptl" exhibits well fidelity by accurately preserving the semantic information of secret images. Besides prompts, our CRoSS also supports the utilization of various other control conditions keys, such as depth maps, scribbles, and segmentation maps. As depicted in Fig. 7 our methods can effectively hide and reveal the semantic information of the secret image without significantly compromising the overall visual quality or arousing suspicion. Our CRoSS can also adopt different LoRAs as keys, which is conducive to personalized image steganography.
4.4 Property Study#3: Robustness
Simulation Degradation. To validate the robustness of our method, we conduct experiments on simulation degradation such Gaussian noise and JPEG compression. As reported in Tab. 2 our CRoSS performs excellent adaptability to various levels of degradation with minimal performance decrease, while other methods suffer significant drops in fidelity (over 20dB in PSNR). Meanwhile, our method achieves the best PSNR at a 20 and o = 30. Furthermore, when we perform nonlinear image enhancement (62] on degraded container images, all other methods have deteriorations our CRoSS can still maintain good performance and achieve improvements in the Gaussian noise degradation. Noting that RIS (68) is trained exclusively on degraded data, but our CRoSS naturally resistant to various degradations in zero-shot manner and outperforms RII in most scenarios.
Real-World Degradation. We further choose two real-world degradations including "WeChat" and "Shoot". Specifically, we send and receive container images via the pipeline of WeChat to implement network transmission. Simultaneously. we utilize the mobile phone to capture the container images on the screen and then simply crop and warp them. Obviously, shown in Fig, R all other methods have completely failed or present severe color distortion subjected these two extremely complex degradations, yet our method can still reveal the approximate content of the secret images and maintain well semantic consistency, which proves superiority our method.
Conclusion
propose a coverless image steganography framework named CRoSS (Controllable, Robust, and Secure Image Steganography) based diffusion models. This framework leverages the unique

---

properties of diffusion models and demonstrates superior performance in terms of security, control- lability, and robustness compared to existing methods. To the best of our knowledge, CRoSS is the first attempt to integrate diffusion models into the field of image steganography. In the future, duffusion-based image steganography techniques will continue to evolve, expanding their capacity and improving fidelity while maintaining their existing advantages.
References
[1]
http:///ghaaa.oooaaaaaattttttttt 2019.
[2] animal-image- htgpaill..inngaaaaaaeeoooooaaaaa 2022.
[3] Rameen Abdal, Yipeng Qin, and Peter Wonka. Image2stylegan: How to embed images into the stylegan latent space? In Proceedings of the IEEF/CVF International Conference on Computer Vision (ICCV), 2019.
[4] Alaa A Jabbar Altaay, Shahrin Bin Sahib, and Mazdak Zamani. An introduction to image steganography techniques. In 2012 International Conference on Advanced Computer Science Applications and Technologies (ACSAT), 2012.
[5] Shumeet Baluja. Hiding images in plain sight: Deep steganography. In Advances in Neural Information Processing Systems (NeurIPS), 2017.
[6] Shumeet Baluja. Hiding images within images. IEEE transactions on pattern analysis and machine intelligence (TPAMI), 2019.
[7] Benedikt Boehm. Stegexpose-a tool for detecting Isb steganography, arXiv preprint 140.6664 2014.
[8] Tim Brooks, Aleksander Holynski, and Alexei A Efros. Instructpix2pix: Learning to follow image editing instructions. arXiv preprint (.XXx:22110090000 2022.
[9] woog Chan and Lee-Ming Cheng. Hiding data in images by simple Isb substitution. Puttern recognition, 2004.
[10] Yambem Jina Chanu, Kh Manglem Singh, and Themrichon Tuithung. Image steganography and steganalysis: A survey. International Journal of Computer Applications,, 2012.
[11] Abbas Cheddad, Joan Condell, Kevin Curran, and Paul Mc Kevitt. Digital image steganography: Survey and analysis of current methods. IEEE Transactions on Signal Prucessing (TIP), 2010.
[12] Xuxin Cheng, Bowen Cao, Qichen Ye, Zhihong Zhu, Hongxiang Li, and Yuexian Zou, MI-Imel: Mutual learning and large-margin contrastive learning for improving robustness in spoken language understanding. In Findings of the Association for Computational Linguistics (ACL), 2023.
[13] Xuxin Cheng, Qianqian Dong, Fengpeng Yue, Tom Ko, Mingxuan Wang, and Yuexian Zou. M 3 st: Mix at three levels for speech translation. In IEEE International Conference Acoustics, Speech and Signal Processing (ICASSP), 2023.
[14] Jooyoung Choi, Sungwon Kim, Yonghyun Jeong, Youngjune Gwon, and Sungroh Yoon. lvr: Conditioning method for denoising diffusion probabilistic models. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2021.
[15] Ingemar Cox, Matthew Miller, Jeffrey Bloom, Jessica Fridrich, and Ton Kalker. Digital watermarking and steganography. Morgan kaufmann, 2007.
[16] Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis. In Advances in Neural Information Processing Systems (NeurIPS), 2021.
[17] Laurent Dinh, David Krueger, and Yoshua Bengio. Nice: Non-linear independent components estimation. arXiv preprint arXiv:1410.8516, 2014.
10

---

[18] Laurent Dinh, Jascha Sohl-Dickstein, and Samy Bengio. Density estimation using real NVP. In International Conference on Learning Representations (ICLR), 2017.
[19] Rinon Gal, Yuval Alaluf, Yuval Atzmon, Or Patashnik, Amit H Bermano, Gal Chechik, and Daniel Cohen-Or. An image is worth one word: Personalizing text-to-image generation using textual inversion. arXiv preprint ar 22v:: 0/668,, 2022.
[20] Amir Hertz, Ron Mokady, Jay Tenenbaum, Kfir Aberman, Yacl Pritch, and Daniel Cohen-Or Prompt-to-prome image editing with cross attention control. arXiv preprint arXiv:2208.014 2022.
[21] Stefan Hetzl and Petra Mutzel. A graph-theoretic approach to steganography. In IFIP Interna- tional Conference on Communications and Multimedia Security, 2005.
[22] Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. In Advances in Neural Information Processing Systems (NeurIPS), 2020.
[23] Edward Hu, yelong shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. LoRA: Low-rank adaptation of large language models. In International Conference on Learning Representations (ICLR), 2022.
[24] Shoko Imaizumi and Kei Ozawa. Multibit embedding algorithm for steganography of palette- based images. In Image and Video Technology: 6th Pacific- Rim Symposium 2013
[25] Priyank Jaini, Kira A Selby, and Yaoliang Yu. Sum-of-squares polynomial flow. In International Conference Machine Learning (ICML), 2019.
[26] Junpeng Jing, Xin Deng, Mai Xu, Jianyi Wang, and Zhenyu Guan. Hinet: Deep image hiding by invertible network. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2021.
[27] Inas Jawad Kadhim, Prashan Premaratne, Peter James Vial, and Brendan Halloran. Compre- hensive survey of image steganography: Techniques, evaluations, and trends in future research. Neurocomputing, 2019.
[28] Bahjat Kawar, Michael Elad, Stefano Ermon, and Jiaming Song. Denoising diffusion restoration models. In Advances in Neural Information Processing Systems (NeurIPS), 2022.
[29] Gwanghyun Kim, Taesung Kwon, and Jong Chul Ye. Diffusionclip: Text-guided diffusion models for robust image manipulation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022.
[30] Durk P Kingma, Tim Salimans, Rafal Jozefowicz, Xi Chen, Ilya Sutskever, and Max Welling. Improved variational inference with inverse autoregressive flow. In Advances in Neural Infor- mation Processing Systems (NeurIPS), 2016
[31] Bin Li, Ming Wang, Jiwu Huang, and Xiaolong Li. A new cost function for spatial image steganography. In Proceedings of the International Conference on Image Processing (ICIP), 2014.
[32] Junnan Li, Dongxu Li, Caiming Xiong, and Steven Hoi. Blip: Bootstrapping language- image tre-tnngning for unified dision-languae understanding and generation. In International Conference Machine Learning (ICML), 2022.
[33] Yung-Hui Li, Ching-Chun Chang, Guo-Dong Su, Kai-Lin Yang, Muhammad Saqlain Aslam, and Yanjun Liu. Coverless image steganography using morphed face recognition based on convolutional neural network. EURASIP Journal on Wireless Communications and Networking, 2022.
[34] Qiang Liu, Xuyu Xiang, Jiaohua Qin, Yun Tan, and Yao Qiu. Coverless image steganography based on densenet feature mapping. EURASIP Journal Image and Video Processing, 2020.
[35] Shao-Ping Lu, Rong Wang, Tao Zhong, and Paul I. Rosin. Large-capacity image steganography based on invertible neural networks. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2021.

---

[36] Andreas Lugmayr, Martin Danelljan, Andres Romero, Fisher Yu, Radu Timofte, and Lue Van Gool. Repaint: Inpainting using denoising diffusion probabilistic models. In Proceedings of the IEEF/CVF Conference on Computer Vision and Puttern Recognition (CVPR), 2022.
[37] Chenlin Meng. Yutong He, Yang Song, Jiaming Song, Jiajun Wu, Jun-Yan Zhu, and Stefano Ermon. SDEdit: Guided image synthesis and editing with stochastic differential equations. In International Conference on Learning Representations (ICI.). 2022.
[38] Mohammed Saad Mohamed, EH Hafez, et al. Coverless image steganography based on jigsaw puzzle image generation. Computers, Materials and Continua, 2021.
[39] Ron Mokady, Amir Hertz, Kfir Aberman, Yael Pritch, and Daniel Cohen- -hhen-Or. Null-text inversion for editing real images using guided diffusion models. arXiv preprint arXiv:2211.09794, 2022.
[40] Chong Mou, Xintao Wang, Liangbin Xie, Jian Zhang, Zhongang Qi, Ying Shan, and Xiaohu Qie. T2i-adapter: Learning adapters to dig out more controllable ability for text-to-image diffusion 2023.
models. arXiv preprint ar arXiv:2302.08455
[41] Bui Cong Nguyen, Sang Moon Yoon, and Heung-Kyu Lee. Multi bit plane image steganography, In International Workshop on Digital Watermarking, 2006.
[42] Michiharu Nimi,, Hideki Noda, Eiji Kawaguchi, and Richard O Eason. High capacity and secure digital steganography to palette-based images. In Proceedings of the International Conference on Image Processing (ICIP), 2002.
[43] Feng Pan, Jun Li, and Xiaoyuan Yang. Image steganography method based on pvd and modulus function. In International Conference Electronics, Communications and Control (ICECC), 2011.
[44] George Papamakarios, Theo Pavlakou, and lain Murray. Masked autoregressive flow for density estimation. In Advances in Neural Information Processing Systems (NeurIPS), 2017.
[45] Tomá' Pevný, Tomáš Filler, and Patrick Bas. Using high-dimensional image models to perform highly undetectable steganography. In Information Hiding: 12th International Conference (IHIP), 2010.
[46] Niels Provos and Peter Honeyman. Hide and seek: An introduction to steganography. IEEE Symposium on Security and Privacy, 2003.
[47] Jiaohua Qin, Yuanjing Luo, Xuyu Xiang, Yun Tan, and Huajun Huang. Coverless image steganography: a survey. IEEE Access, 2019.
[48] Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text-conditional image generation with clip latents. arXiv preprint arXiv:2204.06125, 2022.
[49] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022.
[50] Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kfir Aberman. Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition (CVPR), 2023.
[51] Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily Denton, Seyed Kamyar Seyed Ghasemipour, Raphael Gontijo-Lppss, Burcu Karagol Ayan, Tim Salimans, Jonathan Ho, David J. Fleet, and Mohammad Norouzi. Photorealistic -oxt-to- diffusion models with deep language understanding. In Advances in Neural Information Processing Systems (NeurIPS), 2022.
[52] Chitwan Saharia, Jonathan Ho, William Chan, Tim Salimans, David J Fleet, and Mohammad Norouzi. Image super-resolution via iterative refinement. IEEE Transactions on Patlern Analysis and Machine Intelligence (TPAMI), 2022.
12

---

[53] Haichao Shi, Jing Dong, Wei Wang, Yinlong Qian, and Xiaoyu Zhang. Ssgan: secure steganog- raphy based on generative adversarial networks. In Pacific Rim Conference on Multimedia, 2017.
[54] Jiaming Song. Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In International Conference on Learning Representations (ICLR), 2021.
[55] Yang Song and Stefano Ermon. Generative modeling by estimating gradients of the data distribution. In Advances in Neural Information Processing Systems (NeurIPS), 2019.
[56] Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In International Conference on Learning Representations (ICLR), 2021.
[57] Xuan Su, Jiaming Song, Chenlin Meng, and Stefano Ermon. Dual diffusion implicit bridges for saage-to-image translation. In International Conference Learning Representations (ICLR), 2023.
[58] Weixuan Tang, Bin Li, Shunquan Tan, Mauro Barni, and Jiwu Huang. Can-based adversarial embedding for image steganography. IEEE Transactions Information Forensics and Security (TIFS), 2019.
[59] Weixuan Tang, Shunquan Tan, Bin Li, and Jiwu Huang. Automatic steganographic distortion learning using generative adversarial network. IEEE Signal Processing Letters, 2017.
[60] Piyu Tsai, Yu-Chen Hu, and Hsiu-Lien Yeh. Reversible image hiding scheme using predictive coding and histogram shifting. Signal Processing, 2009.
[61] Clement Fuji Tsang and Jessica Fridrich. Steganalyzing images of arbitrary size with cnns. Electronic Imaging, 2018.
[62] Xintao Wang, Liangbnn Xie, Chao Dong, and Ying Shan. Real-esrgan: Training real-world blind super-resolution with pure synthetic data. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2021.
[63] Yinhuai Wang. Jiwen Yu, Runyi Yu, and Jian Zhang. Unlimited-size diffusion restoration. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), 2023.
[64] Yinhuai Wang, Jiwen Yu, and Jian Zhang. Zero-shot image restoration using denoising diffusion null-space model. In International Conference on Learning Representations (ICLR), 2023.
[65] Zhixin Wang, Xiaoyun Zhang, Ziying Zhang, Huangjie Zheng, Mingyuan Zhou, Ya Zhang, and Yanfeng Wang. Dr2: Diffusion-based robust degradation remover for blind face restoration. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2023.
[66] Mingging Xiao, Shuxin Zheng, Chang Liu, Yaolong Wang, Di He, Guolin Ke, Jiang Bian, Zhouchen Lin, and Yan Liu. Invertible image rescaling. In European Conference on Computer Vision (ECCV), 2020.
[67] Guanshuo Xu, Han- Zhou Wu, and Yun-Qing Shi. Structural design of convolutional neural networks for steganalysis. IEEE Signal Processing Letters, 2016.
[68] Youmin Xu, Chong Mou, Yujie Hu, Jingfen Xie. and Jian Zhang. Robust invertible image steganography. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022.
[69] Jianhua Yang, Danyang Ruan, Jiwu Huang, Xiangui Kang, and Yun-Qing Shi. An embedding cost learning framework using gan. IEEE Transactions on Information Forensics and Security (TIFS), 2019.
[70] Mehdi Yedroudj, Frédéric Comby, and Mare Chaumont. Yedroudj-net: An efficient con for spatial steganalysis. In IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2018.
13

---

[71] Weike You, Hong Zhang, and Xianfeng Zhao. A siamese enn for image steganalysis. IEEE Transactions on Information Forensics and Security (TIFS), 2020.
[72] Jiwen Yu, Yinhuai Wang, Chen Zhao, Bernard Ghanem, and Jian Zhang. Freedom: Training-free energy-guided conditional diffusion model. arXiv:2303.099 09833, 2023.
[73] Kevin Alex Zhang, Alfredo Cuesta-Infante, Lei Xu, and Kalyan Veeramachaneni. Steganogan: High capacity image steganography with gans. arXiv preprint arXiv:1901.0380 2019.
[74] Lymin Zhang and Maneesh Agrawala. Adding conditional control to text-to-image diffusion models, arXiv preprint arXiv:2302.05543 2023.
[75] Min Zhao, Fan Bao, Chongxuan Li. and Jun Zhu. Egsde: Unpaired image-to-iman transla- tion via energy eneryy-gideed stochastic differential equations. In Advances in Neural Information Processing Systems (NeurIPS), 2022.
[76] Zhili Zhou, Huiyu Sun, Rohan Harit, Xianyi Chen, and Xingming Sun. Coverless image steganography without embedding. In Cloud Computing and Security: First International Conference (ICCCS), 2015.
[77] Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. In European Conference on Computer Vision (ECCV), 2018.
[78] Jun-Yan Zhu, Taesung Park, Phillip Isola, and Alexei A Efros. Unpaired image-to-iman translation using cycle-consistent adversarial networks. In Proceedings of the IEEE International Conference on Computer Vision (ICCV), 2017.
14


Reviews:
[{"review_id": "pxCzjcK0Rj", "reviewer": "Reviewer_mtD2", "summary": "In this work, the authors introduce an image steganography framework (CRoSS) that leverages the properties of diffusion models to enhance the security, controllability, and robustness of the steganography process. The authors show how the diffusion model can integrate with image steganography to achieve these goals without additional training. The authors claim this to be the first work to introduce diffusion models to the field of image steganography. The effectiveness of the proposed CRoSS framework was validated with different experiments where the authors demonstrated the advantages over existing methods.\n", "questions": "- Will the proposed method recover the secret image well when an attacker applies another type of noise? Can this negatively impact the performance of the method?\n- Is the method robust to local distortions?", "limitations": "The authors acknowledged the limitations of their work, including the gap in pixel-wise objective fidelity metrics, the trade-off that sacrifices the editing capability to ensure the zero-shot invertibility of image translation, and the limitation of hiding only one secret image within a single container image. However, they could provide more insights into potential solutions or future research directions to address these limitations. They did not explicitly discuss potential negative societal impacts.", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- This paper proposes to apply diffusion models to the field of image steganography, creatively combining existing ideas to overcome the limitations of traditional methods. \n\n- The paper is clear, and the authors clearly define their goals, explain their methodology, and discuss their results.\n\n- Overall, the paper was easily understandable and easy to follow. Its structure is well-organized, and the proposed method is presented clearly and makes sense.\n\n- To validate the effectiveness of the method, the authors conducted different experiments showing the advantages of the proposed approach in terms of security, controllability, and robustness. \n\n- In general, the paper is very well written.", "weaknesses": "- Although the authors considered validating their method against distortion attacks, Gaussian noise distortion is not the appropriate approach to evaluate its robustness. As authors may know,  Gaussian noise is already used in the diffusion process due to its mathematical properties. The Gaussian distribution is symmetric and has the property that the sum of multiple Gaussian random variables is also Gaussian. This makes it mathematically convenient, especially in diffusion models where noise is added iteratively. Therefore, adding more Gaussian noise to the container image will not affect the reveal process too much. I would like to see if the method is still robust to another type of noise but Gaussian.\n- In my opinion, the robustness validation made in the paper is not enough to conclude that the method is robust. For example, did the authors consider the scenario where an attacker performs not only global distortions (like JPEG compression, adding noise, etc.) but local distortions, e.g., blurring a patch on the image?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your constructive comments! We hope that our response addresses all of your concerns. All discussions and supplementary experiments will be included in our revised version. If there are any remaining questions that have not been resolved, please feel free to continue the discussion with us!\n\n$\\textbf{\\textcolor{red}{The supplementary rebuttal PDF file can be found at the bottom of the overall response.}}$\n\n> ***Weakness #1 & Question #1: Robustness experiments involving a broader range of noise types*** \n\n- The robustness experiments involving additional types of noise are provided in the supplementary rebuttal PDF file (**Table 1 and Figure 3**). We have included the results for **Poisson noise** and **salt-and-pepper noise**. The experimental results show that CRoSS maintains robustness against other types of noise and has an advantage compared to other methods.\n- Regarding the implementation details of the two types of noise, for Poisson noise, we referred to the implementation in [1] and adjusted the noise level using the parameter $\\alpha$. For salt-and-pepper noise, we adjusted the noise level using the parameter probability $p$. The examples of degraded images are presented in **Figure 2** of the Supplementary Rebuttal PDF file.\n\n> ***Weakness #2 & Question #2: Robustness experiments involving local distortions*** \n\n- The robustness experiments concerning local distortions are presented in the supplementary rebuttal PDF file (**Figure 1**). We have included the results for the scenario of **blurring a patch**. The experimental results indicate that CRoSS maintains significant robustness against local distortions and exhibits clear advantages compared to other methods.\n- Regarding the implementation details of \"blurring-a-patch,\" we extracted a $256\\times256$ patch from the center of the image and applied Gaussian blur exclusively to this patch. The blur kernel size was set to $5$, and the sigma was set to $2$. The examples of degraded images are presented in **Figure 2** of the Supplementary Rebuttal PDF file.\n\n> ***Future research directions for limitations*** \n\n- (1) Regarding the limitation of **the gap in pixel-wise objective fidelity metrics**, which is primarily attributed to the training-free nature of DDIM Inversion, a potential solution could involve training diffusion models specifically for image steganography tasks to improve objective fidelity. \n- (2) Regarding the limitation of **sacrificing editing capability to ensure invertibility**, which is mainly attributed to the unsatisfactory generation capabilities of Stable Diffusion (with guidance scale = 1), a potential strategy involves keeping up with the latest advancements in the diffusion model field and replacing the base model in CRoSS in a plug-and-play way to alleviate this issue. \n- (3) Regarding the limitation of **hiding only one secret image within a single container image**, this is primarily due to the current design of diffusion models being Single Input Single Output (SISO). A potential solution could involve designing Multiple Input Multiple Output (MIMO) diffusion models specifically for high-capacity image steganography.\n\n> ***Potential negative societal impacts*** \n\n- The related technology could potentially be utilized for improper distribution of personal privacy or for inappropriate distribution of images that might lead to offense.\n\n> ***References***\n\n[1] Practical Blind Denoising via Swin-Conv-UNet and Data Synthesis. ArXiv 2022."}, {"review_id": "XQvwz63vVn", "reviewer": "Reviewer_Nci3", "summary": "This paper introduces diffusion models to the field of image steganography. It argues the significant advantages in controllability, robustness, and security compared to cover-based image steganography methods. It utilized the power of Stable Diffusion to translate between two images without training. This paper collects a benchmark and shows experiments on it.", "questions": "1. Why Secret and Container are required to share a similar background?", "limitations": "Please refer to the \"weakness\".", "rating": 7, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. This paper proposes a novel idea to utilize the diffusion Model to do image steganography. I think this is reasonable because pretrained diffusion models can invert an image to noise or translate between images without training.\n2. The presentation is clear such as Fig.2 and Fig.3.\n3. The qualitative results seem good as shown in Fig. 6.\n4. This paper collects a benchmark containing 260 images, which may be useful for the community.\n5. Analysis is in detail, including discussion from Sec 4.2 to Sec 4.4.", "weaknesses": "1. According to null-text inversion [1], DDIM is not enough to invert a real image perfectly. In this case, how to deal with the artifacts in your method? I believe low-level artifacts are fatal for image steganography.\n2. Most secrets and containers share a similar background. Does it mean we need a good image editing tool when using this method?\n3. It is difficult to generate high-quality human faces with Stable Diffusion. Inverting human faces is also not stable. Why do the qualitative results in Fig. 6 seem good?\n\n\n[1] Null-text Inversion for Editing Real Images using Guided Diffusion Models", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your constructive comments! We hope that our rebuttal has addressed all your concerns. If there are still aspects that need further clarification, please feel free to continue the discussion with us!\n\n> ***Weakness #1: The invertibility is not perfect, and how to address the artifacts.*** \n\n- We acknowledge that achieving perfect invertibility through DDIM Inversion can be challenging. Therefore, at this stage, we only require the revealed image to match the secret image in subjective visual quality. By ensuring **acceptable subjective fidelity**, we can fully exploit the advantages of CRoSS in terms of security and robustness. \n- Regarding the concern you raised about \"low-level artifacts\", we suspect you are referring to the situation where some of the revealed images might appear to have slightly lower quality. This phenomenon can be attributed to the generation capability of the diffusion model, which directly impacts the quality of the revealed image. However, it's important to note that our method itself is **independent of the specific choice of the diffusion model**. Opting for a more powerful diffusion model (such as the latest SDXL [1]) can further enhance the quality of the revealed image, thereby potentially alleviating the concern you mentioned.\n\n> ***Weakness #2 & Question #1: The similarity between the secret and container images' backgrounds*** \n\n- In our experimental setting, there is indeed a similarity in background between the secret image and the container image. This similarity is primarily influenced by the editing capability of Stable Diffusion (with guidance scale = 1) that we employ. Therefore, your observation is correct: a better editor could enhance our proposed CRoSS framework in a plug-and-play manner, resulting in greater diversity between the secret image and the container image. \n\n> ***Weakness #3: The generation capability and stability on human face images*** \n\n- Based on our knowledge, Stable Diffusion does possess the ability to generate high-quality human faces. There are numerous galleries within the community that serve as references, such as the following blog [2]. \n- Furthermore, within our experimental setting, we do not solely rely on Stable Diffusion to generate results from scratch. Instead, we utilize DDIM Inversion for image editing, which is less challenging and exhibits higher stability.\n\n> ***References***\n\n[1] https://stablediffusionxl.com/\n\n[2] https://www.reddit.com/r/StableDiffusion/comments/13bjs6x/some_unedited_faces_made_with_base_sd_15/"}, {"review_id": "oSfPqi4AEk", "reviewer": "Reviewer_g14p", "summary": "This paper addresses coverless image steganography by taking the prompt as the guidance to generate stego images using Stable Diffusion. It shows better controllability with language-driven model, better robustness and security with stronger generation power of diffusion probabilistic model. Experimental results show better performance than SOTAs. ", "questions": "+) In Figure 8, what does \"Shoot\" mean?\n+) Typo error: In Algorithm1, L2, hided -> hidden\n+) Does CRoSS have any limitations?", "limitations": "Not mentions. I'd like to hear about any potential limitations.", "rating": 3, "confidence": 5, "soundness": 2, "presentation": 1, "contribution": 1, "strengths": "+) The first coverless stegnography that uses pretrained diffusion model for image steganography;\n+) Prompt as control of steganography", "weaknesses": "-) Novelty is somewhat limited. It is obvious that using fixed sampling could always generate the same image using a pretrained diffusion model. I'd like to see contributions in terms of network structures and insights that drives coverless steganography in general. \n-) Not clear about how the public and private keys are used in the model. \n-) Missing experiments on popular datasets such as  BOSSbase and BOWS2. \n-) Another major problem is RIIS performance better than CRoSS in some cases. Please explain them in details. It is not proper that RIIS is trained on degraded data compared to CRoSS, as both can be set under the same setting. \n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your constructive comments! If there are any additional comments to be added, please continue the discussion with us.\n\n> ***Weakness #1: The novelty is limited.*** \n\n- Our contributions are primarily demonstrated in the following aspects. $\\textbf{\\textcolor{red}{These major contributions firmly establish the novelty of our work}}$: \n    - (1) We are the $\\textbf{\\textcolor{red}{first}}$ to apply diffusion models to image steganography. \n    - (2) Our approach exhibits $\\textbf{\\textcolor{red}{significant advantages}}$ in terms of security and robustness.\n    - (3) CRoSS, as a novel image steganography framework, can provide $\\textbf{\\textcolor{red}{valuable insights}}$ for future research in the field of image steganography. \n- We are uncertain why you mentioned the point about \"fixed sampling generating the same image,\" as it appears unrelated to our work. Could you please provide further clarification or elaboration on this matter? \n- Our work does not focus on introducing a new model structure; instead, our objective is to present a novel image steganography framework. This framework inherently offers a wealth of insights to inspire future research.\n\n> ***Weakness #2 & Question #1 & Question #3: Some missing contents (but we have already provided them)*** \n\n- **(Weakness #2)** We have provided detailed explanations about private and public keys in two separate paragraphs in $\\textbf{\\textcolor{red}{Section 3.3 (Lines 206-212, Lines 231-237)}}$. Could you please specify the specific points that you find unclear so that we can address them more precisely?\n- **(Question #1)** We have already explained the meaning of \"Shoot\" in $\\textbf{\\textcolor{red}{Section 4.4 (Lines 305-306)}}$. The meaning of \"Shoot\" is: we utilize the mobile phone to capture the container images on the screen and then simply crop and warp them.\n- **(Question #3)** We have thoroughly discussed the limitations of CRoSS in $\\textbf{\\textcolor{red}{Section D}}$ of the supplementary materials.\n\n> ***Weakness #3: Missing experiments on other datasets.*** \n\n- The two datasets you mentioned, BOSSbase and BOWS2, both consist of 10,000 grayscale images with dimensions of 512x512. As far as we are aware, many studies related to image steganography have not conducted experiments on them, such as RIIS (CVPR 2022) [1], HiNet (ICCV 2021) [2], and ISN (CVPR 2021) [3]. \n- Moreover, these two datasets $\\textbf{\\textcolor{red}{do not align with our experimental setting}}$. For evaluation, CRoSS requires labeled text prompts for secret images. BOSSbase and BOWS2 do not meet this specific requirement. Therefore, we gathered and labeled the Stego260 dataset ourselves for evaluation, and this dataset can also facilitate future related research.\n\n> ***Weakness #4: Comparison between RIIS and CRoSS*** \n\n- Please note that RIIS [1] is a method that requires training specific to degradation types, whereas CRoSS $\\textbf{\\textcolor{red}{does not require training}}$. Therefore, RIIS and CRoSS cannot share the same setting and it's not surprising that RIIS performs better in scenarios with no degradation or some synthetic degradation, as opposed to CRoSS. \n- However, CRoSS exhibits $\\textbf{\\textcolor{red}{significant advantages}}$ in cases involving real-world degradations such as WeChat and Shoot. Furthermore, it's not possible for RIIS to train on all types of degradations, including real-world degradations. Therefore, CRoSS holds clear $\\textbf{\\textcolor{red}{practical advantages}}$ over RIIS, and such a comparison is appropriate.\n\n> ***Question #2: A typo*** \n\nThank you for pointing out this typo. We will correct it in the revised version.\n\n> ***References***\n\n[1] Robust Invertible Image Steganography. CVPR 2022.\n\n[2] HiNet: Deep Image Hiding by Invertible Network. ICCV 2021.\n\n[3] Large-capacity Image Steganography based on Invertible Neural Networks. CVPR 2021. \n\n"}, {"review_id": "MyzoJfjywa", "reviewer": "Reviewer_1iwK", "summary": "This paper presents CRoSS, a novel image steganography framework leveraging text-driven diffusion models. It offers improved security, robustness, and controllability compared to cover-based methods. ", "questions": "- Please conduct large-scale quantitative experiments, author may refer to the the settings in InstructPix2Pix [A].\n- Please conduct experiments using prompts that show low relation with the secret images.\n- More distortions shall be considered to verify general robustness.\n\n[A] Brooks T, Holynski A, Efros A A. Instructpix2pix: Learning to follow image editing instructions[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2023: 18392-18402.", "limitations": "NA", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "CRoSS is the first work to introduce diffusion models to image steganography and achieves these benefits without requiring additional training.", "weaknesses": "- Equation 3 should be written in detail. Is it the same as those in Section H of appendix in guided diffusion [A]？\n\n- The collected dataset only contains 260 images, rendering it not convincing in the conclusions from the presented quantitative experiments.  Besides, the secret and stego image pairs much resemble either in appearance or in concept, e.g., cat versus tiger, or man versus woman. As a result, there is a restriction of secret-stego correlation that does not exist in the compared previous works.\n\n- Stable diffusion [B] utilizes VAE to reconstruct images from the latent space, leading to inherent errors. As a result, the performance of CRoSS is constrained by this factor, resulting in significant errors. In hiding tasks, the extraction accuracy is a crucial metric. But the PSNR between the revealed images and the corresponding secret images is merely 23.79dB, or even less when there is distortion, suggesting that the method can be less applicable in the real world.\n\n- For each instance of covert transmission using the proposed method, the recipient must know the exact prompt or condition, e.g., word, sketch, or even parameters, used during hiding, which might be costy and inpractical.\n\n- As stated in [C], setting the guidance scale to 1 (used in the classifier-free control algorithm) may compromise the image editability. But in this paper, it is indeed set to 1, which could potentially limit the range of secret image selection.\n\n\n[A] Dhariwal P, Nichol A. Diffusion models beat gans on image synthesis[J]. Advances in Neural Information Processing Systems, 2021, 34: 8780-8794.\n\n[B] Rombach R, Blattmann A, Lorenz D, et al. High-resolution image synthesis with latent diffusion models[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2022: 10684-10695.\n\n[C] Mokady R, Hertz A, Aberman K, et al. Null-text inversion for editing real images using guided diffusion models[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2023: 6038-6047.\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your constructive comments! If there are any remaining questions that have not been adequately addressed, please feel free to continue the discussion with us.\n\n> ***We earnestly request you to reconsider your assessment of our work, taking into consideration different aspects.***\n\n- We understand that your concerns about our work primarily center around objective fidelity and practical applicability. From our perspective, CRoSS holds distinct advantages in terms of $\\textbf{\\textcolor{red}{security and robustness}}$, which significantly enhance its $\\textbf{\\textcolor{red}{practical applicability}}$. \n- The introduction of diffusion models for the $\\textbf{\\textcolor{red}{first}}$ time introduces new directions and tools in the field of image steganography, $\\textbf{\\textcolor{red}{inspiring}}$ future research. \n\n> ***Weakness #1: The details of Equation 3 and its relationship with guided diffusion.*** \n\n- Equation 3 describes the sampling process of DDIM [1], while the appendix H in guided diffusion [2] discusses sampling process of conditional diffusion models. $\\textbf{\\textcolor{red}{These are distinct concepts and not closely related}}$. \n- As the specific details of the DDIM sampling process are not a central focus of our work, we employed the concise form presented in Equation 3. This type of representation is commonly used in many relevant literatures due to its brevity. \n- The details of Equation 3 involve iteratively executing the single-step sampling formula (Equation 2) using a FOR loop, sampling from $\\mathbf{x}_T$ to $\\mathbf{x}_0$ .\n\n> ***Weakness #2 & Question #1: Insufficient size of Stego260 and similarity between secret and container images.*** \n\n- On one hand, the dataset size of Stego260 is not considered small. For instance, some previous works such as RIIS (CVPR 2022) [3], only conducted evaluation on just 100 images from DIV2K. \n- On the other hand, creating a large-scale dataset for image steganography with text prompt labels (similar to Instruct-Pix2Pix [4]) is both costly and not a primary focus of our study. It might be more appropriate to leave this issue for future work. \n- In our experimental setting, there is indeed an issue of similarity between secret images and container images. This is primarily attributed to the limited editing capability of Stable Diffusion (with guidance scale = 1). However, this aspect is **independent** of our proposed CRoSS framework. If in the future there are more powerful diffusion-based editors available, they could be seamlessly integrated into CRoSS, potentially alleviating the concern you raised.\n\n> ***Weakness #3: Concerns about objective fidelity and practicality.***\n\n- The fidelity of our results is subjectively acceptable in terms of visual perception, and the quality does not reach the level of \"significant errors\" as you mentioned. Our emphasis is not on pixel-level objective fidelity metrics such as PSNR, but rather on semantic fidelity. \n- It's important to emphasize that evaluating an image steganography algorithm requires a $\\textbf{\\textcolor{red}{comprehensive consideration}}$ of three aspects: fidelity, security, and robustness. CRoSS exhibits significant advantages in terms of security and robustness, and considering that its fidelity is subjectively acceptable, CRoSS should indeed have $\\textbf{\\textcolor{red}{great practical advantages}}$ in real-world applications. \n\n> ***Weakness #4: Practicality of the private and public keys such as prompts.*** \n\n- In most cases, we use text prompts as the key. In this scenario, we have the following reasons to demonstrate the practicality of using text prompts: \n    - (1) The transmission and storage costs of text prompts are **highly efficient**. \n    - (2) During the reveal process, it's not necessary for each word to be exact; rather, a **general semantic correctness** is sufficient. \n- For other types of keys, they are extensions we introduced to showcase the diversity and extensibility of the CRoSS framework.\n\n> ***Weakness #5 & Question #2: The editability is limited with 1 as guidance scale.*** \n\n- To ensure invertibility, we opted for Stable Diffusion (with guidance scale = 1), which indeed has limitations in terms of generation and editing capabilities. Therefore, it may not perform well in cases where the correlation between the given prompt and secret image is low.\n- However, this limitation is inherent to Stable Diffusion itself. The focus of the CRoSS work is to introduce a novel framework, which is **independent** of the specific diffusion model chosen. If in the future, more powerful diffusion-based editors (such as the latest SDXL [5]) become available, they can be readily integrated as a plug-and-play replacement for Stable Diffusion to achieve improved outcomes.\n\n> ***Question #3: More distortions should be considered to verify general robustness.*** \n\n- Regarding distortion types, we have conducted experiments involving five different types: **Resize, Gaussian noise, JPEG compression, WeChat, and Shoot**. Particularly, the WeChat and Shoot categories include complex real-world degradations, such as information loss due to **image compression, color distortion, and moiré patterns**. \n- Following the advice from Reviewer mtD2, we have also added supplementary experiments in the supplementary rebuttal PDF file, including **Poisson noise, salt-and-pepper noise and blurring-a-patch distortion**. \n- In conclusion, the number of distortion types included in the robustness experiments should be $\\textbf{\\textcolor{red}{sufficient}}$ to clearly demonstrate the significant advantages of CRoSS in terms of robustness.\n\n> ***References:***\n\n[1] Denoising Diffusion Implicit Models. ICLR 2021.\n\n[2] Diffusion Models Beat Gans on Image Synthesis. NeurIPS 2021.\n\n[3] Robust Invertible Image Steganography. CVPR 2022.\n\n[4] InstructPix2Pix: Learning to Follow Image Editing Instructions. CVPR 2023.\n\n[5] https://stablediffusionxl.com/\n"}]

Author rebuttal:
We sincerely appreciate all the constructive comments from the reviewers! Below is our brief overall response. 

> ***Firstly, we are delighted to observe that the reviewers have acknowledged various aspects of our work:***

- Reviewer mtD2 and Reviewer Nci3 hold a $\textbf{\textcolor{red}{positive}}$ side for our work in terms of $\textbf{\textcolor{red}{soundness, presentation, contribution, novelty and effectiveness.}}$
- $\textbf{\textcolor{red}{All}}$ reviewers, including Reviewer mtD2, Reviewer Nci3, Reviewer g14p, and Reviewer 1iwK, consider our attempt to introduce diffusion models into the field of image steganography as a $\textbf{\textcolor{red}{strength}}$ of our work.

> ***Secondly, we would like to emphasize the value and contribution of our work:***

- Based on diffusion models, CRoSS demonstrates unique advantages in terms of $\textbf{\textcolor{red}{security and robustness}}$, while maintaining acceptable subjective fidelity. This highlights the $\textbf{\textcolor{red}{greater practicality}}$ of CRoSS compared to previous non-diffusion model methods. 
- CRoSS introduces the $\textbf{\textcolor{red}{first}}$ image steganography framework based on diffusion models, and this framework exhibits strong extensibility, serving as $\textbf{\textcolor{red}{inspiration}}$ for the future development of the field of image steganography.
- We have observed that Reviewer g14p claims a lack of novelty and insights in our work. However, the advantages and contributions listed above clearly demonstrate the novelty of CRoSS.

> ***Thirdly, we would like to further clarify the concerns regarding objective fidelity and practicality.***

- We have observed Reviewer 1iwK's concerns regarding the objective fidelity and practicality of CRoSS. However, evaluating an image steganography algorithm requires $\textbf{\textcolor{red}{a comprehensive consideration of fidelity, security, and robustness}}$, which many previous methods have overlooked, leading to poor practicality. In contrast, CRoSS exhibits excellent security and robustness, along with acceptable subjective fidelity, which grants it significant practical advantages.

We kindly request the reviewers to thoroughly consider the value and contribution of our work. The detailed rebuttals for each reviewer can be found below. 

Additionally, we have attached a $\textbf{\textcolor{red}{PDF file}}$ containing some figures and tables for the reviewers' reference.


Meta-review: In this paper, the authors introduce an image steganography framework that uses a diffusion model to enhance controllability, and robustness of the steganography method. It is a significant benefit that this can be achieved using a foundation diffusion model and does not require additional training. 

One reviewer maintained a concern that the comparison between RIIS and CROSS is not fair, because the baseline method has not been trained with Stable Diffusion. There was extensive discussion but the reviewer remained concerned.  This is understood but leveraging powerful pre-trained models is beneficial if it improves performance, so despite the fairness issue this is progress in my opinion. 

There were additional concerns on the image quality for some of the experiments but overall the paper seems to have good ideas and reasonable experiments so I recommend acceptance.
Decision: Accept (poster)