LD-RoViS: Training-free Robust Video Steganography for Deterministic Latent Diffusion Model
Authors: Xiangkun Wang
Kejiang Chen
Lincong Li
Weiming Zhang
Nenghai Yu
Venue: NeurIPS 2025 poster ()
Keywords: Video steganography
latent diffusion model
Primary area: deep_learning

Abstract: Existing video steganography methods primarily embed secret information by modifying video content in the spatial or compressed domains. However, such methods are prone to distortion drift and are easily detected by steganalysis. Generative steganography, which avoids direct modification of the cover data, offers a promising alternative. Despite recent advances, most generative steganography studies focus on images and are difficult to extend to videos because of compression-induced distortions and the unique architecture of video generation models. To address these challenges, we propose LD-RoViS, a training-free and robust video steganography framework for the deterministic latent diffusion model. By modulating implicit conditional parameters during the diffusion process, LD-RoViS constructs a dedicated steganographic channel. Additionally, we introduce a novel multi-mask mechanism to mitigate errors caused by video compression and post-processing. The experimental results demonstrate that LD-RoViS can embed approximately 12,000 bits of data into a 5-second video with an extraction accuracy exceeding 99\%. Our implementation is available at https://github.com/xiangkun1999/LD-RoViS.

LD-RoViS: Training-free Robust Video Steganography for Deterministic Latent Diffusion Model
Xiangkun Wang!
Kejiang C2
Lincong Li
Weiming Zhang Nenghai Yu!
University of Science and Technology of China, China Anhui Province Key Laboratory of Digital Security, China
wangxiangkunnmaiil ustc. edu. cn
chenkj@ustc, edu. cn
Abstract
Existing video steganography methods primarily embed secret information by mod- ifying video content in the spatial or compressed domains. However, such methods are prone distortion drift and are easily detected by steganalysis. Generative steganography, which avoids direct modification of the cover data, offers a promis- ing alternative. Despite recent advances, most generative steganography studies fo- cus images and are difficult to extend to videos because of compression induced distortions and the unique architecture of video generation models. To address these challenges, we propose LD-RoViS. ViS, training-free and robust video steganography framework for the deterministic latent diffusion model. By modulating implicit con- ditional parameters during the diffusion process, LD-RoViS constructs a dedicated steganographic channel. Additionally, we introduce a novel multi-mask mechanism mitigate eгrоrs caused by video compression and post-procet settprocessing The experi- mental results demonstrate that LD-Ro DD-RoViS ViS can embed approximately 12,000 bits of data into 5-second video with an extraction accuracy exceeding 99%. Our im- com http://iinnnn999/1D---- RoVis
plementation is available at
1 Introduction
In the contemporary digital era, the rapid spread and extensive sharing of information have brought increasing attention to information security. Steganography [1] as a key technique for information hiding, aims to embed secret data within normal data to enable covert communication. Among various media, video has become particularly valuable cover for steganography because of its high complexity and large capacity for hiding data [2]. In contrast, steganalysis [3. as an adversarial technique of steganography, seeks to detect the presence of hidden information.
Early video steganography methods can be broadly categorized into spatial domain methods and transform domain methods. Spatial domain methods 4
5 6
7 g 9
embed information by directly
modifying pixel values in video frames. Transform domain methods 10 [1
[3] 14] 15 16), on
the other hand, leverage transformations such as DWT and DCT to embed data in the frequency domain, enhancing robustness against video encoding. Given the advantages of compressed video in storage and transmission, researchers have also explored compressed domain steganography [17 [8] 19 20 22 23), embedding messages into elements such as DCT coefficients, motion vectors, and prediction modes during video compression. While effective in certain scenarios, these traditional methods inevitably modify video content or encode content, making them vulnerable to distortion drift and steganalysis attacks (24] 25 26).
With the rapid development of generative AI, many perforrerre models has emerged, capable of generating realistic text, images, and video. Among them, video generation models based on
Corresponding author.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

diffusion models have become a dominant paradigm, exemplified by advanced systems such as Sora [27] Gen-4 [28], Veo-2, Hunyuan Video [29] and Wan2.1 [3). Simultaneously, Al g-geerrtted videos have become widespread on social media platforms, reshaping the data environment for video steganography. According to statisties from Zebracat A Al-generated videos account for 40% of video content on major social platforms. Recent studies have proposed generative steganography methods [31 32
37 38 39I, which avoid directly modifying the cover data, and instead embed secret messages implicitly during the data generation process. These methods have shown strong resistance to steganalysis. However, current research in this area has focused almost exclusively on images, leaving generative video steganography largely unexplored.
33
34 35, 36
Given that videos are composed of sequences of images, and that generative image steganography has matured considerably, an intuitive question arises: Can these methods be extended to videos? Some researchers have made early attempts in this direction. For example, [40] extends 31 into latent space and provides a simple implementation of video steganography based on Stable Video Diffusion [1 Similarly, [42 employs a facp-swapping model to embed messages into facial features, achieving robust video steganography. However, these methods
not compatible with most state- of-the-art (SOTA) video generation models, which face three main challenges: First, SOTA video generation models often rely on deterministic sampling to accelerate inference, making methods such 40 which depend on random noise sampling inaaagg-anapplcbb..... Second, most diffusion samplers designed for one-directional generation and cannot achieve perfect invertibility, whereas 37 38 39 map messages to the initial noise and depend on accurate inversion of the sampling process for extraction, making them unsuitable for non-reversible video diffusion models. Third, compression processing [43 imposed by video-sharing platforms presents additional challenges to the robustness of steganographic embedding.
as [31] 32
33
36
To address these limitations, we propose LD-RoViS (Latent Diffusion-based Robust Video Steganography), a training-free and robust steganography framework designed for deterministic latent diffusion models. By modulating the conditional parameters at the final time step of the diffusion process, we construct steganographic channel to embed secret information into latent variables. Furthermore, to ensure robustness against video compression on social platforms, we introduce multi-mask mechanism identify and utilize the robust regions in the latent space for message embedding.
Our main contributions can be summarized as follows:
We introduce LD-RoViS, the first training-free frrenngg-reeeeee video steganography method for deterministic latent diffusion models.
We design an implicit parameter modulation strategy to seamlessly integrate message embedding into the generation process.
We propose a multi-mast mechanism to identify robust regions in latent space, enabling adaptive message embedding and enhancing resistance to compression-indee induuedd errors.
We conduct extensive experiments to evaluate LD-RoViS, demonstrating its superior perfor- mance over existing methods terms of capacity, robustness, and security.
2
Related Work
2.1 Diffusion Models
The core framework of diffusion models consists of two phases: forward diffusion and reverse denoising. The forward process incrementally corrupts data with Gaussian noise until it becomes pure noise, whereas the reverse process learns to predict and remove noise via neural networks to reconstruct the original data. Diffusion models have emerged as the dominant paradigm in generative models because of their high-quality generation capabilities. Current diffusion models can be categorized on the basis of their sampling strategies, outlined below.
DDPM (Denoising Diffusion Probabilistic Model), The forward process of DDPM 44 follows
Markov chain for noise addition, whereas the reverse process trains a U-Net via variational inference.

---

From one time step t to the previous time step t 1, the reverse sampling in DDPM can be expressed as:
Ott Or
co(x(;:) t) + oec, N(O,
X
X
(I)
where (x,e t) is the noise predicted by the neural network, ae and āg are predefined noise scheduler parameters, and is the standard deviation of the sampled Gaussian noise. Despite excellent genera- tion quality, DDPM requires hundreds of sampling iterations, leading to low efficiency. Additionally, its reliance stochastic sampling of makes it non-deterministic model.
DDIM (Denoising Diffusion Implicit Model). To address DDPM's inefficiency, DDIM [45] employs non- non-Markenn Markoviak process and reparameterizatioo to enable sampling with arbitrary step sizes. From time step to a time step s (where 8 < t), the DDIM sampling can be expressed as:
vI dieo (x,,
X, Vāglo + vI a, ozea(x,, 1) t,E, fo(x
v 0r
where (x,,,,)) t) is the noise predicted by the neural network, a, and c. are the predefined noise scheduler parameters. When a, + O, DDIM becomes non-deterministic; otherwise, DDIM is deterministic.
Flow Matching. Instead of relying Markov chains, Flow Matching 466 formulates diffusion as the continuous evolution of vector fields. From a time step t to a time step t At, the flow-based sampling in Flow Matching can be expressed as:
X At x Al fx I):
where (x,, 1) is an output of a neural network. Since Flow Matching does not involve the sampling of random variables, it is deterministic.
2.2 Diffusion-Band Generative Steganography
Steganographic methods based on diffusion models embed hidden information into the data synthesis process. Previous work mainly focused on image steganography, which supports image-level [3 35
or message-level 31 40
33
32
hiding. In this paper, we focus on message-level hiding.
StegaDDPM 332 performs steganographic embedding at the final time step of the reverse diffusion process. By partitioning the probability density function of the Gaussian distribution into equal- probability intervals, it constructs a reversible mapping from binary messages to Gaussian noise variables e, thereby enabling message embedding within the generated images. However, this method is highly sensitive to lossy image transformations.
extends StegaDDPM from the pixel space the latent space, making it compatible with mainstream latent diffusion models. By mapping messages to a biased distribution, LDStega reduces the probability of extraction errors. In addition, it enhances robustness by performing a pre-encoding and decoding scheme on the latent variables.
L.Steega 33
Pulsar B1 adopts different mapping strategy. At the final time step of the diffusion process, two noise samples, 1 and e2, are generated via two distinct secret keys. These are then mixed according binary message produce the final noise added the image. The receiver extracts the hidden message by comparing the distances between the stego image and the two reference images generated via the secret keys.
PSyDUCK [40] extends Pulsar from the pixel space to the latent space and investigates the impact of using two distinct keys at different diffusion timesteps. Moreover, it explores the applicability of the method in video generation models.
These methods heavily rely non-deterministic sampling models. However, mainstream video generation models typically adopt deterministic sampling to enable faster inference and better con- trollability 30), rendering the above methods inapplicable. Moreover, the compression [ applied by video-sharing platforms poses additional challenges to the robustness of video steganography methods.
3

---

emerald bird ranning and jumping branck.
Sender
011010011
seed
Wan
Embedding
Video Model
Xy
key
Ry czz
Muli-Maok
Xs
Social Netwark Trarsmision
seed
Multi-Makk
Wan
key kf
Extraction
Video Model
X
Xs
V/2
Promept: A bus smerald bird rarsing and jumping on branah.
Receiver
'011010111'
Figure I: Overview of our proposed LD-RoViS.
Method
Our robust video steganography method is built upon deterministic latent diffusion video model, enabling reliable message embedding and extraction even under challenging transmission conditions. The following sections provide systematic overview of the proposed method.
3.1 Overview of LD-RoViS
As shown in Fig. the sender and receiver share the parameters: prompl, seed, hig, and cfg, where prompt refers to the text input fed into the video generation model to control the semantic content of the generated video. seed a random seed that controls the sampling of the initial noise Xr. The values kg. and cfg denote different values of the classifier-free guidance (CFG) scale. The CFG scale controls how closely the generated content aligns with the input prompt.
On the sender's side, prompt, seed, and k2 are used to drive the diffusion process in the latent space up the final time step. At this final time step, message embedding is performed via efg and the message m, yielding the final latent variable X,, This latent variable is then passed through the decoder D to generate the stego video V,, The stego video is shared with the receiver via social platforms, and the received video is denoted as V.. The receiver encodes V via the encoder F to obtain the latent variable X and leverages the shared prompt, seed, and to perform the same generation procedure as the sender. At the final time step, the receiver uses cfş and X to extract the hidden message.
V RCXPXXXWW to represent the video, and X C x'W' to represent the latent variable, where C. F. W denote the number of channels, frames, height, and width of the video V. while C', F', H', W represent the corresponding attributes in the latent space.
In the following,
3.2 Message Embedding
The detailed framework our proposed LD-RoViS is shown in Fig. where "Shared" denotes the operations that need to be performed by both the sender and the receiver.
To embed message, the sender first executes the "Shared" component. Specifically, the sender provides prompt and seed to the video generative model (denoted as G). The model G begins by sampling Xr from a Gaussian distribution using the given seed, and then performs 7 denoising steps to obtain the latent representation X₁. We use Diffuse(-) to represent the denoising process, then the above process can be formulated as:
X1 Diffusee(Ga XT,
3.2.1 Parameter Modulation Strategy
The parameter modulation strategy lies at the core of our steganographic method. During each denois- ing step, the CFG scale controls the weighting between the predicted conditional and unconditional noise, formulated as:
cx(x;, t) prrdduncond + CFG (predcond preduncond),
(5)

---

Shared
Provett On, conntr resd nea ralsing
Sender
X
lndi berd to prodect isel from the rail.
My - Mene(A
Wan
X3
Embrasongg 9 R.
Xy
X1
X
N.
X
M
Tranniister
X
Eetraccion(y X 422..
Noai
Y.
Preprocess
Receiver
X3
X6
M
Figure 2: Framework of our proposed LD-RoViS.
where eø (X,, t) denotes the noise predicted by G at each timestep, while predoond and preduncond represent the conditional and unconditional predicted noise, respectively.
Varying the CFG scale alters the trajectory of the diffusion process, resulting in different latent variables. This modulation strategy is equally applicable to deterministic diffusion models. On the basis of this insight, we can generate three different outputs--Xo X and X2-from the same latent variable X1 in the final denoising step by using different values of CFG kg. kg cfg, and k; efg, respectively. This can be expressed as:
X₂ = Diffuse X1, where X, E (Xo, Xo: & E (ka, k, + cfg, ko cfg). (6)
These latents exhibit subtle semantic differences while maintaining visual consistency with prompt. creating discriminative latent pair for message encoding.
3.2.2 Multi-mask Mechanism
Before message embedding, design multi-mask mechanism to identify robust regions in the latent space, aiming to enhance the resilience of the steganographic method against operations such video compression.
Invariance Mask M1: This mask highlights latent positions that remain stable after encoder-decoder and noise addition. As shown in the "Preprocess" section of Fig. 2, we apply encoding, decoding, and noise to Xo to simulate the distortion that may occur when the generated video used in real- weal-world scenarios. We use Noise(-) to denote lossy processing such video compression. The above process can be expressed as:
X E(Noise (D(o)) We then compute the Ln distance between X, and X as:
di (c, f. w) Xo(c, f, h, w) Xo(c, f. w)ll
(8)
where (c, f,h, h, w) indices valid positions within the spatial-temporal dimensions.
The invariance mask Mi defined as the set of position indices corresponding the smallest 71% values in dj. We define this function as Mask(-), -.), formally expressed as:
if di S, w) E top smallest TI, otherwise.
M1 w) Mask (d1, m1)
Mj = marks invariant regions resilient to codec distortions and noise.
Discriminative Mask M2: This mask identifies latent positions where X3 and X differ the most, enabling reliable bit discrimination. Similarly, compute L1 distances between X and X3:-
d2(c, f, h, w) [|X] f, h, w) - X3 (c, f, h, w)]-
(10)
The discriminative mask M2 defined as the of position indices corresponding the largest 72% values in dy, formally expressed as:
Ma(c, J. w) I Mask(d2, 12)) = {1
if d2 f, w) top largest 72,
(11)
otherwise,
5

---

where I is the identity matrix.
Combined Mask M: The final mask is the dot product of M, and M2, retaining positions that both invariant (M1 = 1) and discriminative (M2 =1)
M = Mi O M2, E x='"""XX'
(12)
Positions where M = 1 (both masks are 1) are used for message embedding, ensuring robustness.
3.2.3 Embedding
On the basis of the analysis in Section 3.2.2, the steganographic capacity of LD-RoViS depends on TI and T2. For generated video V,, assume that M1 and M2 are independent, the embedding capacity is given by:
==
F H
W X
(13)
where slight variations may occur due to ties in percentile rankings. Accordingly, embed binary message m of length n, and construct an embedding matrix from m via the following rule:
{-1 mh Mf, w) 1, (embedding region)
if M(c, f. h, w) = 0, (non-embedding region)
(e, [,,,,,h, f,h, w), = Transform( M, m)
(14)
where my {0, 1} is the k-th bit m, which is filled row-wise from top-left nottom-right The stego latent X, formed by mixing Xo. Xo. and X3 according to H:
S,lc,
if H(c, f,h, w) = -1, if H f, w) =0, if
Xg(c,f,h w)= Embeddiin(XXo...... X2.
h,
(15)
Finally, X₂ is decoded to the stego video V, D(X.) for transmission.
Algorithm Message Embedding Algorithm
Algorithm 2 Message Extraction Algorithm
Input: prompt, seed, k., efg, message m.
1: Input: prompt, seed, hss cfg, received video
thresholds
V2. thresholds 7ı,
2: Output: stego video V,
2: Output: recovered message m'
3: Shared: G, D, E
3: Shared:
E
4: Sample Xr from (0)
4: Sample Xy from (/ I)
5: Perform T-step denoising:
5: Perform T-step denoising:
6: Xo + DiffuselG. Xr, ks)
6: Xo Diffuuse (G, Ny,
7:
x! Dif X1, efg)
7:
X3 Diffusee G,X X1, efg)
8:
X DC, G, Xi, cfg)
8:
X Diffuse X1, efg)
9: Preprocess:
Preprocess:
10:
X/ E(Noise(D((x)))
10:
X E(Noise ([NooiseD((Xo))
11:
Mi Mask(Li L, (Xo, X6), Ti)
11:
Mi + Mask(Li (Xo, X6);
12: Ma + 1- Mask(Lo (X)= X3),
12:
M2 + 1 Mask(Li (X X2),
13:
Mi @ M2
13: M <- Mi M2
14: Message Encoding:
14: Stego Latent Extraction:
15:
Transform( (,onmMM,,n m))
15: X + FFVV))
16: Latent Mixing!
16: Message Decoding:
17: For each (c. w)) in latent space:
17: Initialize empty message m'
18:
if H,,,
then X.(c, f,,,,,,
18:
For each f. where M(c,
Xule, f.h,
19:
elif (c,, f. w) = then (c,
19:
di (X (1,5)
X) J.
20:
de + (x, xf
20:
else (x f, h, f.h W*+D(X,
21:
if d2 then append ml
22:
else append to ml
22: return V.
23:
return m/

---

3.3 Message Extraction
The receiver, equipped with the shared prompt and parameters (seed, ks cfg), regenerates Xu, Xo.-xp x and M via the same steps ("Shared" section in Fig. 2). The received video V is encoded X EVV))
For each position (c, ʃ h, w) where Mc, h. w) = 1, the receiver compares the 1, distances between X and X6: X3 recover the message m' Eatraction(XX, X²: X X3, M):
dc,,,, w) = (e, f, w) (e f,h, will:
(16)
((efhh,w) - h) - (c, f. w)ll;
(17)
k,,,) w) and M (c, f, h, w) = 1, S0 (c, < de,c, f, h,
mi {1 (c,f 2 dg(c, f. h. w) and (c, f, h, w) = 1,
(18)
where mn E {0, 1} is the k-th bit m', which is filled row-wise from top-left to bottom-right.
The embedding and extraction procedures are shown in Algorithm 1 and Algorithm 2. respectively. According to Equations 16, 17, and 18, the accuracy of message extraction highly dependent on the difference between X and X3. To simplify the design while maintaining this distinguishability. we generate the two variables using symmetric CFG scales, ie., kg + cfg and k2 cfg, where efg a tunable hyperparameter controlling the modulation intensity.
4 Experiment
4.1
Experiment Setup
Our proposed LD-RoViS is built upon a deterministic latent video diffusion model. To this end, adopt the T2V-1.3B model from Wan2.1 (30 as video model. This model leverages Flow Matching sampling to efficiently produce high-quality videos. For evaluation, we use VidProM [47). large-scale and diverse text-to-video prompt dataset. We randomly sample 100 prompts from VidProM and generate corresponding videos via Wan2.1 Each video has resolution of 480x832, a duration of seconds, and frame rate of 16 fps. resulting 81 frames per video. All subsequent experiments are conducted on these 100 prompts with seed 99, k,- 5.0 and run on four NVIDIA RTX A6000 GPUs, each with 48 GB of VRAM. our experiments, we set the hyperparameters as T1 0.32, 72 0.02, and cfş = 16. Additional experiments and analysis of these hyperparameters can be found the Appendix A, including experiments on a non-deterministic model (L.TX-Video
4.2 Evaluation Metrics
We evaluate the performance of our steganographic method via the following metrics:
Accuracy (acc, %) is defined as the ratio of correctly recovered bits in m' to m. A higher acc indicates greater robustness.
Peak Signal-to-Noise Ratio (PSNR, dB) measures the perceptual similarity between two images; higher PSNR indicates better image quality. In this work. the PSNR is computed as the average PSNR across all frames between V. and V..
BRISQUE 49 is no-reference image quality assessment metric commonly used to evaluate the perceptual quality of generated images. Lower BRISQUE scores correspond to higher perceptual quality. Here, we define it as the average BRISQUE
over all frames of V,.
Capacity refers to the total number of data bits that can embedded in the stego video V..
Error Rate (Pr, %) denotes the error rate in steganalysis detection. A higher Py: indicates better security of the steganographic method.
4.3
Quantitative Performance Evaluation
4.3.1
Metric Experiments
To evaluate the performance of the proposed method, we conducted experiments on 100 videos generated from diverse prompts. As shown in Table 1, we report four metrics: PSNR, BRISQUE
7

---

score, accuracy (acc), and embedding capacity. Each result is presented as the mean and standard deviation over the 100 test videos. We compare our method with three recent video steganography methods: two transform-domain methods (AQIM [12 and MEC_AQIM [3]), and a face-swapping based generative method (RoGVSN (42). For a fair comparison, we set the embedding capacity of
AQIM and MEC_AQIN, to 10,000 bits and tested them under the same conditions. Since RoGVSN only supports face-related video and does not allow for adjustable capacity, we selected 10 face-related videos from the test set for its evaluation. Additionally, the PSNR is not applicable to RoGVSN because of its face-swapping nature, and the corresponding values are left blank. The experimental results show that our method significantly outperforms the baselines in terms of visual quality, while maintaining high extraction accuracy and embedding capacity.
Table 1: Comparison of performance. The results are presented as the means and standard deviations.
Method
PSNRT
BRISQUEL
(%)
capacity
AQIM
34.81
32.87 1 6.06
99.44
0.27
10000 (fied)
MEC AQIM
35.21 = 0.47
32.71 + 6.10
90.99
= 5.90
10000 (fixed)
RoGVSN
19.53
+ 4.55
99
= 0.38
729 (fixed)
Ours 41.66 1.52
28.90
+ 6.05
99.17
= 0.63
11983 + 1446
4.3.2 Security Experiments
To evaluate the resistance of our proposed LD-RoViS against steganalysis attacks, we compare it with three baseline methods. Following the experimental setup in [2], we adopt two image steganalyzers, CovNet (24] and LWENet [25], and one video steganalysis feature extractor, SUPERB (50) combined with linear classifier [51] We test 100 generated cover-stego video pairs. For fair comparison, the capacity of AQIM and MEC AQIM is set to 10,000 bits. Since the capacity of RoGVSN is fixed, we follow its original design with a payload 729 bits. Using ffimpeg we decode these videos to obtain 8,100 pairs of cover and stego frames, with 4,000 used for training, 600 for validation, and 3,500 for testing, As shown in Table 2, LD-RoViS effectively resists steganalysis attacks, achieving error rates close to 50% (random guessing).
Table 2: Pg (%,,1) of steganalysis
Table 3: acc(%) under different compression and noise.
Method
SUPERB CovNel LWENei
Method
CRF=18 CRF=23
CRF=27
moise
sall&pepper brightness
AQIM
49.14
AQIM
99.44
91.24
90.67
87.49
82.46
80.04
48.93
MEC AQIM
47.32
0.01
1.07
MEC_AQIM
90.99
82.83
82.29
78.87
72.83
71.60
50.31
RoGVSN
47.58
0.36
2.61
RoGVSN
99.28
97.42
97.06
97.04
96.20
94.45
96.05
49.18
49.74
48.49
99.17
95.89
93.70
91.67
92.82
98.72
99.02
4.3.3 Robustness Experiments
To evaluate the robustness of LD-RoViS against video compression and noise, we conducted the following experiments. The most common processing method on social media platforms is H.264 compression, where the Constant Rate Factor (CRF) a key quality control parameter, typically set to 23. In our experiments, we tested both CRF=18 and CRF=27. Additionally, we applied common noise perturbations: "noise" refers to Gaussian noise with a standard deviation of 0.05, "saltt denotes impulse noise with probability of 0.01, and "brightness" represents increase of 0.1 in the HSV color space. As shown in Table 3, LD-Ro demonstrates strong robustness to brightness changes and salt-and-pepper -epppee noise, while maintaining over 90% extraction accuracy under other lossy conditions. Although RoGVSN is more robust against H.264 compression and Gaussian noise, it is important to note that its embedding capacity is only 729 bits, whereas LD-RoViS supports approximately 12,000 bits.
4.4 Subjective performance evaluation
To evaluate the impact of steganographic embedding on video visual quality, we present several visual examples in Fig. 3. Using FFmpeg, we decode both cover and stego videos and extract the middle
' and pepper noise is applied in an image-leve manner, where single spatial impulse mask is shared across frames with an overall probability of 0.01.
8

---

(4jours
PSNR: 35.39
PSNR: db
IRISQUI:: 40.01
IRRIQQUR: $1.51
(2)AQIM
15
PSNR: 30.78 db
PSNR: 50 25 dh
PSNR: 35.63 db
PONR: 15 d.
BRINQUE: 46.66
BRISQUE: 43.94
BRISQUE: 45.27
BRISQUE: $2.15
(3)MEC AQIM
(GJROGVSN
Figure 3: Visual comparisons between our method and baselines. In (2)(4), the second row shows the pixel differences between the cover and stego frames (brightness increased by 10x), whereas in (5), the second row shows the temporally adjacent frames.
frame (the s1st frame). In SubFig. 3 (2), (3), and (4), the top row shows the stego frames, whereas the bottom row shows the pixel-wise differences between the stego and cover frames (brightness enhanced 10x for better visibility). As shown, traditional video encoding and introduce noticeable block artifacts. In contrast, our method avoids direct modification of video content, resulting in only minor pixel differences in texture-rich regions. In SubFig. (5) and (6), the top row shows the stego frame, whereas the bottom row displays the subsequent frame in temporal order (i.e., the 42nd frame). Since RoGVSN embeds messages via face- swapping, noticeable blur and distortion are observed in facial regions, leading to lower perceptual quality. These results demonstrate that our method balances effective steganography with minimal perceptual impact, outperforming baselines in preserving video quality for real-world applications.
monsform-domili methods are sensitive
4.5 Ablation Studies
To further investigate the effectiveness of the multi-mask mechanism, conducted ablation studies on the two masks Mj and M2. Specifically, we evaluated three different variants of the full model, with their differences summarized in Table 4. Each variant tested 10 generated videos, and the average results are reported in Table 5. The experimental results show that removing either M, or M₂ leads to significant decrease in accuracy, confirming the effectiveness of Mj in identifying invariant regions and M2 in identifying discriminative regions within the latent space. Their combined effect enables the identification of robust areas in the latent space achieve robust steganography.
Table 4: Ablation variants.
Table 5: Performance of different variants.
Method
Mask Mi Mask Ma
Method
acc(Se)t
PSNR(db)
BRISQUEL
capacity(bits))
variantii
variantt1
62.67
35.39
30.55
1935111
varianik2
variamiW2
75.46
37.49
29.47
617913
variantH13
40.53
41132
ours
99.17
41.66
28.90
11983
5
Conclusion
In this work, we present a robust video steganography method for deterministic latent diffusion models. Our method innovatively constructs a steganographic channel by leveraging classifier- free guidance (CFG) scale of diffusion models. In addition, we introduce multi-mask mechanism based on adversarial recoding-decoding and video compression perturbations identify invariant and distinguishable regions in the latent space, thereby ensuring robustness. To the best of our knowledge.

---

this is the first steganographic method for deterministic latent diffusion, which achieves significant advantages in both embedding capacity and security compared with existing video steganography methods.
6 Acknowledgements
This work was supported in part by the National Natural Science Foundation of China under Grant U2336206, Grant 62472398, Grant U2436601, and Grant 62402469.
References
[1] Ross J Anderson and Fabien AP Petitcolas, On the limits of steganography, IEEE Journal on selected areas in communications, 16(4):474-481 1998.
[2] Jayakanth Kunboth, Nandhini Subramanian, Somaya Al-Maadeed, and Ahmed Bouridane. Video steganog- raphy: recent advances and challenges. Multimedia Tools and Applications, 82(27):41943 41985, 2023.
[3] Jessica Fridrich and Miroslav Goljan. Practical steganalysis of digital images: state of the art. security and Watermarking of Multimedia Contents IV, 4675:1-13, 2002.
[4] Kousik Dasgupta, JK Mandal, and Paramartha Dutta. Hash based least significant bit technique for video steganography (hlsb). International Journal of Security, Privacy and Trust Management (IJSPTM), 1(2):-11, 2012.
[5] Vivek Kumar Jha, Srilekha Mukharjee, Subhajit Roy, and Goutam Sanyal. Vidco steganography technique using factorization and spiral Isb methods. In 2017 International Conference Computer, Communications and Electronics (Comptelix), pages 315-320. IEEE, 2017.
[6] Ramadhan J Mstafa, Younis Mohammed Younis, Haval Ismael Hussein, and Muhsin Atto. new video steganography scheme based on shi-tomasi corner detector, IEEE Access, 125-166137 2020.
[7] Mritha Ramalingam and Nor Ashidi Mat Isa. A steganography approach over video images to improve security. Indian Journal of Science and Technology, 8(1):79, 2015.
[8] Hamdy M Kelash, Osama F Abdel Wahab, Osama A Elshakankiry, and Hala S El-sayed. Utilization of steganographic techniques in video sequences. International Journal of Computing and Network Technology, 2(01). 2014.
[9] Sneha Khupse and Nitin N Patil. An adaptive stegamography technique for videos using stcganoflage. In 2014 International Conference on Issues and Challenges in Intelligent Computing Techniques (ICICT), pages 811-815. IEEE, 2014.
[10] Anush Kolakalur, Toannis Kagalidis, and Branislav Vuksanovic. Wavelet based color video steganography. International Journal of Engineering and Technology. 8(3):165, 2016.
[1]] Meenu Suresh and Shatheesh Sam. Optimal wavelet transform using oppositional grey wolf optimization for video steganography. Multimedia Tools and Applications, 79:27023-27037. 2020.
[12] Pingan Fan, Hong Zhang, Yifan Cai, Pei Xie, and Xianfeng Zhao. A robust video steganographic method against social networking transcoding based on steganographic side channel. Proceedings of the 2020 ACM workshop on information hiding and multimedia security. pages 127-137) 2020.
[13] Pingan Fan, Hong Zhang, and Xianfeng Zhao. Adaptive qim with minimum embedding cost for robust video steganography on social networks. IEEE Transactions on Information Forensics and Security, 17:3801- 3815, 2022.
[14] Ramadhan J Mstafa and Khaled M Elleithy. An eceldct- based robust video steganography algorithm for secure data communication. Journal of Cyber Security and Mobility, pages 167-194, 2016.
[15] Meenu Suresh and Shatheesh Sam. High secure video steganography based on shuffling data on least significant det coefficients. In 2018 Second international conference on intelligent computing and control systems (ICICCS), pages 877- 882, IEEE, 2018
[16] Mritha Ramalingam and Nor Ashidi Mat Isa. Video steganography based on integer haar wavelet transforms for secured data transfer. Indian Journal of Science and Technology, ((7):897-044 2014.
10

---

[17] Yun Cao, Yu Wang, Xianfeng Zhao, Meineng Zhu, and Zhoujun Xu. Cover block decoupling for content- adaptive h. 264 steganography. In Proceedings of the 6th ACM workshop on information hiding and multimedia security, pages 23-30, 2018.
[18] Yunxia Liu, Leiming Ju, Mingsheng Hu, Hongguo Zhao, Suimin Jia, and Zhijuan Jia, A new data hiding method for h. 264 based on secret sharing. Neurocomputing, 188: 188:113-11 13,19,, 2016.
[19] Si Liu, Yunxia Liu, Cong Feng, Hongguo Zhao, and Yu Huang. A have steganography method based on gdet coefficient. In Intelligent Computing Methodologies: 16th International Conference, ICIC 2020, Bari, Italy, October 2-5, 2020, Proceedings, Part III 16. pages 624-632. Springer, 2020.
[20] Dinh-Chien Nguyen, Thai-Son Nguyen, Fang-Ron Hsu, and Hsich- Yung Hsien. A novel steganography scheme for video h. 264/ave without distortion drift. Multimedia Tools and Applications, 78:16033-16052, 2019.
[21] Yiming Xue, Jie Zhou, Hao Zeng, Ping Zhong, and Juan Wen. An adaptive steganographic scheme for h. 264/ave video with distortion optimization. Signal Processing: Image Communication, 76:22-30, 2019.
[22] Hong Zhang, Yun Cao, and Xianfeng Zhao. Motion vector-based video steganography with preserved local optimality. Multimedia Tools and Applications,
2016.
[23] Lingyu Zhang and Xianfeng 7hao. An adaptive video steganography based intra-prediction mode and cost assignment. In International workshop on digital watermarking, pages 318-532. Springer, 2016.
[24] Xiaoqing Deng, Bolin Chen, Weiqi Luo, and Da Luo. Fast and effective global covariance pooling network for image steganalysis. In Proceedings of the ACM workshop on information hiding and multimedia security, pages 230-234, 2019.
[25] Shaowei Weng, Mengfei Chen, Lifang Yu, and Shiyao Sun. Lightweight and effective deep image steganalysis network. IEEE Signal Processing Letters, 29:1888-1892 2022.
[26] Mchdi Boroumand, Mo Chen, and Jessica Fridrich. Deep residual network for steganalysis of digital images. IEEE Transactions on Information Forensics and Security, 14(5); (45);1181-14 118--199,, 2018.
[27] Tim Brooks, Bill Peebles, Connor Holmes, Will DePue, Yufei Guo, Li Jing. David Schnurr, Joe Taylor, Troy Luhman, Eric Luhman, Clarence Ng, Ricky Wang, and Aditya Ramesh. Video generation models as world simulators. 2024.
[28] Shakiba Kheradmand, Delio Vicini, George Kopanas, Dmitry Lagun, Kwang Moo Yi. Mark Matthews, and Andrea Tagliasacchi. Stochasticsplats: Stochastic rasterization for sorting-free 3d gaussian splatting, arXiv preprint MiXiv:2503.223666 2025.
[29] Weijie Kong, Qi Tian, Zijian Zhang, Rox Min, Zuozhuo Dai, Jin Zhou, Jiangfeng Xiong, Xin Li, Bo Wu, Jianwei Zhang, et al. Hunyuanvideo: A systematic framework for large video generative models. arXiv preprint wxXi:2412.036033 2024.
[30] Ang Wang. Baole Ai, Bin Wen, Chaojie Mao, Chen-Wei Wei Xie, Di Chen, Feiwu Yu, Haiming Zhao, Jianxiao Yang. Jianyuan Zeng, et al. Wan: Open and advanced large-scale video generative models. arXiv preprint arXiv:2503.20314. 2025.
[31] Tushar M Jois, Gabrielle Beck, and Gabriel Kaptchuk. Pulsar: Secure steganography for diffusion models. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 4703-4717, 2024.
[32] Yinyin Peng, Donghui Hu, Yaofci Wang, Kejiang Chen, Gang Pei, and Weiming Zhang. Stegaddpm: Generative image steganography based on denoising diffusion probabilistic model. In Proceedings of the 31st ACM International Conference on Multimedia, pages 71 7143-7151, 2023.
[33] Yinyin Peng, Yaofei Wang, Donghui Hu, Kejiang Chen, Xianjin Rong, and Weiming Zhang. Ldstega: Practical and robust generative image steganography hased on latent diffusion models. In Proceedings of the 32nd ACM International Conference on Multimedia, pages 3001-3009, 2024.
[34] Jiwen Yu, Xuanyu Zhang, Youmin Xu, and Jian Zhang. Cross: Diffusson model makes controllable, robust and secure image steganography. Advances in Neural Information Processing Systems, 36:80730-8077 2023.
[35] Yiwei Yang, Zheyuan Liu, Jun Jia, Zhongpai Gao, Yunhao Li, Wei Sun, Xiaohong Liu, and Guangtao Zhai. Diffistega: towards universal training-free free coverless image steganography with diffusson models, arXiv preprint arXiv:2407. 10459, 2024.

---

[36] Qing Zhou, Ping Wei, Zhenxing Qian, Xinpeng Zhang, and Sheng Li. Improved generative steganography based on diffusion model. IEEE Transactions Circuity and Systems for Video Technology, 2025.
Xiaoxiao Hu, Sheng Li, Qichao Ying, Wanli Peng. Xinpeng Zhang, and Zhenxing Qian. Establishing robust generative image steganography via popular stable diffiusion. IEEE Transactions Information Forensics and Security, 2024.
[37]
[38] Daegyu Kim, Chaehun Shin, Jooyoung Choi, Dahuin Jung, and Sungroh Yoon. Diffusion-stego: Training- free diffusion generative steganography via message projection. Information Sciences, page 122358, 2025.
[39] Luke Bauer, Wenxuan Bao, and Vincent Bindschaedler. Provably secure covert messaging using image- based difffusion processes. In 2025 IEEE Conference on Secure und Trustworthy Muchine Learning (SaTML). pages 941-955. IEEE, 2025.
[40] Aqib Mahfuz, Georgia Channing, Mark van der Wilk, Philip Torr, Fabio Pizzati, Christian Schroeder de Witt. Psyduck: Training-fiee free steganography for latent diffusionn arXiv preprint arXiv:2501.191 1917, 2025.
[41] Andreas Blattmann, Tim Dockhorn, Sumith Kulal, Daniel Mendelevitch, Maciej Kilian, Dominik Lorenz, Yam Levi, Zion English, Vikram Voleti, Adam Letts, et al. Stable video diffusion: Scaling latent video diffussin models to large datasets. arXiv preprint arXiv:2311. 151227 2023.
[42] Xueying Mao, Xiaoxiao Hu, Wanli Peng. Zhenliang Gan, Zhenxing Qian, Xinpeng Zhang, and Sheng Li. From covert hiding to visual editing: robust generative video steganography. In Proceedings of the 32nd ACM International Conference on Multimedia, pages 2757-2765, 2024.
[43] Thomas Wiegand, Gary Sullivan, Gisle Bjontegaard, and Ajay Luthra. Overview of the h. 264/ave video coding standard. IEEE Transactions circuits and systems for video technology. 13(7):560-577) 2003.
[44] Jomathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840 6851, 2020.
[45] Jiaming Song. Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. arXiv preprint wrXiv:2010002502 2020.
[46] Yaron Lipman, Ricky TQ Chen, Heli Ben-Hamu, Maximilian Nickel, and Matt Le. Flow matching for generative modeling. arXiv preprint arXiv:2210.02747 2022.
[47] Wenhao Wang and Yi Yang. Vidprom: A million-scale real prompt-gallery dataset for text-to-video diffusion models. arXiv preprini arXiv:2403.06098. 2024.
[48] Yoav HaCohen, Nisan Chiprut, Benny Brazowski, Daniel Shalem, Dudu Moshe, Fitan Richardson, Eran Levin, Guy Shiran, Nir Zabari, Ori Gordon, et al. Lix-video: Realtime video latent diffusion. arXiv preprint arXiv:2501.00103 2024.
[49] Anish Mittal, Anush Krishna Moorthy, and Alan Conrad Bovik. No-reference image quality assessment in the spatial domain. IEEE Transactions on image processing. 21(12):4695-4708 2012.
[50] Yun Cao, Hong Zhang, Xianfeng Zhao, and Xiaolei He. Steganalysis of h. 264/ave videos exploiting subtractive prediction error blocks. IEEE Transactions on Information Forensicy and Security, 16:3326-3338, 2021.
[51] Rémi Cogranne, Vahid Sedighi, Jessica Fridrich, and Tomáš Pevný. ensemble classifier needed for steganalysis in high-dimensional feature spaces? In 2015 JEEE International Workshop on Information Forensics and Security (WIFS), pages 1-6. IEEE, 2015.
12

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The main claims presented in the abstract and introduction accurately reflect the paper's 's core contributions and overall scope, as supported by experimental results.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: Due to space constraints, we provide a detailed discussion of the limitations of our work in the supplementary material.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g.. independence assumptions, noiseless settings, model cell-specification. asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect the scope of the claims made, e.g. if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-tex, system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
13

---

Answer: [NA]
This paper does not include any formal theoretical assumptions, theorems, or proofs, and is therefore not applicable to this question.
Justification:
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proof' can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: The paper provides detailed description of method in the "Method" sec- tion and a comprehensive explanation of the experimental setup in the Experiments section. Additional implementation and configuration details are included in the supplementary material to ensure the reproducibility of the main results.
Guidelines:
The answer NA means that the paper does not include experiments. If the paper includes experiments, No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (c.g., to registered users), but it should be possible for other researchers to have some path to reproducing verifying the results.
14

---

5. Open access to data and code
Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
Justification: We use the publicly available VidProM dataset 47 The code used in our experiments is released catttss//anony:: 4open. wcwence/rrLDD- Ltticce/r/L--Roo------- RoViS-7FB1/ with full instructions to reproduce the main results. The code link has been anonymized.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (c.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed run to reproduce the results. See the NeurIPS code and data submission guidelines (https
//ipps.c/ppll wwtpcccccpcccccceoco /ttee//gdddeeeeeeeuuuemeeebeeee iatoomisssinooooiiiieee
for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Answer: [Yes]
The main paper provides detailed descriptions of the experimental setup, including data splits, training procedures, hyperparameter configurations, and other imple- mentation details necessary to interpret the results.
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can provided either with the code, appendix, or as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification:
For key experimental results, report the average performance over 100 generated videos. We also include the standard deviation to quantify variability. This information is presented in the main paper.
Guidelines:
The answer NA means that the paper does not include experiments.
15

---

The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the enror bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall
with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars reported in tables plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: We specify the computational environment in the experimental setup, including the use of four NVIDIA RTX A6000 GPUs. Additional details such timesteps and computation times are reported in the supplementary material, ensuring reproducibility.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental rums as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported didn't 'tttt make it into the paper).
paper (e.g., preliminary or failed experiments that NeurlPS Code of Ethics https: http::::///nuuiriep http:/pp.....pbbeeccccccccceeeee
9. Code of ethics
Question: Does the research conducted the paper conform, in every respect, with the
Answer: [Yes]
Justification: Our research complies fully with the NeurIPS Code Ethics. does not involve any human subjects, sensitive data, practices that may raise ethical concerns.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
16

---

Justification:
This paper proposes a method for secure covert communication, which has potential positive applications privacy protection and information security.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has socictal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, is not needed to point out that generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: This paper does not release any models datasets that pose potential risks of misuse, and thus no safeguards are necessary.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but encourage authors to take this into account and make best. faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: All the external datasets and models used in this work are properly cited in the paper. Their licenses and terms of use are clearly stated and have been fully respected.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
17

---

The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g.. website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that re-packaged, both the original license and the license of the derived asset (if it has changed) should provided.
If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
The new code assets introduced in this paper are thoroughly documented. Detailed instructions on the installation, usage, and replication of results are provided alongside the code to facilitate reproducibility.
Justification:
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve crowdsoureing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: The paper does not involve crowdsoureing nor research with human subjects.
18

---

Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with
human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods this research? Note that the LLM used only for writing, editing, or formatting purposes and does not impact the core methodology. scientific rigorousness, or originality of the research, declaration is not required.
Answer: [NA]
Justification: The core method development in this research does not involve LLMs any important, original, or non-standard components.
Guidelines:
The answer NA means that the core method development in this research does involve LLMs as any important, original, or non standardd components.
Please refer to our LLM policy for what should or should not be described.
19

---

A Hyperparameter Tuning
In the LD-RoViS framework, the optimal values of three hyperparameters- -1, 72, and cfs need to be determined through experiments. We generated stego videos using 10 different prompts and computed the average values of aceuracy (acc), PSNR, BRISQUE, and capacity. The results are 0.02 and cfx 16; to evaluate 72,
summarized in Table 6, 7, 8. To evaluate 7I, we fixed fixed Ti 0.32 and cfx = 16; and to evaluate cfg, we fixed T1 0.32 and 72 = 0.02.
We observe that decrease. Similarly, as cfg increases, acc improves, PSNR and BRISQUE decrease, and capacity remains nearly unchanged. Our goal is to maximize capacity while maintaining acc 2 99%. On this basis, we choose the combination T1 0.32, 72 0.02, and cfg = 16. Notably, the BRISQUE, score of the cover video is 28.83, which is very close to that of our stego videos. This finding indicates that although there are content differences between the stego and cover videos, their perceptual quality, as measured without reference, remains similar.
and increase, capacity ierrasss,, whereas acc, PSNR, and BRISQUE
Table 6: Performance under diffferent values of 71-
acc(%)
PSNR(db))
BRISQUE!
capacity(bits))
0.01
99.45
43.11
28.80
364
0.02
99.31
42.99
28.84
721
0.04
99.52
42.83
28.84
1464
0.08
99.42
42.56
28.83
2913
0.16
99,42
42.18
28.91
5869
0.32
99.17
41.66
28.90
11983
0.64
97.84
40.97
28.94
24995
Table 7: Performance under different values of 72.
T2
acc(%)f
PSNR(db)
BRISQUEJ
capacity(bits))
0.01
99.65
42.18
28.89
5957
0.02
99.17
41.66
28.90
11983
0.04
98.53
41.01
28.96
23511
0.08
97.25
40.10
29.05
47708
0.16
94.80
39.02
29.25
100786
0.32
90.85
38.12
29.36
204572
0.64
82.90
37.57
29.48
413237
Table Performance under different values of cfg.
cfg
acc(%))
PSNR(db))
BRISQUEL capacity(bits))
60.72
43.15
28.83
12168
68.56
43.04
28.84
12206
83.72
42.84
28.84
12083
95.45
42.43
28.79
12105
16
99.17
41.66
28.90
11983
B Validation on Other Video Diffusion Models
To further evaluate the generalization ability of the proposed LD-RoViS, we additionally implemented the method on another open-source text-to-video generation model, Video [8] (Itxv-2b-0.9.5 distilled version). LTX. Video is two-stage diffusion model. The first stage focuses on generating high-quality image frames, while the second stage refines temporal consistency across frames. It
20

---

adopts DiT-based architecture and employs an EDM sampler nion-deterministic). In our imple- mentation, we retained the first stage unchanged and inserted the steganographic module at the final step of the second stage's denoising process. Due to architectural and sampling differences between Wan2.1 and L.TX-Video we re-tuned the hyperparameters using small validation set and obtained the following optimal values:
l; 1.1, cfg 1.8,
0.32, = 0.02.
Note that ViX-''s generated video quality slightly inferior to that Wan2.1, 1, which explains the higher BRISQUE scores reported in Table 9. In addition, the latent size in LTX- Video is approximately 2/5 Wan2.1's latent size, leading to corresponding reduction in embedding capacity. Experimental results demonstrate that LD-RoViS maintains stable performance under this different architecture and sampler, confirming the adaptability our method.
Table 9: Performance comparison of LD-RoVis on different video generation models.
Model
Accuracy (%)f
PSNR (dB)f
BRISQUE &
Capacity (bits)
LD-RoViS (Wan2.1)
99.17 99.23
41.66 41.39
28.90
11983
LD-RoViS (LTX-Video)
34.21
4281
C Ablation on Modulation Time Step
To investigate the effect of the modulation time step in the CFG modulation strategy, performed ablation studies by applying the modulation at different denoising steps. Here, denotes the reverse denoising step counting from the last step, i.e.,
corresponds the second-to-last denoising step. The results are shown in Table 10. When the modulation is applied at earlier denoising steps, the resulting latent variables X and X3 become more uncontrollable. After several denoising steps, the difference between X3 and X3 may either increase or decrease unpredictably. As our message extraction relies heavily on the distinguishability between X. and X²- this uncertainty leads to lower extraction accuracy with higher standard deviations. Mcanwhile, PSNR, BRISQUE, and steganalysis results remain nearly unchanged, indicating that perceptual quality and security are preserved. Therefore, the final-step modulation is adopted in our design.
Table 10: Ablation study on different modulation time steps.
Time step
Accuracy (%)
PSNR (dB)f
BRISQUE
CovNet P. (2(%)
t=1 (Ours)
99.17
41.66
28.90
49.74
1-2
9..43+1.12
41.22
29.99
49.93
1=4
95.72+2.57
41.34
28.06
49.78
1=8
94.82++3.30
41.94
29.62
49.72
D Time Consumption
The embedding time is also a critical metric for evaluating steganographic methods. Methods with lower embedding times are generally more practical for real-world applications. To assess this, we measured the embedding latency using Python's time package, and the results are shown in Table 11. Notably, since LD-RoViS performs steganographic embedding during the video generation process, the actual embedding time should be calculated by subtracting the time required to generate clean video via the video model. The experimental results show that LD-RoVis introduces minimal time overhead (30.48 s), significantly outperforms AQIM and MEC_AQIM, and achieves a runtime comparable that of RoGVSN
E More Experimental Details
In this section, we provide more experimental details to ensure the reproducibility of LD-RRViS. We adopt the 1.3-1.3B model from Wan2.1 [30] the video generation model. This model has
21

---

Table 11: Embedding latency (in seconds) for different methods.
Method
Video Model
LD-RoViS
RoGVSN
AQIM
MEC_AQIM
Additional Time (s)
366.02
30.48
36.52
698.80
697.59
low memory requirements and can run on single RTX 4090 Ti. It also offers fast generation speed, producing a video just 50 time steps. On average, it takes approximately 6 minutes generate an 81-frame video at a resolution of 480x832. For steganographic tasks, the average generation time is approximately minutes per video.
Our experiments use a dataset consisting of 100 cover videos and 100 stego videos. The prompts for the cover and stego videos exactly the same. The cover videos generated via a clean version the Wan2.1 model, whereas the stego videos are produced via a Wan2.1 model with the steganographic module. All prompts randomly selected from the VidProM dataset [47]. However, some prompts from VidProM contain parameters unsupported by Wan2. 1. We manually filtered such prompts. Table 12 lists subset of the prompts used in our experiments.
Dataset:
Table 12: Example prompts used for video generation.
1
a kangaroo dancing to electromic music in crowded nightclub.
a lady wandering in the enchanted woods, lost and confused.
3 aliens walking in city.
4
cars on the beach are attacked by sharks.
5
Animals working together, sharing resources, and demonstrating cooperation under the guidance of Leo, the wise lion.
The black Chinese dragon opens its eyes.
7
wolf walking in the jungle.
A massive storm hitting a city.
9
wild cat running in the jungle.
10
an elephant riding a bike, masterpiece, cinematic.
F
More Visual Results
In this section, present more visual results to evaluate the impact of steganographic embedding video quality.
Visual Quality across Video Frames: A common challenge in traditional video steganography distortion drift, where embedding distortions gradually propagate across frames, resulting in noticeable artifacts in later parts of the video. To investigate whether LD-Ro LD-RoVe ViS suffers from similar issue, we decomposed four generated stego videos into individual frames via FFmpeg. We then visualized the first frame, middle frame (41 (41st), and last frame (81 (81st) in Fig. 4. The results show that the steganographic modifications made the latent space by LD-RoViS do not introduce visible distortions or artifacts. The visual quality remains stable throughout the video.
Pixel-Wia Differences between Cover and Stego Videos: In the main paper, Fig. shows that the pixel differences between cover and stego videos generated by LD-Ro ViS are minimal and are mostly concentrated in regions with complex textures. results. Fig. presents additional examples of pixel-level differences. The "diff" images represent the absolute pixel difference between the 41st frame the cover and stego videos, with brightness amplified by factor of 10 for better visibility. These visualizations confirm that pixel differences are extremely subtle and imperceptible to human eye. Notably, most differences appear along object contours. We hypothesize that this is due to the low weighting of the predicted noise the final step of the diffusion model's reverse process. Even large modifications to this predicted noise have minimal effects on the final output. This suggests that the last step of the diffusion process provides
this section, we provide deeper analysis of these
22

---

PSNR: 38.59 db
PSNR: 39.57 db
PSNR: 42.47 db
PSNR: 44.69
An underwater world with realistic fish and other creatures of the sea.
large field with wild flowers waving staady but moderate breezs.
leaves falling, slowly blinking, gently turning the pages, girl sitting under a tree with a book in her hands and reading gentle wind, anima style.
student putting his phone aside and looking around with a smile on face slowmotion transition.
Figure 4: The first frame, middle frame (t1st), and last frame (81st) of stego video generated by LD-RoViS, along with their corresponding prompts.
naturally robust channel for steganography aallooo hidden information to be embedded with negligible visual degradation and strong resistance to detection.
G
Limitations
Although the proposed LD-RoViS enables robust video steganography and outperforms existing methods in terms of both security and visual quality, it also has certain limitations.
The quality of the stego video depends heavily the performance of the video generation model. While video generation models are rapidly improving, they still occasionally produce low-quality outputs. As shown in Fig some generated videos exhibit physically implausible deformations, artifacts, or distorted faces. These low-quality samples may raise suspicion during transmission between the sender and receiver, thereby reducing the practical usability of the steganographic method.
LD-RoViS inevitably alters the video generation process. Specifically, it modifies the parameters at the final timestep of the reverse diffusion process, which may introduce slight shifts in the distribution of the generated videos and lead to decrease in visual quality. However, the experimental results show that steganalysis tools fail to detect meaningful distribution differences between the cover and stego videos, indicating that LD-Ro ViS remains secure against detection. Additionally, the stego videos maintain high PSNR and favorable BRISQUE scores, suggesting that LD-RoVis ViS achieves strong practicality despite the minimal distortion introduced.
23

---

cover
stego
diff
cover
stego
diff
Figure 5: Cover video, stego video, and their pixel-wise difference ("diff" denotes the pixel difference, with brightness amplified by factor of 10 for better visibility).
cover
stego
Figure 6: Examples of low-quality generated videos, where noticeable distortions and artifacts are present in the frames.
24


Reviews:
[{"review_id": "GxlRXPxArZ", "reviewer": "Reviewer_tdSw", "summary": "This work proposes a generative video steganography method for latent diffusion models by proposing an implicit parameter modulation strategy with keys and a multi-mask mechanism for identifying robust regions. It was demonstrated that this work can embed 12,000 bits of secret messages into a 5-second video with an accuracy >99%.", "questions": "Please address the major concerns above.\n\nIt is unclear if multi-mask is robust for any video contents. Any discussion?", "limitations": "Yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths:\n1) This work addresses an interesting problem of generative video steganography for modern video generation models based on DDIM. \n2) Evaluating for video compression seems practical.\n\nWeaknesses:\n1) Even though this work claimed that it is for video, theoretically the method for LDM for image generation can be applicable to LDM for video generation by replacing the decoder. Thus, in terms of novelty, it is unclear if this work has specific novelty over other generative image steganography methods with LDM. See [33], [36] as well as the followings:\n- Improved Generative Steganography Based on Diffusion Model (10.1109/TCSVT.2025.3539832)\n- Conditional Diffusion Model for Image Steganography (10.1109/AIPMV62663.2024.10692262)\n- Establishing Robust Generative Image Steganography via Popular Stable Diffusion (10.1109/TIFS.2024.3444311)\n- Generative Image Steganography Based on Text-to-Image Multimodal Generative Model (10.1109/TCSVT.2025.3556892)\n- DGADM-GIS: Deterministic Guided Additive Diffusion Model for Generative Image Steganography (10.1109/TDSC.2025.3578676)\n- Diffusion-Stego: Training-free diffusion generative steganography via message projection (10.1016/j.ins.2025.122358)\n- Provably Secure Covert Messaging Using Image-Based Diffusion Processes (10.1109/SaTML64287.2025.00057)\n- StegaFDS: Generative Steganography Based on First-Order DPM-Solver (10.1109/TrustCom63139.2024.00042)\n- Conditional Flow-based Generative Steganography (10.1109/TDSC.2025.3570468)\nSince the proposed method looks generic for any LDM, it seems important to comprehensively discuss, compare and demonstrate over these prior works. Moreover, the proposed parameter modulation strategy looks very similar to the above works, so it is important to distinguish the proposed method over them in the setting of LDM.\n2) Even though 12,000 bits of data into a 5-sec video may be great, it seems also possible to embed messages per image using any above image-based methods, which can embed 1 bpp with 100% accuracy - of course it may fail for video compression. However, there is no demonstration for it, so it is difficult to see the proposed method as a SOTA. Thus, the proposed method should be compared with other image-based methods as well as other video steganography method if possible, such as\n- Large-capacity and Flexible Video Steganography via Invertible Neural Network (CVPR 2023)\n- StegaNeRV: Video Steganography using Implicit Neural Representation (CVPRW 2024)\n- Efficient three layer secured adaptive video steganography method using chaotic dynamic systems (Scientific Reports 2024)", "was_revised": true, "final_justification": "The rebuttal has addressed most of my concerns. After reading the rebuttal and other reviews, I will increase my score.", "rebuttal": "Thank you for the time you have devoted and for your valuable suggestions. Below, we will address each of the weaknesses you listed individually.\n\n`Weakness 1：In terms of novelty, it is unclear if this work has specific novelty over other generative image steganography methods with LDM. Since the proposed method looks generic for any LDM, it seems important to comprehensively discuss, compare and demonstrate over these prior works. Moreover, the proposed parameter modulation strategy looks very similar to the above works, so it is important to distinguish the proposed method over them in the setting of LDM.`\n\nWe sincerely thank the reviewer for providing detailed references and raising this insightful question. We systematically compared our method with existing works based on three key dimensions: **whether inversion is required**, **whether the method supports latent diffusion models**, and **whether it is compatible with deterministic samplers**. The results are shown in the table.\n\n| Method | Inversion-Free | Latent Diffusion Compatible | Deterministic Sampler Compatible |\n| --- | --- | --- | --- |\n| [1], [2], [4], [5], [6], [8], [9] | × | × | √ |\n| [3], [7] | × | √ | √ |\n| [10], [11], [12] | √ | √ | × |\n| ours | √ | √ | √ |\n- **Novelty compared to LDM-based image steganography**\n\nWe observe that works [1]–[9] hide messages in the initial latent $X_T$﻿ of the denoising process and rely on inversion at the receiver side to reconstruct $X_T'$﻿ from the stego image. However, most diffusion samplers (e.g., DDIM, Flow Matching) are designed for one-directional generation and **cannot achieve perfect invertibility**. For example, method [1] retrains DDIM to improve invertibility, method [7] introduces a reversible sampler (EDICT), and method [9] employs a reversible flow-based model instead of a diffusion model.\n\nOn the other hand, methods [10]–[12] embed messages in the random noise of the final denoising step. However, these methods rely on non-deterministic sampling (e.g., DDPM or DDIM with $\\sigma_s\\ne 0$), which is not compatible with most modern video generation models that employ deterministic samplers (e.g., Flow Matching or DDIM with $\\sigma_s=0$﻿).\n\nOur work is explicitly designed to overcome these limitations by proposing a steganographic method that is **inversion-free**, **compatible with latent diffusion models**, and **suitable for deterministic samplers**. \n\n- **How our parameter modulation strategy differs from previous works**\n\nWe leverage the CFG scale, an attribute control factor in text-to-video models, to embed secret information in the final denoising step, eliminating the reliance on non-deterministic samplers. This enables high-capacity steganography while maintaining high video quality. To the best of our knowledge, **this is the first generative steganography method based on CFG scale**, offering both generality and practicality under latent diffusion models. \n\n`Weakness 2：The proposed method should be compared with other image-based methods as well as other video steganography method if possible.`\n\n- **Comparison with the provided video steganography methods**\n\nWe have carefully studied the three mentioned video steganography works. Works [13] and [14] are designed to hide **images or video frames** within videos. Work [15] is a spatial-domain adaptive steganography method. In fact, works [13]–[15] fall into the category of modification-based video steganography, where message embedding requires alterations to video content, making them vulnerable to both distortion drift and steganalysis attacks.\n\n- **Comparison with the provided image steganography methods**\n\nRegarding comparisons with image steganography methods: most mentioned diffusion-based image steganography methods ([1]–[12]) either rely heavily on **exact inversion** or require **non-deterministic samplers**, making them incompatible with state-of-the-art video generation models like Wan2.1. Nonetheless, in response to your suggestion, we implemented a variant of [10] (LDStega) adapted to video diffusion models, referred to as **LDStega_video**. To simulate the stochasticity required by [10], **we manually injected Gaussian noise into the final denoising step**—an operation that does **not exist by default in deterministic samplers**. To simulate a realistic non-deterministic sampling process, we adopt the noise standard deviation from the final denoising step of the **non-deterministic sampler EDM Sampler [16]**, which is set to **$\\sigma = 2\\times10^{-3}$**. For fair comparison, we also created a low-capacity version (**LDStega_adjust**) with 10,080 bits embedded per video.\n\nThe results are shown in the table below. We observe that:\n\n**(1) The accuracy** of LDStega variants is significantly lower than ours;\n\n**(2) Visual quality** (PSNR and BRISQUE) degrades heavily for LDStega_video, and it is easily detected by the CovNet steganalyzer;\n\n(3) Even the tuned LDStega_adjust performs worse than our method across all metrics.\n\n| Method | Accuracy (%) ↑ | PSNR ↑ | BRISQUE ↓ | Capacity (bits) | CovNet Pₑ (%) ↑ |\n| --- | --- | --- | --- | --- | --- |\n| Ours | 99.17 | 41.66 | 28.90 | 11,983 | 49.74 |\n| LDStega_video | 84.50 | 29.09 | 43.42 | 2,096,640 | 0.01 |\n| LDStega_adjust | 84.97 | 36.51 | 34.06 | 10,080 | 37.13 |\n\nThis performance gap can be attributed to two key factors:\n\n**(1) Video latent diffusion models are more compressed** than image models. For example, Wan2.1’s latent space has a 64× compression ratio compared to the original video, making message recovery more difficult.\n\n**(2) Temporal correlations in video make steganographic distortions more noticeable**. While a small perturbation might be tolerable in a static image, it could cause significant temporal artifacts in video, leading to perceptual degradation or easier detection.\n\nTherefore, even when compared with state-of-the-art image steganography methods, our proposed video steganography method demonstrates clear advantages in terms of **robustness, quality preservation, and steganalysis resistance**.\n\nFinally, we wish to clarify that our method is **not tied to a specific sampler**. Since the embedding relies only on modulating the **CFG scale** in the final denoising step—a parameter widely supported in modern diffusion models—our method is broadly compatible with **DDPM, DDIM, Flow Matching**, and other popular sampling frameworks with CFG scale.\n\nBelow are the answers to the questions you raised:\n\n`Question: It is unclear if multi-mask is robust for any video contents. Any discussion?`\n\nWe believe that our proposed **multi-mask** strategy is robust for diverse video content, as supported by both experimental results and its underlying design:\n\nFirst, the **experimental results provide strong empirical evidence**. Our steganographic framework achieves **over 99% message extraction accuracy** on a diverse test set of **100 videos with different prompts**, which demonstrates its applicability across a wide range of video contents.\n\nSecond, from a design perspective, the **multi-mask strategy is based on latent-space percentile selection**, rather than relying on pixel-level or semantic information. The Invariance Mask $M_1$ identifies the $\\tau_1$% **least-different positions** between $X_0$ and $X_0'$, while the Discriminative Mask $M_2$ captures the $\\tau_2$% **most-different positions** between $X_0^1$ and $X_0^2$. $M=M_1\\odot M_2$ indicates positions meeting both conditions. Regardless of the variations in video content, our multi-mask strategy always selects the most robust regions in the latent space for message embedding, ensuring the robustness of the proposed method.\n\nFinally, we truly appreciate your pointers to numerous related works. If the paper is accepted, we will include a more comprehensive discussion and comparison with these works in the final submission to better highlight the novelty of our method.\n\n[1] Improved Generative Steganography Based on Diffusion Model (10.1109/TCSVT.2025.3539832)\n\n[2] Conditional Diffusion Model for Image Steganography (10.1109/AIPMV62663.2024.10692262)\n\n[3] Establishing Robust Generative Image Steganography via Popular Stable Diffusion (10.1109/TIFS.2024.3444311)\n\n[4] Generative Image Steganography Based on Text-to-Image Multimodal Generative Model (10.1109/TCSVT.2025.3556892)\n\n[5] DGADM-GIS: Deterministic Guided Additive Diffusion Model for Generative Image Steganography (10.1109/TDSC.2025.3578676)\n\n[6] Diffusion-Stego: Training-free diffusion generative steganography via message projection (10.1016/j.ins.2025.122358)\n\n[7] Provably Secure Covert Messaging Using Image-Based Diffusion Processes (10.1109/SaTML64287.2025.00057)\n\n[8] StegaFDS: Generative Steganography Based on First-Order DPM-Solver (10.1109/TrustCom63139.2024.00042)\n\n[9] Conditional Flow-based Generative Steganography (10.1109/TDSC.2025.3570468)\n\n[10] Ldstega: Practical and robust generative image steganography based on latent diffusion models. *Proceedings of the 32nd ACM International Conference on Multimedia*. 2024.\n\n[11] PSyDUCK: Training-Free Steganography for Latent Diffusion. *arXiv preprint arXiv:2501.19172* (2025).\n\n[12] Pulsar: Secure steganography for diffusion models. *Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security*. 2024.\n\n[13] Large-capacity and Flexible Video Steganography via Invertible Neural Network (CVPR 2023)\n\n[14] StegaNeRV: Video Steganography using Implicit Neural Representation (CVPRW 2024)\n\n[15] Efficient three layer secured adaptive video steganography method using chaotic dynamic systems (Scientific Reports 2024)\n\n[16] Ltx-video: Realtime video latent diffusion. *arXiv preprint arXiv:2501.00103* (2024)."}, {"review_id": "lHJZv380AH", "reviewer": "Reviewer_t9WQ", "summary": "This paper proposes a video steganography framework named LD-RoViS. It targets latent diffusion models that employ deterministic sampling strategies by modulating the CFG scale at the final step of the diffusion process, thereby constructing a steganographic channel for information embedding. The authors introduce a multi-masking mechanism to identify locations in the latent space that are both robust to distortion and highly discriminative for the embedded information. Experimental results demonstrate that the method achieves high embedding capacity and extraction accuracy.", "questions": "A core claim of the paper is that its method is applicable to general deterministic diffusion models, but all experiments are based on a single model employing a Flow Matching sampling strategy. We would like to know if this method remains effective on other types of deterministic samplers (e.g., deterministic DDIM)? Given the differences in update dynamics across various samplers, we hope the authors can provide additional arguments or experimental evidence to support this generalization claim. For example, a brief theoretical analysis or preliminary experiments on a publicly available DDIM-based model would greatly enhance our confidence in the method's scope of applicability.\n\nTo resist compression distortion, the multi-masking mechanism tends to embed information in texture-rich, high-frequency regions. However, these regions are typically also areas closely monitored by steganalysis tools. We would like to discuss with the authors whether this strategy of selecting embedding locations for the sake of robustness might inadvertently concentrate modification traces in specific areas, thereby forming new statistical features that could potentially be exploited by future, more advanced analysis models?", "limitations": "Yes.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n\nThe paper extends the applicability of generative steganography to deterministic diffusion models. Currently, many generative steganography techniques rely on interfering with stochastic sampling processes, which prevents their direct application to increasingly popular deterministic samplers. This paper addresses this by utilizing the CFG scale, a universal parameter, to construct the steganographic channel.\n\nThe multi-masking mechanism proposed in the paper is a noteworthy component. This mechanism constructs an \"invariance mask\" by explicitly simulating the encoding-decoding and noise injection processes, and combines it with a \"discriminability mask\" generated by CFG modulation. Its effectiveness is supported by data in the Ablation Studies, demonstrating the necessity of both mask components for achieving high extraction accuracy.\n\nWeaknesses:\n\nThe paper lacks sufficient ablation studies regarding the design choices for the core CFG modulation strategy (e.g., why modulation occurs in the final step, why symmetric perturbation is used).\n\nPerformance evaluation is based on **only 100 video samples.** For a method aiming to handle diverse video content, this scale needs further improvement.\n\nThe experimental evidence presented in the paper originates from **a single model only**.\n\nSimilar to all generative methods, the upper bound of the paper's method performance (including visual quality and imperceptibility) is closely coupled with the performance of the chosen base video generation model; any flaws in the base model will directly transfer to the steganographic video.", "was_revised": true, "final_justification": "The author's feedback has addressed some of my concerns, including doubling the dataset size and adding another model for evaluation. I have decided to retain the original score.", "rebuttal": "We are pleased to receive your positive feedback. Thank you for recognizing our contribution in extending steganography to deterministic diffusion models. Below, we provide point-by-point responses to the weaknesses you listed.\n\n`Weakness 1：The paper lacks sufficient ablation studies regarding the design choices for the core CFG modulation strategy (e.g., why modulation occurs in the final step, why symmetric perturbation is used).`\n\nWe provide additional analysis below to clarify our design choices for the CFG modulation strategy.\n\n- **Why modulation is applied at the final denoising step:**\n\nFollowing your suggestion, we conducted ablation studies by applying the modulation at different denoising steps. The results are presented in the table below. Modulating at **earlier steps negatively affects message extraction accuracy**, as evidenced by both lower accuracy and higher standard deviation with increasing $t$. We hypothesize that when parameters are modulated at early denoising steps, **the resulting latent variables $X_0^1$ and $X_0^2$ become more uncontrollable.** After several denoising steps, the difference between $X_0^1$ and $X_0^2$ may either increase or decrease unpredictably. As our message extraction relies heavily on the distinguishability between $X_0^1$ and $X_0^2$, this uncertainty leads to lower extraction accuracy. Meanwhile, PSNR, **BRISQUE scores, and steganalysis results remain stable**, indicating that the perceptual quality of the video does not degrade significantly. Moreover, the stego videos are statistically indistinguishable from clean videos, suggesting a high level of imperceptibility. Based on the above results, we keep the strategy of applying parameter modulation at the final denoising step to ensure accurate message extraction. \n\n| Time step $t$ | Accuracy (%)↑ | PSNR (dB)↑ | BRISQUE↓ | CovNet $P_e$(%)↑ |\n| --- | --- | --- | --- | --- |\n| $t$=1 (Ours) | 99.17+-0.63 | 41.66 | 28.90 | 49.74 |\n| $t$=2 | 98.43+-1.12 | 41.22 | 29.99 | 49.93 |\n| $t$=4 | 95.72+-2.57 | 41.34 | 28.06 | 49.78 |\n| $t$=8 | 94.82+-3.30 | 41.94 | 29.62 | 49.72 |\n\n- **Why symmetric perturbation is used:**\n\nThis is a practical simplification. Since message extraction relies on the difference between $X_0^1$ and $X_0^2$, which is determined by the distance between $k_1$ and $k_2$, we only care about their relative distance. Therefore, we define $k_1 = k_s - \\text{cfg}, k_2 = k_s + \\text{cfg}$, using symmetric perturbation to **reduce the number of tunable parameters** and make the method more deployment-friendly in practice.\n\nConsidering that $k_1$ and $k_2$ in our method are essentially controlled by a single hyperparameter $\\text{cfg}$, we will remove the use of $k_1$ and $k_2$ in the final submission and retain only the hyperparameter $\\text{cfg}$. Meanwhile, to avoid confusion between the hyperparameter $\\text{cfg}$ and the commonly used CFG scale in diffusion models, we will rename $\\text{cfg}$ to $k_m$ to reduce ambiguity.\n\n`Weakness 2：Performance evaluation is based on only 100 video samples. For a method aiming to handle diverse video content, this scale needs further improvement.`\n\nFollowing previous works on video steganography, such as [1], we initially evaluated our method on 100 video pairs. Although this dataset yields **8100 frame pairs**, which is sufficient for standard image-level steganalysis, we acknowledge that the size of the video dataset could be further improved to better reflect real-world diversity.\n\nIn response to your suggestion, we have generated and evaluated an additional 100 video pairs, resulting in a total of **200 video pairs**. The experimental results, summarized below, demonstrate that the performance of our method remains stable with the larger dataset, indicating good generalization. These results show minimal variation in metrics, validating that our method performs consistently even with a doubled dataset.\n\n| Dataset Size | Accuracy (%)↑ | PSNR (dB)↑ | BRISQUE ↓ | Capacity (bits)↑ | CovNet $P_e$ (%) ↑ |\n| --- | --- | --- | --- | --- | --- |\n| 100 Videos (original) | 99.17 ± 0.63 | 41.66 ± 1.52 | 28.90 ± 6.05 | 11983 ± 1446 | 49.74 |\n| 200 Videos (extended) | 99.19 ± 0.56 | 42.08 ± 1.88 | 28.99 ± 4.50 | 11704 ± 1085 | 49.78 |\n\n`Weakness 3：The experimental evidence presented in the paper originates from a single model only.`\n\nDue to the significantly higher computational cost and time required for video generation and testing compared to images, our initial submission evaluated performance solely on one current mainstream video generation model, Wan2.1.\n\nTo address your concern about generalization, we conducted preliminary experiments on another video generation model, LTX-Video [2]. LTX-Video is a two-stage model utilizing a more advanced EDM sampler compared to DDIM. We inserted our steganography module into the diffusion process of the second stage. Due to differences between Wan2.1 and LTX-Video, we re-conducted hyperparameter experiments and determined the following hyperparameter values by testing on a small number of samples: $k_s=1.1,\\text{cfg}=1.8,\\tau_1=0.32,\\tau_2=0.02$.\n\n| Method | Accuracy (%)↑ | PSNR (dB)↑ | BRISQUE ↓ | Capacity (bits)↑ |\n| --- | --- | --- | --- | --- |\n| ours (Wan2.1) | 99.17 | 41.66 | 28.90 | 11983 |\n| ours (LTX-Video) | 99.23 | 41.39 | 34.21 | 4281 |\n\nThe results show that our method maintains strong performance on a video model based on the EDM sampler. Note that LTX-Video's video quality is slightly inferior to Wan2.1, which explains the higher BRISQUE scores of LTX-Video. Also, the latent size in LTX-Video is approximately 2/5 of Wan2.1’s latent size, leading to a reduction in capacity.\n\n`Weakness 4：Similar to all generative methods, the upper bound of the paper's method performance (including visual quality and imperceptibility) is closely coupled with the performance of the chosen base video generation model; any flaws in the base model will directly transfer to the steganographic video.`\n\nWe acknowledge that the performance of generative steganography methods depends to some extent on the quality of the chosen generative model. However, this does not compromise the practical utility of our steganographic method. The essence of steganography lies in **behavioral security — being indistinguishable from normal behavior.** And the widespread use of generated videos on social media platforms has made them a common and accepted form of content. As long as the stego videos are indistinguishable from normal generated videos, behavioral-level security can still be achieved. Although stego videos may present certain flaws, similar limitations are often observed in normally generated videos as well, rendering them hard to differentiate from this viewpoint.\n\nMoreover, our method exhibits strong generalizability across different generative models. As the performance of generative models continues to improve, the visual quality of the stego video of our method is also expected to benefit accordingly.\n\n`Question 1：We would like to know if this method remains effective on other types of deterministic samplers (e.g., deterministic DDIM)? `\n\nAs explained in our response to Weakness 3, we have validated the effectiveness of our method on the EDM sampler-based LTX-Video model. Meanwhile, our method supports both deterministic and non-deterministic sampling processes. **This is due to our parameter modulation strategy, which only needs to modify the CFG scale parameter during the final denoising step.** To the best of our knowledge, mainstream text-to-video generation models all support the CFG scale parameter, indicating that our method is broadly applicable and is theoretically fully compatible with samplers such as deterministic DDIM.\n\n`Question 2：We would like to discuss with the authors whether this strategy of selecting embedding locations for the sake of robustness might inadvertently concentrate modification traces in specific areas, thereby forming new statistical features that could potentially be exploited by future, more advanced analysis models?`\n\nAccording to the study in [3], in the denoising process of diffusion models, **earlier steps typically reconstruct low-frequency structures and semantics**, while **later steps capture high-frequency details and textures**. Our steganographic modulation is applied at the final denoising step, and we employ a multi-mask strategy to select robust regions in the latent space. Together, these designs result in stego modifications being concentrated in high-frequency areas of the image, which typically correspond to fine-grained textures, as illustrated in Figure 3 of our main paper.\n\nAccording to the theory of adaptive steganography [4], **high-frequency regions in video** are more information-dense and closer to randomness, making it inherently more difficult for stego modifications in these areas to be accurately detected. This provides theoretical support for the security of our method.\n\nFurthermore, our steganalysis experiments show that neither the video codec-based SUPERB method nor deep learning-based methods such as CovNet and LWENet are able to effectively detect our steganographic traces. This suggests that the modifications introduced by the multi-mask strategy do not produce statistically significant anomalies, providing strong empirical evidence for the security of our method.\n\n[1] Adaptive QIM with minimum embedding cost for robust video steganography on social networks. IEEE Transactions on Information Forensics and Security 17 (2022): 3801-3815.\n\n[2] Ltx-video: Realtime video latent diffusion. *arXiv preprint arXiv:2501.00103* (2024).\n\n[3] Boosting diffusion models with moving average sampling in frequency domain. *Proceedings of the IEEE/CVF conference on computer vision and pattern recognition*. 2024.\n\n[4] Content-adaptive steganography by minimizing statistical detectability. *IEEE transactions on information forensics and security* 11.2 (2015): 221-234."}, {"review_id": "g2SZMEmAlj", "reviewer": "Reviewer_4czU", "summary": "This paper introduces LD-RoViS, a training-free and compression-resilient video steganography framework that embeds secret information into latent variables by modulating the final timestep of a deterministic diffusion process.", "questions": "To address concerns regarding generalizability and reliability, \n- testing transferability to alternative generative backbones\n- analyzing reconstruction failures to understand the inherent brittleness of the encoding scheme", "limitations": "yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths\n- The proposed multi-mask mechanism selectively identifies stable regions in latent space, leading to strong resilience against video compression artifacts, which are prevalent in social media platforms.\n- By operating at the final timestep, the method maintains determinism and enables precise control over where and how secret content is embedded in the latent space.\n\nWeaknesses\n- The method relies heavily on deterministic reverse sampling, restricting its use to a narrow subset of diffusion models. As the community shifts toward stochastic samplers or improved generative backbones (e.g., DiT), the method’s relevance may diminish without adaptation.\n- Despite focusing on robustness, the method does not always guarantee full secret message reconstruction, even under clean conditions. This raises concerns about its practical reliability in high-stakes environments.", "was_revised": true, "final_justification": "After reviewing the authors’ rebuttal and taking into account the comments from other reviewers, I have decided to raise my score.", "rebuttal": "Thank you for your time and valuable suggestions. Below, we provide point-by-point responses to the concerns you raised.\n\n`Weakness 1：The method relies heavily on deterministic reverse sampling, restricting its use to a narrow subset of diffusion models. As the community shifts toward stochastic samplers or improved generative backbones (e.g., DiT), the method’s relevance may diminish without adaptation.`\n\nThank you for your concern regarding the applicability of our method. First, we would like to clarify a misunderstanding about the scope of our method: our method is applicable to both **deterministic and non-deterministic sampling** processes. In contrast, existing diffusion-based image steganography methods [1-3] that do not rely on inversion typically support only non-deterministic samplers. We address this limitation through a **parameter modulation strategy** that only adjusts the CFG (Classifier-Free Guidance) scale during the denoising process. To the best of our knowledge, mainstream text-to-video generation models all support CFG scale, making our method broadly applicable. \n\n\n\n- **Our method is compatible with non-deterministic sampling and does not need reverse inversion:**\n\n\n\nAlthough our method, like [1–3], requires the sender and receiver to share the generation process, this can be easily achieved by **synchronizing the prompt and a random seed** (as illustrated by the `seed` in Figure 2). While non-deterministic samplers introduce random noise at each step, the noise sequence becomes deterministic when the random seed is fixed, and thus can be shared between both sender and receiver. Therefore, **our method remains applicable to non-deterministic sampling**, just as in methods [1]–[3].\n\n\nFurthermore, our method **does not require any inversion of the sampling**. The steganographic embedding is performed at the **final denoising step**, and the secret message can be accurately recovered simply by passing the stego video through the VAE encoder (the \"$E$\" module in Figure 2). This design does not rely on the reversibility of the sampler, making it compatible with a wide range of diffusion-based generative models. Notably, the official documentation of Wan2.1 states that \"**Wan2.1 is designed on the mainstream diffusion transformer paradigm**,\" confirming that it adopts the DiT (Diffusion Transformer) architecture.\n\n- **Performance on another DiT-based model with non-deterministic sampling:**\n\nAddressing your concern on applicability, we integrated our steganographic module into another **DiT-based text-to-video model, LTX-Video** [4], and evaluated its performance. LTX-Video is a two-stage model using a more advanced EDM sampler than DDIM (when $\\sigma_s \\neq 0$, EDM sampler is non-deterministic). We inserted our steganography module into the diffusion process of the second stage. Due to differences between Wan2.1 and LTX-Video, we re-conducted hyperparameter experiments and determined the following hyperparameter values by testing on a small number of samples: $k_s=1.1,\\text{cfg}=1.8,\\tau_1=0.32,\\tau_2=0.02$. The results, in the table below, demonstrate that our method also maintains strong performance on EDM-based video models.\n\n| Method | Accuracy (%)↑ | PSNR (dB)↑ | BRISQUE ↓ | Capacity (bits)↑ |\n| --- | --- | --- | --- | --- |\n| ours (Wan2.1) | 99.17 | 41.66 | 28.90 | 11983 |\n| ours (LTX-Video) | 99.23 | 41.39 | 34.21 | 4281 |\n\nNote that LTX-Video's video quality is slightly inferior to Wan2.1, which explains the higher BRISQUE scores of LTX-Video. Also, the latent size in LTX-Video is approximately 2/5 of Wan2.1’s latent size, leading to a reduction in capacity.\n\n`Weakness 2：Despite focusing on robustness, the method does not always guarantee full secret message reconstruction, even under clean conditions. This raises concerns about its practical reliability in high-stakes environments.`\n\nYour insightful question about the inability to fully reconstruct the secret message even under clean conditions highlights an inherent challenge in our method, which mainly stems from the following two factors:\n\n1. **The VAE encoding and decoding process is highly nonlinear and irreversible**. The stego video is generated by decoding the latent variable $X_s$, and then re-encoded back to latent $X_s'$. This lossy process causes variations in the latent variables, leading to errors in message extraction. To address this, we designed the Invariance Mask $M_1$, aiming to identify regions of the latent space that remain stable through the VAE encoding-decoding process.\n2. **The Invariance Mask $M_1$ only estimates the robust regions** for the latent variable with VAE encoding-decoding. In our method, to ensure the sender and receiver share the same mask, we perform a VAE encoding-decoding preprocessing on the clean latent $X_0$, using this as an approximation for the robust regions of $X_s$.\n\nNotably, our method already achieves around 99% message accuracy with a high capacity exceeding 10,000 bits. This level of accuracy and capacity supports the practical use of error-correcting codes to realize full secret message recovery. \nTo this end, we adopt Low-Density Parity-Check (LDPC) coding for error correction, using the open-source Python library `ldpc`. By setting the code rate to 0.8, we successfully improve the message accuracy to 100% while maintaining a usable capacity of 9,000 bits.\n\n| Method | Accuracy (%)↑ | Capacity (bits)↑ |\n| --- | --- | --- |\n| ours | 99.17 | 11,983 |\n| ours+LDPC | 100 | 9,000 |\n\n`Question 1:To address concerns regarding generalizability and reliability, testing transferability to alternative generative backbones.`\n\nThank you for your concerns regarding the generalizability of our method. Please refer to our response in weakness 1: we have integrated and tested our steganographic method on the DiT-based video generation model LTX-Video. The results demonstrate the good generalization capability of our method. Moreover, our method supports both deterministic and non-deterministic samplers, and is theoretically compatible with mainstream text-to-video generation models.\n\n`Question 2: Analyzing reconstruction failures to understand the inherent brittleness of the encoding scheme`\n\nThe inability to achieve 100% accurate secret message reconstruction mainly stems from the irreversible and lossy nature of the VAE encoding-decoding process. \n\nTo illustrate the distortion introduced by the VAE encoding-decoding process, we analyze the distribution of two variables. Specifically, $v_1$ is defined as the reconstruction error between **$X_0$** and its VAE-reconstructed latent **$X_0'$**, i.e., **$v_1 = L_1(X_0, X_0')$**. $v_2$ is defined as **$v_2=v_1(M_1)$**, representing the reconstruction error in regions selected by mask **$M_1$**. As shown, without any masking, approximately 31% of the positions in **$X_0$** experience a distortion greater than 0.1. Such a level of perturbation significantly interferes with accurate message extraction. After applying the mask **$M_1$**, it is observed that all positions with perturbations greater than 0.1 are effectively filtered out. $M_1$ significantly enhances the robustness of the steganographic method.\n\n| Variable | [0, 0.1) | [0.1, 0.2） | [0.2, 0.3) | [0.3, 1] |\n| --- | --- | --- | --- | --- |\n| $v_1$ | 1,454,410(69.4%) | 488,785(23.3%) | 121,738(5.8%) | 31,707(1.5%) |\n| $v_2$ | 670,925(100%) | 0 | 0 | 0 |\n\nFinally, we appreciate your interest in the generalizability and robustness of our method. If the paper is accepted, we will include additional experiments on new models in the final submission and add a thorough discussion on the causes of imperfect message reconstruction in the appendix.\n\n[1] Ldstega: Practical and robust generative image steganography based on latent diffusion models. *Proceedings of the 32nd ACM International Conference on Multimedia*. 2024.\n\n[2] PSyDUCK: Training-Free Steganography for Latent Diffusion. *arXiv preprint arXiv:2501.19172* (2025).\n\n[3] Pulsar: Secure steganography for diffusion models. *Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security*. 2024.\n\n[4] Ltx-video: Realtime video latent diffusion. *arXiv preprint arXiv:2501.00103* (2024)."}, {"review_id": "WOqi1np9hA", "reviewer": "Reviewer_66yD", "summary": "This paper proposes a generative steganography method utilizing pre-trained video diffusion models. It demonstrates high robustness against information loss during transmission by employing a classifier-free guidance trick and an embedding selection strategy called the Multi-mask mechanism.", "questions": "- In this method, can sender and receiver use M_2 = Mask( X_0, X_0^1), thereby avoiding the need to share k_2? Is there a specific reason for requiring k_2?\n\n- Since the multi-mask mechanism enhances robustness, is it possible to increase capacity by embedding multi-bit messages using multiple values of k?", "limitations": "Yes", "rating": 5, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "[Strength]\n\n- The novel multi-mask mechanism effectively addresses robustness issues commonly encountered in diffusion-based steganography methods, particularly those caused by encoder-decoder errors in latent-based diffusion models.\n\n- The writing and figures in the paper are sufficiently clear to understand the proposed method.\n\n[Weakness]\n\n- The number of hidden messages is significantly reduced due to masking, particularly with M_2. It appears that using random noise instead of X_0^1 and X_0^2, as done in StegaDDPM, may alleviate this issue.\n\n- It would be helpful to quantify the computational overhead compared to standard text-to-video generation using metrics like latency or GFLOPS.\n\n- The proposed method is only validated on the T2V-1.3B model of WAN2.1. Readers may wonder whether it would also work on other widely-used open-source models such as LTX-Video [A].\n\n[A] Lightricks, https://huggingface.co/Lightricks/LTX-Video", "was_revised": true, "final_justification": "The rebuttal addresses previous concerns. I will keep my rating as acceptance.", "rebuttal": "We are pleased to receive your positive feedback. Thank you for taking the time to review our work and for recognizing our contributions to robustness. Below, we provide detailed responses to the concerns you have raised.\n\n`Weakness 1：The number of hidden messages is significantly reduced due to masking, particularly with M_2. It appears that using random noise instead of X_0^1 and X_0^2, as done in StegaDDPM, may alleviate this issue.`\n\nIn fact, StegaDDPM and methods [1-3] cannot be applied to deterministic diffusion models, as explained below:\n\nThe diffusion denoising sampling process can be simplified as:\n\n$X_s = \\mu_\\theta(X_t,t)+\\sigma_s\\epsilon, \\epsilon\\in N(0,I),s<t$\n\nWhen $\\sigma_s = 0$, the sampling is deterministic. Mainstream video generation models (e.g., our used Wan2.1) adopt deterministic sampling to reduce computational cost. The secret message in StegaDDPM and related works [1-3] is embedded into **the random noise $\\epsilon$ at the final denoising step, thus these methods cannot be applied to deterministic sampling models**.\n\nIn contrast, our method only relies on modifying the CFG scale parameter at the final denoising step, i.e., modulating the $\\mu_\\theta(X_t, t)$ term. Therefore, our method supports both non-deterministic and deterministic sampling, which is a core innovation of our work.\n\n`Weakness 2：It would be helpful to quantify the computational overhead compared to standard text-to-video generation using metrics like latency or GFLOPS.`\n\nThank you for your suggestion to quantify computational consumption. In the appendix, we previously measured time consumption only in seconds, which is indeed insufficient. Following your advice, we used Python’s `time` package to measure latency, and the results are shown in the table below:\n\n| Method | Video Model Inference Time  | ours  | RoGVSN  | AQIM  | MEC_AQIM  |\n| --- | --- | --- | --- | --- | --- |\n| Additional Time for embedding (s)↓ | 366.02 | 30.48 | 36.52 | 698.80 | 697.59 |\n\nSince our steganography method is training-free and plug-and-play, it does not modify the training parameters of the base generation model and only adds an extra stego module during inference, we did not use GFLOPS metrics for evaluation.\n\n`Weakness 3：The proposed method is only validated on the T2V-1.3B model of WAN2.1. Readers may wonder whether it would also work on other widely-used open-source models such as LTX-Video [4].`\n\nThank you for suggesting LTX-Video as an open-source alternative. Your suggestion is very valuable. We implemented our steganography method on the `ltxv-2b-0.9.8-distilled` version of LTX-Video. We carefully studied its technical documentation and inference code, successfully integrated our method, and conducted performance tests. The results are shown below: \n\n| Method | Accuracy (%)↑ | PSNR (dB)↑ | BRISQUE ↓ | Capacity (bits)↑ |\n| --- | --- | --- | --- | --- |\n| ours (Wan2.1) | 99.17 | 41.66 | 28.90 | 11983 |\n| ours (LTX-Video) | 99.23 | 41.39 | 34.21 | 4281 |\n\nLTX-Video is a two-stage diffusion model. The first stage generates image frames with a focus on visual quality, while the second stage optimizes temporal coherence. It is based on a DiT architecture and uses a more advanced EDM sampler compared to DDIM. We kept the first stage unchanged and inserted our steganographic module at the final step of the second stage's denoising process. Due to differences between Wan2.1 and LTX-Video, we re-conducted hyperparameter experiments and determined the following hyperparameter values by testing on a small number of samples: $k_s=1.1, \\text{cfg}=1.8, \\tau_1=0.32, \\tau_2=0.02.$ The results show that our method maintains performance even under this different architecture and sampler.\n\nNote that LTX-Video's video quality is slightly inferior to Wan2.1, which explains the higher BRISQUE scores of LTX-Video. Also, the latent size in LTX-Video is approximately 2/5 of Wan2.1’s latent size, leading to a reduction in capacity.\n\nBelow are our responses to the questions you raised:\n\n`Question 1: In this method, can sender and receiver use M_2 = Mask( X_0, X_0^1), thereby avoiding the need to share k_2? Is there a specific reason for requiring k_2?`\n\nIndeed, our method can be simplified to avoid explicitly using $k_2$, requiring only $\\text{cfg}$ and $k_s$. As mentioned in Section 3.3 of our paper, we set $k_1$ = $k_s$ - cfg and $k_2$ = $k_s$ + cfg, so both $k_1$ and $k_2$ are controlled by a single hyperparameter cfg. And in this case, $d_2 = ||X_0^1 - X_0^2|| = 2\\times ||X_0 - X_0^1||$. Since the Discriminative Mask $M_2$ captures the $\\tau_2$% most-different positions between $X_0^1$ and $X_0^2$, therefore $M_2 = \\text{Mask}(X_0^1, X_0^2) = \\text{Mask}(X_0, X_0^1)$.\n\n\nSince message extraction depends primarily on the difference between $X_0^1$ and $X_0^2$, and this difference is determined by the distance between $k_1$ and $k_2$, a single parameter cfg is sufficient. Considering that the design of $k_1$ and $k_2$ is somewhat redundant, we appreciate your suggestion and will remove their description in the final submission, retaining only the hyperparameter **cfg**. This simplification reduces the number of tunable hyperparameters, making the method more practical for real-world deployment.\n\n`Question 2: Since the multi-mask mechanism enhances robustness, is it possible to increase capacity by embedding multi-bit messages using multiple values of k?`\n\nThank you for raising this insightful question. This idea has indeed been experimentally explored in prior work [2]. Specifically, during message extraction, if we use 4 different keys, we can obtain four corresponding variables $X_0^1, X_0^2, X_0^3, X_0^4$, thereby enabling us to encode 2-bit messages at each position and effectively doubling the embedding capacity.\n\nHowever, this introduces **a clear trade-off between capacity and robustness**. In practice, to ensure accurate extraction between just two variables $X_0^1$ and $X_0^2$, we already apply a strict filtering threshold ($\\tau_2 = 0.02$ of Mask $M_2$), which filters about 98% of the regions. Introducing additional keys would further reduce the usable embedding area, potentially making message extraction unreliable. Hence, we did not pursue the multi-key scenario further.\n\n[1] Ldstega: Practical and robust generative image steganography based on latent diffusion models. *Proceedings of the 32nd ACM International Conference on Multimedia*. 2024.\n\n[2] PSyDUCK: Training-Free Steganography for Latent Diffusion. *arXiv preprint arXiv:2501.19172* (2025).\n\n[3] Pulsar: Secure steganography for diffusion models. *Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security*. 2024.\n\n[4] Ltx-video: Realtime video latent diffusion. *arXiv preprint arXiv:2501.00103* (2024)."}]

Author rebuttal:

Meta-review: After the rebuttal, the paper received ratings of 4455. The paper presents a training-free video steganography framework to enhance robustness against compression artifacts in deterministic latent diffusion models. It introduces a new multi-mask mechanism for embedding information, which achieves an impressive capacity of about 12,000 bits with over 99% extraction accuracy. The presented approach is practical with strong performance. There were some concerns regarding limited initial evaluations and generalizability, but the authors have addressed reviewers' concerns well. Given the positive feedback from the reviewers, the AC recommends acceptance to NeurIPS 2025.
Decision: Accept (poster)