LDStega: Practical and Robust Generative Image Steganography based on  Latent Diffusion Models

Venue: acmmm_org_ACMMM_2024_Conference
Published: 2024-04-09 04:32:22

Abstract: Generative image steganography has gained significant attention due to its ability to hide secret data during image generation. However, existing generative image steganography methods still face challenges in terms of controllability, usability, and robustness, making it difficult to apply real-world scenarios. To ensure secure and reliable communication, we propose a practical and robust generative image steganography based on Latent Diffusion Models, called LDStega. LDStega takes controllable condition text as input and designs an encoding strategy in the reverse process of the Latent Diffusion Models to couple latent space generation with data hiding. The encoding strategy selects a sampling interval from a candidate pool of truncated Gaussian distributions guided by secret data to generate the stego latent space. Subsequently, the stego latent space is fed into the Decoder to generate the stego image.  The receiver extracts the secret data from the globally Gaussian distribution of the lossy-reconstructed latent space in the reverse process. Experimental results demonstrate that LDStega achieves high extraction accuracy while controllably generating image content and saving the stego image in the widely used PNG and JPEG formats. Additionally, LDStega outperforms state-of-the-art techniques in resisting common image attacks.

Main paper: 
 introduction: 
 The rapid advancements in AI-generated content (AIGC) have led to significant concerns regarding data privacy, security, and protection. Image steganography is a technique used for covert communication, where secret data are concealed within images to prevent unauthorized access or detection. Traditional image steganography involves modifying the cover image to embed secret data, including both hand-crafted and deep learning-based methods. However, these methods often leave explicit traces of the secret data as artifacts or local details in the stego image, making them susceptible to detection by well-designed steganalysis techniques, reducing the security of steganography. Recently, significant progress has been made in image generation using generative models, producing the proposal of generative image steganography (GIS) [19, 23, 32, 33, 41] . While GIS shows promising performance in resisting typical steganalysis attacks, there are still certain drawbacks that need to be addressed. GANbased DCGAN-Steg [13] is limited by the choice of model, resulting in generated images with insufficient fidelity. Although S2IRT [41] based on the Glow model and IDEAS [19] based on image disentanglement autoencoder improve the quality of generated images, they are trained in a noiseless simulation environment, making them vulnerable to real-world attacks. Additionally, these methods save stego images as floating-point types instead of integer types, which severely impacts their robustness and usability. RoS-teALS [4] and CtrGAN [40] consider robustness but overlook the problem of quantization rounding of stego images. Furthermore, the generating content of the stego images in these methods lacks controllability, as generated images are only randomly sampled from the generation model. For a steganographer, it's essential to take into account both the resistance to steganalysis of the steganographic image and its covert behavior, that is, the stego image needs to be tailored according to the sender's characteristics, including his/her occupation and interests, thereby preventing any suspicion from arising due to unusual behavior. Overall, the current methods lack a comprehensive solution that encompasses controllability, availability, and robustness.Recently, diffusion models, especially Latent Diffusion Models (LDM), have developed a lot, facilitating text-based conditional image generation, which aligns well with our steganography task's need for controllability. Meanwhile, large-scale LDM communities have contributed an extensive collection of freely available opensource tools, which provides a good camouflage environment for steganography. However, how to couple message hiding and image generation in LDM, while the process is also robust to lossy data storage and lossy channel transmission operations, remains a problem. To address this, we propose LDStega, a practical and robust generative image steganography based on LDM, as illustrated in Fig. 1 . Specifically, LDStega conceals secret data within the noise and utilizes a deterministic sampler to generate the latent space of the stego image. Subsequently, a Decoder is then used to generate the stego image from this latent space. However, the discretization, noise addition, and encoding processes introduce information loss in the latent space, leading to diminished decoding accuracy of the secret data. To enhance the precision of secret data recovery, a mapping function based on a truncated Gaussian distribution is designed. For the receiver, the shared random seed and condition can be utilized to replicate the generation process of the latent space, thereby obtaining the probability distribution of the latent space and facilitating secret data extraction. The main contributions of LDStega can be summarized as follows:• Latent steganography: By experimentally exploring three key properties of LDM, we design practical and robust generative image steganography based on LDM. LDStega conceals secret data within the noise and utilizes a deterministic sampler to generate the stego latent space. Notably, LDStega does not require fine-tuning pre-trained models or training additional models.• Practicality: LDStega utilizes the controlled condition text as input, enabling the sender to generate personalized stego images for various scenarios with the sender's characteristics, thereby avoiding suspicion arising from unusual behavior. Furthermore, LDStega saves stego images in the commonly used PNG and JPEG formats, effectively addressing the issue of reduced extraction accuracy resulting from quantization errors.• Robustness: We design a coding strategy that selects a sampling interval from a candidate pool of truncated Gaussian distributions guided by secret data to generate the stego latent space, which ensures high extraction accuracy in resisting common image attacks. 
preliminaries and related work 2.1 steganography based on embedding: 
 For steganography with embedding, the earliest traditional methods embed secret data based on least significant bits (LSBs) replacement [30] . After that, adaptive steganography [8, 11, 12, 17, 18, 31, 39] is proposed to find suitable regions to modify during the embedding process. In recent years, deep learning-based techniques have been used for steganographic tasks [2, 9, 16, 20] because of their powerful learning capabilities. Baluja et al. [2] proposed an encoder and a decoder for concealing and extracting secret color images, respectively. FNNS [16] exploits neural networks' sensitivity to tiny perturbations, achieving a reliable 0% error rate when concealing up to 3 bits per pixel (bpp) of secret data in images. To improve security, AdaSteg [22] utilized deep reinforcement learning and encrypted noises to implement adaptive local image steganography. Following, invertible neural networks (INNs) [9, 14, 20, 34] are used to implement large-capacity steganography. Nevertheless, steganography with embedding has an inherent risk that modification traces of the cover image are inevitably left. This, in turn, may result in easy detection of the stego image by well-designed steganalysis techniques [3, 35, 36] .Generative image steganography utilizes generative models to hide secret data during image generation. In 2022, Liu et al. [19] proposed an image disentanglement autoencoder for steganography (IDEAS), which exploits the structure representation's stability to improve the secret data's decoding rate. However, it suffers from the inefficiency and irreversibility of the secret-to-image transformation. To address this issue, Zhou et al. [41] proposed an S2IRT scheme that utilizes the Glow model to establish a bijective mapping between the latent space with a multivariate Gaussian distribution and the image space with a complex distribution. However, S2IRT has limitations regarding the visual quality and diversity of stego images. CtrGAN [40] introduces a generative steganographic framework that auto-generates semantic object contours. It encodes the given secret data as these object contours, preserving their distribution for stego image generation. RoSteALS [4] proposes a practical steganography technique leveraging frozen pretrained autoencoders to free the payload embedding from learning the distribution of cover images. Additionally, the stego images of these methods are saved as floating-point types rather than integer types, which severely impacts their availability in the real world. GSN [32] integrates a mutual information mechanism for synthesizing stego images. It consists of four sub-networks: a discriminator, a steganalyzer, an extractor, and a generator. While GSN [32] addresses the issue of quantization error, it is still trained in a noiseless simulation environment, failing to improve the robustness of steganography.Due to its powerful network representation, diffusion models, which are trained to model the target image distribution starting from a noise distribution, have been applied to a wide variety of generative modeling tasks, such as image generation [27, 29] , image inpainting [6, 7, 21] , image editing [1, 5] , among others. Diffusion models involve a forward diffusion process where noise is progressively added to the image to create a noisy image conforming to a Gaussian distribution, and a backward image generation process where the noisy image is gradually denoised to yield a natural image. The denoising diffusion probabilistic model (DDPM) [5, 10] has multiple image generation steps and operates directly in the pixel space, resulting in long processing times and high inference costs. Fortunately, a recent advancement called Latent Diffusion Models [24] has applied the diffusion process and its inverse to the latent space of images. This improvement significantly reduces training costs and greatly enhances image fidelity compared to previous diffusion models. Recently, Yu et al. [38] utilize the image transformation capability of LDM to realize the conversion of secret image to container image. Unlike their approach, which hides the secret image into the container image, LDStega designs an encoding strategy in the reverse process of the LDM to hide binary bit stream to improve extraction accuracy of secret data and enhance universality. 
proposed approach: 
 In this paper, we propose a practical and robust generative image steganography based on LDM to achieve controllability, availability, and robustness in secret data hiding. In the LDStega framework, illustrated in Fig. 2 , the sender can personalize the stego image by transforming input text into text embedding through a Condition Encoder T 𝜃 . By leveraging the pretrained LDM's characteristics, which exhibit the loss of reconstructing the latent space in the diffusion process and robustness of image reconstruction in the reverse process, LDStega designs an encoding strategy utilizing the probability distribution of the latent space to hide secret data. The sender uses this encoding strategy of the truncated Gaussian distribution to encode the secret data into the latent space 𝑍 𝑠 𝑇 . Following this, the stego latent space is fed into the Decoder to generate the stego image. Stego images are stored in widely used PNG or JPEG formats and transmitted through lossy channels. In the extracting process, the receiver extracts the secret data from the globally Gaussian distribution of the lossy-reconstructed latent space by executing the inverse procedure of message hiding.To explore whether a pretrained LDM [25] has steganographic capabilities, LDStega conducts experiments using an LDM that accepts condition text input to control the content of the generated image. Taking Fig. 2 as an illustration, the condition text (prompt="a virus monster is playing guitar, oil on canvas") is initially inputted into the Condition Encoder T 𝜃 to derive the corresponding condition embedding 𝑐𝑑. Simultaneously, a latent space 𝑍 0 of size 𝐻 ′ ×𝑊 ′ ×𝐶 ′ is sampled from a Gaussian distribution. Following this, both 𝑍 0 and the condition embedding 𝑐𝑑 are fed into the conditional inverse process of the denoising diffusion implicit model (DDIM). The process can be mathematically represented as follows:EQUATIONwhere 𝑂𝐷𝐸𝑆𝑜𝑙𝑣𝑒 is an Ordinary Differential Equation (ODE) solver [26] , and 𝜖 𝜃 represents a pretrained noise estimator. After 𝑇 steps of diffusion, the obtaining 𝑍 𝑇 is inputted a Decoder D to produce an image 𝑋 of size 𝐻 × 𝑊 × 𝐶, where 𝐻 ′ ≤ 𝐻 and 𝑊 ′ ≤ 𝑊 . In the process of reconstructing the latent space, the pretrained Encoder E is employed to reconstruct the latent space 𝑍 ′ 𝑇 from the generated image 𝑋 . (iii) The sampling process of 𝑍 𝑇 obeys the Gaussian distribution, and within a range of truncation intervals, the difference between images generated by global Gaussian sampling and truncated Gaussian sampling is minimal. As illustrated in the rightmost three columns of Fig. 3 , the images are generated with truncated intervals 𝛾 on both the left and right sides of the symmetry axis of the Gaussian distribution probability density function set to 0.1, 0.3, and 0.5, respectively. It is noticeable that setting 𝛾 to 0.1 and 0.3 has a minor impact on the generated image, whereas when 𝛾 = 0.5, the impact becomes substantial due to the significant deviation of the sampled value from the mean of the Gaussian distribution 𝜇 𝑇 -1 . Based on both (i) and (ii), it is apparent that the reconstruction of the latent space yields a loss in all three cases when the generated image remains unprocessed, quantized, and noisy. Regarding (iii), when 𝛾 ≤ 0.3, the generated image is insensitive to this variation.EQUATIONEQUATIONEQUATIONwhere 𝑆𝑎𝑚𝑝𝑖𝑛𝑔 (•) denotes the sampling function associated with the Gaussian distribution. Therefore, the mapping function designed by LDStega should be able to robustly hide the secret data in the generation process from 𝑍 𝑇 -1 to 𝑍 𝑇 in the LDM.LDStega requires three pretrained submodels of the LDM: a Conditional Encoder T 𝜃 , a Decoder D, and an Encoder E. The communication process involves two participants: the sender and receiver, with the stego image transmitted through a lossy channel. For generating stego images, LDStega initiates by initializing the latent space 𝑍 0 using a random seed, ensuring 𝑍 0 ∼ N (0, I), where I denotes the identity matrix. The condition text is encoded into 𝑐𝑑 using the conditional encoder T 𝜃 .EQUATIONSubsequently, 𝑍 0 and 𝑐𝑑 are utilized as inputs for the first step of the DDIM inverse process, resulting in the derivation of the mean 𝜇 0 and the variance 𝜎 0 :EQUATIONwhere 𝑓 (•) represents the DDIM network. Following Eq. ( 7), the latent space 𝑍 1 is obtained, and then 𝑍 1 continues to be fed into the network to get 𝜇 1 and 𝜎 1 . This process is repeated until 𝑍 𝑇 -1 is generated, where N 𝑡 ∼ N (0, I).EQUATIONTo minimize secret data loss caused by the reconstruction of the latent space and the lossy transmission of stego image, LDStega designs a robust mapping function 𝐻 (•) to hide the secret data into the latent space 𝑍 𝑠 𝑇 during the diffusion process from 𝑍 𝑇 -1 to 𝑍 𝑇 . Given that both the sender and receiver share the same random seeds, allowing the model to reverse the LDM process and reproduce 𝑋 𝑇 , the sender can perform pre-generation 𝑋 = D (𝑍 𝑇 ). Subsequently, the sender utilizes the Encoder to reconstruct an approximation of the latent space, denoted as 𝑍 , we employ Eq. ( 8) to hide secret data in targeting positions where 𝐷 exhibits relatively low values during the diffusion process from 𝑍 𝑇 -1 to 𝑍 𝑇 , until the entire secret data is effectively concealed.𝑍 𝑠 𝑇 [𝑖] = 𝐻 𝑚 𝑘 , N 𝜇 𝑇 -1 [𝑖] , 𝜎 2 𝑇 -1 [𝑖] , 𝛾 , 𝑖 𝑓 𝐷 [𝑖] ∈ 𝑀𝑆 𝑢 𝑍 𝑠 𝑇 [𝑖] = 𝜇 𝑇 -1 [𝑖] + 𝜎 𝑇 -1 [𝑖] • N 𝑇 -1 [𝑖] , 𝑖 𝑓 𝐷 [𝑖] ∉ 𝑀𝑆 𝑢 (8) where 𝑢 ∈ {0, 1, • • • , 6}, 𝑖 ∈ 1, 2, • • • , 𝐻 ′ × 𝑊 ′ × 𝐶 ′. Following the completion of diffusion, the Decoder D is utilized to generate the stego image 𝑋 𝑠 .EQUATIONWhile Wei et al. [33] showed that saving stego images in floatingpoint TIFF format in superior extraction accuracy compared to integer-based PNG or JPEG formats, it's noteworthy that the TIFF format occupies more storage space than the PNG and JPEG formats. Additionally, PNG and JPEG formats are more prevalent on platforms such as social media. Consequently, LDStega stores 𝑋 𝑠 as an integer type PNG or JPEG formatted image 𝑋 𝑞 .EQUATIONwhere 𝑄𝑢𝑎𝑛𝑡 (•) denotes the quantitative function applied to store the stego image in PNG or JPEG format. At the receiver's end, the stego image 𝑋 𝑟 is received over the lossy channel.EQUATIONwhere 𝑅𝑜𝑏𝑢𝑠𝑡 (•) represents the noise layer applied to the stego image in PNG or JPEG format. It is worth noting that both the sender and receiver must share the pretrained LDM and mapping function. The detailed procedure for generating the stego image 𝑋 𝑟 using LDStega is outlined in Algorithm 1.3.3.1 Message hiding. LDStega conceals the secret data in the generated image through four primary steps: preprocessing secret data, designing the mapping function 𝐻 (•), constructing of stego latent space 𝑍 𝑠 𝑇 , and generating stego image 𝑋 𝑠 . In the preprocessing stage, the sender encrypts the secret data 𝑚 of length 𝑙 using the key 𝑘 1 to enhance security, resulting in uniformly distributed encrypted secret message 𝑚 𝑒 . Then, to ensure robust extraction of secret data while maintaining the quality of generated images, LDStega leverages the Gaussian distribution property of 𝑍 𝑇 to hide the encrypted data 𝑚 𝑒 . It designs candidate pools 𝑝𝑜𝑜𝑙 𝑘 = 𝑝𝑜𝑜𝑙 𝑘,0 , 𝑝𝑜𝑜𝑙 𝑘,1 , symmetrically positioned about the mean 𝜇 𝑇 -1 of the Gaussian distribution's probability density function, for 𝑘 in the set 𝑘 ∈ {1, 2, • • • , 𝑙 }. Then, driven by the secret data, one candidate pool is selected as the sampling interval. To enhance the robustness of LDStega, a parameter with a truncated interval 𝛾 is introduced. This modification confines the two candidate pool intervals to the ranges (-∞, 𝜇 𝑇 -1 -𝛾) and (𝜇 𝑇 -1 + 𝛾, +∞), respectively. To further enhance security, LDStega encrypts 𝑝𝑜𝑜𝑙 𝑘 using the key 𝑘 2 , yielding encrypted candidate pools labeled [1] ) from left to right. When the secret data are 0, the candidate pool 𝐼𝑛𝑑 [0] is sampled using the truncated Gaussian distribution. Conversely, when the secret data if 𝑡 = 0 then 5:𝐼𝑛𝑑 [0] = (𝑐 [0] [0] , 𝑐 [0] [1]) and 𝐼𝑛𝑑 [1] = (𝑐 [1] [0] , 𝑐 [1]𝑍 0 = 𝑆𝑎𝑚𝑝𝑙𝑖𝑛𝑔(𝑑 0 , N (0, I))6:else 7:(𝜇 𝑡 , 𝜎 𝑡 ) = 𝑓 (𝑍 𝑡 , 𝑐𝑑)N 𝑡 = 𝑆𝑎𝑚𝑝𝑙𝑖𝑛𝑔(𝑑 𝑡 , N (0, I))9:𝑍 𝑡 +1 = 𝜇 𝑡 + 𝜎 𝑡 • N 𝑡 10:end if11: 𝑋 = D (𝑍 𝑇 ), 𝑍 ′ 𝑇 = E (𝑋 ), 𝐷 = 𝑍 𝑇 -𝑍 ′ 𝑇 12: if 𝑘 < 𝑙 then 13: for 𝑢 ∈ {0, 1, • • • , 6} do 14: for 𝑖 ∈ 1, 2, • • • , 𝐻 ′ × 𝑊 ′ × 𝐶 ′ do 15:if 𝐷 [𝑖] ∈ 𝑀𝑆 𝑢 then 16: 𝑍 𝑠 𝑇 [𝑖] = 𝐻 𝑚 𝑘 , N 𝜇 𝑇 -1 [𝑖] , 𝜎𝑍 𝑠 𝑇 [𝑖] = 𝜇 𝑇 -1 [𝑖] + 𝜎 𝑇 -1 [𝑖] • N 𝑇 -1 [𝑖] 20:end ifend forend forend if𝑋 𝑠 = D 𝑍 𝑠 𝑇 , 𝑋 𝑞 = 𝑄𝑢𝑎𝑛𝑡 (𝑋 𝑠 ), 𝑋 𝑟 = 𝑅𝑜𝑏𝑢𝑠𝑡 (𝑋 𝑞 ) 25: end for are 1, the candidate pool of 𝐼𝑛𝑑 [1] is sampled using the truncated Gaussian distribution.EQUATION)This process is repeated until all the secret data are concealed, and generating the stego latent space 𝑍 𝑠 𝑇 . Subsequently, Eq. ( 9) is employed to produce the stego image 𝑋 𝑠 . The detailed procedure of the mapping function 𝐻 (•) is illustrated in Algorithm 2.𝑇 from the received 𝑋 𝑟 using the Encoder E. The generation process of 𝑍 𝑇 -1 is then reproduced utilizing the shared random seed 𝑆𝑒𝑒𝑑 and condition text 𝑐𝑑. The mean 𝜇 𝑇 -1 and standard deviation 𝛿 𝑇 -1 is computed via Eq. ( 6). The receiver sequentially extracts the secret data from 𝑍 𝑠 ′ 𝑇 based on 𝐷 and the length 𝑙 of the shared secret message. This extraction sequence is performed according to seven interval in 𝑀𝑆 = {𝑀𝑆 0 , 𝑀𝑆 1 , . . . , 𝑀𝑆 6 }. The receiver reconstructs the candidate pools 𝑝𝑜𝑜𝑙 𝑘,0 and 𝑝𝑜𝑜𝑙 𝑘,1 with the mean 𝜇 𝑇 -1 of the probability density function of Gaussian distribution as the axis of symmetry. Their intervals are (-∞, 𝜇 𝑇 -1 ] and (𝜇 𝑇 -1 , +∞). To maintain the same labeling order as the sender, LDStega encrypts the candidate pools for 𝑢 ∈ {0, 1, • • • , 6} do 5: for 𝑖 ∈ 1, 2, • • • , 𝐻 ′ × 𝑊 ′ × 𝐶 ′ do 6:if 𝐷 [𝑖] ∈ 𝑀𝑆 𝑢 then 7:𝑧 𝑖 ∼ N 𝜇 𝑖 𝑇 -1 , (𝜎 𝑖 𝑇 -1 ) 2 8: 𝑝𝑜𝑜𝑙 𝑘,0 = -∞, 𝜇 𝑖 𝑇 -1 -𝛾 9:𝑝𝑜𝑜𝑙 𝑘,1 = 𝜇 𝑖 𝑇 -1 + 𝛾, +∞ 10:(𝐼𝑛𝑑 [0] , 𝐼𝑛𝑑 [1] ) = 𝐸 𝑘 2 , 𝑝𝑜𝑜𝑙 𝑘,0 , 𝑝𝑜𝑜𝑙 𝑘,111:𝑧 𝑠 𝑖 = 𝑡𝑟𝑢𝑛𝑐 𝜇 𝑖 𝑇 -1 , 𝜎 𝑖 𝑇 -1 , 𝑐 𝑚 𝑒 𝑘 [0] , 𝑐 𝑚 𝑒 𝑘 [1]12:end if13:end for 14:end for 15: end for using the shared key 𝑘 2 . The encrypted candidate pools are labeled 𝐼𝑛𝑑 [0] and 𝐼𝑛𝑑 [1] from left to right, respectively. When𝑧 𝑠 ′ 𝑖 ≤ 𝜇 𝑇 -1 , 𝑚 𝑒 ′ 𝑘 = 0. When 𝑧 𝑠 ′ 𝑖 > 𝜇 𝑇 -1 , 𝑚 𝑒 ′ 𝑘 = 1.The above operation is repeated until all the secret data 𝑚 𝑒 ′ are extracted. Finally, the secret data 𝑚 𝑒 ′ is decrypted using the key 𝑘 1 to obtain 𝑚EQUATION 
experimental results: 
 In our experiment, we chose a publicly pretrained Latent Diffusion Model 1 to perform the generative image steganography task, where the size of the latent space is 32 ×32 ×4 and 𝑟 = 0.3. The forward diffusion and backward processes all consisted of 50 steps. All experiments were executed on a GeForce RTX 1080Ti, and LD-Stega requires no additional training or fine-tuning of the LDM. We assess the flexibility of LDStega's capacity by varying the conditions of the targeted steganography positions. To demonstrate the controllability of LDStega, LDStega designed experiments in two scenarios based on the condition text. To demonstrate the superiority of LDStega in terms of availability and robustness, we compare it with two steganography with embedding (SE) methods, namely Hidden [42] , CHAT-GAN [28] and four state-of-the-art (SOTA) GIS methods, namely IDEAS [19] , S2IRT [41] , and StegaDDPM [23] .The above methods were evaluated on Bedroom and Cat datasets [37] , as well as on face images from FFHQ [15] . LDStega categorizes the dataset into three classes, namely human faces, animals, and general objects (such as bedrooms, architecture, etc.). Extraction accuracy (Acc) and capacity are used to evaluate the decoding accuracy of secret data and steganographic capacity, respectively.1 https://github.com/CompVis/latent-diffusion To validate the effectiveness of LDStega's hiding strategy in the case of low steganographic capacity, which selects targeting positions where 𝐷 exhibits relatively low values to hiding secret data, Table 1 presents the steganographic capacity and extraction accuracy for three distinct conditions of the targeted steganography positions: (𝑀𝑆 0 ) , (𝑀𝑆 0 , 𝑀𝑆 1 ) , (𝑀𝑆 0 , • • • , 𝑀𝑆 6 ). By employing the mapping function to hide secret data within 𝑍 𝑠 𝑇 at the specified position (𝑀𝑆 0 ) in 𝐷, we achieve a steganographic capacity of 1639 bits for the PNG format, with outstanding extraction accuracies of 99.51%, 99.32%, and 99.46% for the FFHQ, Bedroom, and Cat datasets, respectively. Transitioning to JPEG format slightly reduces the steganographic capacity to 1129 bits, but the extraction accuracy is still commendable, at 98.34%, 98.27%, and 98.22% for the respective datasets. When focusing on positions (𝑀𝑆 0 , 𝑀𝑆 1 ) in 𝐷 for 𝑍 𝑠 𝑇 , the PNG format delivers a higher steganographic capacity of 2805 bits, accompanied by equally impressive extraction accuracies of 99.22%, 99.39%, and 99.28% for the FFHQ, Bedroom, and Cat datasets. In the case of JPEG format, a steganographic capacity of 2085 bits is observed, along with strong extraction accuracies of 97.96%, 98.01%, and 98.11% for the FFHQ, Bedroom, and Cat datasets. Table 1 confirms that LDStega's position selection strategy effectively optimizes steganographic performance under low steganographic capacity, while also maintaining a high extraction accuracy even if the capacity is 4096 bits.LDStega with regard to image content generation, as illustrated in Fig. 5 , LDStega presents the generated stego images for two scenarios based on the input condition text. In the first scenario, the sender generates personalized stego images for different scenes using distinct condition text. For instance, when inputting descriptions such as "Mickey Mouse and Donald Duck" or "Van Gogh's Starry Night" into the model, LDStega will generate the corresponding stego images. In the second scenario, the sender generates multiple stego images for the same scene, all based on the same condition text. For example, when "A vase brimming with flowers" and "A cactus that grows in the desert" are entered, the second row of Fig. 5 displays four stego images corresponding to condition text. LDStega excels at tailoring steganographic images to align with the sender's characteristics, including their occupation and interests, thereby preventing any suspicion from arising due to "High-speed "Mickey Mouse and "An oil painting of "Van Gogh's rail" "Two rabbits" Donald Duck" "Winter" space shuttle" "Dolphin" Starry Night" "Sunflower" "A vase brimming with flowers" "A cactus that grows in the desert" unusual behavior. In contrast, methods such as IDEAS [19] , S2IRT [41] , StegaDDPM [23] , RoSteALS [4] fall short in this aspect. These techniques are limited to generating steganographic image content within the boundaries of their training dataset, lacking autonomous control over features such as style, object count, and color in the generated images. Given that our proposed approach grants precise control over the content of generated images, potential attackers are unable to discern the presence of steganography by scrutinizing the application context of steganographic images, thus enhancing the security of steganographic practices.To improve the availability of steganography in realistic scenarios, we discretized the pixel values of the stego images into integers and subsequently saved them in PNG and JPEG formats. As shown in Table 2 , we compare our work with two types of steganography methods in terms of steganographic capacity, extraction accuracy, and stego image size: 1) SE methods based on deep learning, in which the cover image is modified to perform secret data embedding (including Hidden [42] and CHAT-GAN [28] ,where Hidden [42] is trained without a noise layer). 2) GIS methods (including IDEAS [19] , S2IRT [41] , and StegaDDPM [23] ). The results in Table 2 demonstrate that LDStega outperforms the SOTA methods in both PNG and JPEG formats. Specifically, when the stego image is PNG format, Hidden [42] , IDEAS [19] , and S2IRT [41] exhibit significantly lower extraction accuracy of secret data at the corresponding capacity, which can not meet the communicating parties' requirements for information accuracy. While CHAT-GAN [28] , StegaDDPM [23] , and LDStega perform relatively well. Notably, LDStega achieves impressive extraction accuracy of 98.65%, 98.50%, and 98.48% on FFHQ, Bedroom, and Cat datasets, respectively. The experiments indicate that Hidden [42] and S2IRT [41] exhibit weak resistance to quantization errors, whereas CHAT-GAN [28] , StegaDDPM [23] and LDStega demonstrate robustness against quantization errors. Additionally, it was observed that the low extraction accuracy of IDEAS [19] is attributed to its steganographic capacity rather than quantization errors. Even when the stego image is in JPEG format, LDStega maintains a consistently high extraction accuracy that remains unattainable by two types of steganography methods. Furthermore, our observations reveal that stego images with the PNG format lead to a higher extraction accuracy of secret data compared to the JPEG format. This is attributed to JPEG's use of lossy compression for reducing image file size, whereas PNG utilizes lossless compression, making it more suitable for preserving the integrity of hidden information. In conclusion, LDStega emerges as an efficient and competitive GIS method with high availability in realistic scenarios.To evaluate the robustness of LDStega, we subjected the generated stego images to commonly used image attacks, including Identity, Crop, Salt & Pepper noise, Gaussian noise, and JPEG compression. These attacks are known to increase the difficulty of extracting secret data. We focus on analyzing and discussing the robustness of LDStega's PNG and JPEG stego images against these attacks. Table 2 demonstrates that Acc of Hidden [42] , IDEAS [19] , and S2IRT [41] are already considerably low, even in the absence of attacks. Therefore, when the stego image is PNG format, Table 3 compares Acc of LDStega with CHAT-GAN [28] and StegaDDPM [23] under the aforementioned attacks. The results in Table 3 illustrate that LDStega exhibits excellent adaptability to various common image attacks, maintaining a high extraction accuracy for secret data. In particular, when resisting JPEG compression, the Acc of CHAT-GAN [28] and StegaDDPM [23] is close to 50%, whereas LDStega continues to uphold a high extraction accuracy. The main reason is that the secret data are encoded in the latent space of generated images. LDM lies in its natural robustness to noise and perturbations due to its inherent Gaussian noise characteristics of latent space. Thus, combined with the robust mapping function, we can still achieve high decoding accuracy for secret data in the case where the stego image undergoes discrete quantization and lossy channels.When the stego image is in JPEG format, Table 4 only displays the experimental results of the proposed methods under the attacks of Identity, Crop, Salt & Pepper noise, Gaussian noise, and JPEG compression. This is because CHAT-GAN [28] and StegaDDPM [23] have already shown low resistance to attacks in the PNG format, failing to meet the basic requirements of steganography. It can be observed from Table 4 that LDStega still maintains a high Acc in JPEG format, which proves the superiority of LDStega. 
conclusion: 
 In this paper, we propose LDStega, a practical and robust generative image steganography based on LDM. By reconstructing the latent space and applying quantization and noise to the generated image, we draw three conclusions about LDM, and based on three conclusions we design a coding strategy to hide secret data on the latent space, achieving controllable, available, and robust generative image steganography. The controllability of LDStega allows senders to generate personalized stego images for different scenarios with the sender's characteristics, including their occupation and interests, thereby preventing any suspicion from arising due to unusual behavior. Furthermore, we compare LDStega with the SOTA methods.Experimental results demonstrate that LDStega maintains a high extraction accuracy when stego images are saved in the widely used PNG and JPEG formats. LDStega also exhibits superior resistance to common image attacks compared to existing techniques. Consequently, LDStega shed light on the practical application of generative image steganography in real-world scenarios.  
 
 Appendix:  


Decision: The manuscript has been reviewed by four reviewers, and has received mixed reviews post rebuttal,

The comments from Reviewer pgJE, who is an experienced expert in the field, gave detailed comments and in-depth analysis. After the rebuttal, the reviewer is not convinced by the authors' response, including the comments on the novelty, among others. There are also some concerns on, for example, the Steganalysis.

Since MM seeks the highest quality, the manuscript in the current form, unfortunately, could not be accepted. The AC understands that this might be a sad news, and hopes the authors could address the major concerns raised by the reviewers in the next version.

***TPC Addendum***
Besides official reviews, this paper was discussed between TPC, SAC, and AC. The limitations on novelty were noted but we also discussed the importance of the application area and the strengths in terms of unified methodology and personalization. Three of the four reviewers recommended acceptance, and two also raised their scores after rebuttal. While the paper is very close to the borderline, we are suggesting a poster acceptance to allow for the debate and discussion to continue at the conference.

Reviews: review: paper_summary: paper_summary: This paper introduces a robust generative steganographic scheme based on the LDM.  The scheme proposes a mapping method to hide binary secret data, applying a truncated Gaussian distribution sampling method.   It also takes the text as a condition to guide the generation of stego images.  Though better performances are achieved compared to existing methods, the paper has some weaknesses.
strength_weakness: strength_weakness: This paper proposes a new mapping function to hide secret data during the diffusion process of LDM, which is well organized. For instance, it introduces the principle of diffusion models, counting the number of elements in six different intervals and showing the algorithms and results of different text prompts in the paper. At last, it demonstrates detailed experiments on various datasets.
limitations: limitations: However, some weaknesses exist in the paper. 
1)  the novelty of this paper is limited. This paper only proposes a mapping function, which is improved slightly on existing methods. It seems the paper is not innovative.
2) Steganalysis is not conducted in the paper, which is necessary for steganography.
3) Some existing comparative methods, like work[1], are not included in the paper. They also demonstrate good robustness. 
4) The experiments do not verify the so-called  "practical and robustness steganography".  The noising factors in Table 3 and Table 4 are too small, which seems impractical in reality 
5) This paper is not clearly written, and the secret mapping process is perplexing. For example, line 11 in Algorithm 2 is not elaborated, where $Ind[0]$ is the same as $C[.][0]$?
6) Do different text prompts affect the performances?

[1] Wei P, Zhou Q, Wang Z, et al. Generative steganography diffusion[J]. arXiv preprint arXiv:2305.03472, 2023.
paper_summary: paper_summary: The proposed method LDStega utilizes large-scale LDM communities that have contributed an extensive collection of freely available open-source tools. LDStega has a broader range of applications and offers a new reference pattern for steganography design.
strength_weakness: strength_weakness: LDStega utilizes the controlled condition text as input, enabling the sender to generate personalized stego images for various scenarios with the sender’s characteristics, thereby avoiding suspicion arising from unusual behavior.  Furthermore, LDStega saves stego images in the commonly used PNG and JPEG formats, making this method more practical.
limitations: limitations: 1. LDStega leverages a pre-trained Latent Diffusion Model to hide the secret data in the latent space. However, the transformation of the stego image into the latent space by the receiver will incur information loss. Why not consider training a lightweight secret data extractor for extraction.
2. The experimental design in Table 1 requires refinement. To validate the effectiveness of LDStega's hiding strategy in the case of low steganographic capacity, a comparative analysis should be conducted. This would involve assessing the accuracy of extraction when employing LDStega's strategy at a low embedding capacity, as opposed to the accuracy achieved without utilizing LDStega under same low steganographic capacity conditions.
3. The English grammar, spelling, and sentence structure of this paper should be improved, so that the goals and results of the study are clearer to the reader.
4. For improved readability, the numerical clarity in both the horizontal and vertical axes of Figure 4 should be enhanced.
5. LDStega utilizes a truncated Gaussian distribution for hiding to improve the extraction rate of secret data. A comprehensive analysis is needed to identify the elements within the LDStega framework that contribute to potential decoding losses of the secret data.
paper_summary: paper_summary: This paper proposes LDStega, a practical and robust generative image steganography based on LDM. By reconstructing the latent space and applying quantization and noise to the generated image, LDStega designed a coding strategy to hide secret data on the latent space, achieving controllable, available, and robust generative image steganography.
strength_weakness: strength_weakness: 1.	LDStega can conceal secret data within the noise and utilizes a deterministic sampler to generate the stego latent space. Notably, LDStega does not require fine-tuning pre-trained models or training additional models.

2.	LDStega utilizes the controlled condition text as input, enabling the sender to generate personalized stego images for various scenarios with the sender’s characteristics, thereby avoiding suspicion arising from unusual behavior

3.	LDStega design a coding strategy that selects a sampling interval from a candidate pool of truncated Gaussian distributions guided by secret data to generate the stego latent space, which ensures high extraction accuracy in resisting common image attacks.
limitations: limitations: 1.	LDStega consistently applies a truncation interval of 0.3 for r. Can r be reduced below 0.3 in low-capacity steganographic scenarios, thereby enhancing the quality of the stego images without compromising the high extraction rate?

2.	Given that Pulsar [1] is another image steganography algorithm based on diffusion models, it merits inclusion in the reference section to ensure a thorough literature review. 
[1] Jois T M, Beck G, Kaptchuk G. Pulsar: Secure Steganography through Diffusion Models[J]. Cryptology ePrint Archive, 2023.

3.	The manuscript encompasses a multitude of variables; a thorough examination is required to confirm the proper utilization of each variable name.

4.	The experimental setup in Section 4.1 should be revised, as the title "Flexibility of Steganographic Capacity" is not consistent with the purpose of the experiments discussed.
paper_summary: paper_summary: This paper proposes the LDStega method. Experimental results show that LDStega can control the content of generated images while also saving steganographic images in PNG and JPEG formats, achieving high extraction accuracy.
strength_weakness: strength_weakness: This paper discusses an interesting area and achieves superior performance than existing methods.
limitations: limitations: Several limitations are shown as follows:

(1) How stable is the method? That is, the experimental results lack standard deviation.

(2) The fonts in Figure 2 are not uniform and the modules are not aligned. Please modify them carefully to improve the professionalism of the drawing.

(3) Does the performance of the proposed method mainly come from diffusion or what? This aspect must be experimentally compared and discussed.

If the above questions are adequately answered, I may consider increasing my existing score.