[Paper Review] Diffusion-Stego: Training-free Diffusion Generative Steganography via Message Projection

Daegyu Kim, Chaehun Shin+3 more|arXiv (Cornell University)|May 30, 2023

Advanced Steganography and Watermarking Techniques4 citations

TL;DR

Diffusion-Stego is a training-free generative steganography method that embeds secret messages into the latent noise of pre-trained diffusion models using a novel message projection technique, enabling high-capacity, high-fidelity stego images indistinguishable from real ones. It achieves up to 6.0 bpp with 90% message accuracy and a FID score of 2.77 at 1.0 bpp on FFHQ 64×64, leveraging deterministic samplers for invertible message embedding and extraction without retraining.

ABSTRACT

Generative steganography is the process of hiding secret messages in generated images instead of cover images. Existing studies on generative steganography use GAN or Flow models to obtain high hiding message capacity and anti-detection ability over cover images. However, they create relatively unrealistic stego images because of the inherent limitations of generative models. We propose Diffusion-Stego, a generative steganography approach based on diffusion models which outperform other generative models in image generation. Diffusion-Stego projects secret messages into latent noise of diffusion models and generates stego images with an iterative denoising process. Since the naive hiding of secret messages into noise boosts visual degradation and decreases extracted message accuracy, we introduce message projection, which hides messages into noise space while addressing these issues. We suggest three options for message projection to adjust the trade-off between extracted message accuracy, anti-detection ability, and image quality. Diffusion-Stego is a training-free approach, so we can apply it to pre-trained diffusion models which generate high-quality images, or even large-scale text-to-image models, such as Stable diffusion. Diffusion-Stego achieved a high capacity of messages (3.0 bpp of binary messages with 98% accuracy, and 6.0 bpp with 90% accuracy) as well as high quality (with a FID score of 2.77 for 1.0 bpp on the FFHQ 64$ imes$64 dataset) that makes it challenging to distinguish from real images in the PNG format.

Motivation & Objective

• Address the limitations of GAN- and flow-based generative steganography, which produce low-fidelity stego images due to inherent model constraints.
• Leverage the superior image generation quality of diffusion models to improve stego image realism and anti-detection capability.
• Develop a training-free method that enables message embedding and extraction using only pre-trained diffusion models and a deterministic sampler.
• Overcome challenges in naive noise-based message embedding, such as visual degradation and reduced message extraction accuracy.
• Enable application of steganography to large-scale text-to-image models like Stable Diffusion using only secret messages and text prompts.

Proposed method

• Project secret messages into the latent noise space of pre-trained diffusion models using a message projection technique that preserves noise distribution and image quality.
• Utilize deterministic samplers (e.g., Heun’s sampler from EDM) with invertible properties to enable both image generation and message extraction from the same model.
• Introduce three message projection variants—MB, MS, and MP—to balance trade-offs between message accuracy, image fidelity, and anti-detection performance.
• Apply message projection by modifying noise in the reverse denoising process to embed messages while minimizing distortion and maintaining the statistical properties of random noise.
• Ensure message extraction is lossless by reversing the same deterministic sampling path used for generation, enabling end-to-end steganography without additional training.
• Support application to text-to-image diffusion models by injecting messages into the latent space conditioned on text prompts, enabling prompt-based stego image generation.

Experimental results

Research questions

• RQ1 Can diffusion models be effectively used for high-capacity, high-fidelity generative steganography without retraining?
• RQ2 How can secret messages be embedded into the latent noise of diffusion models without degrading image quality or reducing message extraction accuracy?
• RQ3 What techniques can maintain the invertibility of deterministic samplers while enabling robust message embedding and extraction?
• RQ4 How does message projection compare to naive noise replacement in terms of image fidelity, message accuracy, and anti-detection robustness?
• RQ5 To what extent can Diffusion-Stego be applied to large-scale text-to-image models like Stable Diffusion for practical steganographic communication?

Key findings

• Diffusion-Stego achieves a message capacity of 3.0 bits per pixel (bpp) with 98% message extraction accuracy and 6.0 bpp with 90% accuracy on the FFHQ 64×64 dataset.
• The method maintains exceptional image quality, achieving a Fréchet Inception Distance (FID) score of 2.77 when embedding 1.0 bpp messages on the FFHQ 64×64 dataset.
• Message accuracy is significantly higher when saving stego images in TIFF format (99.99% accuracy) compared to PNG (94.78% accuracy), confirming the impact of quantization on message integrity.
• The proposed message projection technique effectively mitigates visual degradation and error accumulation during the reverse sampling process, ensuring high message extraction accuracy.
• Diffusion-Stego is successfully applied to Stable Diffusion, generating high-quality stego images from text prompts with message accuracy ranging from 92.09% to 98.25% across diverse prompts.
• The method is fully training-free, requiring no fine-tuning of the diffusion model or training of additional extractors, enabling plug-and-play use with any pre-trained diffusion model.