StegoNGP: 3D Cryptographic Steganography using Instant-NGP

The paper proposes StegoNGP, a parameter-free 3D cryptographic steganography method that leverages Instant-NGP's hash encoding as a key-controlled mechanism to securely embed a complete hidden 3D scene within a single neural network model indistinguishable from a standard cover scene, while offering high capacity, imperceptibility, and robustness through an enhanced multi-key scheme.

The Gist

Imagine you have a beautiful, high-definition 3D model of a living room. You want to share this model with the world so people can look around it. But, you also have a secret: inside that living room, you've hidden a completely different, secret 3D world (maybe a treasure map or a private message) that only you and a few trusted friends can see.

Usually, hiding a whole secret world inside a normal model is like trying to stuff a elephant into a suitcase. You either have to break the suitcase (change the model's structure), make the elephant visible (add extra files), or the suitcase becomes so heavy it's obvious something is wrong.

StegoNGP is a new magic trick that solves this problem. Here is how it works, explained simply:

1. The Magic Key (The Hash Function)

Think of the 3D model not as a picture, but as a giant, complex library of instructions. To build the living room, the computer needs to look up specific instructions in a massive book (called a "hash table").

In the original technology (Instant-NGP), there is a standard way to find these instructions, like using a standard library card catalog.

• The Trick: The authors realized they could change the rules of the catalog. Instead of using the standard catalog, they created a secret code (a "key") that rearranges the shelves.
• The Result:
  • If you use the Standard Key (the public one), the computer follows the standard catalog and builds the Living Room (the cover scene).
  • If you use the Secret Key (the private one), the computer follows the rearranged catalog. It looks at the exact same shelves, but because the rules are different, it pulls out completely different instructions to build the Treasure Map (the hidden scene).

2. The "Ghost" Suitcase (Zero Overhead)

This is the most impressive part. Usually, to hide a secret, you need a second suitcase or a hidden compartment.

• Other methods (like the ones they compared against) are like adding a hidden false bottom to the suitcase. If someone weighs the suitcase or counts the number of items inside, they know, "Hey, this suitcase is heavier than it should be! It's hiding something!"
• StegoNGP is different. It's like having a suitcase that looks exactly the same size and weight whether it's empty or full of secrets. The computer doesn't add any new files or change the model's structure. To an outsider, it looks like a perfectly normal 3D model. It is indistinguishable from a standard model.

3. The "Master Key" vs. The "Partial Key"

The authors also created a super-secure version called Multi-Key StegoNGP.

• Imagine the secret instructions are written on 16 different pages of a book.
• In the basic version, you need one key to read the whole book.
• In the Multi-Key version, the book is split up. You need Key A to read pages 1-4, Key B for pages 5-8, and so on.
• Why is this cool? If a hacker steals one key, they can't read the secret. They might see a few random words, but the rest is just gibberish. To see the full secret, they need to steal all the keys. This makes it incredibly hard to crack.

4. What Happens if You Use the Wrong Key?

If you try to open the secret door with the wrong key (or no key), the computer doesn't just show you a blank wall. It shows you static noise, like a TV with no signal. It looks like random, meaningless pixels. This is great for security because it proves you don't have the right code, but it doesn't accidentally leak the secret.

The Big Picture: Why Does This Matter?

• For Artists: You can sell a 3D model of a car, but hide the copyright info or a secret message inside it. If someone tries to steal it, they can't see the secret without your key.
• For Spies: You can send a 3D model of a city over the internet. To the public, it's just a city. But to the person with the key, it reveals a secret underground bunker.
• For Security: Because the model looks "normal," no one suspects it's hiding anything. You can't detect it by just looking at the file size or the code.

In short: StegoNGP is like a chameleon. It wears the skin of a normal 3D model to fool everyone, but if you have the right "magic glasses" (the key), you can see a completely different world hidden right underneath. And the best part? The chameleon doesn't even look any heavier or different to the naked eye.

Technical Summary

1. Problem Statement

The rapid advancement of 3D reconstruction technologies, particularly Instant Neural Graphics Primitives (Instant-NGP), has made high-fidelity 3D scene generation accessible. However, as these models become valuable digital assets, there is a critical need for secure, high-capacity information hiding (steganography) for copyright protection and secret communication.

Existing solutions face significant limitations:

• Low Capacity: Traditional NeRF watermarking methods typically embed only low-capacity data (e.g., binary messages or small logos).
• Architectural Detectability: Methods that hide larger data (like full 2D images or 3D scenes) often require external decoders, additional neural network layers, or extra parameters (e.g., GS-Hider adds spherical harmonics parameters). These modifications alter the model's structure and parameter count, making the steganographic model easily detectable by observers.
• Integrity Damage: Some "backdoor" approaches (hiding data via secret viewpoints) compromise the integrity of the original 3D model or are limited to single 2D images.

The Core Challenge: How to hide a complete, high-quality 3D scene within another 3D scene's model with zero parameter overhead, maintaining the exact architecture of a standard Instant-NGP to ensure undetectability.

---

2. Methodology: StegoNGP

The authors propose StegoNGP, a parameter-free 3D cryptographic steganography framework that leverages the inherent structural redundancy of hash-based neural fields.

A. Core Mechanism: Key-Controlled Scene Switching

The method transforms the Instant-NGP hash encoding function into a key-controlled scene switcher.

• Standard Instant-NGP: Maps 3D coordinates to a feature table using a hash function $h(x)$ based on a default sequence of large prime numbers ($\Pi$).
• StegoNGP Approach:
  1. Dual Scene Training: A single model is trained to represent two distinct scenes simultaneously:
     • Cover Scene ($S$): Rendered using the default key ($\Pi$).
     • Hidden Scene ($B$): Rendered using a secret steganographic key ($K$), which is a different sequence of large prime numbers.
  2. Hash Function Modification: The standard hash function is generalized to $\psi(x, K)$. By swapping the prime sequence in the hash calculation, the same network weights ($MLP$) and the same shared feature table ($T$) map to different feature vectors, effectively reconstructing a completely different 3D geometry.
  3. Training Process: During training, the model randomly selects a sample from either the cover scene (using $\Pi$) or the hidden scene (using $K$) and optimizes the shared weights to minimize the reconstruction error for both, without adding any new parameters.

B. Multi-Key Level-Assignment Scheme

To enhance security against partial key disclosure, the authors introduce a Multi-Key configuration:

• Instead of using one secret key for all hash levels, the method assigns multiple independent secret keys ($K_1, K_2, \dots, K_m$) to different resolution levels of the hash table.
• Keys are assigned cyclically across the $L$ resolution levels.
• Security Impact: An attacker must possess the entire set of keys and their correct assignment order to reconstruct the hidden scene. Possessing only a subset of keys results in incoherent noise, significantly expanding the cryptographic key space.

---

3. Key Contributions

1. Parameter-Free High-Capacity Hiding: StegoNGP is the first method to hide a complete 3D scene within another 3D scene using Instant-NGP without adding any extra parameters, decoders, or architectural modifications.
2. Cryptographic Security & Imperceptibility:
   • The cover scene is indistinguishable from a standard Instant-NGP model in both architecture and file size.
   • Security relies on the confidentiality of the prime number sequence (key). Without the exact key, the hidden scene renders as meaningless noise.
3. Multi-Key Robustness: The proposed Multi-Key scheme dramatically expands the key space (from $\approx 2^{86}$ to $\approx 2^{1380}$ bits), making brute-force attacks computationally infeasible and providing strong resistance against partial key discovery.
4. Plausible Deniability: The model behaves exactly like a standard, non-steganographic model when the default key is used, allowing the user to deny the existence of hidden data.

---

4. Experimental Results

The authors evaluated StegoNGP on synthetic (Blender) and real-world (Mip-Nerf-360) datasets.

• Reconstruction Fidelity:

  • StegoNGP successfully reconstructed both the cover and hidden scenes with high quality.
  • Metrics: On the Blender dataset, StegoNGP achieved PSNR/SSIM/LPIPS scores comparable to (and in some cases slightly better than) the baseline Instant-NGP trained independently on single scenes.
  • Visuals: The cover scene rendered with the default key showed no visual artifacts compared to the baseline.

• Security Analysis:

  • Key Sensitivity: Using an incorrect key or a partially correct key (mixed primes) resulted in incoherent noise, confirming that the entire key is required for recovery.
  • Brute-Force Resistance: Theoretical analysis shows that breaking the basic scheme ($m=1$) would take $\approx 7.43 \times 10^{16}$ years even with high-end GPUs. The Multi-Key scheme ($m=16$) is computationally infeasible to break.

• Comparison with GS-Hider:

  • GS-Hider (based on 3D Gaussian Splatting) achieves high fidelity but requires ~20.54 MB of extra parameters and alters the model architecture, making it structurally detectable.
  • StegoNGP adds 0 MB of overhead and is structurally indistinguishable from a standard model.

• Limitations & Trade-offs:

  • In complex real-world scenes (Mip-Nerf-360), performance degradation was observed due to hash collisions (two scenes competing for the same feature table entries).
  • Increasing the hash table size ($T$) mitigated this issue, improving reconstruction quality, confirming that the degradation is due to feature interference rather than the method's fundamental flaw.
  • Embedding multiple hidden scenes ($\Phi > 1$) further degrades quality due to increased collision rates.

---

5. Significance

StegoNGP represents a paradigm shift in 3D information hiding. By treating the hash encoding mechanism not just as a spatial indexer but as a cryptographic switch, the authors demonstrate that neural fields can serve as secure containers for high-capacity data without compromising the model's utility or detectability.

This work is significant because:

1. It solves the detectability problem inherent in previous steganography methods that relied on architectural changes.
2. It enables secure 3D communication and robust copyright protection where the hidden asset is a full 3D environment, not just a watermark or 2D image.
3. It establishes a new standard for zero-overhead steganography in neural representations, proving that security and model integrity can coexist without sacrificing capacity.