⚡ electrical engineering

Secret-Stego Dissimilarity as a Design Axis: Invertible Coverless Image Steganography with Diffusion Models

This paper proposes InvCISD, an invertible diffusion framework that utilizes a reference image and a specialized network (LIMNet) to generate coverless stego images with significantly reduced visual similarity to the secret image, thereby addressing security vulnerabilities while maintaining high reconstruction fidelity.

Original authors: Hongxin Xu, Jianping Mei, Can Wang, Defang Chen

Published 2026-08-17

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Hongxin Xu, Jianping Mei, Can Wang, Defang Chen

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to send a secret message, but instead of writing it on a piece of paper and hiding it inside a book, you want to hide the message inside a picture. This is the world of steganography, the art of invisible communication. For a long time, the standard trick was to take an innocent-looking photo (like a picture of a cat) and secretly tweak tiny pixels to hide a secret image (like a map) inside it. The problem? If someone looks closely at the "cat" photo, the hidden map might still leave a ghostly outline, or the photo might look slightly weird, giving the game away.

Recently, scientists started using powerful AI tools called Diffusion Models. Think of these as digital artists that can paint entirely new pictures from scratch based on a description. Instead of hiding a secret inside an existing photo, these new methods try to paint a brand-new photo that looks like a totally different subject (like a sunset) but still contains the secret map inside it. The goal is to make the secret and the final picture look so different that no one suspects a thing. But here's the catch: if the AI tries too hard to make them different, the final picture might look like a weird, glitchy mess, or the secret map might become impossible to recover. It's a delicate balancing act between making the disguise convincing and keeping the secret safe.

This is exactly the puzzle tackled by Hongxin Xu and their team in their new paper, "Secret-Stego Dissimilarity as a Design Axis." They noticed that while previous AI methods could create beautiful "coverless" images, the secret and the final image still looked too much alike. It was like trying to hide a red apple inside a basket of red apples; even if you paint the basket blue, the shape of the apple is still obvious. The authors argue that for true security, the secret image and the final "stego" image need to look as different as possible, without ruining the quality of the picture or losing the secret.

To solve this, they built a new system called InvCISD. Imagine you have a secret photo of a dog, and you want to send it to a friend. Instead of just tweaking the dog photo, InvCISD takes that dog photo and a completely unrelated photo—say, a picture of a vintage taxi—and mashes them together in a hidden mathematical space. It uses a special "magic bridge" (an invertible network they call LIMNet) to translate the dog's secret details into a format that fits perfectly inside the taxi's structure. The result? The final image looks like a cool, natural photo of a taxi, but it holds the dog's secret inside. When your friend receives the taxi photo, they use the same "magic bridge" in reverse to pull the dog photo back out, perfectly reconstructed.

The team found that their method is a game-changer. By carefully training their AI, they managed to make the secret and the final image look drastically different. In their tests, the visual difference (measured by a metric called LPIPS) jumped from around 0.48 in older methods to 0.87 with their new system. That's a huge leap, meaning the secret is much harder to spot just by looking at the picture. At the same time, they kept the final taxi photo looking sharp and natural, and they could still recover the dog photo with high clarity (a reconstruction score of 19.10 PSNR).

However, the authors are careful not to call this a "perfect" solution. They ran tests to see if a computer could spot that something was fishy. Even with their new, highly different-looking images, they found that a specialized detection model could still tell the difference between the secret and the fake image with high accuracy. This suggests that while making the images look different is a great step forward, it doesn't make the system immune to all detection yet. The paper concludes that while InvCISD successfully hides the visual clues of the secret, the next big challenge is making these systems robust enough to fool the detectives who are looking for them. It's a brilliant step in the right direction, turning a "maybe" disguise into a "very likely" one, but the cat-and-mouse game of digital security is far from over.

Technical Summary: InvCISD – Invertible Coverless Image Steganography with Diffusion Models

Problem Statement

Coverless Image Steganography (CIS) synthesizes a stego image from scratch rather than modifying an existing cover, allowing authorized recipients to reconstruct the original secret image. While recent diffusion-based CIS methods can generate natural-looking stego images, they suffer from a critical security vulnerability: substantial visual similarity between the secret and the stego images.

Existing approaches typically condition the generation of the stego image on the secret's latent representation to ensure high-fidelity recovery. However, this results in the stego image retaining recognizable structural and semantic cues of the secret (e.g., object silhouettes, spatial layouts). As demonstrated in the paper, simply increasing the content divergence between the secret and the reference prompt often leads to unnatural stego images where secret information remains prominent. The core challenge is to achieve substantial visual dissimilarity between the secret and stego images without compromising stego quality or the fidelity of secret reconstruction. Furthermore, the paper notes that current CIS methods remain highly detectable by targeted steganalysis models, indicating that visual dissimilarity alone is insufficient for security.

Methodology: InvCISD Framework

The authors propose InvCISD, an invertible diffusion framework designed to decouple the visual appearance of the stego image from the secret image while maintaining a reversible information path.

Core Architecture

The framework operates in the latent space of a pre-trained diffusion model (Stable Diffusion v1.5) and consists of two main stages:

Latent Invertible Mapping (LIMNet):
- The secret image ( $x_s$ ) and an unrelated reference image ( $x_r$ ) are inverted into diffusion latents ( $\ell_s$ and $\ell_r$ ) using EDICT.
- LIMNet, an invertible neural network composed of eight affine coupling blocks, maps the pair $[\ell_s, \ell_r]$ to a secret-bearing residual ( $f$ ) and an auxiliary latent ( $z$ ).
- The stego latent ( $\ell_h$ ) is constructed by adding the residual to the reference latent: $\ell_h = \ell_r + f$ .
- The stego image ( $x_h$ ) is generated by decoding $\ell_h$ conditioned on the reference image features (via IP-Adapter), ensuring the visible content is governed by the reference rather than the secret.
Recovery Process:
- The receiver regenerates the reference image ( $x'_r$ ) using the shared prompt and seed.
- Both the received stego ( $x'_h$ ) and regenerated reference ( $x'_r$ ) are inverted to obtain $\ell'_h$ and $\ell'_r$ .
- The residual is recovered as $f' = \ell'_h - \ell'_r$ .
- Since transmitting $z$ is insecure, the receiver samples a new auxiliary latent $z' \sim \mathcal{N}(0, I)$ and applies the inverse LIMNet mapping to recover $\hat{\ell}_s$ , which is then decoded to reconstruct the secret $\hat{x}_s$ .

Training Strategy

The authors employ a two-stage training pipeline:

Latent-Only Training: LIMNet is trained on cached latent pairs to optimize a regularized latent reconstruction loss. This stage includes an auxiliary latent regularizer ( $R_z$ ) to minimize the expected error introduced when the receiver substitutes the true $z$ with a sampled $z'$ .
End-to-End Fine-Tuning: The entire network (LIMNet + diffusion inversion/generation modules) is fine-tuned. This stage penalizes the difference between the decoded stego and the reference (to ensure naturalness) and the difference between the reconstructed secret and the original secret.

Theoretical Insight

The paper provides a theoretical analysis showing that minimizing the norm of the auxiliary latent $z$ (via $R_z$ ) directly limits the expected squared error when $z$ is replaced by a random sample $z'$ during recovery. This allows the system to function without transmitting the auxiliary latent, preserving the "coverless" nature of the transmission.

Key Contributions

Formulation of a New Objective: The paper explicitly formulates the challenge of increasing secret-stego visual dissimilarity while retaining high-quality generation and reconstruction, a dimension previously under-explored in CIS design.
LIMNet and Training Pipeline: The proposal of an invertible latent mapping network (LIMNet) coupled with a tailored two-stage training strategy and an auxiliary latent regularizer to enable reliable recovery without transmitting auxiliary data.
Comprehensive Evaluation: The introduction of Unistega_full, a dataset with source captions and evaluation prompts, and a rigorous evaluation protocol covering five aspects: visible leakage, reconstruction quality, stego quality, secret-stego dissimilarity, and steganalytic detectability.

Experimental Results

Experiments on the Unistega_full dataset compare InvCISD against state-of-the-art baselines CRoSS and DiffStega.

Visual Dissimilarity: InvCISD achieves significantly higher dissimilarity. The LPIPS (Learned Perceptual Image Patch Similarity) score between secret and stego is 0.871 for InvCISD, compared to 0.481 (CRoSS) and 0.487 (DiffStega).
Stego Quality: InvCISD outperforms baselines in stego quality metrics (PSNR, SSIM, LPIPS, CLIPScore), indicating the generated images are more natural and consistent with the reference prompt.
Reconstruction Quality: Despite the high visual dissimilarity, InvCISD maintains satisfactory secret reconstruction quality (PSNR ~19.10 dB), comparable to or better than baselines.
Steganalysis: Crucially, the paper reports that all evaluated methods (including InvCISD) are highly detectable by a CIS-oriented steganalysis model (XuNet) when trained on reference-stego pairs. This indicates that while visual dissimilarity is improved, it does not currently confer resistance against targeted steganalysis.

Significance and Claims

The paper positions InvCISD as a step forward in addressing the "visible secret leakage" problem inherent in diffusion-based CIS. By successfully decoupling the visual appearance of the stego from the secret, the method reduces the risk of structural and semantic cues being exposed to human or automated inspection.

However, the authors maintain a modest and defensive stance regarding the security implications:

The work is intended for controlled research and defensive analysis, not as an operationally secure covert channel.
The primary contribution is exposing visible secret leakage as a failure mode and motivating stronger forensic evaluation.
The paper explicitly acknowledges that visual dissimilarity alone does not provide cryptographic security or resistance against steganalysis, as evidenced by the high detection rates in their experiments.
Future work is identified as necessary to improve robustness against image perturbations and to address the sensitivity of diffusion inversion, rather than claiming immediate deployment readiness.