Hiding Images in Diffusion Models by Editing Learned Score Functions

TL;DR

This work addresses the challenge of securely hiding images within diffusion models by editing the learned score function at a single, privately chosen timestep. By introducing a secret-key–guided, one-step extraction mechanism and a hybrid parameter-efficient fine-tuning strategy, the approach substantially improves extraction fidelity and embedding efficiency while preserving the diffusion model’s original behavior. Empirical results demonstrate high PSNRs (e.g., $52.90$ for $32\times32$ and $39.33$ for $256\times256$), near-original FID values, and embedding times orders of magnitude faster than prior methods, with support for multi-recipient scenarios via independent keys. The method offers practical diffusion-based neural steganography with strong efficiency and robustness, and points toward future work in adaptive hiding strategies, theoretical bounds on detectability, and robustness to perturbations.

Abstract

Hiding data using neural networks (i.e., neural steganography) has achieved remarkable success across both discriminative classifiers and generative adversarial networks. However, the potential of data hiding in diffusion models remains relatively unexplored. Current methods exhibit limitations in achieving high extraction accuracy, model fidelity, and hiding efficiency due primarily to the entanglement of the hiding and extraction processes with multiple denoising diffusion steps. To address these, we describe a simple yet effective approach that embeds images at specific timesteps in the reverse diffusion process by editing the learned score functions. Additionally, we introduce a parameter-efficient fine-tuning method that combines gradient-based parameter selection with low-rank adaptation to enhance model fidelity and hiding efficiency. Comprehensive experiments demonstrate that our method extracts high-quality images at human-indistinguishable levels, replicates the original model behaviors at both sample and population levels, and embeds images orders of magnitude faster than prior methods. Besides, our method naturally supports multi-recipient scenarios through independent extraction channels.

Figures (6)

• Figure 1: Comparison of diffusion-based image hiding methods. Existing methods typically embed trigger patterns (acting as secret keys) at the initial timestep of the reverse diffusion process, and optionally at all subsequent timesteps (denoted by dashed lines). These patterns guide the reconstruction of the secret image ${\bm x}_{s}$, but compromise model fidelity and reduce hiding efficiency due to persistent intervention of the entire reverse diffusion process. In stark contrast, the proposed method operates selectively: the secret image $\bm x_s$ is embedded and extracted only at a privately chosen timestep $t_s$. Hiding is governed by a secret key $k_s$, which serves as the seed to generate the input Gaussian noise $\bm z_s$. By localizing the intervention to a single timestep, the integrity of the reverse diffusion process is preserved.
• Figure 2: Visual comparison of extracted secret images along with the absolute error maps.
• Figure 3: Visual comparison of images generated by the original and stego diffusion models with the same set of initial noise.
• Figure 4: Ablation on the selection of the secret timestep.
• Figure A1: Visual examples of extracted secret images and corresponding absolute error maps for hiding two images (subfigures (a) and (b)) and four images (subfigures (c) and (d)). In each subfigure, columns from left to right show the ground-truth secret images, extracted secret images, and absolute error maps, respectively.