RFNNS: Robust Fixed Neural Network Steganography with Universal Text-to-Image Models

TL;DR

RFNNS tackles covert communication in the era of universal text-to-image models by eliminating the need for training new steganography networks. It combines texture-aware localization to localize perturbations in high-texture regions with a Robust Steganographic Perturbation Generation (RSPG) strategy and a fixed decoding network, enabling reliable recovery of secret images under common and unknown attacks. Empirical results show RFNNS achieves a 23% average SSIM improvement for recovered secrets under attacks and reduces LPIPS to 39% of the SOTA under unseen attacks, while maintaining perceptual quality and strong anti-steganalysis. This approach offers practical covert communication with high fidelity, robustness, and low transmission overhead since only a shared key and prompt are exchanged, not large models.

Abstract

With the rapid development of generative AI, image steganography has garnered widespread attention due to its unique concealment. Recent studies have demonstrated the practical advantages of Fixed Neural Network Steganography (FNNS), notably its ability to achieve stable information embedding and extraction without any additional network training. However, the stego images generated by FNNS still exhibit noticeable distortion and limited robustness. These drawbacks compromise the security of the embedded information and restrict the practical applicability of the method. To address these limitations, we propose Robust Fixed Neural Network Steganography (RFNNS). Specifically, a texture-aware localization technique selectively embeds perturbations carrying secret information into regions of complex textures, effectively preserving visual quality. Additionally, a robust steganographic perturbation generation (RSPG) strategy is designed to enhance the decoding accuracy, even under common and unknown attacks. These robust perturbations are combined with AI-generated cover images to produce stego images. Experimental results demonstrate that RFNNS significantly improves robustness compared to state-of-the-art FNNS methods, achieving an average increase in SSIM of 23\% for recovered secret images under common attacks. Furthermore, the LPIPS value of recovered secrets images against previously unknown attacks achieved by RFNNS was reduced to 39\% of the SOTA method, underscoring its practical value for covert communication.

Figures (8)

• Figure 1: The process of sending and extracting in RFNNS.
• Figure 2: RFNNS framework: (a): Alice (The Sender) employs the proposed texture-aware localization technique to identify embedding regions corresponding to the perturbation. A RSPG strategy is then utilized to incorporate this perturbation into the AI-generated cover image, guided by a shared key, thereby producing the stego image. (b): The eavesdropping and potential image attacks that a stego image may encounter during transmission over a public channel. (c): Bob (The Receiver) first reconstructs the original cover image using the shared key to isolate the perturbation from the stego image. Subsequently, the same decoding network is employed to recover the secret image. (d): Framework of Fixed Random Decoding Network.
• Figure 3: The texture-aware localization technique framework of the proposed method.
• Figure 4: Anti-steganalysis performance at the low embedding capacity: (a) StegExpose; (b) YeNet; (c) SiaStegNet.
• Figure 5: The image quality of stegos for different methods.