Targeted Pooled Latent-Space Steganalysis Applied to Generative Steganography, with a Fix

TL;DR

The paper tackles the problem that generative steganography in latent diffusion models can evade image-space detectors. It develops a latent-space steganalysis approach by modeling the norm distribution of latent vectors and deriving a pooled Likelihood Ratio Test on the latent-norm $R_{oldsymbol{Y}}$, revealing a variance-based signature that distinguishes Cover from Stego after the L2L channel. To counter this, it proposes a scaled spreading-spectrum fix by sampling the latent-norm from a $ ext{Chi}_n$ distribution before generation, aligning latent distributions under both hypotheses and achieving Stego-security in the latent space. Empirical results show that, without the fix, batch-sized latent analyses improve detection, while the scaled fix significantly reduces detectability, though the effect depends on the inversion parameters and prompts knowledge. Overall, the work highlights a latent-space security vulnerability in generative steganography and provides a concrete countermeasure, informing future design of robust embedding schemes and latent-space defenses.

Abstract

Steganographic schemes dedicated to generated images modify the seed vector in the latent space to embed a message, whereas most steganalysis methods attempt to detect the embedding in the image space. This paper proposes to perform steganalysis in the latent space by modeling the statistical distribution of the norm of the latent vector. Specifically, we analyze the practical security of a scheme proposed by Hu et. al. for latent diffusion models, which is both robust and practically undetectable when steganalysis is performed on generated images. We show that after embedding, the Stego (latent) vector is distributed on a hypersphere while the Cover vector is i.i.d. Gaussian. By going from the image space to the latent space, we show that it is possible to model the norm of the vector in the latent space under the Cover or Stego hypothesis as Gaussian distributions with different variances. A Likelihood Ratio Test is then derived to perform pooled steganalysis. The impact of the potential knowledge of the prompt and the number of diffusion steps, is also studied. Additionally, we also show how, by randomly sampling the norm of the latent vector before generation, the initial Stego scheme becomes undetectable in the latent space.

Figures (4)

• Figure 1: Illustration in 2D: gray dots in the Stego setup represent the space of messages using the encoding proposed in hu2024establishing (2 bits are encoded), which creates a spherical distribution in the original latent space and can be approximated as a Gaussian distribution after the latent-to-latent channel. Our proposal, consisting of sampling the norm after encoding, fixes this discrepancy.
• Figure 2: Principle of the presented steganalysis scheme targeted to hu2024establishing. The entities in italic are, according to the Kerckhoffs principle, considered as public. Prompts are potentially public (dotted arrow).
• Figure 3: Histogram of the norm of the latent vector $||\mathbf{Y}||_F$. The curves represent the Gaussian fit for each class. Notice the small difference of the variance on the left plot which is corrected on the right plot. Guidance=5.0, steps=20, 20k prompts.
• Figure 4: $P_E$ for steps = 20: as the batch size increases, the LRT becomes more powerful, contrary to the proposed fix, which is effective.