Rethinking Security of Diffusion-based Generative Steganography

TL;DR

The paper tackles the security of diffusion-model-based generative steganography (DM-GIS) by proving that the diffusion-noise distribution underlies detectability and that any alteration to this noise distribution degrades security, quantified by $D_{KL}(\mathbb{P}_c \| \mathbb{P}_s)$. It introduces NS-DSer, a noise-space steganalyzer that deterministically recovers diffusion noise and extracts simple statistical features from both the noise and its transform domain, feeding them into a Fisher Linear Discriminant ensemble for efficient detection without knowing steganographers' diffusion settings. Theoretical results are complemented by extensive experiments across four escalating scenarios and nine DM-GIS methods, showing NS-DSer outperforms traditional image-space steganalyzers and remains robust to data heterogeneity and ablations on sampling steps and prompt guidance. The approach provides a practical, scalable path toward real-world DM-GIS threat assessment and informs encoder-design trade-offs between extraction accuracy and security.

Abstract

Generative image steganography is a technique that conceals secret messages within generated images, without relying on pre-existing cover images. Recently, a number of diffusion model-based generative image steganography (DM-GIS) methods have been introduced, which effectively combat traditional steganalysis techniques. In this paper, we identify the key factors that influence DM-GIS security and revisit the security of existing methods. Specifically, we first provide an overview of the general pipelines of current DM-GIS methods, finding that the noise space of diffusion models serves as the primary embedding domain. Further, we analyze the relationship between DM-GIS security and noise distribution of diffusion models, theoretically demonstrating that any steganographic operation that disrupts the noise distribution compromise DM-GIS security. Building on this insight, we propose a Noise Space-based Diffusion Steganalyzer (NS-DSer)-a simple yet effective steganalysis framework allowing for detecting DM-GIS generated images in the diffusion model noise space. We reevaluate the security of existing DM-GIS methods using NS-DSer across increasingly challenging detection scenarios. Experimental results validate our theoretical analysis of DM-GIS security and show the effectiveness of NS-DSer across diverse detection scenarios.

Figures (3)

• Figure 1: Two types of DM-GIS frameworks: (a) The secret messages are embedded in the initial noise $\mathbf{x}_T$, which is typically a Gaussian white noise; and (b) The secret messages are concealed within the intermediate noise $\mathbf{x}_t$ at a certain timestep $t$ in the deterministic denoising process.
• Figure 2: An illustrative example of $E(\mathbf{m}, \theta) = \mathbf{g}$ with $l = 2$, showcasing an invertible bit-to-noise mapping for DM-GIS while highlighting a scenario where extraction errors arise.
• Figure 3: Detection pipeline of the proposed NS-DSer. The input image $\mathbf{x}_0$ first undergoes a deterministic condition-free diffusion process which is implemented by the ODE solver $\Phi$, to obtain the noise $\hat{\mathbf{x}}_{T}^{\Phi}$. Five statistical features of $\hat{\mathbf{x}}_{T}^{\Phi}$—mean, variance, skewness, kurtosis, and IQR—are extracted to form feature $\mathcal{F}_o$. Additionally, a transform-domain feature $\mathcal{F}_t$ is extracted from $\hat{\mathbf{x}}_{T}^{\Phi}$. The features $\mathcal{F}_0$ and $\mathcal{F}_t$ are concatenated and fed into a binary classifier.

Theorems & Definitions (4)

• Theorem 1
• proof
• Proposition 1
• proof