StegoNGP: 3D Cryptographic Steganography using Instant-NGP

TL;DR

Experimental results demonstrated that StegoNGP can hide a complete high-quality 3D scene with strong imperceptibility and security, providing a new paradigm for high-capacity, undetectable information hiding in neural fields.

Abstract

Recently, Instant Neural Graphics Primitives (Instant-NGP) has achieved significant success in rapid 3D scene reconstruction, but securely embedding high-capacity hidden data, such as an entire 3D scene, remains a challenge. Existing methods rely on external decoders, require architectural modifications, and suffer from limited capacity, which makes them easily detectable. We propose a novel parameter-free 3D Cryptographic Steganography using Instant-NGP (StegoNGP), which leverages the Instant-NGP hash encoding function as a key-controlled scene switcher. By associating a default key with a cover scene and a secret key with a hidden scene, our method trains a single model to interweave both representations within the same network weights. The resulting model is indistinguishable from a standard Instant-NGP in architecture and parameter count. We also introduce an enhanced Multi-Key scheme, which assigns multiple independent keys across hash levels, dramatically expanding the key space and providing high robustness against partial key disclosure attacks. Experimental results demonstrated that StegoNGP can hide a complete high-quality 3D scene with strong imperceptibility and security, providing a new paradigm for high-capacity, undetectable information hiding in neural fields. The code can be found at https://github.com/jiang-wenxiang/StegoNGP.

Figures (8)

• Figure 1: Application scenario of the proposed StegoNGP: A 3D model creator (Bob) creates a 3D scene (cover scene) and embeds hidden information (e.g., copyright information) into it using a steganographic key $\mathcal{K}$. The trained StegoNGP is then publicly released on the internet or a cloud drive, and its model is indistinguishable from a standard Instant-NGP model. A normal user (Alice) can utilize and render the original cover scene. Mark, the intended recipient holding the key $\mathcal{K}$, can extract the hidden scene, thereby achieving copyright protection or secret communication. Kid, who attempts to access the hidden scene with an irrelevant key $\mathcal{O}$, will only obtain meaningless blank or noise images.
• Figure 2: StegoNGP framework for dual-scene representation.
• Figure 3: Visualization comparing the Ground Truth (GT) images of the cover scene $\mathcal{S}$ and hidden scene $\mathcal{B}$ against the rendered outputs from the baseline Instant-NGP (INGP) and our StegoNGP. Our model renders the scene $\mathcal{S}$ using the default key $\Pi$ and reveals the scene $\mathcal{B}$ using the secret key $\mathcal{K}$. It also shows the blank or noise outputs from an unrelated key $\mathcal{O}$.
• Figure 4: Demonstration of key sensitivity and security in the StegoNGP. The model renders the cover scene (Lego) and hidden scene (Mic) only when the precise default key $\{\pi_1, \pi_2, \pi_3\}$ or secret key $\{k_1, k_2, k_3\}$ is provided. Partially correct (mixed) keys or other incorrect keys fail to decode any coherent information, resulting in noise.
• Figure 5: The Multi-Key StegoNGP scheme and its robustness against partial key disclosure. Columns represent different total key quantities ($m=4, 8, 16$). Rows show the rendered results as the proportion of the correct secret key set $\mathbf{K}$ increases from $0\%$ to $100\%$ (where missing secret keys are substituted with the default key $\Pi$). The model transitions from the cover scene $\mathcal{S}$ ($0\%$$\textbf{K}$ provision) to the hidden scene $\mathcal{B}$ ($100\%$$\textbf{K}$ provision).