# Diffusion-Stego: Training-free Diffusion Generative Steganography via Message Projection

arXiv: https://arxiv.org/abs/2305.18726 · HTML: https://mlsanity.com/paper/2305.18726/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models.
- Builds on 28 of its 52 references that are in the map.
- First posted on arXiv 30 May 2023.

## Placed in

- Diffusion models / [Robustness, privacy and adversarial aspects](https://mlsanity.com/diffusion/robustness-privacy-and-adversarial-aspects/)

## Builds on (most cited first, 28 of 28)

- [Denoising Diffusion Probabilistic Models](https://mlsanity.com/paper/2006.11239/) (2020)
- [High-Resolution Image Synthesis with Latent Diffusion Models](https://mlsanity.com/paper/2112.10752/) (2021)
- [Denoising Diffusion Implicit Models](https://mlsanity.com/paper/2010.02502/) (2020)
- [Score-Based Generative Modeling through Stochastic Differential Equations](https://mlsanity.com/paper/2011.13456/) (2020)
- [Deep Unsupervised Learning using Nonequilibrium Thermodynamics](https://mlsanity.com/paper/1503.03585/) (2015)
- [Hierarchical Text-Conditional Image Generation with CLIP Latents](https://mlsanity.com/paper/2204.06125/) (2022)
- [Photorealistic Text-to-Image Diffusion Models with Deep Language Understanding](https://mlsanity.com/paper/2205.11487/) (2022)
- [A Style-Based Generator Architecture for Generative Adversarial Networks](https://mlsanity.com/paper/1812.04948/) (2018)
- [Elucidating the Design Space of Diffusion-Based Generative Models](https://mlsanity.com/paper/2206.00364/) (2022)
- [Video Diffusion Models](https://mlsanity.com/paper/2204.03458/) (2022)
- [Conditional Generative Adversarial Nets](https://mlsanity.com/paper/1411.1784/) (2014)
- [DPM-Solver: A Fast ODE Solver for Diffusion Probabilistic Model Sampling in Around 10 Steps](https://mlsanity.com/paper/2206.00927/) (2022)
- [Glow: Generative Flow with Invertible 1x1 Convolutions](https://mlsanity.com/paper/1807.03039/) (2018)
- [DiffWave: A Versatile Diffusion Model for Audio Synthesis](https://mlsanity.com/paper/2009.09761/) (2020)
- [StarGAN v2: Diverse Image Synthesis for Multiple Domains](https://mlsanity.com/paper/1912.01865/) (2019)
- [Diffusion-LM Improves Controllable Text Generation](https://mlsanity.com/paper/2205.14217/) (2022)
- [Pseudo Numerical Methods for Diffusion Models on Manifolds](https://mlsanity.com/paper/2202.09778/) (2022)
- [Conditional Image Synthesis With Auxiliary Classifier GANs](https://mlsanity.com/paper/1610.09585/) (2016)
- [Fast Sampling of Diffusion Models with Exponential Integrator](https://mlsanity.com/paper/2204.13902/) (2022)
- [HiDDeN: Hiding Data With Deep Networks](https://mlsanity.com/paper/1807.09937/) (2018)
- [Poisson Flow Generative Models](https://mlsanity.com/paper/2209.11178/) (2022)
- [PFGM++: Unlocking the Potential of Physics-Inspired Generative Models](https://mlsanity.com/paper/2302.04265/) (2023)
- [SteganoGAN: High Capacity Image Steganography with GANs](https://mlsanity.com/paper/1901.03892/) (2019)
- [Generative Steganography Network](https://mlsanity.com/paper/2207.13867/) (2022)
- [Secret-to-Image Reversible Transformation for Generative Steganography](https://mlsanity.com/paper/2203.06598/) (2022)
- [Coverless Information Hiding Based on Generative adversarial networks](https://mlsanity.com/paper/1712.06951/) (2017)
- [Generative Steganographic Flow](https://mlsanity.com/paper/2305.05838/) (2023)
- [Learning Iterative Neural Optimizers for Image Steganography](https://mlsanity.com/paper/2303.16206/) (2023)

## Built on by (most cited first, 8 of 8)

- [Plug-and-Hide: Provable and Adjustable Diffusion Generative Steganography](https://mlsanity.com/paper/2409.04878/) (2024)
- [PSyDUCK: Training-Free Steganography for Latent Diffusion](https://mlsanity.com/paper/2501.19172/) (2025)
- [LLMs can hide text in other text of the same length](https://mlsanity.com/paper/2510.20075/) (2025)
- [Provably Secure Covert Messaging Using Image-based Diffusion Processes](https://mlsanity.com/paper/2503.10063/) (2025)
- [CIF: A Constrained Inversion Framework for Reliable Message Extraction in Diffusion-Based Generative Steganography](https://mlsanity.com/paper/2508.00434/) (2025)
- [Training-Free Color-Aware Adversarial Diffusion Sanitization for Diffusion Stegomalware Defense at Security Gateways](https://mlsanity.com/paper/2512.24499/) (2025)
- [Rethinking Security of Diffusion-based Generative Steganography](https://mlsanity.com/paper/2602.10219/) (2026)
- [PRoADS: Provably Secure and Robust Audio Diffusion Steganography with latent optimization and backward Euler Inversion](https://mlsanity.com/paper/2603.10314/) (2026)

## Abstract (arXiv)

Generative steganography is the process of hiding secret messages in generated images instead of cover images. Existing studies on generative steganography use GAN or Flow models to obtain high hiding message capacity and anti-detection ability over cover images. However, they create relatively unrealistic stego images because of the inherent limitations of generative models. We propose Diffusion-Stego, a generative steganography approach based on diffusion models which outperform other generative models in image generation. Diffusion-Stego projects secret messages into latent noise of diffusion models and generates stego images with an iterative denoising process. Since the naive hiding of secret messages into noise boosts visual degradation and decreases extracted message accuracy, we introduce message projection, which hides messages into noise space while addressing these issues. We suggest three options for message projection to adjust the trade-off between extracted message accuracy, anti-detection ability, and image quality. Diffusion-Stego is a training-free approach, so we can apply it to pre-trained diffusion models which generate high-quality images, or even large-scale text-to-image models, such as Stable diffusion. Diffusion-Stego achieved a high capacity of messages (3.0 bpp of binary messages with 98% accuracy, and 6.0 bpp with 90% accuracy) as well as high quality (with a FID score of 2.77 for 1.0 bpp on the FFHQ 64×64 dataset) that makes it challenging to distinguish from real images in the PNG format.