# Stego Battlefield: Evaluating Image Steganography Attacks and Steganalysis Defenses

arXiv: https://arxiv.org/abs/2605.05789 · HTML: https://mlsanity.com/paper/2605.05789/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 16 of its 48 references that are in the map.
- First posted on arXiv 7 May 2026.

## Builds on (most cited first, 16 of 16)

- [Universal and Transferable Adversarial Attacks on Aligned Language Models](https://mlsanity.com/paper/2307.15043/) (2023)
- [The Hateful Memes Challenge: Detecting Hate Speech in Multimodal Memes](https://mlsanity.com/paper/2005.04790/) (2020)
- [HiDDeN: Hiding Data With Deep Networks](https://mlsanity.com/paper/1807.09937/) (2018)
- [A StrongREJECT for Empty Jailbreaks](https://mlsanity.com/paper/2402.10260/) (2024)
- [MM-SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Models](https://mlsanity.com/paper/2311.17600/) (2023)
- [SteganoGAN: High Capacity Image Steganography with GANs](https://mlsanity.com/paper/1901.03892/) (2019)
- [RoSteALS: Robust Steganography using Autoencoder Latent Space](https://mlsanity.com/paper/2304.03400/) (2023)
- [CRoSS: Diffusion Model Makes Controllable, Robust and Secure Image Steganography](https://mlsanity.com/paper/2305.16936/) (2023)
- [Yedrouj-Net: An efficient CNN for spatial steganalysis](https://mlsanity.com/paper/1803.00407/) (2018)
- [Odysseus: Jailbreaking Commercial Multimodal LLM-integrated Systems via Dual Steganography](https://mlsanity.com/paper/2512.20168/) (2025)
- [CALPA-NET: Channel-pruning-assisted Deep Residual Network for Steganalysis of Digital Images](https://mlsanity.com/paper/1911.04657/) (2019)
- [PRIS: Practical robust invertible network for image steganography](https://mlsanity.com/paper/2309.13620/) (2023)
- [Robust Message Embedding via Attention Flow-Based Steganography](https://mlsanity.com/paper/2405.16414/) (2024)
- [Stegomalware: A Systematic Survey of MalwareHiding and Detection in Images, Machine LearningModels and Research Challenges](https://mlsanity.com/paper/2110.02504/) (2021)
- [Low-frequency Image Deep Steganography: Manipulate the Frequency Distribution to Hide Secrets with Tenacious Robustness](https://mlsanity.com/paper/2303.13713/) (2023)
- [CLPSTNet: A Progressive Multi-Scale Convolutional Steganography Model Integrating Curriculum Learning](https://mlsanity.com/paper/2504.16364/) (2025)

## Built on by (most cited first, 1 of 1)

- [Replay What Matters: Off-Policy Replay for Efficient LLM Reinforcement Unlearning](https://mlsanity.com/paper/2606.15333/) (2026)

## Abstract (arXiv)

Image steganography is widely used to protect user privacy and enable covert communication. However, it can also be abused by the adversary as a covert channel to bypass content moderation, disseminate harmful semantics, and even hide malicious instructions in images to elicit dangerous outputs from large models, posing a practical security risk that continues to evolve. To address the lack of a unified and systematic evaluation framework, we propose SADBench, a systematic benchmark that assesses the adversary's ability to inject harmful secrets via steganography and the defender's ability to detect such threats through steganalysis. Crucially, SADBench comprises 4 core tasks, namely steganography attack capability evaluation, steganalysis defense capability evaluation, efficiency evaluation, and transferability evaluation. It evaluates both image-payload and text-payload steganography across diverse cover distributions, utilizing harmful visual semantics and toxic instructions to simulate malicious attacks. Across a broad set of attacks and detectors, SADBench reveals that (i) INN and autoencoder-based methods demonstrate superior stability compared to other architectures, (ii) in-domain detection is near-perfect and cheaper than generation, (iii) a critical asymmetry exists in transferability where attacks robustly generalize to new distributions while detectors fail to adapt, and (iv) real-world threats persist on social media, where payloads either survive minimal compression or effectively adapt to aggressive compression via simulated training. Overall, SADBench establishes a systematic, reproducible, and extensible framework to quantify risks, paving the way for measurable and security-driven advancements in steganography defense.