StegoNGP: 3D Cryptographic Steganography using Instant-NGP

Wenxiang Jiang; Yujun Lan; Shuo Zhao; Yuanshan Liu; Mingzhu Zhou; Jinxin Wang

cs.CVMar 1, 2026

StegoNGP: 3D Cryptographic Steganography using Instant-NGP

Authors: Wenxiang Jiang, Yujun Lan, Shuo Zhao, Yuanshan Liu, Mingzhu Zhou, Jinxin Wang

Organizations: Shandong Technology and Business University · Ocean University of China · Adelaide University

Abstract

Recently, Instant Neural Graphics Primitives (Instant-NGP) has achieved significant success in rapid 3D scene reconstruction, but securely embedding high-capacity hidden data, such as an entire 3D scene, remains a challenge. Existing methods rely on external decoders, require architectural modifications, and suffer from limited capacity, which makes them easily detectable. We propose a novel parameter-free 3D Cryptographic Steganography using Instant-NGP (StegoNGP), which leverages the Instant-NGP hash encoding function as a key-controlled scene switcher. By associating a default key with a cover scene and a secret key with a hidden scene, our method trains a single model to interweave both representations within the same network weights. The resulting model is indistinguishable from a standard Instant-NGP in architecture and parameter count. We also introduce an enhanced Multi-Key scheme, which assigns multiple independent keys across hash levels, dramatically expanding the key space and providing high robustness against partial key disclosure attacks. Experimental results demonstrated that StegoNGP can hide a complete high-quality 3D scene with strong imperceptibility and security, providing a new paradigm for high-capacity, undetectable information hiding in neural fields. The code can be found at https://github.com/jiang-wenxiang/StegoNGP.

Figures & tables

Figure 1: Application scenario of the proposed StegoNGP: A 3D model creator (Bob) creates a 3D scene (cover scene) and embeds hidden information (e.g., copyright information) into it using a steganographic key $\mathcal{K}$ . The trained StegoNGP is then publicly released on the internet or a cloud drive, and its model is indistinguishable from a standard Instant-NGP model. A normal user (Alice) can utilize and render the original cover scene. Mark, the intended recipient holding the key $\mathcal{K}$ , can extract the hidden scene, thereby achieving copyright protection or secret communication. Kid, who attempts to access the hidden scene with an irrelevant key $\mathcal{O}$ , will only obtain meaningless blank or noise images.

Figure 2: StegoNGP framework for dual-scene representation.

Panel of Figure 3 — Figure 3: Visualization comparing the Ground Truth (GT) images of the cover scene $\mathcal{S}$ and hidden scene $\mathcal{B}$ against the rendered outputs from the baseline Instant-NGP (INGP) and our StegoNGP. Our model renders the scene $\mathcal{S}$ using the default key $\Pi$ and reveals the scene $\mathcal{B}$ using the secret key $\mathcal{K}$ . It also shows the blank or noise outputs from an unrelated key $\mathcal{O}$ .

Model	Scene	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$
Instant-NGP	$\mathcal{S}$	26.508	0.913	0.078
(baseline)	$\mathcal{B}$	32.436	0.985	0.014
StegoNGP	$\mathcal{S}$	26.581	0.910	0.083
(Ours)	$\mathcal{B}$	34.048	0.988	0.007

Table 1: Quantitative comparison of reconstruction quality (PSNR, SSIM, and LPIPS) between StegoNGP (ours) and Instant-NGP (baseline) on the Blender Synthetic dataset. The baseline method reconstructs each scene independently, whereas our StegoNGP method reconstructs the cover scene

\mathcal{S}

with one embedded hidden scene

\mathcal{B}

Scene	cover scene $\mathcal{S}$			hidden scene $\mathcal{B}$			additional parameters	structural
Model	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	Model Size $\downarrow$	detectability
GS-Hider [ 23 ]	36.194	0.991	0.006	29.625	0.962	0.030	+ 20.54 MB	+
StegoNGP (ours)	29.678	0.946	0.056	26.248	0.897	0.094	+ 0 MB	-

Table 2: Comparison of StegoNGP (ours) with the GS-Hider [ 23 ] method across reconstruction fidelity (PSNR, SSIM and LPIPS), additional model size (MB), and structural detectability.

Panel of Figure 4 — Figure 4: Demonstration of key sensitivity and security in the StegoNGP. The model renders the cover scene (Lego) and hidden scene (Mic) only when the precise default key $\{\pi_{1},\pi_{2},\pi_{3}\}$ or secret key $\{k_{1},k_{2},k_{3}\}$ is provided. Partially correct (mixed) keys or other incorrect keys fail to decode any coherent information, resulting in noise.

Panel of Figure 5 — Figure 5: The Multi-Key StegoNGP scheme and its robustness against partial key disclosure. Columns represent different total key quantities ( $m=4,8,16$ ). Rows show the rendered results as the proportion of the correct secret key set $\mathbf{K}$ increases from $0\%$ to $100\%$ (where missing secret keys are substituted with the default key $\Pi$ ). The model transitions from the cover scene $\mathcal{S}$ ( $0\%$ K provision) to the hidden scene $\mathcal{B}$ ( $100\%$ K provision).

Panel of Figure 6 — Figure 6: Visualization of StegoNGP performance on the Mip-Nerf-360 dataset. The figure compares the rendered results for several scene pairs against their respective Ground Truth images. Pairs are denoted as Cover Scene (Hidden Scene).

Model	Key Composition	Key Space Size	Bit Strength	Est. Brute-Force Time (RTX 5090 @ 20 FPS)
Basic ( $m=1$ )	3 primes	$\approx$ 9.36\text{\times}{10}^{25}$$	$\approx 2^{86.3}$	$\approx$ 7.43\text{\times}{10}^{16}$$ years
Multi-Key ( $m=16$ )	48 primes	$\approx$ 3.46\text{\times}{10}^{415}$$	$\approx 2^{1380}$	Computationally Infeasible
AES-256 [ 21 ]	256-bit key	$\approx$ 1.15\text{\times}{10}^{77}$$	$2^{256}$	Computationally Infeasible

Table 3: StegoNGP Key Space and Security Summary

Table Size ( $T$ )	Scene	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$
$T=2^{18}$	$S$	23.145	0.715	0.317
$T=2^{18}$	$\mathcal{B}$	22.797	0.572	0.393
$T=2^{19}$	$S$	22.862	0.721	0.286
$T=2^{19}$	$\mathcal{B}$	22.888	0.575	0.398
$T=2^{20}$	$S$	23.626	0.754	0.235
$T=2^{20}$	$\mathcal{B}$	22.695	0.579	0.388

Table 4: Quantitative results of varying the hash table size

T

on the Mip-Nerf-360 ”Bonsai” (

S

) / ”Kitchen” (

\mathcal{B}

) scene pair. As

T

increases, the reduced hash collision probability leads to a clear improvement in reconstruction fidelity for both the cover and hidden scenes.

Scene Pair		Cover Scene ( $S$ )			Hidden Scene ( $\mathcal{B}$ )
Cover Scene ( $S$ )	Hidden Scene ( $\mathcal{B}$ )	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$
Lego	Twitter	26.902	0.910	0.070	32.514	0.985	0.009
Mic	Twitter	28.361	0.955	0.052	32.693	0.984	0.010
Chair	Twitter	28.308	0.921	0.086	32.630	0.986	0.009
Ficus	Twitter	26.950	0.935	0.044	32.891	0.985	0.009
Hotdog	Google	29.586	0.946	0.056	34.991	0.991	0.006

Table 5: Detailed quantitative results on the Blender Synthetic dataset. Each row represents a StegoNGP model trained to hide one scene within another. The metrics show the fidelity for rendering the cover scene

S

(using key

\Pi

) and the hidden scene

\mathcal{B}

(using key

\mathcal{K}

Scene Pair		Cover Scene ( $S$ )			Hidden Scene ( $\mathcal{B}$ )
Cover Scene ( $S$ )	Hidden Scene ( $\mathcal{B}$ )	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$
Hotdog	Lego	35.376	0.985	0.009	30.048	0.971	0.016
Mic	Drums	36.601	0.993	0.005	27.091	0.959	0.028
Chair	Ship	37.055	0.992	0.007	29.460	0.931	0.027
Ficus	Materials	35.744	0.995	0.004	31.899	0.985	0.049
Average		36.194	0.991	0.006	29.625	0.962	0.030

Table 6: Detailed results for the GS-Hider [ 23 ] method across the four specialized scene pairs. The average of these metrics corresponds to the GS-Hider row in Table 2 of the main paper.

Scene Pair		Cover Scene ( $S$ )			Hidden Scene ( $\mathcal{B}$ )
Cover Scene ( $S$ )	Hidden Scene ( $\mathcal{B}$ )	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$
Hotdog	Lego	32.269	0.953	0.052	28.100	0.923	0.062
Mic	Drums	29.213	0.957	0.050	24.017	0.907	0.093
Chair	Ship	28.796	0.925	0.085	26.184	0.832	0.166
Ficus	Materials	28.434	0.948	0.036	26.689	0.926	0.056
Average		29.678	0.946	0.056	26.248	0.897	0.094

Table 7: Detailed quantitative results for our StegoNGP (Ours) method across the four specialized scene pairs. The average of these metrics corresponds to the StegoNGP (Ours) row in Table 2 of the main paper.

Scene Pair		Cover Scene ( $S$ )			Hidden Scene ( $\mathcal{B}$ )
Cover Scene ( $S$ )	Hidden Scene ( $\mathcal{B}$ )	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$
Bonsai	Kitchen	22.862	0.721	0.286	22.888	0.575	0.398
Garden	Treehill	20.559	0.405	0.578	16.951	0.430	0.545
Kitchen	Counter	21.289	0.550	0.425	21.854	0.678	0.397
Room	Bonsai	24.696	0.789	0.259	21.995	0.707	0.264
Average		22.352	0.616	0.387	20.922	0.598	0.401

Table 8: Detailed results for StegoNGP on the Mip-Nerf-360 dataset. Each row corresponds to a scene pair visualized in Figure 6 .

Key ID	Prime	Prime	Prime
( $j$ )	$k_{j,1}$	$k_{j,2}$	$k_{j,3}$
1	10123105283	9423208789	10600480711
2	3674653429	2097192037	1434869437
3	8542170799	6143207549	6519670961
4	15443898139	12668029511	12301111429
5	14405672371	5760082793	11538455387

Table 9: The master set of 16 secret keys used in the Multi-Key StegoNGP experiments. Each key

\mathcal{K}_{j}

is a 3-prime tuple

\{k_{j,1},k_{j,2},k_{j,3}\}

Model	K Provision (%)	PSNR ( $S$ )	PSNR ( $\mathcal{B}$ )
$m=4$	0% (Renders $S$ )	30.620	11.805
	25%	15.860	13.761
	50%	13.822	16.219
	75%	12.640	19.613
	100% (Renders $\mathcal{B}$ )	11.876	27.332
$m=8$	0% (Renders $S$ )	30.093	11.680

Table 10: Detailed results for the Multi-Key StegoNGP partial key disclosure attack, corresponding to Figure 5 in the main paper (using Hotdog as Cover Scene

S

, Chair as Hidden Scene

\mathcal{B}

). We measure the reconstruction fidelity when the percentage of correct secret keys (

\mathbf{K}

) increases.

$\Phi$	Scene	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$
$1$	$S$ (Hotdog)	30.726	0.949	0.053
$1$	$\mathcal{B}_{1}$ (Chair)	27.508	0.919	0.090
$2$	$S$ (Hotdog)	31.606	0.950	0.055
	$\mathcal{B}_{1}$ (Chair)	28.141	0.919	0.090
	$\mathcal{B}_{2}$ (Mic)	28.566	0.955	0.051
$3$	$S$ (Hotdog)	31.037	0.946	0.063

Table 11: Quantitative results for embedding

\Phi

hidden scenes into a single model, using the default

T=2^{19}

hash table. As

\Phi

increases, the increased hash collisions cause a clear degradation in reconstruction fidelity across all scenes.

Panel of Figure 7 — Figure 7: Visualization of image results obtained by simultaneously embedding multiple ( $\Phi$ ) hidden scenes ( $\mathcal{B}_{1}$ , $\mathcal{B}_{2}$ , $\mathcal{B}_{3}$ or $\mathcal{B}_{4}$ ) and cover scenes ( $S$ ) into a single model using the default $T=2^{19}$ hash table.

Panel of Figure 8 — Figure 8: Visualization of depth results when embedding multiple ( $\Phi$ ) hidden scenes ( $\mathcal{B}_{1}$ , $\mathcal{B}_{2}$ , $\mathcal{B}_{3}$ or $\mathcal{B}_{4}$ ) and cover scenes ( $S$ ) simultaneously into a single model using the default $T=2^{19}$ hash table.

IBRSteG: Learning a Generalizable Steganography Framework for 3D Gaussian Splatting
Jun 29, 2026Fanye Kong, Hongyu Xia, Yu Zheng +33D Gaussian Splatting
Department of Automation, Tsinghua University, Beijing 100084, China
Splats in Splats++: Robust and Generalizable 3D Gaussian Splatting Steganography
Apr 17, 2026Yijia Guo, Wenkai Huang, Tong Hu +93D Gaussian Splatting Robust Watermarking
State Key Laboratory of Multimedia Information Processing and National Engineering Research Center of Visual Technology, School of Computer Science, Peking University, Beijing, 100871, China · Shanghai Key Laboratory of Integrated Administration Technologies for Information Security, School of Computer Science, Shanghai Jiao Tong University, Shanghai 200240, China · National Biomedical Imaging Center, College of Future Technology, Peking University, Beijing, 100871, China +2
Style as Cover: Deep Image Steganography via Stylized Transmission
Sep 18, 2026Qi Li, Jidong Yang, Huaike Yu +6
Key Laboratory of Computing Power Network and Information Security, Ministry of Education, Shandong Computer Science Center, and Shandong Provincial Key Laboratory of Industrial Network and Information System Security, Shandong Fundamental Research Center for Computer Science, Qilu University of Technology (Shandong Academy of Sciences), Jinan 250353, China · School of Information Science and Engineering, Dalian Polytechnic University, Dalian 116034, China · School of Electrical, Electronic and Computer Engineering, The University of Western Australia, Perth, WA 6009, Australia +1

Jun 29, 2026J/K move · Enter open · S save

IBRSteG: Learning a Generalizable Steganography Framework for 3D Gaussian Splatting

Fanye Kong, Hongyu Xia, Yu Zheng, Boyang Gong+2

Department of Automation, Tsinghua University, Beijing 100084, China

3D Gaussian Splatting

Open paper AskPDF arXiv

Recent advances in deep learning have notably improved steganographic message hiding. However, designing a generalizable steganographic approach for 3D Gaussian Splatting (3DGS) that can embed meaningful 3D scene content remains challenging. In this paper, we propose IBRSteG, a generalizable framework for 3DGS steganography that enables undetectable concealment of secret scenes within a steganographic scene. Unlike existing approaches whose parameter generation is rigidly coupled with the specific scene, we formulate 3D steganography as a feed-forward 3D Gaussian embedding process that generalizes across different 3DGS scenes. To realize this, we introduce GAS (Gaussian Attributes Steganographer), a network that learns a scene-independent embedding function by injecting the attributes of secret 3D Gaussian points into a cover scene, thereby directly reconstructing the steganographic scenes without per-scene finetuning or optimization. By transforming 3D Gaussian into these structured attributes, these attributes are compatible with 2D learning paradigms and benefit from their structured nature, thereby enhancing generalization to unseen 3DGS scenes. Extensive experiments on established datasets demonstrate that IBRSteG can effectively conceal different scenes with high visual quality, and achieves superior capacity and security. Code is available at https://github.com/LingXiang2023/IBRSteG.

Abstract

Explore similar work

IBRSteG: Learning a Generalizable Steganography Framework for 3D Gaussian Splatting

Splats in Splats++: Robust and Generalizable 3D Gaussian Splatting Steganography

Style as Cover: Deep Image Steganography via Stylized Transmission