Training-Free Coverless Multi-Image Steganography with Access Control

Minyeol Bae; Si-Hyeon Lee

cs.CVMar 10, 2026

Training-Free Coverless Multi-Image Steganography with Access Control

Authors: Minyeol Bae, Si-Hyeon Lee

Organizations: School of Electrical Engineering, Korea Advanced Institute of Science and Technology (KAIST), Daejeon 34141, South Korea.

Abstract

Coverless Image Steganography (CIS) hides information without explicitly modifying a cover image, providing strong imperceptibility and inherent robustness to steganalysis. However, existing CIS methods largely lack robust access control, making it difficult to selectively reveal different hidden contents to different authorized users. Such access control is critical for scalable and privacy-sensitive information hiding in multi-user settings. We propose MIDAS (Multi-Image Diffusion-based Access-controlled Steganography), a training-free diffusion-based CIS framework that enables multi-image hiding with user-specific access control via latent-level fusion. MIDAS introduces a Random Basis mechanism to suppress residual structural information, together with a theoretical analysis of information leakage, and a Latent Vector Fusion module that reshapes aggregated latents to better align with the diffusion process. Experimental results demonstrate that MIDAS consistently outperforms existing training-free CIS baselines in access control functionality, stego image quality and diversity, robustness to noise, and resistance to steganalysis, establishing a practical and scalable approach to access-controlled coverless steganography.

Figures & tables

Figure 1: Comparison of stego image quality across training-free CIS methods with two hidden secret images. CRoSS*, DiffStega*, and DiffStega** are extensions of CRoSS and DiffStega based on latent concatenation (see Section 4.1 and Appendix B.2 for details). Dashed lines indicate concatenation boundaries. While baseline methods often suffer from visual artifacts or discontinuities due to limited diversity, MIDAS preserves high visual fidelity and natural image synthesis.

Method	Coverless	Training	Multi-image	Access control
Baluja		moderate	✓
HiNet		moderate
ISN		moderate	✓
DeepMIH		moderate	✓
RIIS		moderate	✓
Kweon et al.		moderate	✓	✓

Table 1: Comparison of image steganography methods.

Figure 2: The overall scenario. The sender embeds multiple secret images ( $I_{sec}^{1},...,I_{sec}^{N}$ ) into a single stego image ( $I_{stego}$ ), which is then transmitted through a public channel. Each secret image ${I}_{sec}^{i}$ is encrypted with a private key ${\mathcal{K}}_{priv}^{i}$ . Let $\hat{I}_{sec}^{j}(i)$ denote the reconstruction result of secret image $j$ obtained by user $i$ using $\mathcal{K}_{priv}^{i}$ . Due to the access control function, only the intended receiver $i$ possessing ${\mathcal{K}}_{priv}^{i}$ can successfully recover $\hat{I}_{sec}^{i}(i)$ , whereas for any other image $j\neq i$ , the reconstruction $\hat{I}_{sec}^{j}(i)$ results in a meaningless output.

Figure 3: Visual comparisons of MIDAS, CRoSS*, and DiffStega* on the Stego260 dataset under different prompts for two-image hiding.

$N$	Method	Stego image quality	Stego image diversity				Correct $\mathcal{K}_{priv}$ reconstruction			Wrong $\mathcal{K}_{priv}$ reconstruction
$N$	Method	MANIQA $\uparrow$	PSNR $\downarrow$	SSIM $\downarrow$	LPIPS $\uparrow$	CLIP Score $\uparrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	PSNR $\downarrow$	SSIM $\downarrow$	LPIPS $\uparrow$
1	IIS	-	-	-	-	-	48.588	0.999	0.016	10.551	0.107	0.818
	AIS	-	-	-	-	-	35.990	0.999	0.127	22.981	0.595	0.367
	CRoSS*	0.409	20.535	0.740	0.322	27.937	22.870	0.796	0.263	18.387	0.650	0.430
	DiffStega*	0.450	19.686	0.664	0.419	28.871	24.958	0.833	0.232	19.447	0.650	0.397
	MIDAS(Ours)	0.429	13.407	0.419	0.610	29.686	25.161	0.831	0.234	12.718	0.237	0.698

Table 2: Quantitative results for stego and reconstructed images on the Stego260 dataset. Best results among training-free CIS methods are highlighted in bold .

Method	Clean	Gaussian noise	JPEG	Gaussian blur
IIS	41.360	12.439	10.047	10.677
AIS	30.774	14.654	9.442	9.996
CRoSS*	17.606	16.300	16.932	15.629
DiffStega*	21.908	20.076	20.422	19.375
MIDAS(Ours)	23.903	20.046	19.922	19.689

Table 3: PSNR(dB) of reconstructed images under practical degradations. For Gaussian noise and JPEG compression, standard deviation

\sigma=5

and quality factor

Q=70

are used, respectively. For Gaussian blur,

\sigma=2

and kernel size 7 are used. Considering these degradations as additional noise, 5 additional denoising steps are applied to the diffusion-based frameworks (CRoSS*, DiffStega*, and MIDAS) in the Reconstruction Stage.

Figure 4: Steganalysis accuracy on (a) XuNet and (b) SiaStegNet.

Appendix figures & tables16 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 5: The overall architecture of MIDAS. (a) The Hiding Stage, where $N$ secret images ( ${I}_{sec}^{1},...,{I}_{sec}^{N}$ ) are individually encrypted using private keys ( ${\mathcal{K}}_{priv}^{i}$ ) and then jointly fused using the public key ( $\mathcal{K}_{pub}$ ) to form the single stego image ( ${I}_{stego}$ ). (b) The Reconstruction Stage (for user $1$ ), where user $1$ recovers their assigned image ( ${\hat{I}}_{sec}^{1}$ ) using ${\mathcal{K}}_{priv}^{1}$ , from the received stego image ( ${\tilde{I}}_{stego}$ ) (which may contain noise due to transmission errors), while the access control mechanism ensures that other images remain encrypted.

Figure 6: Visual comparisons of MIDAS, CRoSS*, and DiffStega* on the Stego260 dataset under different prompts for four-image hiding.

$N$	Method	Stego image quality	Stego image diversity				Correct $\mathcal{K}_{priv}$ reconstruction			Wrong $\mathcal{K}_{priv}$ reconstruction
$N$	Method	MANIQA $\uparrow$	PSNR $\downarrow$	SSIM $\downarrow$	LPIPS $\uparrow$	CLIP Score $\uparrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	PSNR $\downarrow$	SSIM $\downarrow$	LPIPS $\uparrow$
1	IIS	-	-	-	-	-	42.724	0.995	0.032	10.497	0.125	0.786
	AIS	-	-	-	-	-	31.585	0.997	0.155	22.484	0.634	0.342
	CRoSS*	0.445	19.452	0.646	0.397	27.574	21.116	0.713	0.322	17.415	0.564	0.480
	DiffStega*	0.439	18.450	0.581	0.471	28.676	23.183	0.767	0.269	18.614	0.589	0.429
	MIDAS(Ours)	0.409	13.329	0.380	0.658	29.127	21.196	0.677	0.336	13.236	0.218	0.680

Appendix

Table 4: Quantitative results for stego and reconstructed images on the UniStega dataset.

$N$	Dataset	Stego image quality	Stego image diversity				Correct $\mathcal{K}_{priv}$ reconstruction			Wrong $\mathcal{K}_{priv}$ reconstruction
$N$	Dataset	MANIQA $\uparrow$	PSNR $\downarrow$	SSIM $\downarrow$	LPIPS $\uparrow$	CLIP Score $\uparrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	PSNR $\downarrow$	SSIM $\downarrow$	LPIPS $\uparrow$
8	Stego260	0.456	9.698	0.357	0.785	30.257	20.502	0.624	0.440	11.219	0.187	0.731
8	UniStega	0.421	10.320	0.316	0.799	29.084	19.439	0.543	0.502	11.230	0.167	0.738

Appendix

Table 5: Quantitative results of MIDAS on stego and reconstructed images for eight-image hiding.

Figure 7: Qualitative results of MIDAS on the Stego260 dataset under different prompts for eight-image hiding.

Method	Time (s) $\downarrow$	Peak GPU $\downarrow$
IIS	1.540	0.811
AIS	0.257	0.337
CRoSS*	38.982	8.263
DiffStega*	28.436	6.944
MIDAS(Ours)	33.867	7.371

Appendix

Table 6: Runtime and peak memory usage of MIDAS and baseline methods when processing 50 secret images.

$N$	Method	Stego image quality	Stego image diversity				Correct $\mathcal{K}_{priv}$ reconstruction
$N$	Method	MANIQA $\uparrow$	PSNR $\downarrow$	SSIM $\downarrow$	LPIPS $\uparrow$	CLIP Score $\uparrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$
1	HIS*	0.429	23.515	0.819	0.224	27.195	29.686	0.847	0.195
1	MIDAS(Ours)	0.429	13.407	0.419	0.610	29.686	25.161	0.831	0.234
2	HIS*	0.394	22.712	0.816	0.490	27.304	30.149	0.911	0.176
2	MIDAS(Ours)	0.434	9.885	0.287	0.752	30.129	23.903	0.771	0.299
4	HIS*	0.366	22.920	0.814	0.485	27.245	19.347	0.792	0.442

Appendix

Table 7: Quantitative results for stego and reconstructed images of HIS* and MIDAS on the Stego260 dataset.

Method	Number of encrypted channels
Method	0	1	2	3	4
Noise Flip	0.809	0.582	0.355	0.201	0.089
Random Basis	0.809	0.560	0.286	0.128	0.048

Appendix

Table 8: Quantification of residual structural information in the stego image, measured by the structural component of SSIM between

I_{sec}

and

I_{stego}

Method	MANIQA $\uparrow$	CLIP Score $\uparrow$	PSNR ${}_{\text{Correct}}$ $\uparrow$
separate denoising	0.434	30.129	22.928
joint noising	0.417	30.074	23.901
MIDAS(Ours)	0.434	30.129	23.903

Appendix

Table 9: Performance analysis across different diffusion strategies. PSNR

{}_{\text{Correct}}

denote the PSNR values between the original secret images and their reconstructions using the correct

\mathcal{K}_{priv}

Method	MANIQA $\uparrow$	CLIP Score $\uparrow$	PSNR ${}_{\text{Correct}}$ $\uparrow$	PSNR ${}_{\text{Wrong}}$ $\downarrow$
DiffStega*	0.399	26.952	21.908	18.137
DiffStega**	0.324	28.459	24.091	10.769
MIDAS ${}_{\text{NF}}$	0.380	29.631	23.616	10.566
MIDAS(Ours)	0.434	30.129	23.903	9.964

Appendix

Table 10: Effectiveness of Latent Vector Fusion. PSNR

{}_{\text{Correct}}

and PSNR

{}_{\text{Wrong}}

denote the PSNR values between the original secret images and their reconstructions using the correct and incorrect

\mathcal{K}_{priv}

, respectively.

Figure 8: Experimental results of MIDAS with varying $\alpha$ .

$\alpha$	MANIQA $\uparrow$	CLIP Score $\uparrow$	PSNR ${}_{\text{Correct}}$ $\uparrow$	PSNR ${}_{\text{Wrong}}$ $\downarrow$
0.9	0.436	30.212	23.286	9.755
0.95	0.434	30.129	23.903	9.964
1	0.394	29.044	24.481	10.271

Appendix

Table 11: Performance analysis of MIDAS with varying

\alpha

Figure 9: Visual comparisons of stego images generated by MIDAS with varying (a) $\gamma_{priv}$ and (b) $\gamma_{fuse}$ .

$\gamma_{priv}$	MANIQA $\uparrow$	CLIP Score $\uparrow$	PSNR ${}_{\text{Correct}}$ $\uparrow$	PSNR ${}_{\text{Wrong}}$ $\downarrow$
0.2	0.406	29.923	23.840	13.875
0.4	0.434	30.129	23.903	9.964
0.6	0.451	30.181	23.921	8.153

Appendix

Table 12: Performance analysis of MIDAS with varying

\gamma_{priv}

$\gamma_{fuse}$	MANIQA $\uparrow$	CLIP Score $\uparrow$	PSNR ${}_{\text{Correct}}$ $\uparrow$	PSNR ${}_{\text{Wrong}}$ $\downarrow$
0.3	0.392	29.861	23.899	10.040
0.5	0.434	30.129	23.903	9.964
0.7	0.461	30.198	23.888	9.910

Appendix

Table 13: Performance analysis of MIDAS with varying

\gamma_{fuse}

Figure 10: Experimental results of MIDAS using an alternative checkpoint 5 .

Style as Cover: Deep Image Steganography via Stylized Transmission
Sep 18, 2026Qi Li, Jidong Yang, Huaike Yu +6
Key Laboratory of Computing Power Network and Information Security, Ministry of Education, Shandong Computer Science Center, and Shandong Provincial Key Laboratory of Industrial Network and Information System Security, Shandong Fundamental Research Center for Computer Science, Qilu University of Technology (Shandong Academy of Sciences), Jinan 250353, China · School of Information Science and Engineering, Dalian Polytechnic University, Dalian 116034, China · School of Electrical, Electronic and Computer Engineering, The University of Western Australia, Perth, WA 6009, Australia +1
Zero-Shot Interpretable Image Steganalysis for Invertible Image Hiding
May 2, 2026Hao Wang, Yiming Yao, Yaguang Xie +2Digital Image Forensics
Zhejiang Provincial Key Laboratory for Sensitive Data Security Protection and Confidentiality Management, Hangzhou Dianzi University, Hangzhou 310018, China · Arcvideo Technology, Hangzhou 310018, China
No Prompt, No Leaks: A Robust Generative Steganography Framework via Prompt-Free Diffusion
Jun 30, 2026Jingwen Cai, Fen Xiao, Shuhua Deng +1Latent Diffusion Models Diffusion-Based Image Generation
MOE Key Laboratory of Intelligent Computing and Information Processing, Xiangtan University, Xiangtan 411105, China · College of Information Science and Engineering, Hunan Normal University, Changsha 410006, China

Sep 18, 2026J/K move · Enter open · S save

Style as Cover: Deep Image Steganography via Stylized Transmission

Qi Li, Jidong Yang, Huaike Yu, Chunpeng Wang+5

Key Laboratory of Computing Power Network and Information Security, Ministry of Education, Shandong Computer Science Center, and Shandong Provincial Key Laboratory of Industrial Network and Information System Security, Shandong Fundamental Research Center for Computer Science, Qilu University of Technology (Shandong Academy of Sciences), Jinan 250353, China · School of Information Science and Engineering, Dalian Polytechnic University, Dalian 116034, China · School of Electrical, Electronic and Computer Engineering, The University of Western Australia, Perth, WA 6009, Australia+1

Open paper AskPDF arXiv

Image steganography hides secret message within normal images, with most existing works relying on cover-preserving transmission. However, such a paradigm becomes vulnerable once the original cover is exposed or can be reliably approximated. In this paper, we propose StyleStegaNet, a stylized image hiding framework that replaces cover matching with style-concealment transmission. Instead of transmitting a cover-like stego image, StyleStegaNet generates stylized stego images conditioned on publicly available style references, redefining steganography invisibility from cover-preserving concealment to behavior-level camouflage based on style transformation. Such a setting poses a substantial challenge to reliable secret recovery, since neural stylization can significantly alter the feature statistics exploited by deep hiding methods. To address this challenge, StyleStegaNet decouples the overall task into four coordinated stages: stego generation, stylized transmission, structure-preserving reconstruction, and secret recovery. Moreover, StyleStegaNet is optimized with a progressive three-stage training strategy, in which wavelet-domain constraints and perceptual supervision guide the recoverable information toward structural representations. We further provide an analysis showing that secret recoverability is largely restricted to the normalized structural subspace, offering a mechanistic explanation for why directly stylized baselines fail and why a reconstruction-guided recovery path is necessary. Extensive experiments on DIV2K and MS-COCO datasets demonstrate the effectiveness of StyleStegaNet. And few-shot image steganalysis with two deep detectors further shows detection accuracy near random guessing, approximately 51%.

Abstract

Explore similar work

Style as Cover: Deep Image Steganography via Stylized Transmission

Zero-Shot Interpretable Image Steganalysis for Invertible Image Hiding

No Prompt, No Leaks: A Robust Generative Steganography Framework via Prompt-Free Diffusion