A New AI System Hides Secret Messages in Images Designed to Survive Social-Media Compression
Images posted online are routinely resized, compressed, sharpened, blurred and contaminated by noise, yet a new artificial-intelligence system is designed to keep hidden messages readable through that digital abuse. Called RIS-MoE, the framework combines diffusion-based image generation with a mixture-of-experts restoration system, allowing it to conceal information in an image that is generated specifically for the purpose rather than altered from an existing photograph. In tests, the method recovered more than 94 percent of a hidden message after images were uploaded to and downloaded from Weibo and Instagram, according to a study published in the journal Cybersecurity. The result points to a rapidly developing form of generative steganography: communication in which the image itself is synthesized around a secret payload, potentially making conventional detection methods more difficult.
Steganography has traditionally hidden data by modifying an ordinary “cover” image. A program might subtly alter pixel values or transform-domain coefficients, changes that are intended to be invisible but can still disturb the statistical patterns of natural images. Steganalysis algorithms exploit those disturbances to determine whether an image contains concealed information. Generative steganography takes a different route. Instead of starting with a photograph and editing it, the system generates an image while incorporating the secret into the model’s internal representation. In principle, this avoids the telltale mismatch created by modifying a pre-existing image. Earlier approaches based on generative adversarial networks often struggled with unstable training, unrealistic images and unreliable message extraction. Diffusion models, which generate images through a gradual process of noise removal, have offered a more stable and visually convincing foundation, but their hidden information can still be destroyed by real-world image transmission.
RIS-MoE addresses that weakness inside the compressed mathematical space used by latent diffusion models. The researchers used Stable Diffusion 2.1, a model that does not generate every pixel directly. Instead, a variational autoencoder first converts an image into a lower-dimensional latent tensor, and diffusion takes place in that representation before a decoder reconstructs the final RGB image. For a 512-by-512 output, the system works with a latent space of dimensions 4 × 64 × 64. The researchers used that space to carry up to 16,384 secret bits, equivalent to 0.0625 bits per pixel in the generated image. The latent representation is compact enough to make diffusion computationally practical, but it also provides a structured space in which small changes can encode information without necessarily producing obvious visual artifacts.
The first component is a learnable orthogonal transformation that spreads the secret across many latent dimensions. Before embedding, encrypted binary data are converted from zero-and-one symbols into minus-one-and-one values and reshaped into a square matrix. A trainable matrix then rotates and distributes that message representation while preserving its signal energy through an orthogonality constraint. In mathematical terms, the transformation matrix is optimized while remaining consistent with the condition WᵀW = I. The design resembles spread-spectrum communication, in which a signal is distributed broadly rather than concentrated in one narrow frequency band. If a blur or compression artifact damages part of the representation, the message may still be recoverable from the remaining dimensions. The researchers also argue that the distributed signal more closely resembles the approximately isotropic statistics of diffusion noise, reducing the abrupt distribution shifts that steganalysis systems might learn to recognize.
A second neural network, called the Hide Network, embeds that transformed message into the diffusion latent. Rather than replacing the original latent completely, the network predicts a residual adjustment, ΔZ, and adds it to the clean latent Z₀ produced by deterministic Denoising Diffusion Implicit Models, or DDIM. This residual-learning strategy is important because it limits the size of the change introduced by the secret. The Hide Network is built around a customized U-Net with residual blocks and spatial-attention modules. U-Nets can combine fine details with broader spatial context, while skip connections help preserve image structure. Attention allows the model to relate distant regions of the latent feature map, which may help distribute message-related changes and reduce the effect of localized damage. The modified latent is finally passed through the pretrained decoder to create the stego image, meaning the visible image is synthesized rather than visibly edited.
The receiver faces a harder problem than simply reversing the embedding process. Once an image has passed through a social-media platform, its pixels no longer correspond perfectly to the sender’s output. JPEG compression quantizes high-frequency information, blur suppresses fine structure, resizing changes spatial correspondence, and random noise perturbs values throughout the image. When the received image is encoded back into latent space, those effects appear as a complicated mixture of latent corruption. RIS-MoE therefore inserts a restoration stage before message extraction. Its routing network, based on a multi-label ResNet-34, estimates which types of distortion are present. Because an image can be simultaneously resized, blurred and compressed, the router is not restricted to choosing a single category. It produces probabilities for multiple degradation types and activates the relevant restoration experts.
Each expert is a separate NAFNet image-restoration model trained to handle a particular distortion, such as JPEG artifacts or Gaussian blur. The outputs are combined using normalized routing weights, while a threshold suppresses experts whose predicted relevance is too low. If no expert exceeds the threshold, the system falls back to the most probable one. This sparse mixture-of-experts design is intended to make the restoration both adaptive and efficient: not every denoising branch needs to run for every image. The restored latent is then compared with a reference latent reproduced from the same text prompt and deterministic DDIM configuration used during generation. A Reveal Network receives the reference latent, the restored message-bearing latent and their explicit difference. That residual cue helps it isolate the perturbation associated with the hidden message instead of confusing the image’s ordinary semantic content with the payload. An inverse orthogonal transformation then reconstructs the original bits.
The reported experiments tested RIS-MoE on prompts and images drawn from DescGPT, LAION-10K, MS-COCO and Flickr8K, while the trainable modules were optimized using MS-COCO and the Stable Diffusion backbone remained fixed. Under PNG conditions, extraction accuracy exceeded 98.6 percent across the evaluated datasets, reaching 99.36 percent on Flickr8K. The method remained comparatively resilient under individual distortions, generally retaining more than 90 percent accuracy for resizing and Gaussian blur. More demanding tests combined several operations in sequence, reflecting how images are treated online. In those simulations, accuracy stayed above 90 percent for all tested combinations. In real-world transmission experiments, the researchers uploaded generated images to Weibo and Instagram, retrieved the platform-processed versions and attempted extraction. RIS-MoE recovered 94.62 percent of the message on Weibo and 95.29 percent on Instagram, compared with 90.26 and 92.38 percent, respectively, for the strongest comparator tested in those scenarios.
The system also performed competitively on visual quality. On Flickr8K, it achieved a Fréchet Inception Distance of 7.35 and an LPIPS perceptual-distance score of 0.21; lower values indicate closer resemblance to natural or reference imagery. Those results were substantially better than several competing latent methods, although the authors emphasize that visual metrics do not by themselves establish security. To test detectability, they trained or applied four steganalyzers spanning pixel-space, latent-space and diffusion-aware analysis. RIS-MoE was harder to distinguish from ordinary diffusion-generated images than most baselines in the reported comparisons, and when a detector was trained on only five cover images and five stego images per class, its detection accuracy was 48 percent—effectively random guessing. With 20 examples per class, accuracy was 54 percent. However, detection performance rose as more training data became available, demonstrating that the generated images still contain learnable traces. The researchers explicitly caution that the method does not achieve complete statistical indistinguishability.
Ablation tests indicate that the two central ideas contribute differently. Removing the trainable orthogonal transformation reduced recovery accuracy under difficult conditions, including a decline from 87.45 to 82.55 percent under severe JPEG compression and from 81.57 to 76.62 percent under strong additive Gaussian noise. Removing the mixture-of-experts denoiser caused larger losses: under JPEG quality 50, accuracy fell from 87.45 to 80.57 percent, while under Gaussian noise with a standard deviation of 0.1 it dropped from 81.57 to 73.08 percent. The denoising module also improved other latent-space systems when inserted without changing their original embedding logic. For example, it raised PsyDuck’s recovery accuracy from 61.68 to 75.45 percent in one combined-distortion test and improved LDStega from 46.90 to 60.71 percent in another. The added machinery is computationally heavier than lightweight pixel-domain methods, but the reported inference latency was 3,817.79 milliseconds with peak GPU memory use of 6.76 gigabytes. The findings suggest that receiver-side recovery, rather than embedding alone, may be the key to making generative steganography work across unreliable digital channels—while also underscoring the continuing arms race between systems that hide information and detectors trained to expose it.
