← 研踪 PaperTrailarXiv:2611.15583 · v1
Your Secrets Are Showing: Deep Image Hiding Models Are Surprisingly Easy to Attack
首次提交 2026-11-11 23:05
版本更新 2026-11-11 23:05
雷达观测 2026-11-13 14:16
摘要
In this work, we ask whether an attacker can go beyond detecting a hidden image and tell what it depicts, even without knowing which model hid it. We show that, for deep image hiding, this is surprisingly easy. To test this, we build an evaluation dataset of stego images generated by 11 hiding models. These models span two families (invertible neural networks and autoencoders), use different backbones (CNN, Transformer, and Mamba), and include both spatial- and frequency-domain hiding methods. We demonstrate that training HiNet [17] in the usual way yields a single decoder that can extract secret content from unseen models across these settings. Both humans and machines can recognize what it reveals. A frequency analysis shows that most models favor mid- and high-frequency embedding. Guided by this finding, we strengthen cross-model extraction by enhancing cover textures and suppressing secret textures during training. The attack extends to out-of-distribution secrets and to multi-image hiding. It even exposes private content hidden by AIRPNet [13], a recent image restoration method that uses steganography for privacy protection. What surprised us most is that decoders from every hiding model we test exhibit this ''universal'' extraction ability to varying degrees. Our code and datasets will be open-sourced.
观测到的版本
相邻记录可能跳过中间版本；首次发现 v2 及以上也会标为版本更新。
v1 · 2026-11-11 23:05 · 最新观测版本
Your Secrets Are Showing: Deep Image Hiding Models Are Surprisingly Easy to Attack
In this work, we ask whether an attacker can go beyond detecting a hidden image and tell what it depicts, even without knowing which model hid it. We show that, for deep image hiding, this is surprisingly easy. To test this, we build an evaluation dataset of stego images generated by 11 hiding models. These models span two families (invertible neural networks and autoencoders), use different backbones (CNN, Transformer, and Mamba), and include both spatial- and frequency-domain hiding methods. We demonstrate that training HiNet [17] in the usual way yields a single decoder that can extract secret content from unseen models across these settings. Both humans and machines can recognize what it reveals. A frequency analysis shows that most models favor mid- and high-frequency embedding. Guided by this finding, we strengthen cross-model extraction by enhancing cover textures and suppressing secret textures during training. The attack extends to out-of-distribution secrets and to multi-image hiding. It even exposes private content hidden by AIRPNet [13], a recent image restoration method that uses steganography for privacy protection. What surprised us most is that decoders from every hiding model we test exhibit this ''universal'' extraction ability to varying degrees. Our code and datasets will be open-sourced.
查看此版本解读 →查看此版本原文 ↗