Your secrets are being exposed: deep image hiding models are surprisingly easy to attack

Core question: In deep image hiding, can an attacker go beyond "detecting whether a secret exists" and extract the content of the secret image itself under zero-shot conditions.

• Setting and importance: Image hiding conceals an entire secret image within a cover image and has been used in privacy-preserving applications, such as AIRPNet performing image restoration directly in the stego domain and StegaVAR performing video action recognition in the stego domain. The authors argue that if the secret content can be extracted, the privacy promises of these applications would directly fail.
• Shortcomings of existing methods: Existing security research is mainly steganalysis, i.e., binary detection of whether an image is a stego; the authors point out that a detector can tell an attacker that a secret exists but cannot tell what the secret depicts.
• Core observation: The authors find that a hiding model's decoder, trained in the conventional way, can recognize embedding patterns shared across different hiding models; frequency-domain analysis of 11 models shows that most models prefer to embed secrets in the mid-to-high frequencies.
• What the paper proposes: A "secret showing" attack (training one's own decoder for zero-shot cross-model extraction), an evaluation dataset of 83,050 stego images generated by 11 hiding models, two enhanced attack training settings (ours+, ours++), and leakage evaluation at two levels: human vision and machine (image retrieval).
• Threat model:
  • Goal: Recover the recognizable semantic content of the secret image from the stego image, rather than merely detecting the presence of a secret.
  • Knowledge: The attacker does not know the target encoder that generated the stego image, nor the corresponding decoder; the target model's training dataset is not needed.
  • Capability: Independently train an image hiding model on a self-chosen dataset following the standard pipeline, freeze its decoder, and apply it directly to stego images from unseen models, with no target-specific training or fine-tuning (zero-shot).
  • Victim systems: 11 deep image hiding models (INN and autoencoder families) and the steganography-based privacy-preserving application AIRPNet.

Deep image hiding

• Baluja [3]—proposed a convolutional encoder-decoder framework that hides an entire color image within an image of the same size; an early work in deep image hiding.
• HiNet [17]—uses an invertible neural network (INN) to model hiding and recovery as the forward and inverse processes of the same network; subsequent methods fall into the autoencoder and INN families and introduce Transformer and Mamba backbones and spatial/wavelet-domain embedding (e.g., StegFormer [19], StegMamba [27]).
• DeepMIH [14]—INN-based multi-image hiding; this paper uses it for multi-secret attack experiments.

Steganography-based privacy protection

• AIRPNet [13]—hides a low-quality private image in a cover and performs restoration (denoising, deblurring, super-resolution) directly on the stego image, with the user later recovering the enhanced secret image; this paper uses it as a test case for attacking privacy applications.
• StegaVAR [7]—hides action videos in ordinary cover videos and performs action recognition directly in the stego domain.
• CloakDiff [26]—uses diffusion-based adversarial editing to hinder privacy inference by vision-language models, then embeds the original image into the adversarial example for recovery.

Steganalysis

• Traditional and DNN detectors—rich-model methods [8, 12] and DNN methods [4, 43] perform binary stego detection; the authors point out that such methods can only determine whether a secret exists and cannot say what the secret content is.
• Cross-model detection—Li et al. [24] show that an attacker can train an effective detector with as few as 50 cover-stego image pairs; the detector of Wang et al. [37] can generalize to some extent to models unseen in training.
• Mallet et al. [28]—a recent steganalysis work that reports its method can reveal the rough outline of the secret hidden by AIRPNet; this paper uses it as a comparison baseline when attacking AIRPNet, and the authors state that its extraction performance is limited.

Baselines and benchmarks: when attacking AIRPNet, compared against UDH [42] and Mallet et al. [28]; the evaluation datasets are COCO and ImageNet (main experiments), DIV2K (training), and three out-of-distribution secret datasets: sketch, logo, and cartoon.

Authors' positioning: prior security research focused on steganalysis-style detection, whereas this paper claims that deep image hiding has secret semantic leakage, advancing the attack from "whether a secret is hidden" to "what the secret is."

Overall idea: the attacker independently trains an image hiding model, treats its decoder as a "secret extractor" that acts directly on stego images generated by unseen models, and then designs training enhancements based on the embedding preferences found by frequency-domain analysis to make the leaked content clearer. The method is named the "secret showing" attack (Figure 2).

Problem setting

• In deep image hiding, the cover and secret are passed through an encoder to generate a stego image, and the legitimate receiver uses the corresponding decoder to recover the secret.
• The attacker does not know the target encoder/decoder and can only rely on a steganalyzer for binary detection; this paper advances the attack goal from detection to content extraction.

Attack pipeline (two steps)

1. Preparing: the attacker chooses any image hiding model (the paper mainly uses the open-source HiNet [17]) and trains it on a self-chosen dataset following its official training procedure; no reference to other models and no stego images generated by the target model are needed.
2. Attacking: freeze the trained decoder and directly run forward inference on stego images generated by unseen hiding models, obtaining the secret image content zero-shot; no target-specific training or fine-tuning.

Evaluation datasets and frequency-domain analysis

• 11 hiding models with public or official implementations are used to generate 83,050 stego images, covering the INN and autoencoder families, CNN/Transformer/Mamba backbones, and spatial-domain and frequency-domain embedding (Table 1).
• For each stego image and its corresponding cover, the embedding residual Δ res = I_stego − I_cover is computed, and its normalized power spectrum is visualized following the frequency-domain analysis of Wang et al. [38] (Figure 3, based on 7,550 image pairs from the DIV2K, COCO, and ImageNet test sets).
• The authors state that most models prefer embedding in mid-to-high-frequency components, and design the training enhancements accordingly.

Two enhancement settings

• ours+: when training HiNet, enhance the texture of the cover image and suppress the texture of the secret image.
• ours++: on top of ours+, double the weight λf of HiNet's low-frequency loss; both push the network to hide information in the high-frequency components of the cover.
• There is also a milder variant † (enhancement strength 25% lower than +), which appears only in the gain analysis of Figure 8.

Success criteria and evaluation method

• Human judgment: extracted images are shown side by side with the secret reference images (Figure 4); the authors state that key texture patterns are exposed and the secret content is recognizable.
• Machine judgment (secret retrieval): the extracted image is fed into DINOv3 ViT-L/16 (a self-supervised vision foundation model), and the cosine similarity of its last-layer CLS token embedding is used to retrieve the original secret from a candidate gallery; the candidate gallery is limited to all original secret images used in that evaluation.
• Metrics: R@K (the percentage of queries for which the original secret appears in the top K retrieval results, K=1/10/20/50), plus PSNR and SSIM; the authors note that PSNR/SSIM are affected by the cover and cannot fully reflect semantic leakage.
• Main experiments are conducted on COCO and ImageNet, with 5,000 and 10,000 images randomly selected respectively.

Experimental Setup

• Attacker model: HiNet [17] trained according to the official setup (training set DIV2K); a hiding/recovery network built on ResNet-50 is also tested.
• Target models (11): HiNet, LiDiNet, StegFlow, StegMamba, EFCA-DIH (INN family); Baluja, StegFormer, Ectformer, StegTransX, UDH, URSMamba (autoencoder family); plus AIRPNet (privacy-preserving application) and DeepMIH (multi-image hiding).
• Datasets: main experiments on COCO (5,000 images) and ImageNet (10,000 images); out-of-distribution secrets use the sketch [33], logo [32], and cartoon [44] datasets, with covers from COCO.
• Evaluation method: retrieval by cosine similarity of the last-layer CLS token embeddings of DINOv3 ViT-L/16; the candidate gallery is all original secret images from that evaluation.
• Metrics: R@1/R@10/R@20/R@50, PSNR, SSIM.
• Baselines: when attacking AIRPNet, compared against UDH [42] and Mallet et al. [28]; there is also a control experiment that retrieves directly on stego images (in the supplementary material).
• The paper does not report the number of repetitions or statistical significance tests.

Main Results

Table 2: Cross-model secret retrieval by the HiNet decoder on 10 unseen models (COCO, R@1/R@10, %):

Swipe horizontally to read the table

Target model	ours R@1	ours R@10	ours+ R@1	ours+ R@10	ours++ R@1	ours++ R@10
LiDiNet	8.20	16.16	9.64	19.64	6.52	14.52
StegFlow	3.44	7.72	25.64	41.36	4.44	10.48
StegMamba	6.72	14.92	3.92	10.32	29.88	48.16
EFCA-DIH	30.96	50.84	57.92	76.72	70.04	85.20
Baluja	0.60	2.92	2.12	6.40	0.32	1.96
StegFormer	0.72	2.56	1.44	3.64	13.80	22.88
Ectformer	64.56	80.68	74.48	86.08	27.84	45.96
StegTransX	5.08	11.48	23.60	37.80	1.80	4.60
UDH	23.32	42.76	5.00	12.64	4.72	12.48
URSMamba	35.20	55.12	23.24	42.88	96.60	99.40

• The authors state: ours without enhancement is already effective against most models; different models each have the enhancement variant best suited to them (Table 2 marks the best setting for each target in blue), and no single variant is best on all models.
• The authors acknowledge that the gains from the two enhancements are uneven across models, attributing this to differences in the strength of each model's embedding preferences; they emphasize that the enhancements are simple to implement and add no extra inference cost.
• ImageNet results show a similar trend, e.g., ours++ achieves R@1 of 97.22% on URSMamba (Table 2).

Out-of-Distribution Secrets and Multi-Image Hiding

• Out-of-distribution secrets (Table 3, ours+): on sketch, 6 models exceed 50% R@1 (e.g., HiNet 68.50, Ectformer 86.40); on logo, 7 models exceed 50% (e.g., EFCA-DIH 85.40); on cartoon, HiNet, Ectformer, and EFCA-DIH exceed 50% on both metrics. The authors state that some results are better than in Table 2, and suggest that secrets with a single clear semantic content are easier for vision models to recognize.
• Multi-image hiding (Figure 6): for DeepMIH and StegFormer (2 secrets hidden per cover, COCO test set), ours+ clearly exposes the core semantics of the first secret, while the second is not recovered; StegFormer's second output erroneously reflects the semantics of the first secret. The authors state that the attack is partially effective against multi-image hiding; quantitative results are in the supplementary material.

Attacking AIRPNet and Cross-Decoder Generalization

• AIRPNet (Table 4): on COCO, R@1 for ours/ours+/ours++ is 17.00/35.60/45.00, higher than 8.44 for Mallet et al. [28] and 0.48 for UDH [42]; the trend on ImageNet is the same. The authors state that [28] can only reveal a rough outline, and that UDH's output contains almost no usable information.
• Cross-decoder (Table 6): each model's decoder is averaged over the remaining 11 source models in recall; the URSMamba decoder has the highest average R@1 (35.68), HiNet is 17.80, and Baluja is lowest (0.63); the authors state that the decoders of all tested models possess this "universal" extraction capability to varying degrees and can serve as a "master key."
• ResNet-50 extractor (Figure 9): for 4 representative target models, the output is dominated by the stego outline but contains traces of the secret content (marked with yellow boxes in the figure); the authors state that even a standard network without steganography-specific architecture can develop this capability.

Other Ablations and Analyses

• Training data (Table 5): training the extractor on ImageNet-2000/10000 instead remains effective against all models; most targets have higher recall on 10,000 images (e.g., R@1 for the HiNet target rises from 31.08 to 41.00, but LiDiNet drops from 7.00 to 3.56, and EFCA-DIH drops from 33.08 to 23.32).
• Enhancement gains (Figure 8): reports the average R@50 gain of +, ++, † relative to no enhancement for the 11 targets; most are positive, with a few negative (the figure marks -3.3%, -7.8%, -33.1%, etc.); the authors state that the gains support the existence of shared embedding patterns in most models.
• Mechanism analysis (Figure 10): measures channel activation changes in the η subnetwork of each inverse block of the HiNet decoder; the authors state that stego from different sources elicit maximum responses on many of the same channels, and that this pattern persists after randomizing the Fourier phase of the residual; the authors therefore conjecture that the decoder exploits spectral patterns shared by the embedding traces of different models.
• Negative results: ours+ reduces R@1 on UDH from 23.32 to 5.00 (Table 2); in multi-image hiding the second secret is not recovered; the authors do not explain the reasons for these exceptions.

Limitations and Future Directions Noted by the Authors

• Mechanism unclear (Conclusion): The authors state that the analysis suggests end-to-end training enables the decoder to recognize embedding patterns shared across models, but the precise mechanism remains an open question ("the precise mechanism remains an open question").
• Multi-image hiding recovers only one (Sec. 4.4): The attack exposes only the semantics of the first secret image; the second is not recovered, and the authors state that the attack is only partially effective against multi-image hiding.
• Uneven enhancement gains (Sec. 4.2, 4.6): The two enhancements do not improve the attack on all models (e.g., on UDH); the authors attribute this to differences in the strength of each model's embedding preferences.
• Limitations of PSNR/SSIM (Sec. 4.2): The authors point out that these two metrics are confounded by stego/cover interference and cannot adequately reflect whether the secret semantics leak, hence the introduction of retrieval-based evaluation.
• The paper has no dedicated Limitations section; the above all come from the corresponding subsections of the main text and the conclusion.

Scope of Experimental Coverage

• There are 11 tested hiding models in total (Table 1), plus AIRPNet (Sec. 4.5) and DeepMIH (Sec. 4.4); the main attacker model is HiNet, and a ResNet-50 extractor is also tested (Sec. 4.6).
• Main experiments are conducted on COCO (5,000 images) and ImageNet (10,000 images); out-of-distribution secrets cover three types—sketch, logo, and cartoon—with covers from COCO (Sec. 4.3).
• Retrieval evaluation uses DINOv3 ViT-L/16, with the candidate gallery limited to all original secret images from that evaluation (Sec. 4.2); the paper does not report the number of repetitions or statistical significance tests.
• Training details, quantitative results for multi-image hiding, full cross-decoder results, and the control experiment on direct stego retrieval are all in the supplementary material and are not included in this converted text.
• The paper states that the code and dataset will be open-sourced ("will be open-sourced"), i.e., the authors plan to release them, which has not yet been completed.

An attack paper on deep image hiding (image-in-image steganography) that advances the threat from "detecting the presence of a secret" to "extracting the secret content."

• Problem: Steganalysis can only determine whether an image hides a secret; the authors ask whether an attacker can directly see what the secret image depicts without knowing the target model. This bears on whether steganography-based privacy-preserving applications such as AIRPNet hold up.
• Method: The attacker trains a hiding model (mainly HiNet) on a self-chosen dataset following the standard pipeline, freezes its decoder, and performs zero-shot extraction on stego images generated by 11 unseen models; based on the frequency-domain finding that most models prefer mid-to-high-frequency embedding, during training it enhances cover texture and suppresses secret texture (ours+) and doubles the low-frequency loss weight (ours++).
• Main results: Evaluated by DINOv3 retrieval, on COCO the unenhanced attack is effective against most models (e.g., R@1 64.56% on Ectformer); under each model's best variant, ours++ achieves R@1 of 96.60% on URSMamba, and ours+ achieves R@10 of 86.08% on Ectformer (Table 2).
• Extended experiments: The attack is effective on out-of-distribution secrets sketch, logo, and cartoon (on sketch, 6 models exceed 50% R@1); for multi-image hiding it recovers only the first secret; against AIRPNet its R@1 reaches up to 45.00% (COCO, ours++), higher than the compared Mallet et al. and UDH.
• Generalization: The decoders of all 11 models have cross-model extraction capability to varying degrees (average R@1 from 0.63 for Baluja to 35.68 for URSMamba); even a ResNet-50 extractor without steganography-specific architecture can reveal traces of the secret.
• Authors' conclusion: The authors believe end-to-end training lets the decoder learn embedding patterns shared across models, and that every tested model can serve as a "master key"; the precise mechanism remains open. The authors state that deep image hiding can no longer be relied upon to keep the content of secret images confidential, and plan to open-source the code and dataset.