生成式图像隐写综述：方法、鲁棒性挑战与展望

doi:10.3969/j.issn.1671-1122.2026.07.005

摘要/Abstract

摘要：

生成式图像隐写（GIS）将秘密信息嵌入图像生成过程中，提供了一条不同于传统载体修改范式的新路径。然而，该研究仍面临鲁棒性问题挑战，尤其在线社交网络（OSN）中的重压缩、格式转换、多轮重编码等处理会破坏隐藏信号与生成反演稳定性，并加剧鲁棒性与容量和安全性之间的冲突。文章围绕鲁棒性主线，对当前GIS方法进行系统综述。首先，梳理3种不同技术路线的生成隐写方法及其近期进展；然后，通过分析OSN有损信道下的鲁棒性挑战，归纳鲁棒性评测指标、OSN 信道建模等实验评估规范；最后，从失真信道建模、鲁棒潜空间映射等方面展望鲁棒GIS的未来研究方向，旨在深化GIS在OSN信道下的鲁棒性问题的系统认识，并推动相关前沿研究与应用。

关键词: 图像隐写, 生成式人工智能, 鲁棒性, 在线社交网络

Abstract:

Generative image steganography (GIS) embeds secret information into the image generation process, providing a new path different from the traditional carrier modification paradigm. However, the research on this technical method is still challenged by robustness issues. Especially in online social network (OSN), processing such as recompression, format conversion, and multiple rounds of re-encoding can undermine the stability of hidden signals and generated inversion, and intensify the conflict between robustness and capacity-security performance. This paper focused on the main line of robustness and conducted a systematic review of current GIS methods. Firstly, it sorted out the generative steganography methods based on three different technical routes and their recent progress. Subsequently, analyzed the robustness challenges of OSN in lossy channels. Then summarized the robustness evaluation indicators, OSN channel modeling and other experimental evaluation norms. Finally, the future research directions of robust GIS were prospected from multiple aspects such as distorted channel modeling and robust latent space mapping, aiming to deepen the systematic understanding of the robustness problem of GIS in OSN channels and promote related frontier research and applications.

Key words: image steganography, generative artificial intelligence, robustness, online social network

中图分类号:

TP309

宫长威, 金波, 袁得嵛, 张璇. 生成式图像隐写综述：方法、鲁棒性挑战与展望[J]. 信息网络安全, 2026, 26(7): 1058-1076.

Gong Changwei, Jin Bo, Yuan Deyu, Zhang Xuan. A review of generative image steganography: methods, robustness challenges and prospects[J]. Netinfo Security, 2026, 26(7): 1058-1076.

图/表 9

图1

图2

图3

表1

表2

代表性GIS方法实验结果归纳

方法	类型	数据集	载荷	结果	说明
文献[2]方法	GAN	DIV2K	消息嵌入深度1/3/6（约为 0.96/2.36/2.24~ 2.27 bpp）	准确率约为 0.98 / 0.89 / 0.67~0.69	该方法验证了GAN生成式无覆盖隐写的可行性，但随着嵌入深度增加，消息恢复准确率明显下降
文献[3]方法	GAN	FFHQ	1.0/2.0/3.0 bpp	消息比特准确率为97.15%/ 79.62%/ 72.74%；弗雷歇距离（Fréchet Inception Distance，FID）为13.4 / 24.8 / 30.4	GSN能够实现消息驱动的生成式隐写，但载荷升高后恢复准确率和图像质量下降较明显，说明GAN路线在高容量条件下仍存在稳定性不足问题
文献[4]方法	FM	CelebA	3.0/24.0 bpp	3 bpp下准确率为92.44%；24 bpp下准确率为99.53%	GSF利用Glow的可逆映射提高了信息恢复能力，但高容量结果与保存格式关系较大，部分结果不宜直接迁移至OSN有损传播场景
文献[5]方法	FM	CelebA-HQ	0.1~4.0 bpp	0.1~2.0 bpp下准确率为1.0000；4.0 bpp下准确率为0.9943	该方法通过分布保持映射降低含密潜变量与原始先验分布之间的差异，在高容量条件下仍保持较高提取准确率和较好的抗检测性
文献[10]方法	DM	UniStega	图像消息无法用bpp衡量	PSNR为21.248 dB；SSIM为0.711；学习感知图像块相似度为0.320	CRoSS利用Stable Diffusion 实现可控图像级隐写，重点在于秘密图像恢复和生成可控性，而非标准bpp比特流传输
文献[16]方法	DM	UniStega	图像消息无法用bpp衡量	PSNR为23.290 dB；SSIM为0.769；LPIPS为0.266	DiffStega在统一复现实验中相比CRoSS具有更高秘密图像恢复质量，并在JPEG压缩后保持更好的恢复效果
文献[18]方法	DM	FFHQ	1.0~6.0 bpp	载荷从1.0 bpp增至6.0 bpp： BA从 98.12%降至 91.12%；FID约为 2.77~4.30	该结果表明扩散模型可支持较高载荷，但当载荷继续提高时，消息恢复准确率仍会下降
文献[22]方法	DM	ILSVRC 2013 ImageNet	1.0/3.0/6.0 bpp	高斯噪声下：逐比特错误率为5.46%/ 5.82%/ 5.24%，FID约为 3.21~3.28；图像压缩下：BER为6.48%/ 7.00%/ 7.15%，FI约为 4.69~4.81	在高斯噪声扰动下，CGIS仍保持相对稳定的逐比特错误率，说明其对噪声退化具有一定鲁棒性；在JPEG压缩质量因子(QF=50)条件下，CGIS 的误码率有所上升，但图像质量退化相对可控

表2

表3

图4

表4

表5

参考文献 60

[1]	Duan Xintao, Li Baoxia, Guo Daidou, et al. A coverless steganography method based on generative adversarial network[J]. EURASIP Journal on Image and Video Processing. 2020, 1(2020): 64.
[2]	Qin Jiaohua, Wang Jing, Tan Yun, et al. Coverless image steganography based on generative adversarial network[J]. Mathematics, 2020, 8(9): 1394. doi: 10.3390/math8091394 URL
[3]	Wei Ping, Li Sheng, Zhang Xinpeng, et al. Generative steganography network[C]// The 30th ACM International Conference on Multimedia. New York: ACM, 2022: 1621-1629.
[4]	Wei Ping, Luo Ge, Song Qi, et al. Generative steganographic flow[C]// 2022 IEEE International Conference on Multimedia and Expo. New York: IEEE, 2022: 1-6.
[5]	Tang Weixuan, Rao Yuan, Yang Zuopeng, et al. Reversible generative steganography with distribution-preserving[J]. Cybersecurity, 2025(8): 18.
[6]	Zhou Qing, Wei Ping, Wang Zichi, et al. Conditional flow-based generative steganography[J]. IEEE Transactions on Dependable and Secure Computing, 2025, 22(5): 5632-5647. doi: 10.1109/TDSC.2025.3570468 URL
[7]	Dong Yunyun, Wang Zhen, Song Bingbing, et al. Double-flow-based steganography without embedding for image-to-image hiding[J]. Electronics, 2025, 14(21): 4270. doi: 10.3390/electronics14214270 URL
[8]	Wei Ping, Zhou Qing, Wang Zichi, et al. Generative steganography diffusion[EB/OL]. (2023-05-05)[2026-06-10]. https://arxiv.org/abs/2305.03472.
[9]	Peng Yinyin, Hu Donghui, Wang Yaofei, et al. StegaDDPM: generative image steganography based on denoising diffusion probabilistic model[C]// The 31st ACM International Conference on Multimedia. New York: ACM, 2023: 7143-7151.
[10]	Yu Jiwen, Zhang Xuanyu, Xu Youmin, et al. CRoSS: diffusion model makes controllable, robust and secure image steganography[C]// Advances in Neural Information Processing Systems. Red Hook: Curran Associates Inc., 2023: 80730-80743.
[11]	Rombach R, Blattmann A, Lorenz D, et al. High-resolution image synthesis with latent diffusion models[C]// The IEEE/CVF Conference on Computer Vision and Pattern Recognition. New York: IEEE, 2022: 10684-10695.
[12]	Zhang Lyumin, Rao Anyi, Agrawala M. Adding conditional control to text-to-image diffusion models[C]// The IEEE/CVF International Conference on Computer Vision. New York: IEEE, 2023: 3836-3847.
[13]	Hu E J, Shen Y, Wallis P, et al. LoRA: low-rank adaptation of large language models[EB/OL]. (2021-10-16)[2026-06-10]. https://openreview.net/forum?id=nZeVKeeFYf9.
[14]	Hu Xiaoxiao, Li Sheng, Ying Qichao, et al. Establishing robust generative image steganography via popular stable diffusion[J]. IEEE Transactions on Information Forensics and Security, 2024(19): 8094-8108.
[15]	Peng Yinyin, Wang Yaofei, Hu Donghui, et al. LDStega: practical and robust generative image steganography based on latent diffusion models[C]// The 32nd ACM International Conference on Multimedia. New York: ACM, 2024: 3001-3009.
[16]	Yang Yiwei, Liu Zheyuan, Jia Jun, et al. DiffStega: towards universal training-free coverless image steganography with diffusion models[C]// International Joint Conference on Artificial Intelligence. Jeju: IJCAI Organization, 2024: 1579-1587.
[17]	Xu Youmin, Zhang Xuanyu, Yu Jiwen, et al. diffusion-based hierarchical image steganography[C]// The 2025 IEEE International Conference on Multimedia and Expo. New York: IEEE, 2025: 1-6.
[18]	Kim D, Shin C, Choi J, et al. Diffusion-stego: training-free diffusion generative steganography via message projection[J]. Information Sciences, 2025(718): 122358.
[19]	Xu Zihao, Xu Dawei, Li Zihan, et al. MDDM: practical message-driven generative image steganography based on diffusion models[C]// The 42nd International Conference on Machine Learning. Vancouver: PMLR, 2025, 267: 69832-69848.
[20]	Yuan Chengsheng, Ji Zhaonan, Li Xinting, et al. DGADM-GIS: deterministic guided additive diffusion model for generative image steganography[J]. IEEE Transactions on Dependable and Secure Computing, 2025, 22(6): 5956-5969. doi: 10.1109/TDSC.2025.3578676 URL
[21]	Zhang Shengcai, Fu Junkai, Xue Junxiang, et al. Generative image steganography based on mapping-guided stable diffusion with enhanced robustness[J]. Journal of King Saud University-Computer and Information Sciences, 2026(38): 72.
[22]	Wu Tian, Hu Xuan, Liu Chunnian, et al. Controllable generative image steganography based on denoising diffusion implicit model[J]. Journal of King Saud University-Computer and Information Sciences, 2026(38): 60.
[23]	Han Jiajun, Ye Guodong, Han Sirui. An image steganography algorithm using selective timestep embedding and diffusion model[J]. Expert Systems with Applications, 2026(310): 131313.
[24]	Zhang Shengcai, Fu Junkai, An Dezhi. BUStega: a generalized coverless image steganography framework based on diffusion models and U2-Net[J]. Signal Processing, 2026(239): 110317.
[25]	Zhu Jihao, Chen Zixuan, Liu Jiali, et al. Rethinking security of diffusion-based generative steganography[J]. Information Sciences. 2026, 756: 123867. doi: 10.1016/j.ins.2026.123867 URL
[26]	Li Xiao, Chen Liquan, Fu Tong, et al. Coverless image steganography based on semantic-controlled text-to-image generation[J]. IEEE Transactions on Circuits and Systems for Video Technology, 2025, 35(8): 8391-8405. doi: 10.1109/TCSVT.2025.3545067 URL
[27]	Zhou Qing, Wei Ping, Qian Zhenxing, et al. Improved generative steganography based on diffusion model[J]. IEEE Transactions on Circuits and Systems for Video Technology, 2025, 35(7): 6494-6507. doi: 10.1109/TCSVT.2025.3539832 URL
[28]	Liu Yuhuan, Li Yujiang, Zhou Zhili, et al. Hidden space vector coding-based generative image steganography with diffusion model[J]. IEEE Transactions on Consumer Electronics, 2025, 71(4): 9662-9670. doi: 10.1109/TCE.2025.3616171 URL
[29]	Luo Peng, Liu Jia, Dang Qian, et al. Robust image steganography in online social networks via neural style transfer[J]. Mathematics, 2026, 14(4): 629. doi: 10.3390/math14040629 URL
[30]	Tan Yang, Xiang Xuyu, Qin Jiaohua, et al. Robust coverless image steganography against geometric attacks via deep unsupervised hashing[J]. IEEE Transactions on Dependable and Secure Computing, 2026, 23(2): 2458-2472. doi: 10.1109/TDSC.2025.3626810 URL
[31]	Zeng Kai, Chen Kejiang, Zhang Jiansong, et al. Toward secure and robust steganography for black-box generated images[J]. IEEE Transactions on Information Forensics and Security, 2024(19): 3237-3250.
[32]	Lin T Y, Maire M, Belongie S, et al. Microsoft COCO: common objects in context[C]// European Conference on Computer Vision. Heidelberg: Springer, 2014: 740-755.
[33]	Young P, Lai A, Hodosh M, et al. From image descriptions to visual denotations: new similarity metrics for semantic inference over event descriptions[J]. Transactions of the Association for Computational Linguistics, 2014(2): 67-78.
[34]	Schuhmann C, Beaumont R, Vencu R, et al. LAION-5B:an open large-scale dataset for training next generation image-text models[EB/OL]. (2022-10-16)[2026-06-10]. https://arxiv.org/abs/2210.08402.
[35]	Thomee B, Shamma D, Friedland G, et al. YFCC100M: the new data in multimedia research[J]. Communications of the ACM, 2016, 59(2): 64-73.
[36]	Liu Ziwei, Luo Ping, Wang Xiaogang, et al. Deep learning face attributes in the wild[C]// The IEEE International Conference on Computer Vision. New York: IEEE, 2015: 3730-3738.
[37]	Karras T, Laine S, Aila T. A Style-Based generator architecture for generative adversarial networks[C]// The IEEE/CVF Conference on Computer Vision and Pattern Recognition. New York: IEEE, 2019: 4401-4410.
[38]	Yu F, Seff A, Zhang Yinda, et al. LSUN: construction of a large-scale image dataset using deep learning with humans in the loop[EB/OL]. (2015-06-19)[2026-06-10]. https://arxiv.org/abs/1506.03365.
[39]	Zhou Bolei, Lapedriza A, Khosla A, et al. Places: a 10 million image database for scene recognition[J]. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2018, 40(6): 1452-1464. doi: 10.1109/TPAMI.2017.2723009 pmid: 28692961
[40]	Deng Jia, Dong Wei, Socher R, et al. ImageNet: a large-scale hierarchical image database[C]// The IEEE Conference on Computer Vision and Pattern Recognition. New York: IEEE, 2009: 248-255.
[41]	Huiskes M, Lew M. The mir flickr retrieval evaluation[C]// The 1st ACM International Conference on Multimedia Information Retrieval. New York: ACM, 2008: 39-43.
[42]	Chua T, Tang Jinhui, Hong Richang, et al. NUS-WIDE: a real-world web image database from national university of singapore[C]// The 8th ACM International Conference on Image and Video Retrieval. New York: ACM, 2009: 1-9.
[43]	Wang Zijie, Montoya E, Munechika D, et al. DiffusionDB: a large-scale prompt gallery dataset for text-to-image generative models[C]// The 61st Annual Meeting of the Association for Computational Linguistics. Toronto: ACL Linguistics, 2023: 893-911.
[44]	Zhu Mingjian, Chen Hanting, Yan Qiangyu, et al. GenImage: a million-scale benchmark for detecting AI-generated images[C]// Advances in Neural Information Processing Systems. Red Hook: Curran Associates Inc., 2023: 1-15.
[45]	Kadhim I, Premaratne P, Vial p, et al. Comprehensive survey of image steganography: techniques, evaluations, and trends in future research[J]. Neurocomputing, 2019(335): 299-326.
[46]	Fridrich J, Kodovsky J. Rich models for steganalysis of digital images[J]. IEEE Transactions on Information Forensics and Security, 2012, 7(3): 868-882. doi: 10.1109/TIFS.2012.2190402 URL
[47]	Boehm B. StegExpose: a tool for detecting LSB steganography[EB/OL]. (2014-10-24)[2026-06-10]. https://arxiv.org/abs/1410.6656, 2014.
[48]	Xu Guanshuo, Wu Hanzhou, Shi Yunqing. Structural design of convolutional neural network for steganalysis[C]// IEEE International Workshop on Information Forensics and Security. New York: IEEE, 2016: 1-6.
[49]	Ye Jian, Ni Jiangqun, Yi Yang. Deep learning hierarchical representations for image steganalysis[J]. IEEE Transactions on Information Forensics and Security, 2017, 12(11): 2545-2557. doi: 10.1109/TIFS.2017.2710946 URL
[50]	Wei Kangkang, Luo Weiqi, Tan Shunquan, et al. CTNet: a convolutional vision transformer network for color image steganalysis[J]. Journal of Computer Science and Technology, 2025, 40(2): 413-427. doi: 10.1007/s11390-023-3006-3
[51]	Yu Ning, Davis L S, Fritz M. Attributing fake images to GANs: learning and analyzing GAN fingerprints[C]// The IEEE/CVF International Conference on Computer Vision. New York: IEEE, 2019: 7556-7566.
[52]	Corvi R, Cozzolino D, Zingarini G, et al. On the detection of synthetic images generated by diffusion models[C]// IEEE International Conference on Acoustics, Speech and Signal Processing. New York: IEEE, 2023: 1-5.
[53]	Zhang Shengcai, Fu Junkai, Xue Junxiang, et al. A review of generative coverless image steganography based on diffusion models[J]. Neurocomputing, 2026(677): 133070.
[54]	You zhengxin, Ying Qichao, Li Sheng, et al. Image generation network for covert transmission in online social network[C]// The 30th ACM International Conference on Multimedia. New York: ACM, 2022: 2834-2842.
[55]	Vincent T, David Z, Tang Meng, et al. Latent space editing in transformer-based flow matching[C]// The AAAI Conference on Artificial Intelligence. Palo Alto: AAAI, 2024, 38(3): 2247-2255.
[56]	Guo Lin, Mao Yun. SDMStega: robust steganography based on stable diffusion model and spread spectrum technology[C]// The IEEE International Conference on Future Artificial Intelligence and Smart Technologies Applications. New York: IEEE, 2025: 1608-1613.
[57]	Peng Yinyin, Gu Chen, Hu Donghui, et al. Generative image steganography with minimum-distance guidance[J]. IEEE Transactions on Dependable and Secure Computing, 2026, 23(3): 5000-5014. doi: 10.1109/TDSC.2025.3650491 URL
[58]	Cheng Yu, Zhou Jiuan, Chen Jiawei, et al. RFNNS: robust fixed neural network steganography with universal text-to-image models[C]// The AAAI Conference on Artificial Intelligence. Palo Alto: AAAI, 2026, 40(5): 3318-3326.
[59]	Chen Liquan, Feng Bin, Xia Zhihua, et al. Robust generative steganography for image hiding using concatenated mappings[J]. IEEE Transactions on Information Forensics and Security, 2025(20): 5952-5965.
[60]	Zhang Qinghua, Huang Fangjun. Provably secure generative steganography based on adjustable orthogonal mapping[J]. IEEE Transactions on Dependable and Secure Computing, 2026, 23(1): 34-48. doi: 10.1109/TDSC.2025.3604222 URL

方法类别	基于GAN	基于FM	基于DM
主要载密位置	随机向量、生成器输入、隐层特征、解码器输出	可逆潜变量、频域编码、条件流潜空间	初始噪声、潜变量、DDIM轨迹、中间时间步、提示词/ 注意力
典型优势	推理快、结构直观、端到端训练	双向映射、恢复精确、分布可建模、速度较快	图像质量高、语义控制强、训练无关方案丰富
恢复机制	解码器恢复	正向流反演与信息解码	VAE编码、扩散反演与信息解码
模型假设	生成器可学习消息到图像映射	图像与潜变量之间近似可逆	潜空间/噪声空间可稳定反演
容量特点	可较高，但高载荷易产生伪影	高容量下需保持潜变量分布	容量灵活，但易影响噪声分布
图像质量	受训练稳定性影响	与FM表达能力相关	通常较高，语义可控性强
主要鲁棒性瓶颈	不可逆、训练不稳、高容量易伪影、OSN 后误码高	有损信道破坏严格可逆性，逆映射对压缩和缩放敏感	反演误差、采样开销、噪声分布偏移、提示词泄露、OSN 信道不稳定
代表方案	文献[2,3]方案	文献[4-6]方案	文献[10,16,18,19,22] 方案

数据类型	代表性数据集或来源	适用场景	主要评价作用
开放域自然图像与图文描述	文献[32,33] 方案	文生图隐写、开放域生成隐写、提示词驱动测试	评估语义一致性、生成多样性、开放场景下的秘密恢复能力
大规模图文对数据	文献[34,35] 方案	大规模提示词采样、开放域语义覆盖、社交媒体来源图像分析	扩展提示词和图像内容范围，检验方法在复杂开放域数据上的泛化能力
人脸域高质量图像	文献[36,37] 方案	人脸生成隐写、受限域生成、语义条件控制实验	评估高质量受限域图像中视觉质量、恢复稳定性和检测风险
场景与类别图像	文献[38,39,40]方案	场景条件生成、类别条件生成、受限域对比实验	评估特定类别或场景下的载密稳定性、图像质量和模型泛化能力
社交媒体风格图像	文献[41,42] 方案	OSN 有损传播测试、真实平台上传下载实验	评估压缩、缩放、格式转换、多轮重编码后鲁棒恢复能力
生成图像与提示词样本	文献[43,44]方案或 SD、GAN、Flow等黑盒文生图模型生成	生成式隐写、生成图像检测、黑盒生成图像场景	评估携密生成图像与普通生成图像之间的分布差异，以及噪声或潜空间检测风险

指标	类型	含义	评价作用
BER	鲁棒性	逐比特错误率	衡量基础恢复误差
BA/BRR	鲁棒性	比特级消息准确率/ 恢复率	直观反映平均恢复能力
EMR	鲁棒性	完整消息无误恢复比例	反映高容量通信可用性
PSR	鲁棒性	纠错和校验后的有效载荷成功比例	适用于含 ECC 的系统
名义容量	容量	理论可嵌入的信息量	衡量方法标称载荷
有效容量	容量	无失真下可正确恢复的容量	衡量实际可用载荷
鲁棒容量	容量	信道失真后仍可恢复的容量	衡量抗传播退化能力
安全容量	容量	检测风险可控下的容量	衡量安全可用载荷
鲁棒容量	容量	给定失真后可恢复容量	描述鲁棒条件下信道载荷的能力
AUC	安全性	安全检测ROC曲线下面积	衡量安全检测区分能力
Pe	安全性	安全检测出错概率	越接近 0.5 越安全
FPR	安全性	正常图被误判为载密图的比例	衡量误报风险
FNR	安全性	载密图被误判为正常图的比例	衡量逃避检测能力
EER	安全性	误报率与漏检率相等时的错误率	比较检测难度
F1-score	安全性	精确率与召回率的调和平均	综合衡量检测效果
MMD	安全性	两类特征分布差异	衡量潜空间偏移
Wasserstein 距离	安全性	两类分布整体距离	衡量噪声域偏移
PSNR	隐蔽性	像素保真度指标	图像重建质量
SSIM	隐蔽性	结构相似性指标	亮度、对比度和结构保持
LPIPS	隐蔽性	感知质量指标	深度特征层面的感知差异
FID	隐蔽性	生成质量/分布指标	生成图像与真实图像分布差异

安全检测层级	攻击者可见信息	典型检测工具	主要风险
图像域检测	最终图像	文献[46-50]工具	像素与纹理异常
生成图像检测	图像及生成痕迹	文献[51,52]工具	生成模型指纹
潜空间检测	潜变量或噪声表示	MMD、MLP、Transformer、文献[25] 工具	噪声分布偏移