# Quantum dissipative adaptation with cascaded photons

T. Ganascini 1 T. Werlang 1 D. Valente 1<EMAIL_ADDRESS>1 Instituto
de Física, Universidade Federal de Mato Grosso, Cuiabá, MT, Brazil

###### Abstract

Classical dissipative adaptation is a hypothetical non-equilibrium
thermodynamic principle of self-organization in driven matter, relating
transition probabilities with the non-equilibrium work performed by an
external drive on dissipative matter. Recently, the dissipative adaptation
hypothesis was extended to a quantum regime, with a theoretical model where
only one single-photon pulse drives each atom of an ensemble. Here, we further
generalize that quantum model by analytically showing that N cascaded single-
photon pulses driving each atom still fulfills a quantum dissipative
adaptation. Interestingly, we find that the level of self-organization
achieved with two pulses can be matched with a single effective pulse only up
to a threshold, above which the presence of more photons provide unparalleled
degrees of self-organization.

##  I Introduction

Finding nonequilibrium self-organization principles is a longstanding quest
prigogine ; anderson ; JCP2013 . The various behaviors of different
nonequilibrium dissipative systems may seem too diverse to obey one set of
principles. Yet, as physicists we have witnessed many times in history where
unified theories of seemingly distinct phenomena have come to light. For
instance, the Boltzmann distribution is a powerful principle relating the
energy and the probability distribution for any system at thermal equilibrium
with a weakly coupled reservoir. Inspired by that, as well as by living matter
JCP2013 , the principle of dissipative adaptation as a nonequilibrium version
of the Boltzmann distribution has been recently proposed and discussed
naturenano2015 ; PRL2017 ; ragazzon18 ; naturenano2020 . According to the
dissipative adaptation hypothesis, the transition probabilities between pairs
of states are most relevant when a dissipative system is driven far from
equilibrium, and the work performed by a given drive during the dynamical
transition between the initial and the final state can dominate the
probabilities with which these transitions occur.

To test whether the dissipative adaptation hypothesis is truly a general
principle, we should look for it also at the most elementary scales of nature,
where only few energy levels are present, temperatures are very low, and
quantum coherences as well as quantum fluctuations are significant. Indeed, a
quantum dissipative adaptation has been recently found in the case where the
source of work is a single-photon pulse, for which quantum fluctuations are
far more significant than the average field qda ; qsr . In its original
formulation, the quantum dissipative adaptation also depends on quantum
coherence. A quite counterintuitive effect emerges in that case, namely, the
highest average work performed by the photon does not correspond to the
highest probability of single-photon absorption. Finally, the quantum version
is valid at zero temperatures, a regime forbidden by its classical
counterpart. Yet, both the classical and the quantum scenarios have shown
evidence that work is a key thermodynamical quantity to bias the transition
probabilities of a fluctuating system, hence determining the degree of
stabilization (adaptation) to a given drive. The sketch of the quantum self-
organization described here can be seen in Fig.(1).

Here, we raise the question of how broadly applicable is the idea of a quantum
dissipative adaptation. In particular, we are interested in the cases where
quantum self-organization with a single photon is not ideal, i.e., when the
transition probability between two ground states of a $\Lambda$ atom is less
then unity after the single-photon pulse has gone away. Is it true that the
more energy is given (by means of more subsequent photon pulses arriving), the
more the system adapts, so the higher the degree of self-organization? That
would provide a significant analogy with living matter, where we also see the
increase of specialization in time provided enough resources. This adds to a
flourishing list of other analogies between living matter and dissipative
systems, such as self-replication science2010 ; JCP2013 ; qsr  and the
emergence of adaptive energy-seeking behavior kondepudi ; cp22 ; photonic
systems included scirep13 ; natphot . In this paper, we show that the relation
between the transition probability and the average work as found for a single
photon remains valid if $N$ consecutive pulses of arbitrary shapes reach every
atom in the ensemble. Moreover, we show under which conditions a “two-photon
environment” may improve the self-organization beyond any possible “single-
photon environment”. Our results represent a further step in the direction of
promoting the dissipative adaptation hypothesis to a general thermodynamic
principle of non-equilibrium self-organization.

Figure 1:  The quantum self-organization as discussed here. (a) Initially, at
time $t=0$, an ensemble of $\Lambda$ atoms are in a mixed state, either at the
ground state $|a\rangle$ (blue circles) or the ground state $|b\rangle$ (red
circles), at temperature $T=0$. Then, a nonequilibrium environment, composed
of single-photon pulses (at resonance $\omega_{L}=\omega_{a}$), starts driving
the atoms non-perturbatively. (b) Eventually, after a long time
$t\rightarrow\infty$, all the atoms transition to the self-organized (pure)
state $|b\rangle$ (red circles). Our goal in this paper is to understand the
dynamics and thermodynamics of the process where $N$ photons drive each atom.

##  II Model

We consider a global time-independent Hamiltonian of the system and its
environment,

$H=H_{S}+H_{I}+H_{E}.$ (1)

We model light-matter interaction via a dipole coupling, in the rotating-wave
approximation qda ; chen2004 ; dvnjp ; dv2012 ; nonmarkov ; OL2018 ,

$H_{I}=-i\hbar\sum_{\omega}(g_{a}a_{\omega}\sigma_{a}^{\dagger}+g_{b}b_{\omega}\sigma_{b}^{\dagger}-\mbox{H.c.}),$
(2)

where $\sigma_{k}=|k\rangle\langle e|$ (for $k=a,b$) and H.c. is the Hermitian
conjugate. Orthogonal polarization modes $\left\\{a_{\omega}\right\\}$ and
$\left\\{b_{\omega}\right\\}$ respectively interact with transitions
$|a\rangle$ to $|e\rangle$ and $|b\rangle$ to $|e\rangle$. This is a multi-
mode Jaynes-Cummings model, and our interest is in the limit of a broadband
continuum of frequencies,

$\sum_{\omega}\rightarrow\int d\omega\varrho_{\omega}\approx\varrho\int
d\omega,$ (3)

where we have defined a constant density of modes
$\varrho_{\omega}\approx\varrho$. Physically, this means that there is no
frequency filter in our idealized environment. The continuum of frequencies
allows us to employ a Wigner-Weisskopf approximation to obtain dissipation
rates $\Gamma_{a}=2\pi g_{a}^{2}\varrho$ and $\Gamma_{b}=2\pi
g_{b}^{2}\varrho$. The environment Hamiltonian reads

$H_{E}=\sum_{\omega}\hbar\omega(a_{\omega}^{\dagger}a_{\omega}+b_{\omega}^{\dagger}b_{\omega}).$
(4)

The system is described by a three-level Hamiltonian, with states named
$|a\rangle$, $|b\rangle$, and $|e\rangle$, so that

$H_{S}=\hbar\omega_{a}|e\rangle\langle e|+\hbar\delta_{ab}|b\rangle\langle
b|.$ (5)

Most importantly, when in $\Lambda$ configuration, these energy levels provide
an elementary energy barrier (the excited state $|e\rangle$) separating two
highly stable states (the two ground states $|a\rangle$ and $|b\rangle$). The
energy difference between states $|b\rangle$ and $|a\rangle$, given by
$\hbar\delta_{ab}=\hbar(\omega_{a}-\omega_{b})$, although relevant for thermal
equilibrium considerations, does not affect our results as far as
nonequilibrium effects are concerned.

##  III Results

###  III.1 Revisiting the single-photon wavepacket scenario

In Ref.qda , the initial state of the field has been considered as a single-
photon pulse added to a zero-temperature environment, namely,

$|1_{a}\rangle=\sum_{\omega}\phi_{\omega}^{a}(0)\
a_{\omega}^{\dagger}|0\rangle,$ (6)

where
$|0\rangle=\prod_{\omega}|0_{\omega}^{a}\rangle\otimes|0_{\omega}^{b}\rangle$
is the vacuum state of all the field modes. Note that the polarization is
fixed as that of the $a_{\omega}$ modes, thus imposing an environmental
condition to which the atom is expected to adapt. The level of adaptation will
depend on the pulse shape, $\phi_{\omega}^{a}(0)$, which admits a spatial
dependent representation,

$\phi_{a}(z,t)=\sum_{\omega}\phi_{\omega}^{a}(t)e^{ik_{\omega}z}.$ (7)

For simplicity, our electromagnetic environment is one-dimensional in space,
explaining why only coordinate $z$ appears. Also, the modes propagate towards
the positive direction, with a dispersion relation in the form
$k_{\omega}=\omega/c$. This idealized model closely approximates the
experimental scenario known as waveguide quantum electrodynamics (waveguide-
QED) lodahl ; nori . If the photon is prepared by means of the spontaneous
emission of a distant source atom (not shown in the model), then we would have
that

$\phi_{a}(z,0)=N\Theta(-z)\exp[(\Delta/2+i\omega_{L})z/c],$ (8)

where $\Delta$ is the linewidth of the pulse (the lifetime of the atomic
source), and $\omega_{L}$ is the central frequency of the photon (the
transition frequency of the atomic source). The size of the pulse in space is
characterized by $c\Delta^{-1}$, in this case.

The key quantities analyzed in the context of dissipative adaptation are
transition probabilities and their relations with the absorbed work from an
external drive. In the quantum case, we are especially interested in the
transition probability from $|a\rangle$ to $|b\rangle$,

$p_{a\rightarrow b}(t)\equiv\langle
b|\mbox{tr}_{E}\left[U|a,1_{a}\rangle\langle
a,1_{a}|U^{\dagger}\right]|b\rangle,$ (9)

where $U=\exp(-iHt/\hbar)$, and $H$ is the global Hamiltonian in Eq.(1), and
$\mbox{tr}_{E}$ is the partial trace over the field modes. Taking advantage of
the number conservation in the rotating-wave approximation, we restrict our
model to the single-excitation subspace, parametrized by
$U|a,1_{a}\rangle=\psi(t)|e,0\rangle+\sum_{\omega}\phi_{\omega}^{a}(t)a_{\omega}^{\dagger}|a,0\rangle+\phi_{\omega}^{b}(t)b_{\omega}^{\dagger}|b,0\rangle$.
We now have that

$\displaystyle p_{a\rightarrow b}(t)$ $\displaystyle=$
$\displaystyle\sum_{\omega}|\phi_{\omega}^{b}(t)|^{2}$ (10) $\displaystyle=$
$\displaystyle(2\pi\varrho
c)^{-1}\int_{-\infty}^{\infty}dz|\phi_{b}(z,t)|^{2}.$

To obtain the probability amplitude of the field, we make a Wigner-Weisskopf
approximation, thus obtaining that

$\displaystyle\phi_{b}(z,t)$
$\displaystyle=\phi_{b}(z-ct,0)e^{-i\delta_{ab}t}$
$\displaystyle+\sqrt{2\pi\varrho\Gamma_{b}}\Theta(z)\Theta(t-z/c)\psi(t-z/c)e^{-i\delta_{ab}z/c},$
(11)

where $\Theta(z)$ is the Heaviside step function. This expression evidences
the superposition of the freely propagating driving field with that emitted by
the atom. Because the incoming pulse is fixed to the $a_{\omega}$ modes, we
have that $\phi_{b}(z-ct,0)=0$. By using Eqs.(11) and (10), we find that

$p_{a\rightarrow
b}(t)=\Gamma_{b}\int_{0}^{t}dt^{\prime}|\psi(t^{\prime})|^{2},$ (12)

after an appropriate change of variables. The meaning of Eq.(12) is that, for
the system to get to state $|b\rangle$ departing from $|a\rangle$, the entire
history of the excitation amplitude from time $0$ to $t$ matters.

We can think of two options for maximizing that integration: (1) by increasing
the excitation of the atom (making $|\psi(t)|$ as large as possible); or (2)
by increasing the time duration of the pulse (without necessarily exciting the
atom too much, $|\psi(t)|\ll 1$).

To test options (1) and (2) above, we have to solve for the excitation
amplitude. Employing once again the Wigner-Weisskopf approximation, we have
that

$\partial_{t}\psi(t)=-\left(\frac{\Gamma_{a}+\Gamma_{b}}{2}+i\omega_{a}\right)\psi(t)-g_{a}\phi_{a}(-ct,0).$
(13)

For $\psi(0)=0$, this gives us

$\psi(t)=-g_{a}\int_{0}^{t}\phi_{a}(-ct^{\prime},0)e^{-\left(\frac{\Gamma_{a}+\Gamma_{b}}{2}+i\omega_{a}\right)(t-t^{\prime})}dt^{\prime},$
(14)

which provides a generic solution.

For the sake of definiteness, let us take the exponential profile from Eq.(8),
which gives

$\psi(t)=-Ae^{-\left(\frac{\Gamma_{a}+\Gamma_{b}}{2}+i\omega_{a}\right)t}\left[e^{\left(\frac{\Gamma_{a}+\Gamma_{b}-\Delta}{2}-i\delta_{L}\right)t}-1\right],$
(15)

where

$A\equiv\frac{\sqrt{\Gamma_{a}\Delta}}{\frac{\Gamma_{a}+\Gamma_{b}-\Delta}{2}-i\delta_{L}},$
(16)

with $\delta_{L}\equiv\omega_{L}-\omega_{a}$. The resonance condition,
$\delta_{L}=0$, is necessary to maximize $|\psi(t)|$.

Now the relevant degree of freedom is the size of the pulse, $\Delta^{-1}$,
given fixed $\Gamma_{a}$ and $\Gamma_{b}$. If $\Delta^{-1}\rightarrow\infty$,
the pulse is very long and the excitation is arbitrarily small,
$|\psi(t)|^{2}\propto\Delta\rightarrow 0$, as discussed in option (2). If
$\Delta^{-1}\rightarrow 0$, the pulse is arbitrarily short, also making the
excitation probability to vanish, $|\psi(t)|^{2}\propto\Delta^{-1}\rightarrow
0$. This is the worst case scenario, since both the size and the duration of
the atomic excitation are negligible. For intermediate pulse sizes,
$\Delta\sim\Gamma_{a}\sim\Gamma_{b}$, we find from Eq.(15) that

$|\psi(t)|\leq
2\sqrt{\frac{\Gamma_{a}}{\Gamma}}\left(\frac{\Delta}{\Gamma}\right)^{-\frac{1}{2}\frac{\Delta+\Gamma}{\Delta-\Gamma}},$
(17)

where we have defined $\Gamma=\Gamma_{a}+\Gamma_{b}$. The excitation
probability is therefore maximized at $\Delta=\Gamma$, when the duration of
the pulse is equal to the atomic lifetime. This is the scenario of option (1).

By substituting Eq.(15) into (12), we find that

$p_{a\rightarrow
b}(\infty)=\frac{4\Gamma_{a}\Gamma_{b}}{\Gamma(\Gamma+\Delta)}.$ (18)

This clearly shows that option (2) is the correct one. That is, the transition
probability is maximized when the duration of the pulse is maximal
($\Delta/\Gamma\rightarrow 0$), even though the excitation probability is
vanishingly small in that same situation. This is a signature of the
beneficial effect of quantum coherence in this process. However, this raises
the question: if the excitation is negligible, is the work transferred from
the photon to the atom also negligible, therefore violating the classical
dissipative adaptation hypothesis?

To answer that question, we have to define the work performed by the single-
photon drive. Classically, the work of a time-varying classical electric field
$E(t)$ acting on a classical dipole $D(t)=qx(t)$, is given by $W=\int
F\dot{x}\ dt=\int qE\dot{x}\ dt=\int\dot{D}E\ dt$. Here, we define the average
work performed by a single-photon pulse on a quantum dipole by employing the
Heisenberg picture,

$\langle
W\rangle=\int_{0}^{\infty}\langle\left(\partial_{t}D(t)\right)E_{\mathrm{in}}(t)\rangle\
dt,$ (19)

where $E_{\mathrm{in}}(t)=\sum_{\omega}i\epsilon_{\omega}a_{\omega}e^{-i\omega
t}+\mbox{h.c.}$ is the incoming field. The field produced by the atom that
acts back on the atom itself gives rise to heat dissipation in our model. The
dipole operator is given by $D(t)=U^{\dagger}DU$, with $D=\sum
D_{ea}\sigma_{a}+\mbox{h.c.}$, so that $\hbar
g_{a}=D_{ea}\epsilon_{\omega_{a}}$.

Using integration by parts, we can rewrite Eq.(19) as $\langle
W\rangle=-\int_{0}^{\infty}\langle D(t)\partial_{t}E_{\mathrm{in}}(t)\rangle
dt$. Within the rotating-wave approximation, this gives us that

$\displaystyle\langle W\rangle=-\int_{0}^{\infty}dt\ $
$\displaystyle(i\hbar)\sum_{\omega}(-i\omega)g_{a}\langle\sigma_{a}^{\dagger}(t)a_{\omega}\rangle
e^{-i\omega t}$
$\displaystyle+(-i\omega)g_{b}\langle\sigma_{b}^{\dagger}(t)b_{\omega}\rangle
e^{-i\omega t}$ $\displaystyle+\mbox{c.c.},$ (20)

where c.c stands for complex conjugate. Choosing $|1_{a}\rangle$ as the
initial state of the field implies that
$\langle\sigma_{b}^{\dagger}(t)b_{\omega}\rangle=0$. The non-zero correlation
function is

$\displaystyle\langle\sigma_{a}^{\dagger}(t)a_{\omega}\rangle$
$\displaystyle=\langle
U^{\dagger}\sigma_{a}^{\dagger}Ua_{\omega}|a,1_{a}\rangle$ (21)
$\displaystyle=\langle
U^{\dagger}\sigma_{a}^{\dagger}U\phi_{\omega}(0)|a,0\rangle$ (22)
$\displaystyle=\phi_{\omega}(0)\langle a,1_{a}|U^{\dagger}|e,0\rangle$ (23)
$\displaystyle=\phi_{\omega}(0)\psi^{*}(t).$ (24)

We thus get that,

$\langle W\rangle=-\hbar
g_{a}\int_{0}^{\infty}dt\psi^{*}(t)i\partial_{t}\phi_{a}(-ct,0)+\mbox{c.c.}.$
(25)

For a pulse of central frequency $\omega_{L}$ and general envelope shape, we
define $\phi_{a}(-ct,0)=\phi_{a}^{env}(-ct,0)\exp(-i\omega_{L}t)$. The
derivative of the fast oscillating part gives rise to

$\langle W\rangle=\hbar\omega_{L}\int_{0}^{\infty}dt\
(-2g_{a}\mbox{Re}[\psi^{*}(t)\phi_{a}(-ct,0)]).$ (26)

The derivative of the slowly varying part is related with
$\mbox{Im}[\psi^{*}(t)\exp(-i\omega_{L}t)]$, since
$\partial_{t}\phi_{a}^{env}(t)$ is real. From Eq.(14), it follows that
$\mbox{Im}[\psi^{*}(t)\exp(-i\omega_{L}t)]=0$ if $\delta_{L}=0$. This shows
that, at resonance, only the absorptive contribution remains, while the
dispersive (reactive) contribution vanishes.

From Eq.(13), we can derive the dynamics of the excited-state population
$|\psi(t)|^{2}$,

$\partial_{t}|\psi(t)|^{2}=-\Gamma|\psi(t)|^{2}-2g_{a}\mbox{Re}[\psi^{*}(t)\phi_{a}(-ct,0)].$
(27)

Substituting it back in Eq.(26), gives us that

$\langle W\rangle=\hbar\omega_{L}\int_{0}^{\infty}\Gamma|\psi(t)|^{2}dt,$ (28)

where we have used that $|\psi(0)|^{2}=|\psi(\infty)|^{2}=0$. By comparing
Eqs.(28) and (12), we immediately see that

$p_{a\rightarrow b}(\infty)=\frac{\Gamma_{b}}{\Gamma}\ \frac{\langle
W\rangle}{\hbar\omega_{L}},$ (29)

which is the quantum dissipative adaptation relation for a generic single-
photon pulse (not restricted to the exponential profile). This result answers
to the question we have raised above by showing that, even though the
excitation probability is negligible in the highly monochromatic case, the
transferred work is maximized in that regime along with the transition
probability from $|a\rangle$ to $|b\rangle$.

###  III.2 Quantum dissipative adaptation for cascaded photons

By cascaded interactions, we mean that consecutive non-overlapping and
uncorrelated single-photon pulses are driving the atom. Under this assumption,
we have that, either the first photon promotes the transition, or it leaves
the atom unaltered and the second photon enables the transition, and so on.
Asymptotically ($t\rightarrow\infty$), the total probability transition
$p^{(T,N)}_{a\rightarrow b}$ after $N$ pulses have driven the atom is given by

$p^{(T,N)}_{a\rightarrow
b}=\sum_{k=1}^{N}\prod_{j=1}^{k-1}p^{(j)}_{a\rightarrow
a}p^{(k)}_{a\rightarrow b}.$ (30)

Here, $p^{(j)}_{a\rightarrow a}=1-p^{(j)}_{a\rightarrow b}$ is the probability
that the atom remains in state $|a\rangle$ during the interaction with the
$j$-th pulse, and $p^{(k)}_{a\rightarrow b}$ is the transition probability due
to the $k$-th photon. The degrees of freedom considered in this model are the
linewidths $\left\\{\Delta_{k}\right\\}$ of the $N$ photon pulses.

The average work in this cascaded process is additive,

$\langle W^{(N)}\rangle=\sum_{k=1}^{N}\langle W\rangle_{k},$ (31)

where $\langle W\rangle_{k}$ is the average work performed by the $k$-th
photon of linewidth $\Delta_{k}$. The average work performed by the $k$-th
photon is given by

$\langle W\rangle_{k}=p^{(k-1)}_{a}\langle
W\rangle_{a}^{(k)}+p^{(k-1)}_{b}\langle W\rangle_{b}^{(k)},$ (32)

which depends on the probability $p^{(k-1)}_{i}$ that the previous photon has
left the atom in state $|i\rangle$. Also, we have defined $\langle
W\rangle_{a}^{(k)}$ to evidence that the initial state of the system for which
the work is being computed is $|a,1_{a}\rangle$, and $|b,1_{a}\rangle$ for
$\langle W\rangle_{b}^{(k)}$. That is, all the photons are initially equally
polarized, only the atom may be in a different state. We thus find that
$\langle W\rangle_{b}^{(k)}=0$ for all $k$, implying that

$\langle W^{(N)}\rangle=\sum_{k=1}^{N}p^{(k-1)}_{a}\langle
W\rangle_{a}^{(k)}.$ (33)

Because there is no physical mechanism in our model that makes the atom jump
back from $|b\rangle$ to $|a\rangle$ (due to the zero temperature), the only
possible path for it to be found at $|a\rangle$ is that where the atom has
never left state $|a\rangle$ throughout its entire history. This means that
$p^{(k-1)}_{a}$ is a product of the probabilities that all the previous
photons have also left the atom at $|a\rangle$, so that

$\langle
W^{(N)}\rangle=\sum_{k=1}^{N}\left(\prod_{j=1}^{k-1}p^{(j)}_{a\rightarrow
a}\right)\langle W\rangle_{a}^{(k)}.$ (34)

Using the quantum dissipative adaptation relation for each single photon,
namely, $\langle W\rangle_{a}^{(k)}=p_{a\rightarrow
b}^{(k)}\hbar\omega_{L}\Gamma/\Gamma_{b}$, we have that

$\langle
W^{(N)}\rangle=\left(\sum_{k=1}^{N}\prod_{j=1}^{k-1}p^{(j)}_{a\rightarrow
a}p_{a\rightarrow b}^{(k)}\right)\hbar\omega_{L}\Gamma/\Gamma_{b}.$ (35)

By employing Eq.(30), we finally find that

$p^{(T,N)}_{a\rightarrow b}=\frac{\Gamma_{b}}{\Gamma}\frac{\langle
W^{(N)}\rangle}{\hbar\omega_{L}},$ (36)

showing that the quantum dissipative adaptation remains valid for $N$ cascaded
photons of arbitrary shapes.

###  III.3 Long versus short pulses

Is it true that two pulses always increase the degree of organization of the
atom? Or can we find a single photon long enough to produce an equivalent
result? With these questions in mind, we take a closer look at the $N=2$ case.

To answer that question, we analyze

$\displaystyle p^{(T,2)}_{a\rightarrow b}$
$\displaystyle=p^{(1)}_{a\rightarrow a}p^{(2)}_{a\rightarrow
b}+p^{(1)}_{a\rightarrow b},$ $\displaystyle=(1-p^{(1)}_{a\rightarrow
b})p^{(2)}_{a\rightarrow b}+p^{(1)}_{a\rightarrow b}.$ (37)

We assume from here on that our photons have exponential envelope profiles, as
described by Eq.(8), with two generally distinct linewidths $\Delta_{1}$ and
$\Delta_{2}$. Thus Eq.(18) is valid, and we have that

$p^{(k)}_{a\rightarrow b}=\frac{r}{1+\Delta_{k}/\Gamma},$ (38)

where $r=4\Gamma_{a}\Gamma_{b}/\Gamma^{2}$, and
$\Gamma=\Gamma_{a}+\Gamma_{b}$.

Let us take the limit of two pulses that are both very short in time and space
(i.e., highly broadband), $\Delta_{1}\gg\Gamma$ and $\Delta_{2}\gg\Gamma$. In
that case,

$p^{(k)}_{a\rightarrow b}\approx r\Gamma\tau_{k}\ll 1,$ (39)

where $\tau_{k}=\Delta_{k}^{-1}$ is the typical time duration of the pulse.
The total probability now reads

$p^{(T,2)}_{a\rightarrow b}\approx
r\Gamma(\tau_{1}+\tau_{2})=r\Gamma\tau_{\mathrm{eff}}\approx
p^{(1)}_{a\rightarrow b}|_{\tau_{\mathrm{eff}}},$ (40)

where we have neglected the second-order term
$\mathcal{O}[\Gamma^{2}\tau_{1}\tau_{2}]$. This shows that two short pulses
are indeed equivalent to a single longer pulse with effective time duration
given by the sum of the individual pulses,
$\tau_{\mathrm{eff}}=\tau_{1}+\tau_{2}$, as we could intuitively expect.

We now consider the the opposite limit, namely, two very long pulses in time
(highly monochromatic), $\Delta_{1}\ll\Gamma$ and $\Delta_{2}\ll\Gamma$. We
have that

$p^{(k)}_{a\rightarrow b}\approx r,$ (41)

which does not depend on $\Delta_{k}$. Hence,

$p^{(T,2)}_{a\rightarrow b}\approx(1-r)r+r,$ (42)

where the parameter $r$ is bounded to
$r=4\Gamma_{a}\Gamma_{b}/(\Gamma_{a}+\Gamma_{b})^{2}\leq 1$.

Depending on $r$, we find two possible scenarios. If the two decay rates are
identical ($\Gamma_{a}=\Gamma_{b}$, thus $r=1$), we have that
$p^{(T,2)}_{a\rightarrow b}=r=p^{(T,1)}_{a\rightarrow b}$. This shows that two
pulses can be replaced by a single one again, as in the case of two short
pulses. However, in the far more typical case where
$\Gamma_{a}\neq\Gamma_{b}$, we have that $r<1$, so that

$p^{(T,2)}_{a\rightarrow b}>r=p^{(T,1)}_{a\rightarrow b}.$ (43)

We see that a single long pulse saturates the transition probability to a
value below unity ($p^{(1)}_{a\rightarrow b}=r<1$), and the addition of a
second pulse is the only way to improve driven self-organization.

For $0<r<1$, and considering $N>2$ photons of arbitrary linewidths, we have
that

$\displaystyle p^{(T,N)}_{a\rightarrow b}$
$\displaystyle=\frac{r}{1+\Delta_{1}/\Gamma}+\sum_{k=2}^{N}\prod_{j=1}^{k-1}\left(1-\frac{r}{1+\Delta_{j}/\Gamma}\right)\frac{r}{1+\Delta_{k}/\Gamma}$
$\displaystyle>\frac{r}{1+\Delta_{1}/\Gamma},$ (44)

which means that the degree of self-organization only increases with $N$.

Note that $p^{(T,N)}_{a\rightarrow b}\leq 1$ for $N\rightarrow\infty$, as we
can see by taking the extreme limit where all the photons are highly
monochromatic, thus maximally increasing the transition probability. In that
case, $\Delta_{k}/\Gamma\rightarrow 0$ for all $k$, so that

$\displaystyle p^{(T,N)}_{a\rightarrow b}$ $\displaystyle\approx
r+r\sum_{k=1}^{N-1}(1-r)^{k}$ $\displaystyle=r+r\left((1-r)\
\frac{1-(1-r)^{N-1}}{r}\right)$ $\displaystyle=1-(1-r)^{N}$ $\displaystyle\leq
1.$ (45)

We have used that, in the geometric series,
$\sum_{n=1}^{M}a_{1}q^{n-1}=a_{1}(1-q^{M})/(1-q)$, with $a_{1}=q=1-r$, and
$M=N-1$. So the series in our quantum model of $N$ cascaded photons converges,
as it should.

##  IV Conclusions

We have investigated the validity of the dissipative adaptation in a quantum
model where each $\Lambda$ atom in an ensemble is driven by a cascaded
sequence of $N$ single-photon pulses. We have found that, the more energy the
atoms are given, the more organized they become, as reminiscent of the
evolutionary dynamics of living systems. Our model generalizes the previous
ones where the quantum dissipative adaptation has been found, namely, its
original proposal in Ref.qda , as well as its applications in the self-
replication of quantum artificial organisms qsr , and the emergence of energy-
seeking and energy-avoiding in classically-driven dissipative few-level
quantum systems cp22 . We have also found that, in the typical case where the
atom has unequal decay rates, the level of organization achieved with two
pulses matches that with a single one, provided the pair of photons are short
enough; otherwise, the presence of multiple photons becomes a resource to
raise the degree of self-organization.

As a perspective, we plan to study the case where the two pulses overlap. This
could lead to irreversible stimulated emissions, as shown in Ref.dvnjp ,
eventually forcing the atom to go back to its initial state $|a\rangle$,
thereby reducing the chances of self-organization to happen. Understanding not
only whether this is the case, but also how to compute work in that more
complex scenario, as well as further testing the quantum dissipative
adaptation hypothesis, are challenging and timely questions.

###### Acknowledgements.

This work was supported by CNPq (Universal 402074/2023-8, and INCT-IQ
465469/2014-0), Brazil. T.G. was supported by CAPES.

## References

  * (1) I. Prigogine, and G. Nicolis, Biological order, structure and instabilities. Quart. Rev. Biophys. 4, 107-148 (1971).
  * (2) P. W. Anderson, Suggested model for prebiotic evolution: the use of chaos. Proc. Natl. Acad. Sci. USA 80, 3386-3390 (1983).
  * (3) J. L. England, Statistical physics of self-replication. J. Chem. Phys. 139, 121923 (2013).
  * (4) J. L. England, Dissipative adaptation in driven self-assembly. Nature Nanotech. 10, 919-923 (2015).
  * (5) T. Kachman, J. A. Owen, and J. L. England, Self-organized resonance during search of a diverse chemical space. Phys. Rev. Lett. 119, 038001 (2017).
  * (6) G. Ragazzon, and L. J. Prins, Energy consumption in chemical fuel-driven self-assembly. Nature Nanotech. 13, 882-889 (2018).
  * (7) E. te Brinke, et al. Dissipative adaptation in driven self-assembly leading to self-dividing fibrils. Nature Nanotech. 13, 849-855 (2020).
  * (8) D. Valente, F. Brito, and T. Werlang, Quantum dissipative adaptation. Comm. Phys. 4, 11 (2021).
  * (9) D. Valente, Self-replication of a quantum artificial organism driven by single-photon pulses. Sci. Rep. 11, 16433 (2021)
  * (10) J. M. A. Carnall, et al. Mechanosensitive self-replication driven by self-organization. Science 327, 1502-1506 (2010).
  * (11) D. Kondepudi, B. Kay, and J. Dixon, End-directed evolution and the emergence of energy-seeking behaviour in a complex system. Phys. Rev. E 91, 050902(R) (2015).
  * (12) T. Werlang, M. Matos, F. Brito, and D. Valente, Emergence of energy-avoiding and energy-seeking behaviors in nonequilibrium dissipative quantum systems. Comm. Phys. 5, 7 (2022).
  * (13) S. Ito et al., Selective optical assembly of highly uniform nanoparticles by doughnut-shaped beams. Sci. Rep. 3, 3047 (2013).
  * (14) C. Ropp, N. Bachelard, D. Barth, Y. Wang, and X. Zhang, Dissipative self-organization in optical space. Nat. Photon. 12, 739 (2018).
  * (15) T. W. Chen, C. K. Law, and P .T. Leung, Single-photon scattering and quantum-state transformations in cavity QED. Phys. Rev. A 69, 063810 (2004).
  * (16) D. Valente et. al., Optimal irreversible stimulated emission. New J. Phys. 14, 083029 (2012).
  * (17) D. Valente, et al. Universal optimal broadband photon cloning and entanglement creation in one-dimensional atoms. Phys. Rev. A 86, 022333 (2012).
  * (18) D. Valente, M. F. Z. Arruda, and T. Werlang, Non-Markovianity induced by a single-photon wave packet in a one-dimensional waveguide. Opt. Lett. 41, 3126-3129 (2016).
  * (19) D. Valente, F. Brito, R. Ferreira, and T. Werlang, Work on a quantum dipole by a single-photon pulse. Opt. Lett. 43, 2644-2647 (2018).
  * (20) P. Lodahl, S. Mahmoodian, and S. Stobbe. Interfacing single photons and single quantum dots with photonic nanostructures. Rev. Mod. Phys. 87, 347 (2015).
  * (21) X. Gu., et al. Microwave photonics with superconducting quantum circuits. Phys. Rep. 718, 1-102 (2017).


# Diffusion-Based Hierarchical Image Steganography

Youmin Xu1,2, Xuanyu Zhang1,3, Jiwen Yu1, Chong Mou1, Xiandong Meng2, Jian
Zhang1,3
1School of Electronic and Computer Engineering, Peking University
2Peng Cheng Laboratory
3Peking University Shenzhen Graduate School-Rabbitpre AIGC Joint Research
Laboratory

###### Abstract.

This paper introduces Hierarchical Image Steganography (HIS), a novel method
that enhances the security and capacity of embedding multiple images into a
single container using diffusion models. HIS assigns varying levels of
robustness to images based on their importance, ensuring enhanced protection
against manipulation. It adeptly exploits the robustness of the Diffusion
Model alongside the reversibility of the Flow Model. The integration of Embed-
Flow and Enhance-Flow improves embedding efficiency and image recovery
quality, respectively, setting HIS apart from conventional multi-image
steganography techniques. This innovative structure can autonomously generate
a container image, thereby securely and efficiently concealing multiple images
and text. Rigorous subjective and objective evaluations underscore HIS’s
advantage in analytical resistance, robustness, and capacity, illustrating its
expansive applicability in content safeguarding and privacy fortification.

Secret Communication, Large-Capacity Steganography, Watermarking, Diffusion
Models

††copyright: none††ccs: Computing methodologies Computer vision Figure 1.
Workflow and results of (a)proposed HIS and (b)former DeepMIH (Guan et al.,
2022): HIS hides more important $\mathbf{x}_{s-Tier1}$ and less important
$\mathbf{x}_{s-Tier2}$ into a generated container $\mathbf{y}_{c-Add}$.
Compared to $\mathbf{x}^{\prime}_{s-Tier2}$, $\mathbf{x}^{\prime}_{s-Tier1}$
can be more robustly recovered from distorted $\mathbf{y}^{\prime}_{c-Add}$ by
the receiver. Multiple Image Steganography (Guan et al., 2022) usually treats
every secret image with the same priority and ignores the robustness,
resulting in the worse reconstruction over all images under distortion. (c)
presents more results of revealed secret images by HIS and (Guan et al.,
2022).

##  1\. Introduction

Figure 2. Framework of our diffusion-based Hierarchical Image Steganography
(HIS), which takes $\mathbf{x}_{s-Tier1}$ and multiple $\mathbf{x}_{s-Tier2}$
as input to produced $\mathbf{y}_{c-Add}$ as container. Inversely,
$\mathbf{x}^{\prime}_{s-Tier1}$ is recovered via Enhance-Flow and
$\mathbf{x}^{\prime}_{s-Tier2}$ is recovered via Embed-Flow from container.

Steganography is a widely studied topic (Baluja, 2017, 2019), which aims to
hide messages like audio, image, and text into one container image in an
undetected manner. In its reverse process, it is only possible for the
receivers with a correct revealing network to reconstruct secret information
from the container, which is visually identical to the host. For image
steganography, traditional methods often use adaptive encoding according to
distortion cost designed by human or neural networks (Baluja, 2017, 2019; Jing
et al., 2021), which require rules and knowledge.

In the realm of image steganography, there are four primary objectives to
consider: payload capacity, undetectability, integrity, and robustness.
Steganalysis methodologies typically differentiate between the host and
standard images using attributes like color, frequency, and other distinctive
features. It’s thus imperative that the concealed image is embedded within the
unseen spectrum of the host image. Since the earlier steganography methods
stress capacity and invisibility rather than robustness and ignore the noise
and compression interference in practice, they are usually sensitive to
distortion during the transmission of the container.

Traditional approaches to Multiple Image Steganography(Xu et al., 2022; Lu et
al., 2021), or to say Multiple Image Hiding(Guan et al., 2022), involve
embedding multiple images into a single container image without
differentiating the importance of each image. Consequently, if the container
image is degraded, all embedded information risks being lost. Recognizing the
practical necessity in real-world applications, some images demand higher
robustness to maintain integrity post-degradation, while others may tolerate
some compromise. To address this, we introduce the concept of Hierarchical
Steganography, which tailors embedding robustness according to the importance
of the secret content. This tailored scheme represents an adaptive innovation
in the field of steganography.

Guided by this novel design philosophy, we propose the Diffusion-Based
Hierarchical Image Steganography (HIS), advancing beyond existing methods by
robustness, security and capacity. It implements a tiered embedding strategy
that effectively manages the robustness of various images embedded within a
single, model-generated container. Recently, diffusion models have been widely
used in various image applications, including image generation (Dhariwal and
Nichol, 2021; Ramesh et al., 2022; Saharia et al., 2022a; Rombach et al.,
2022), restoration (Saharia et al., 2022b; Kawar et al., 2022; Wang et al.,
2023), translation (Choi et al., 2021; Kim et al., 2022; Meng et al., 2022;
Zhao et al., 2022), and more. HIS incoporates the diffusion model as the core
of generation from secret images to container image. In Fig.1, HIS
differentiates itself by embedding images according to their importance:
Tier-1 images are embedded with the highest robustness to ensure their
integrity against distortions, while Tier-2 images are embedded with lower
robustness. This novel strategy not only maximizes the embedding capacity of
the container image but also introduces a dynamic content prioritization
mechanism that can be tailored according to specific security requirements.

The main contributions are summarized as follows:

  * •

By recognizing the need to assign different levels of robustness based on the
importance of content, the scheme of Hierarchical Steganography innovatively
addresses the limitations of traditional multi-image steganography.

  * •

We propose diffusion-based Hierarchical Image Steganography (HIS), which hides
large-capacity images within undetectable containers as substitute and
enhances the flexibility of steganography in practical applications.

  * •

HIS incorporates Embed-Flow and Enhance-Flow, which significantly improve the
steganographic capacity and recovery quality of diffusion. Owing to the
reversible characteristics of the flow model, the result of diffusion-based
inversion is guided toward more deterministic results, which is also
enlightening for applications of diffusion models.

  * •

HIS method outperforms existing Multi Image Steganography techniques across
several critical metrics, including security, robustness, and capacity. This
advancement sets a new benchmark for the efficacy and applicability of
steganographic practices in securing digital content.

Figure 3. The workflow of Diffusion-based Inversion: $\mathbf{x}_{s-Tier1}$ is
firstly transformed to intermedia noise $\mathbf{y}_{n-Diff}$ with private key
$\mathbf{k}_{pri}$, and then transformed to container $\mathbf{y}_{c-Diff}$
with public key $\mathbf{k}_{pub}$ using the DDIM. Reversely, public key
$\mathbf{k}_{pub}$ is initially ultilized to transfer
$\mathbf{y}^{\prime}_{c-Diff}$ to $\mathbf{y}^{\prime}_{n-Diff}$. Finally,
$\mathbf{x}_{Diff}$ is reconstructed under the condition of
$\mathbf{k}_{pri}$.

##  2\. Related Works

Cover-based Image Steganography.  Unlike cryptography, steganography aims to
hide secret data in a host to produce an information container. For image
steganography, a cover image is required to hide the secret image in it
(Baluja, 2017). Traditionally, spatial-based (Nguyen et al., 2006; Pan et al.,
2011; Provos and Honeyman, 2003) methods utilize the Least Significant Bits
(LSB), pixel value differencing (PVD) (Pan et al., 2011), histogram shifting
(Tsai et al., 2009), multiple bit-planes (Nguyen et al., 2006) and palettes
(Niimi et al., 2002) to hide images, which may arise statistical suspicion and
are vulnerable to steganalysis methods. Adaptive methods (Pevnỳ et al., 2010;
Li et al., 2014) decompose the steganography into embedding distortion
minimization and data coding, which is indistinguishable by appearance but
limited in capacity. Various transform-based schemes (Chanu et al., 2012;
Kadhim et al., 2019) including JSteg (Provos and Honeyman, 2003) and DCT
steganography (Hetzl and Mutzel, 2005) also fail to offer high payload
capacity. Recently, various deep learning-based schemes have been proposed to
solve image steganography. Baluja (Baluja, 2017) proposed the first deep-
learning method to hide a full-size image into another image. Generative
adversarial networks (GANs) (Shi et al., 2017) are introduced to synthesize
container images. Probability map methods focus on generating various cost
functions satisfying minimal-distortion embedding (Pevnỳ et al., 2010; Tang et
al., 2017). (Yang et al., 2019) proposes a generator based on U-Net. (Tang et
al., 2019) presents an adversarial scheme under distortion minimization.
Three-player game methods like SteganoGAN (Zhang et al., 2019) and HiDDeN (Zhu
et al., 2018) learn information embedding and recovery by auto-encoder
architecture to adversarially resist steganalysis. Recent attempts (Xiao et
al., 2020) to introduce invertible neural networks (INN) into low-level
inverse problems like denoising, rescaling, and colorization show impressive
potential over auto-encoder, GAN (Abdal et al., 2019), and other learning-
based architectures. Recently, (Lu et al., 2021; Guan et al., 2022) proposed
designing the steganography model as an invertible neural network (INN) (Dinh
et al., 2014, 2017) to perform image hiding and recovering with a single INN
model.

Coverless Steganography.  Coverless steganography is an emerging technique in
the field of information hiding, which aims to embed secret information within
a medium without modifying the cover object (Qin et al., 2019). Unlike
traditional steganography methods that require a cover medium (e.g., an image
or audio file) to be altered for hiding information, coverless steganography
seeks to achieve secure communication without introducing any changes to the
cover object (Li et al., 2022). This makes it more challenging for adversaries
to detect the presence of hidden data, as there are no observable changes in
the medium’s properties (Mohamed et al., 2021). To the best of our knowledge,
existing coverless steganography methods (Liu et al., 2020) still focus on
hiding bits into container images, and few explorations involve hiding images
without resorting to cover images.

###  2.1. Diffusion Models

Diffusion models (Ho et al., 2020) are a type of generative model that is
trained to learn the target image distribution from a noise distribution.
Recently, due to their powerful generative capabilities, diffusion models have
been widely used in various image applications, including image generation
(Dhariwal and Nichol, 2021), restoration (Saharia et al., 2022b), translation
(Choi et al., 2021), and more. Large-scale diffusion model communities have
also emerged on the Internet, with the aim of promoting the development of
AIGC(AI-generated content)-related fields by applying the latest advanced
techniques.

In these communities, the Stable Diffusion (Rombach et al., 2022) community is
currently one of the most popular and thriving ones, with a large number of
open-source tools available for free, including model checkpoints finetuned on
various specialized datasets. Additionally, various LoRAs (Hu et al., 2022)
and ControlNets (Zhang and Agrawala, 2023) are available in these communities
for efficient control over the results generated by Stable Diffusion. LoRAs
achieve control by efficiently modifying some network parameters in a low-rank
way, while ControlNets introduce an additional network to modify the
intermediate features of Stable Diffusion for control.

##  3\. Methods

To address the issue of poor image reconstruction performance before and after
the DDIM inversion process in diffusion models, this paper employs the
Enhance-Flow model as a supplement to the coverless steganography process. In
Fig.2, leveraging the reversible nature and efficient distribution
transformation capability of flow models, it constructs a mapping from the
original input image, Secret-image $\mathbf{x}_{s-GT}$, to the intermediate
noise in the diffusion model, Container-Noise $\mathbf{y}_{n-Diff}$. The
diffusion model generates the Phase1-Container $\mathbf{y}_{c-Diff}$ from
Container-Noise $\mathbf{y}_{n-Diff}$. The role of the Embed-Flow model is to
hide multiple images, text data, and other metadata into the Container-Image
$\mathbf{y}_{c-Diff}$, producing a second-order container image,
Phase2-Container $\mathbf{y}_{c-Add}$. The Phase2-Container
$\mathbf{y}_{c-Add}$ maintains robustness under various noise interferences,
allowing the embedded images and text data to be decoded in reverse. Under
higher levels of degradation, the Phase1-Container $\mathbf{y}_{c-Diff}$ still
preserves the original information, which, through the diffusion model,
generates the initial restored image $\mathbf{x}_{s-Diff}$, and through the
reverse process of the flow model, produces a high-fidelity restored image
${\mathbf{x^{\prime}}_{s-GT}}$.

Tier-1 Importance: For images of primary importance, you use the diffusion
model to generate container images for concealment. This method is robust
against a wide range of complex degradations, including transformations by
deep neural networks. It ensures the security and integrity of the most
critical images under various challenging conditions.

Tier-2 Importance: For images of secondary importance, you employ a second-
level Embed-Flow for robust, high-capacity image steganography. This level is
resistant to common degradations like noise and compression. However, it might
be less effective against severe and unknown types of degradation.

###  3.1. Diffusion-based Image Inversion

Our basic framework HIS is based on a conditional diffusion model, whose noise
estimator is represented by $\bm{\epsilon}_{\bm{\theta}}$, and two different
conditions that serve as inputs to the diffusion model. In our work, these two
conditions can serve as the private key $\mathbf{k}_{pri}$ and public key
(denoted as $\mathbf{k}_{pub}$, as shown in Fig.3, with detailed workflow
described in Algo.1 and Algo. 2. We will introduce the entire Dif framework in
two parts: the hide process and the reveal process.

We first implement the Secret-Image to Container-Image transformation through
the Diffusion models, which is realized by DDIM Inversion. Secret-Image is
guided by Prompt1 to produce Container-Noise, and Container-Noise is guided by
Prompt2 to produce Container-Noise, which is guided by Prompt2 to produce
Container-Noise. Container-Image is generated under the guidance of Prompt2.

The Process of Hiding Stage.  In the hiding stage, we attempt to perform
translation between the secret image $\mathbf{x}_{s-Tier1}$ and the container
image $\mathbf{x}_{c-Diff}$ using the forward and backward processes of
deterministic DDIM. In order to make the images before and after the
translation different, we use the pre-trained conditional diffusion model with
different conditions in the forward and backward processes respectively. These
two different conditions also serve as private and public keys in the HIS
framework. Specifically, the private key $\mathbf{k}_{pri}$ is used for the
forward process, while the public key $\mathbf{k}_{pub}$ is used for the
backward process. After getting the container image $\mathbf{x}_{c-Diff}$, it
will be transmitted over the Internet and publicly accessible to all potential
receivers.

The Roles of the Private and Public Keys In the proposed HIS, we found that
these given conditions can act as keys in practical use. The private key is
used to describe the content in the secret image, while the public key is used
to control the content in the container image. For the public key, it is
associated with the content in the container image, so even if it is not
manually transmitted over the network, the receiver can guess it based on the
received container image (described in Scenario#2 of Fig. 7). For the private
key, it determines whether the receiver can successfully reveal the original
image, so it cannot be transmitted over public channels.

Algorithm 1 The Hide Process of Diffusion-based Inversion.

Input: The secret image $\mathbf{x}_{s-Tier1}$ which will be hidden, a pre-
trained conditional diffusion model with noise estimator
$\bm{\epsilon}_{\bm{\theta}}$, the number $T$ of time steps for sampling and
two different conditions $\mathbf{k}_{pri}$ and $\mathbf{k}_{pub}$ which serve
as the private and public keys.

Output:  The container image $\mathbf{x}_{c-Diff}$ used to hide the secret
image $\mathbf{x}_{s-Tier1}$.

$\mathbf{y}_{n-Diff}=\mathrm{ODESolve}(\mathbf{x}_{s-Tier1};\bm{\epsilon}_{\bm{\theta}},\mathbf{k}_{pri},0,T)$

$\mathbf{y}_{c-Diff}=\mathrm{ODESolve}(\mathbf{y}_{n-Diff};\bm{\epsilon}_{\bm{\theta}},\mathbf{k}_{pub},T,0)$

return $\mathbf{x}_{c-Diff}$

Algorithm 2 The Reveal Process of Diffusion-based Inversion.

Input: The container image ${\mathbf{y}^{\prime}_{c-Diff}}$ that has been
transmitted over the Internet (may be degraded from $\mathbf{y}_{c-Diff}$),
the pre-trained conditional diffusion model with noise estimator
$\bm{\epsilon}_{\bm{\theta}}$, the number $T$ of time steps for sampling, the
private key $\mathbf{k}_{pri}$ and public key $\mathbf{k}_{pub}$.

Output:  The revealed image $\mathbf{x}_{s-Diff}$.

${\mathbf{y^{\prime}}_{n-Diff}}=\mathrm{ODESolve}({\mathbf{y^{\prime}}_{c-Diff}};\bm{\epsilon}_{\bm{\theta}},\mathbf{k}_{pub},0,T)$

$\mathbf{x}_{s-Diff}=\mathrm{ODESolve}({\mathbf{y^{\prime}}_{n-Diff}};\bm{\epsilon}_{\bm{\theta}},\mathbf{k}_{pri},T,0)$

return $\mathbf{x}_{s-Diff}$

The Process of Revealing Stage.  In the reveal stage, assuming that the
container image has been transmitted over the Internet and may have been
damaged as ${\mathbf{x^{\prime}}_{c-Diff}}$, the receiver needs to reveal it
back to the secret image through the same forward and backward process using
the same conditional diffusion model with corresponding keys. Throughout the
entire coverless image steganography process, we do not train or fine-tune the
diffusion models specifically for image steganography tasks but rely on the
inherent invertible image translation guaranteed by the DDIM Inversion.

###  3.2. Enhance-Flow

####  3.2.1. Framework

The diffusion model exhibits excellent generative capabilities, producing
diverse $\mathbf{y}_{c-Diff}$ results different from $\mathbf{x}_{s-GT}$ under
text guidance, and demonstrates strong robustness. However, its restoration
performance is limited, only able to generate a roughly similar
$\mathbf{x}_{s-Diff}$ from $\mathbf{y}_{c-Diff}$. To address this, the paper
introduces an Enhance-Flow, aiming to generate higher quality restorations
guided by the low-quality $\mathbf{x}_{s-Diff}$ results. In Fig.4, Enhance-
Flow consists of two flow model stages. During the Hiding phase, Stage-1 flow
model uses $\mathbf{x}_{s-GT}$ as a guiding condition to transform the input
image into a Gaussian distribution $\mathbf{y}_{n-flow}$. Similarly, in
Stage-2, guided by $\mathbf{x}_{s-GT}$, the noise of approximate Gaussian
distribution is transformed into $\mathbf{y}_{n-Diff}$ for subsequent
diffusion model input.

In the Revealing phase, the diffusion model first restores
${\mathbf{y^{\prime}}_{c-Diff}}$ into ${\mathbf{y^{\prime}}_{n-Diff}}$ under
public key guidance, and then reconstructs it into $\mathbf{x}_{s-Diff}$ under
private key guidance, providing a lower-quality result sufficient for the flow
model’s auxiliary condition. Stage-2 flow model takes
${\mathbf{y^{\prime}}_{n-Diff}}$ as input and $\mathbf{x}_{s-Diff}$ as an
auxiliary guiding condition, first reconstructing
$\mathbf{y^{\prime}}_{n-Flow}$, and then Stage-1 flow model uses
$\mathbf{y^{\prime}}_{n-Flow}$ under $\mathbf{x}_{s-Diff}$ guidance to produce
the restored result $\mathbf{x^{\prime}}_{s-GT}$.

Figure 4. Framework of Enhance-flow: $\mathbf{x}_{s-Tier1}$ is firstly
transfered to Gaussian-like $\mathbf{y}_{n-Flow}$ via Enh-Flow-S1 with the
feature of $\mathbf{x}_{s-Diff}$, followed by the conversion to
$\mathbf{y}_{n-Diff}$ via Enh-Flow-S2. The reversion from
$\mathbf{y}^{\prime}_{n-Diff}$ to $\mathbf{x}^{\prime}_{s-Tier1}$ is
symmetrical to the forward process.

####  3.2.2. Training Protocol

##### Enhanceflow-S1

Enhanceflow-S1 is solely trained in the first phase, with the goal of high-
quality reconstruction of the original input secret image’s details from a
Gaussian distribution. Supposing $\mathbf{x}_{s-GT}$ serves as the model input
under the condition of $\mathbf{x}_{s-Diff}$, it is transformed to an
approximate Gaussian distribution $\mathbf{x}_{n-Flow}$ via EnhanceFlow-S1.
The loss function for this training process is the Cross-Entropy distance
between $\mathbf{y}_{n-Flow}$ and the Gaussian distribution.

(1)
$\displaystyle\mathcal{L}_{distr-S1}=\ell_{\mathcal{CE}}(p(\mathbf{x}_{n-Flow}),\mathcal{N}(\mathbf{0},\mathbf{I})).$
(2)
$\displaystyle\mathcal{L}_{norm-S1}=||{\mathbf{x^{\prime}}_{s-GT}}-\mathbf{x}_{s-GT}||_{2}.$

In the reverse process, we directly sample from the Gaussian distribution to
obtain $\mathbf{x^{\prime}}_{n-Flow}$. Under the supervision of
$\mathbf{x}_{s-Diff}$, this is then transformed back to
$\mathbf{x^{\prime}}_{s-GT}$ through the reverse process of the shared-weight
EnhanceFlow-S1. This process is supervised using an L2 Loss.

##### EnhanceFlow-S2

We independently train the second stage of Enhanceflow-S2, aiming to compress
redundant information from the diffusion model’s intermediate noise
$\mathbf{x^{\prime}}_{n-Diff}$ under the condition of $\mathbf{x}_{s-Diff}$,
to obtain an intermediate noise $\mathbf{x^{\prime}}_{n-Flow}$ that
approximates a Gaussian distribution. This noise retains key information
beneficial for image reconstruction. This process is constrained using the
Cross-Entropy distance between the intermediate noise
$\mathbf{x^{\prime}}_{n-Flow}$ and the Gaussian distribution.

Figure 5. Framework of Embed-Flow: the Invertible Blocks take the
$\mathbf{y}_{c-Diff}$ and $\mathbf{x}_{s-Tier2}$ as input to produce container
$\mathbf{y}_{c-Add}$ and redundant Gaussian Noise. In the backward pass,
Gaussian sampling datapoint and distorted $\mathbf{y}^{\prime}_{c-Add}$ will
produce recovered secret $\mathbf{x}^{\prime}_{s-Tier2}$.

Methods | clean | JPEG Q=80 | JPEG Enhancer |  Guassian $\sigma$=10
---|---|---|---|---
1-Tier2 | 28.39 | 23.49 | 22.05 | 24.23
2-Tier2 | 23.04 | 22.05 | 21.11 | 22.34
3-Tier2 | 24.09 | 22.78 | 20.87 | 21.84
4-Tier2 | 22.56 | 19.44 | 18.56 | 20.31

Table 1. Average revealed PSNR with different number of embedded images
$\mathbf{x}_{s-Tier2}$ via Embed-Flow under distortions. The recovery quality
degrades when embedding multiple $\mathbf{x}_{s-Tier2}$ images, but can still
resist various distortion.

(3)
$\displaystyle\mathcal{L}_{distr-S2}=\ell_{\mathcal{CE}}(p({\mathbf{y^{\prime}}_{n-Flow}},\mathcal{N}(\mathbf{0},\mathbf{I})).$
(4)
$\displaystyle\mathcal{L}_{norm-S2}=||{\mathbf{y^{\prime}}_{n-Diff}}-\mathbf{y}_{n-Diff}||_{2}.$

In the reverse process of Enhanceflow-S2, we directly sample from the Gaussian
distribution to get $\mathbf{y}_{n-Flow}$. Similarly, under the supervision of
$\mathbf{x}_{s-Diff}$, it is transformed into $\mathbf{x^{\prime}}_{s-GT}$
through the reverse process of EnhanceFlow-S2 with shared weights. We
supervise this process with an L2 Loss.

##### Jointly Training

Then, we train a model holistically, where the input is
${\mathbf{y^{\prime}}_{n-Diff}}$. Under the condition of
${\mathbf{x}_{s-Diff}}$, it transforms into an approximate Gaussian
$\mathbf{y}_{n-Flow}$. Subsequently, this intermediate approximate Gaussian
noise is restored under the supervision of $\mathbf{x}_{s-Diff}$ into a
higher-quality ${\mathbf{x^{\prime}}_{s-GT}}$.

In this training process, the primary constraint is the L2 distance between
$\mathbf{x}_{s-GT}$ and the original image ${\mathbf{x^{\prime}}_{s-GT}}$. On
the other side, it’s to ensure that the intermediate noise
$\mathbf{y_{n-Flow}}$ closely approximates a Gaussian distribution.

(5) $\displaystyle\mathcal{L}_{distr-
joint}=\ell_{\mathcal{CE}}(p(\mathbf{y}_{n-Flow}),\mathcal{N}(\mathbf{0},\mathbf{I})).$
(6) $\displaystyle\mathcal{L}_{norm-
joint}=||{\mathbf{x^{\prime}}_{s-GT}}-\mathbf{x}_{s-GT}||_{2}.$

##### Inference Process

During the inference testing period, in the forward process, the input image
is processed through the diffusion model under the control of the private key
to obtain $\mathbf{y}_{n-Diff}$. It is then transformed into the publicly
disseminated container image $\mathbf{y}_{c-Diff}$ under the control of the
public key through DDIM inversion. During its public network transmission, it
may undergo various degradations and interferences, or be embedded with a
second-level secret information $\mathbf{x}_{Add}$.

At the decoding end, the degraded container image
$\mathbf{y}^{\prime}_{c-Diff}$ is received, and the intermediate noise
$\mathbf{y}_{n-Diff}$ is generated under the guidance of the public key
through the diffusion model. Further, under the condition of obtaining the
private key, the hidden image $\mathbf{x}_{s-Diff}$ is restored in reverse
through the diffusion model. On this basis, to obtain higher quality hidden
image recovery results, EnhanceFlow-S2 is first called with
$\mathbf{y}^{\prime}_{n-Diff}$ as input, extracting information from the rough
recovery image of $\mathbf{x}_{s-Diff}$, transforming it to the approximate
Gaussian $\mathbf{y}_{n-Flow}$, and then further restored to
$\mathbf{x}^{\prime}_{s-GT}$ through EnhanceFlow-S1, thereby achieving a high-
quality restored hidden image.

Figure 6. Visual results of HIS and other methods (Xu et al., 2022; Guan et
al., 2022) under the same degradations of JPEG QF-80. Our method can vividly
reconstruct the secret images, while other methods exhibit significant color
distortion or have completely failed.

Methods |  clean | Gaussian noise |  Gaussian denoiser (Wang et al., 2021) | JPEG compression |  JPEG enhancer (Wang et al., 2021)
---|---|---|---|---|---
$\sigma$ = 10 |  $\sigma$ = 20 |  $\sigma$ = 30 |  $\sigma$ = 10 |  $\sigma$ = 20 |  $\sigma$ = 30 | Q = 20 | Q = 40 | Q = 80 | Q = 20 | Q = 40 | Q = 80
Baluja (Baluja, 2019) | 34.24 | 10.30 | 7.54 | 6.92 | 7.97 | 6.10 | 5.49 | 6.59 | 8.33 | 11.92 | 5.21 | 6.98 | 9.88
ISN (Lu et al., 2021) | 41.83 | 12.75 | 10.98 | 9.93 | 11.94 | 9.44 | 6.65 | 7.15 | 9.69 | 13.44 | 5.88 | 8.08 | 11.63
DeepMIH (Guan et al., 2022) | 42.98 | 12.91 | 11.54 | 10.23 | 11.87 | 9.32 | 6.87 | 7.03 | 9.78 | 13.23 | 5.59 | 8.21 | 11.88
RIIS (Xu et al., 2022) | 43.78 | 26.03 | 18.89 | 15.85 | 20.89 | 15.97 | 13.92 | 22.03 | 25.41 | 26.02 | 13.88 | 16.74 | 20.13
CRoSS (Yu et al., 2024) | 23.79 | 21.89 | 20.19 | 18.77 | 21.39 | 21.24 | 21.02 | 21.74 | 22.74 | 23.51 | 20.60 | 21.22 | 21.19
HIS | 28.39 | 23.49 | 21.88 | 20.02 | 21.73 | 22.41 | 21.98 | 23.21 | 26.11 | 26.23 | 22.42 | 23.23 | 23.15

Table 2. PSNR(dB) results of the proposed HIS and other methods under
different levels of degradations. The proposed HIS can achieve superior data
fidelity in most settings. The best results are red and the second-best
results are blue. Figure 7. Revealed Results of multiple secret images (a
single $\mathbf{x}^{\prime}_{s-Tier1}$ and 4 $\mathbf{x}^{\prime}_{s-Tier2}$),
$\mathbf{x}^{\prime}_{s-Tier1}$ can be robustly revealed under severe
distortion.

###  3.3. Embed-Flow

The container images produced by the diffusion model exhibit strong
robustness, capable of withstanding varied and complex degradation conditions,
even after undergoing complex transformations such as through neural networks.
In the current network environment, there’s a pressing need for image
steganography algorithms with higher capacity and robustness. Hence, we
utilize $\mathbf{y}_{c-Diff}$ from the previous phase as the carrier,
designing the Embed-Flow model to conceal multiple images or large volumes of
text information within it.

The specific flow model conditions of Embed-Flow are decided by the user’s
needs. In Fig. 5, when hiding multiple frames, Embed-Flow first applies a Haar
wavelet transform to the inputs ${\mathbf{y^{\prime}}_{c-Diff}}$ and
$\mathbf{x}_{s-Add}$, and then uses flow model transformations with
${\mathbf{y^{\prime}}_{c-Diff}}$ as an auxiliary condition. The aim is to
transform the channels corresponding to $\mathbf{x}_{s-Add}$ into an
approximate Gaussian distribution, thereby hiding the information in
$\mathbf{x}_{c-Add}$. The obtained $\mathbf{x}_{c-Add}$ can resist common
benign degradations and exhibit broad robustness. At the receiving end, the
same Embed-Flow can be used for inverse operations to decrypt and restore
$\mathbf{y^{\prime}}_{c-Diff}$ and $\mathbf{x^{\prime}}_{s-Add}$. Here,
$\mathbf{y^{\prime}}_{c-Diff}$ will continue as the input for the directional
decoding of DDIM or Enhance-Flow in the first stage.

##### Loss Functions

Concretely, since the distribution can be tractably depicted in flow-based
models, CANP encourages the $p(\mathbf{z})$ to be independent from
$p(\mathbf{h_{f}})$ and $p(\mathbf{y})$ and approximate to Gaussian
distribution by distribution loss $\mathcal{L}_{distr}$ in Eq. (9). We depict
the distribution distance by cross-entropy (CE) on $\mathbf{z}$. To guide the
container image $\mathbf{y}$ to be approximately identical to the host image
$\mathbf{x_{h}}$ both in spatial and frequency domain, we further apply fast
fourier transform (FFT) to extract frequency component in Eq. (10).

(7)
$\displaystyle\mathcal{L}_{rev}=||\mathbf{x}_{s}-\mathbf{\hat{x}_{s}}||_{2}+||\mathbf{{x}_{h}}-\mathbf{\hat{x}_{h}}||_{2}.$
(8) $\displaystyle\mathcal{L}_{norm}=||\mathbf{y}-\mathbf{\tilde{y}}||_{2}.$
(9)
$\displaystyle\mathcal{L}_{distr}=\ell_{\mathcal{CE}}(p(\mathbf{z}),\mathcal{N}(\mathbf{0},\mathbf{I})).$
(10)
$\displaystyle\mathcal{L}_{con}=||\mathbf{x_{h}}-\mathbf{y}||_{2}+||\text{FFT}(\mathbf{x_{h}})-\text{FFT}(\mathbf{y})||_{2}.$
(11)
$\displaystyle\mathcal{L}_{{total}}=\lambda_{1}\mathcal{L}_{rev}+\lambda_{2}\mathcal{L}_{con}+\lambda_{3}\mathcal{L}_{norm}+\lambda_{4}\mathcal{L}_{distr},$

In summary, The total loss function in Eq. (11) considers the following four
components: embedded image revealing, container invisibility, distortion
enhancement, and noise distribution distance:

##  4\. Experimental Results

###  4.1. Implementation and Setup Details

Our proposed framework successfully maintains the payload capacity by hiding
multiple images in one container image. HIS is implemented with the NVIDIA
3090 GPU for acceleration. We implement the Adam optimizer with
$\beta_{1}=0.9$ and $\beta_{2}=0.99$. The learning rate is set to be 0.0001,
and the batch size is set to be 16 for training. The dataset for training and
testing is DIV2K (Agustsson and Timofte, 2017), if not specified. For the
loss, the corresponding weight factors are $\lambda_{1}=1$, $\lambda_{2}=16$,
$\lambda_{3}=1$ and $\lambda_{4}=0.5$. The PSNR (Peak Signal to Noise Ratio)
metric is utilized to evaluate the performance.

###  4.2. Abalation Studies

In Fig. 7, results from HIS demonstrate its Tiered robustness, especially
under severe distortions. Specifically, the method successfully recovers the
highly important $\mathbf{x}^{\prime}{s-Tier1}$ image, while also managing to
reveal multiple $\mathbf{x}^{\prime}{s-Tier2}$ images. This confirms that our
HIS method maintains the integrity of crucial Tier-1 embedded images even in
challenging conditions.

Tab.1 illustrates the average revealed PSNR with varying numbers of embedded
images $\mathbf{x}_{s-Tier2}$ via Embed-Flow under different distortions
provides critical insights into the capabilities of our Hierarchical Image
Steganography (HIS) method. It demonstrates the high capacity of HIS,
affirming its ability to embed multiple images while maintaining significant
robustness. Despite the expected degradation in recovery quality with an
increased number of embedded images, the system effectively resists various
distortions, ensuring the integrity and quality of the recovered images.

In Tab.3, to validate the effectiveness and necessity of the two-stage flow
model enhancement, Enhance-Flow, proposed in this paper, we consider two
simpler network architectures as alternative post-processing enhancement
methods for the diffusion model’s hiding-recovery process.

Case 1: Directly train the two-stage Enhance-Flow without the intermedia
constraint of ${\mathbf{y}_{n-Flow}}$.

Case 2: A single-stage flow model structure, equivalent to Enhance-Flow-S2, is
directly trained to map from ${\mathbf{x^{\prime}}_{s-GT}}$ to
$\mathbf{y}_{n-Flow}$. T In the forward process, the output
${\mathbf{y^{\prime}}_{n-Diff}}$ is compared with the actual noise
$\mathbf{y_{n-Diff}}$ produced by the diffusion model to calculate the
distance:
$\mathcal{L}_{norm}=||{\mathbf{y^{\prime}}_{n-Diff}}-\mathbf{y}_{n-Diff}||_{2}.$
In the reverse process, the output ${\mathbf{x^{\prime}}_{s-GT}}$ is compared
with the original input image to calculate the L2 distance.
$\mathcal{L}_{norm}=||{\mathbf{x^{\prime}}_{s-GT}}-\mathbf{x}_{s-GT}||_{2}.$

Case 3: Train an image-to-image transformation Unet, inputting the noise from
the diffusion model, $\mathbf{x_{s-Diff}}$, and outputting the reconstructed
Secret Image ${\mathbf{x^{\prime}}_{s-GT}}$. This process is constrained using
the L2 distance.

Methods | clean | JPEG Q=80 | JPEG Enhancer |  Guassian $\sigma$=10
---|---|---|---|---
EnhFlow | 28.39 | 23.49 | 22.05 | 24.23
EnhFlow(Direct) | 23.04 | 22.05 | 21.11 | 22.34
Conditional Flow | 24.09 | 22.78 | 20.87 | 21.84
UNet | 22.56 | 19.44 | 18.56 | 20.31

Table 3. Ablation studies of different schemes of post-enhancement over DDIM
inversion under distortions. Figure 8. learning curve of steganalysis on
recent steganography methods. Figure 9. ROC curve of steganalysis on
competitive methods. The more area under the ROC curve (auROC) approaches 0.5
(as Ref.), the less susceptible to steganalysis the method is.

Figure 10. Visual results of proposed HIS: given an input
$\mathbf{x}_{s-Tier1}$ Input-Secret to be hide, the Container is produced by
diffusion-based image inversion, and reversely Rev. by CRoSS is the
reconstructed secret image by the former coverless steganography method CRoSS
(Yu et al., 2024), Rev. by Ours is the better-reconstructed secret by HIS.

figure description

###  4.3. Comparison with SOTA

In the image steganography task, the most common concern is the fidelity of
two pairs: revealed secret $\mathbf{\hat{x}_{s}}$ and origin $\mathbf{x_{s}}$,
container $\mathbf{y}$ and host image $\mathbf{x_{h}}$. For the comparison
with the latest method, we reproduce the State-of-the-art ISN (Lu et al.,
2021) and reach the performance itself claimed on the DIV2K (Agustsson and
Timofte, 2017). Despite the variety of colors and structures of the images,
HIS can restore them with no viewable artifacts. The performance of hiding
images with the container image stained by noise or JPEG compression is shown
in Tab. 2. The results reveal that our proposed method HIS successfully
maintains higher reconstruction quality compared with the latest methods. To
prove the payload capacity of our method, we increase the channel of HIS for
hiding multiple secret images into one container.

In Fig. 6, the visual comparisons of our HIS with others under JPEG QF-80
degradation clearly demonstrate the superior recovery capabilities of HIS.
While competing methods suffer from notable color distortions or failure, HIS
effectively reconstructs secret images with remarkable fidelity and robustness
to compression. Fig. 7 shows the model performance for hiding single or
multiple secret images into one container under different distortions.

Methods |  NIQE $\downarrow$ |  $\lvert$Detection Accuracy - 50$\rvert$ $\downarrow$
---|---|---
XuNet (Xu et al., 2016) |  YedroudjNet (Yedroudj et al., 2018) |  KeNet (You et al., 2020)
Baluja (Baluja, 2019) |  3.43$\pm$0.08 |  45.18$\pm$1.69 |  43.12$\pm$2.18 |  46.88$\pm$2.37
ISN (Lu et al., 2021) | 2.87$\pm$0.02 |  5.14$\pm$0.44 |  3.01$\pm$0.29 |  8.62$\pm$1.19
DeepMIH (Guan et al., 2022) | 2.94$\pm$0.02 |  5.29$\pm$0.44 |  3.12$\pm$0.36 |  8.33$\pm$1.22
RIIS (Xu et al., 2022) |  3.13$\pm$0.05 | 0.73$\pm$0.13 |  0.24$\pm$0.08 |  4.88$\pm$1.15
CRoSS (Yu et al., 2024) | 3.04 | 1.32 | 0.22 | 2.11
HIS | 3.10 | 1.01 | 0.18 | 1.95

Table 4. Security analysis. NIQE indicates the visual quality of container
images, lower is better. The closer the detection rate of a method
approximates $50\%$, the more secure the method is considered, as it suggests
its output is indistinguishable from random chance. The best results are red
and the second-best results are blue. Figure 11. Examples of our applications
of self-recovery and tampering localization.

###  4.4. Anti-Analysis Security

Steganalysis tools are used to identify whether an image is a container image
that carries secret messages. Tab. 4 shows the steganalysis results of
different methods. Compared with existing methods, HIS successfully confused
most steg-analysis tools. Our detection accuracy rates are all around 50%,
which means outstanding statistical security. Fig. 9 demonstrates the
steganalysis performance on various methods. This implies that methods closer
to this ideal auROC value are inherently more secure, as they are less likely
to be identified through common steganalysis (You et al., 2020). The auROC of
HIS is most close to 0.5, suggesting a higher level of security for embedding
sensitive information within images.

Deep steganalysis has been developed to investigate how many leaked training
samples (i.e., the pair of cover and container frames) acquired by the
attacker will make the Recent deep-learning methods perform better than
conventional detectors. Here, we re-train the latest steg-analysis method
SiaSteg (You et al., 2020) with leaked samples from the evaluation set. The
containers are mixed with host images from DIV2K for detection of wide-range
thresholds. As the Fig. 8 presented, HIS reflects the lowest detection
accuracy.

HIS is designed for both the visual and statistical undetectability. Take the
container images, original secret images in Fig. 10 for example, HIS hardly
arouses human-eye suspicion.

###  4.5. Applications

Local Self-Recovery Leveraging the robustness of our Hierarchical Image
Steganography (HIS) method, we propose an enhanced approach for Image Self-
Recovery, which is particularly effective against partial image corruption.
This technology empowers digital images with the ability to auto-recover
tampered sections when shared on social media, without the need for external
image forgery detection or reconstruction techniques. By embedding subtle,
imperceptible changes into the image, users can upload a fortified version
that maintains normal usability while ensuring the integrity of the content.
As Fig.11 shows, HIS enables the recipient to accurately localize and restore
any tampered areas of the image, thereby preserving the original content with
high fidelity.

Tampering Localization The hidden images of Tier-2 importance exhibit certain
vulnerabilities, as local erasure, tampering, or replacement on the container
image can lead to the loss of local information in the recovered hidden images
(Zhang et al., 2024, 2023). Hence, we can utilize the difference in local
robustness to locate local tampering on the container image. If its local
information is modified, the hidden images of Tier-2 importance will display
evident defects such as dark blocks.

Multi-Image Protection Users on social media can securely share multiple
images embedded within a single container image, utilizing HIS. Firstly, users
select images and categorize them based on their sensitivity into Tier-1
(highly sensitive) and Tier-2 (less sensitive). HIS acts as an integrated tool
in the social media platform embeds these images into a single normal-looking
image using steganography. Tier-1 images are embedded with high robustness to
protect against tampering, while Tier-2 images are embedded with less
robustness. The container image is then posted publicly on the user’s profile,
appearing as a typical image.

##  5\. Conclusion

We propose a Hierarchical Image Steganography (HIS) framework that effectively
leverages the unique properties of diffusion models and flow-based models.
This innovative approach achieves superior performance in terms of security,
controllability, and robustness compared to existing steganography methods. By
incorporating a tiered embedding strategy, HIS dynamically adjusts the
robustness of embedded images based on their importance, ensuring that
critical information remains intact even under significant distortions,
offering a powerful tool for protecting digital content in an increasingly
connected world.

## References

  * (1)
  * Abdal et al. (2019) Rameen Abdal, Yipeng Qin, and Peter Wonka. 2019.  Image2stylegan: How to embed images into the stylegan latent space?. In _ICCV_.
  * Agustsson and Timofte (2017) Eirikur Agustsson and Radu Timofte. 2017.  Ntire 2017 challenge on single image super-resolution: Dataset and study. In _CVPRW_.
  * Baluja (2017) Shumeet Baluja. 2017.  Hiding images in plain sight: Deep steganography. In _NeurIPS_.
  * Baluja (2019) Shumeet Baluja. 2019.  Hiding images within images.  _TPAMI_ (2019).
  * Chanu et al. (2012) Yambem Jina Chanu, Kh Manglem Singh, and Themrichon Tuithung. 2012.  Image steganography and steganalysis: A survey. In _IJCAI_.
  * Choi et al. (2021) Jooyoung Choi, Sungwon Kim, Yonghyun Jeong, Youngjune Gwon, and Sungroh Yoon. 2021.  ILVR: Conditioning Method for Denoising Diffusion Probabilistic Models. In _ICCV_.
  * Dhariwal and Nichol (2021) Prafulla Dhariwal and Alexander Nichol. 2021.  Diffusion models beat gans on image synthesis. In _NeurIPS_.
  * Dinh et al. (2014) Laurent Dinh, David Krueger, and Yoshua Bengio. 2014.  Nice: Non-linear independent components estimation.  _arXiv preprint arXiv:1410.8516_ (2014).
  * Dinh et al. (2017) Laurent Dinh, Jascha Sohl-Dickstein, and Samy Bengio. 2017.  Density estimation using Real NVP. In _ICLR_.
  * Guan et al. (2022) Zhenyu Guan, Junpeng Jing, Xin Deng, Mai Xu, Lai Jiang, Zhou Zhang, and Yipeng Li. 2022.  DeepMIH: Deep invertible network for multiple image hiding.  _IEEE Transactions on Pattern Analysis and Machine Intelligence_ 45, 1 (2022), 372–390.
  * Hetzl and Mutzel (2005) Stefan Hetzl and Petra Mutzel. 2005.  A graph–theoretic approach to steganography. In _IFIP International Conference on Communications and Multimedia Security_.
  * Ho et al. (2020) Jonathan Ho, Ajay Jain, and Pieter Abbeel. 2020.  Denoising diffusion probabilistic models. In _NeurIPS_.
  * Hu et al. (2022) Edward J Hu, yelong shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. 2022.  LoRA: Low-Rank Adaptation of Large Language Models. In _ICLR_.
  * Jing et al. (2021) Junpeng Jing, Xin Deng, Mai Xu, Jianyi Wang, and Zhenyu Guan. 2021.  HiNet: Deep Image Hiding by Invertible Network. In _ICCV_.
  * Kadhim et al. (2019) Inas Jawad Kadhim, Prashan Premaratne, Peter James Vial, and Brendan Halloran. 2019.  Comprehensive survey of image steganography: Techniques, Evaluations, and trends in future research.  _Neurocomputing_ (2019).
  * Kawar et al. (2022) Bahjat Kawar, Michael Elad, Stefano Ermon, and Jiaming Song. 2022.  Denoising Diffusion Restoration Models. In _NeurIPS_.
  * Kim et al. (2022) Gwanghyun Kim, Taesung Kwon, and Jong Chul Ye. 2022.  DiffusionCLIP: Text-Guided Diffusion Models for Robust Image Manipulation. In _CVPR_.
  * Li et al. (2014) Bin Li, Ming Wang, Jiwu Huang, and Xiaolong Li. 2014.  A new cost function for spatial image steganography. In _ICIP_.
  * Li et al. (2022) Yung-Hui Li, Ching-Chun Chang, Guo-Dong Su, Kai-Lin Yang, Muhammad Saqlain Aslam, and Yanjun Liu. 2022.  Coverless image steganography using morphed face recognition based on convolutional neural network.  _EURASIP Journal on Wireless Communications and Networking_ 2022, 1 (2022), 1–21.
  * Liu et al. (2020) Qiang Liu, Xuyu Xiang, Jiaohua Qin, Yun Tan, and Yao Qiu. 2020.  Coverless image steganography based on DenseNet feature mapping.  _EURASIP Journal on Image and Video Processing_ 2020 (2020), 1–18.
  * Lu et al. (2021) Shao-Ping Lu, Rong Wang, Tao Zhong, and Paul L Rosin. 2021.  Large-Capacity Image Steganography Based on Invertible Neural Networks. In _CVPR_.
  * Meng et al. (2022) Chenlin Meng, Yutong He, Yang Song, Jiaming Song, Jiajun Wu, Jun-Yan Zhu, and Stefano Ermon. 2022.  SDEdit: Guided Image Synthesis and Editing with Stochastic Differential Equations. In _ICLR_.
  * Mohamed et al. (2021) Mohammed Saad Mohamed, EH Hafez, et al. 2021\.  Coverless image steganography based on jigsaw puzzle image generation.  _Computers, Materials and Continua_ 67, 2 (2021), 2077–2091.
  * Nguyen et al. (2006) Bui Cong Nguyen, Sang Moon Yoon, and Heung-Kyu Lee. 2006.  Multi bit plane image steganography. In _International Workshop on Digital Watermarking_.
  * Niimi et al. (2002) Michiharu Niimi, Hideki Noda, Eiji Kawaguchi, and Richard O Eason. 2002.  High capacity and secure digital steganography to palette-based images. In _ICIP_.
  * Pan et al. (2011) Feng Pan, Jun Li, and Xiaoyuan Yang. 2011.  Image steganography method based on PVD and modulus function. In _ICECC_.
  * Pevnỳ et al. (2010) Tomáš Pevnỳ, Tomáš Filler, and Patrick Bas. 2010.  Using high-dimensional image models to perform highly undetectable steganography. In _IHIP_.
  * Provos and Honeyman (2003) Niels Provos and Peter Honeyman. 2003.  Hide and seek: An introduction to steganography.  _IEEE Symposium on Security and Privacy_ (2003).
  * Qin et al. (2019) Jiaohua Qin, Yuanjing Luo, Xuyu Xiang, Yun Tan, and Huajun Huang. 2019.  Coverless image steganography: a survey.  _IEEE Access_ 7 (2019), 171372–171394.
  * Ramesh et al. (2022) Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. 2022.  Hierarchical text-conditional image generation with clip latents.  _arXiv preprint arXiv:2204.06125_ (2022).
  * Rombach et al. (2022) Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. 2022.  High-Resolution Image Synthesis with Latent Diffusion Models. In _CVPR_.
  * Saharia et al. (2022a) Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily Denton, Seyed Kamyar Seyed Ghasemipour, Raphael Gontijo-Lopes, Burcu Karagol Ayan, Tim Salimans, Jonathan Ho, David J. Fleet, and Mohammad Norouzi. 2022a.  Photorealistic Text-to-Image Diffusion Models with Deep Language Understanding. In _NeurIPS_.
  * Saharia et al. (2022b) Chitwan Saharia, Jonathan Ho, William Chan, Tim Salimans, David J Fleet, and Mohammad Norouzi. 2022b.  Image super-resolution via iterative refinement.  _TPAMI_ (2022).
  * Shi et al. (2017) Haichao Shi, Jing Dong, Wei Wang, Yinlong Qian, and Xiaoyu Zhang. 2017.  SSGAN: secure steganography based on generative adversarial networks. In _Pacific Rim Conference on Multimedia_.
  * Tang et al. (2019) Weixuan Tang, Bin Li, Shunquan Tan, Mauro Barni, and Jiwu Huang. 2019.  CNN-based adversarial embedding for image steganography.  _TIFS_ (2019).
  * Tang et al. (2017) Weixuan Tang, Shunquan Tan, Bin Li, and Jiwu Huang. 2017.  Automatic steganographic distortion learning using a generative adversarial network.  _IEEE Signal Processing Letters_ (2017).
  * Tsai et al. (2009) Piyu Tsai, Yu-Chen Hu, and Hsiu-Lien Yeh. 2009.  Reversible image hiding scheme using predictive coding and histogram shifting.  _Signal Processing_ (2009).
  * Wang et al. (2021) Xintao Wang, Liangbin Xie, Chao Dong, and Ying Shan. 2021.  Real-esrgan: Training real-world blind super-resolution with pure synthetic data. In _ICCV_.
  * Wang et al. (2023) Yinhuai Wang, Jiwen Yu, and Jian Zhang. 2023.  Zero-Shot Image Restoration Using Denoising Diffusion Null-Space Model. In _ICLR_.
  * Xiao et al. (2020) Mingqing Xiao, Shuxin Zheng, Chang Liu, Yaolong Wang, Di He, Guolin Ke, Jiang Bian, Zhouchen Lin, and Tie-Yan Liu. 2020.  Invertible image rescaling. In _ECCV_.
  * Xu et al. (2016) Guanshuo Xu, Han-Zhou Wu, and Yun-Qing Shi. 2016.  Structural design of convolutional neural networks for steganalysis.  _IEEE Signal Processing Letters_ 23, 5 (2016), 708–712.
  * Xu et al. (2022) Youmin Xu, Chong Mou, Yujie Hu, Jingfen Xie, and Jian Zhang. 2022.  Robust Invertible Image Steganography. In _CVPR_.
  * Yang et al. (2019) Jianhua Yang, Danyang Ruan, Jiwu Huang, Xiangui Kang, and Yun-Qing Shi. 2019.  An embedding cost learning framework using GAN.  _TIFS_ (2019).
  * Yedroudj et al. (2018) Mehdi Yedroudj, Frédéric Comby, and Marc Chaumont. 2018.  Yedroudj-net: An efficient CNN for spatial steganalysis. In _ICASSP_.
  * You et al. (2020) Weike You, Hong Zhang, and Xianfeng Zhao. 2020.  A Siamese CNN for image steganalysis.  _IEEE Transactions on Information Forensics and Security_ 16 (2020), 291–306.
  * Yu et al. (2024) Jiwen Yu, Xuanyu Zhang, Youmin Xu, and Jian Zhang. 2024.  Cross: Diffusion model makes controllable, robust and secure image steganography.  _Advances in Neural Information Processing Systems_ 36 (2024).
  * Zhang et al. (2019) Kevin Alex Zhang, Alfredo Cuesta-Infante, Lei Xu, and Kalyan Veeramachaneni. 2019.  SteganoGAN: High Capacity Image Steganography with GANs.  _arXiv preprint arXiv:1901.03892_ (2019).
  * Zhang and Agrawala (2023) Lvmin Zhang and Maneesh Agrawala. 2023.  Adding Conditional Control to Text-to-Image Diffusion Models.  _arXiv preprint arXiv:2302.05543_ (2023).
  * Zhang et al. (2023) Xuanyu Zhang, Runyi Li, Jiwen Yu, Youmin Xu, Weiqi Li, and Jian Zhang. 2023.  Editguard: Versatile image watermarking for tamper localization and copyright protection.  _arXiv preprint arXiv:2312.08883_ (2023).
  * Zhang et al. (2024) Xuanyu Zhang, Youmin Xu, Runyi Li, Jiwen Yu, Weiqi Li, Zhipei Xu, and Jian Zhang. 2024.  V2A-Mark: Versatile Deep Visual-Audio Watermarking for Manipulation Localization and Copyright Protection.  _arXiv preprint arXiv:2404.16824_ (2024).
  * Zhao et al. (2022) Min Zhao, Fan Bao, Chongxuan Li, and Jun Zhu. 2022.  Egsde: Unpaired image-to-image translation via energy-guided stochastic differential equations.  _NeurIPS_ (2022).
  * Zhu et al. (2018) Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. 2018.  Hidden: Hiding data with deep networks. In _ECCV_.