{"id":"af48c000-943a-4840-b30d-212f475c79d0","arxiv_id":"2507.08343","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":1,"one_line_summary":"MRAG hides an image inside a JPEG cover using invertible local and global branches plus a feature-level adversarial loss, yielding high visual quality and steganalysis accuracy near random guess.","lead":"This paper introduces MRAG, a deep learning framework that hides one image inside a color JPEG photograph while making the hidden content hard for automated steganalysis to detect. It combines convolutional and transformer branches and uses an adversarial loss so that the stego image looks like a normal cover to detectors.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Steganalysis imperceptibility is only shown against steganalyzers trained on HRJS stegos, not on MRAG stegos; an adaptive evaluation is required.","rationale":"The reader's weakest assumption is the same as the most load-bearing concern I identify: the steganalysis evaluation is non-adaptive, with all steganalyzers trained on HRJS stegos rather than on MRAG stegos. Because the paper's distinctive contribution is steganalysis imperceptibility, this evaluation gap directly threatens the central claim. The requested adaptive experiment would settle it. I agree with the reader's conditional verdict; the concern is already reflected in the CONDITIONAL status, so I recommend no change. I do not elevate to REJECT because the paper has independent merits in secret restorability and visual imperceptibility, and the missing experiment could conceivably pass. The reader's other points (test-set hyperparameter tuning, loss inconsistency) are noted but do not carry the same weight.","tokens_in":13142,"tokens_out":3927,"duration_ms":45566,"concrete_test":"Train each of the three steganalyzers (UCNet, EWNet, DBS2Net) on a training set of cover-MRAG-stego pairs, using the same architecture, image size, dataset (e.g., 5000 pairs from COCO), and hyperparameters as in the paper, and then evaluate detection accuracy on a held-out MRAG test set. If the average detection accuracy exceeds roughly 60%, the steganalysis imperceptibility claim is refuted. As a control, also train on HRJS stegos to confirm the current numbers are reproducible.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim of steganalysis imperceptibility rests on Table 3, where MRAG detection accuracies approach 50%. However, the evaluation protocol in Experimental Settings trains every steganalyzer—both the surrogate used for the adversarial loss and the steganalyzer used for evaluation—on cover-stego pairs generated by HRJS, a bit-level JPEG steganographic method, not by MRAG. The reported near-50% accuracies therefore only demonstrate that MRAG stegos are not detected by steganalyzers whose training distribution is blind to MRAG's specific embedding traces. Adversarial attacks optimize against a surrogate's feature space (here, an HRJS-trained steganalyzer), and success against a mismatched steganalyzer does not imply statistical undetectability. Given that MRAG embeds a full RGB secret into a JPEG cover—an enormous payload—it is implausible that a steganalyzer trained on MRAG's actual stego distribution would also yield chance-level accuracy. The suspiciously exact values (e.g., 50.00, 50.05) in Table 3 further suggest the evaluator has no discriminative signal specific to MRAG. Without an adaptive (same-algorithm) steganalysis evaluation, the paper's headline claim of 'steganalysis imperceptibility' is unsupported. The internal inconsistency in the norm-changeless loss description (Eq. 3 uses MSE between feature vectors, which also affects angle, so the 'keeping norm values changeless' rationale is not strictly realized) is secondary but reinforces that the adversarial mechanism may not be doing what is claimed.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes MRAG, an invertible-neural-network framework for hiding a spatial RGB secret image inside a color JPEG cover and recovering it from the resulting JPEG stego. The architecture combines a local-range convolutional branch, a global-range transformer branch, an adaptive fusion module, and a frozen surrogate JPEG steganalyzer. A feature-level adversarial loss, called the angle-norm disentanglement loss, is applied to the classified features of the surrogate steganalyzer so that cover and stego features are pulled together in angle while their norm values are claimed to be preserved. Experiments on COCO, ImageNet, and BOSSBase report state-of-the-art secret restorability (PSNR above 40 dB), visual imperceptibility comparable to EFDR, and steganalysis detection accuracies approaching 50% against UCNet, EWNet, and DBS2Net.","tokens_in":13440,"tokens_out":3640,"duration_ms":43111,"significance":"If the central claims are substantiated, this would be a meaningful advance: MRAG appears to be the first color-JPEG image-hiding method that simultaneously achieves high secret restorability, visual imperceptibility, and steganalysis resistance. The architectural motivation from local- and global-range steganalysis features is sensible, and the reported secret restorability and visual-quality improvements over EFDR are large and consistent across three datasets. The paper also includes useful ablations of the range branches and fusion depth. However, the headline steganalysis-imperceptibility claim currently rests on evaluations against steganalyzers trained on HRJS stegos rather than on MRAG stegos, so the paper's most important conclusion is not yet adequately supported.","major_comments":[{"comment":"The central steganalysis-imperceptibility claim is not supported by the current evaluation protocol. In 'Experimental Settings', all steganalyzers used both as surrogates and as evaluators are trained on cover-stego pairs whose stego images are generated by HRJS, a bit-level JPEG steganographic method, not by MRAG. Table 3 therefore shows only that MRAG stegos evade detectors whose training distribution is blind to the specific embedding traces that MRAG introduces. Because adversarial training optimizes against exactly these detector families, near-50% accuracies are expected even if MRAG stegos are statistically distinguishable from covers by a detector trained on MRAG's own stego distribution. The authors should retrain UCNet, EWNet, and DBS2Net on MRAG-generated cover-stego pairs (and ideally include a steganalyzer architecture not used as a surrogate) and report detection accuracies in that adaptive setting. Without such experiments, the headline claim of 'steganalysis imperceptibility' is unsupported.","section":"Experimental Settings; Table 3"},{"comment":"The description of the angle-norm disentanglement loss is internally inconsistent. The text states that the loss 'keep[s] the norm values of S2(Ci) and S2(So) changeless,' but Ln = MSE(S2(Ci), S2(So)) in Eq. (3) is a mean-squared error between the full feature vectors. This loss penalizes all component-wise differences and thus changes both the angles and the norms of the feature vectors; it does not constrain the norm values to remain changeless, nor does it implement a genuine disentanglement of angle and norm. A norm-only loss such as (||S2(Ci)|| - ||S2(So)||)^2, or an explicit normalization step before computing cosine similarity, would be needed to realize the stated mechanism. As written, the paper's explanation of why the adversarial perturbation is confined to the angular space is not supported by the actual objective.","section":"Equation (3); Loss Function"},{"comment":"The number of affine coupling layers in the adaptive fusion module is selected on the test set. Table 4 reports that steganalysis imperceptibility is 'optimal when the number of layers is 3' and that this value is used in the final model, but the comparison is made across the same COCO test set used for the headline results in Tables 1-3. Selecting hyperparameters on the test set can inflate reported steganalysis resistance and invalidate the comparison with baselines that did not enjoy the same selection procedure. The authors should either use a separate validation split for this ablation or report results averaged over multiple random splits.","section":"Table 4; Ablation Study"}],"minor_comments":[{"comment":"There are formatting artifacts in the abstract, including 'm ulti-range r epresentations-driven' and 'M SEis'; these should be cleaned before submission.","section":"Abstract"},{"comment":"The notation 'A U, A E, and A D' in Table 3 is introduced without a clear definition of the subscripts; please define these consistently in the text or caption.","section":"Table 3"},{"comment":"The phrase 'MRAG can supply at least 2.95 dB PSNR advancement' is awkward; consider 'MRAG improves PSNR by at least 2.95 dB over EFDR.'","section":"Comparison Results"},{"comment":"The baselines include only ISN+, RIIS, and EFDR; a brief discussion of why steganalysis-resistant spatial-domain methods such as USAP and DIH-OAIN are not compared, even qualitatively, would help position the contribution.","section":"Related Works; Baselines"},{"comment":"The statement 'The code will be open-sourced on GitHub upon acceptance' means the experiments are currently not reproducible from the manuscript; consider releasing code or providing more implementation details in the supplementary material.","section":"Experimental Settings"}],"recommendation":"major_revision","confidential_remarks":"The key weakness is the steganalysis evaluation: near-50% detection rates against HRJS-trained steganalyzers do not establish undetectability. Please ask the authors for adaptive steganalysis experiments (training on MRAG stegos) and, ideally, for a steganalyzer architecture outside the three used as surrogates. If those experiments also give accuracies close to 50%, the paper would be a strong contribution. The exact values 50.00 and 50.05 in Table 3 also merit a sanity check to rule out a degenerate or non-converged detector."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things you should know about arXiv:2507.08343. First, the architecture is genuinely new: a two-branch invertible network that combines convolutional local features and transformer global features, with a feature-level adversarial loss that pulls cover and stego classified features together in angle and norm. Second, the secret-restorability numbers are the real story — PSNR over 40 dB on COCO, about 6 dB better than EFDR, and visual quality matches EFDR. If that holds up, it's a solid step forward for JPEG image hiding.\n\nWhat the paper does well: it tackles a practical format (color JPEG), uses a sensible invertible design with reversible frequency transforms, and the ablations show both branches matter. The t-SNE visualizations are convincing within the tested setup.\n\nThe soft spots are real and they are in the steganalysis evaluation. The steganalyzers — both the surrogate for the adversarial loss and the evaluators in Table 3 — are trained on cover-stego pairs where the stego images come from HRJS, a bit-level JPEG method. None are trained on MRAG stegos. So the near-50% detection rates show that MRAG stegos are not caught by steganalyzers built for a different embedding algorithm. That is a weak form of undetectability. A steganalyzer trained on MRAG's actual stego distribution could plausibly detect them, especially with a full RGB secret packed into a JPEG cover. The paper should include that adaptive attack, or at least clearly state the claim is limited to non-adaptive settings. This is the main issue.\n\nThere are two smaller issues worth mentioning. The norm-changeless loss is described as keeping the feature norms unchanged, but the Ln term in Eq. 3 is an MSE between feature vectors, which by definition penalizes norm differences. The loss pushes the vectors together in Euclidean space; the 'norm-changeless' rationale is not what the math does. And Table 4 selects the number of fusion layers on the test set, which is overfitting the architecture to the benchmark. No error bars either, which matters for values like 50.00.\n\nOverall: this is a serious piece of work, not a desk-reject. It needs a re-run of the steganalysis evaluation with same-algorithm trained steganalyzers, a corrected description of the loss, and a cleaner hyperparameter selection. I'd send it to peer review, but I'd tell the authors the adaptive steganalysis experiment is required rather than optional.","headline":"Strong hiding architecture and excellent restorability, but the steganalysis-imperceptibility claim is not yet supported because the evaluators are trained on HRJS stegos, not MRAG's own output; needs an adaptive evaluation.","tokens_in":13975,"tokens_out":3109,"would_cite":true,"duration_ms":33829,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper proposes MRAG, a multi-range adversarial stego generation framework that hides a full color image inside a color JPEG cover while keeping detection accuracy near random-guess level and secret recovery above 40 dB PSNR.","keywords":["image hiding","JPEG steganography","steganalysis imperceptibility","adversarial stego generation","invertible neural networks","features angle-norm disentanglement","multi-range representation","covert communication"],"falsifier":"Train a fresh steganalyzer on cover–stego pairs generated by MRAG itself and measure its detection accuracy; accuracy well above 50 percent, say above 80 percent, would contradict the steganalysis-imperceptibility claim. Re-running the paper's t-SNE feature-distribution experiment with that adaptive detector would show whether cover and stego features remain intermingled.","tokens_in":12941,"feed_emoji":"🕵️","tokens_out":9113,"duration_ms":85407,"temperature":0.7,"pith_summary":"This paper proposes MRAG, a framework for hiding one full color image inside another color JPEG image so that the resulting stego looks normal to both people and automated steganalyzers. It claims that by blending local and global image features and attacking the steganalyzer's internal feature space, MRAG achieves secret recovery above 40 dB PSNR on a standard dataset, visual quality on par with the strongest prior JPEG hiding method, and steganalysis detection accuracy close to 50 percent across three steganalyzers. If true, this would make image-level covert communication practical over JPEG, the world's most common lossy image format, rather than only over lossless spatial images.","feed_headline":"Above 40 dB: JPEG image hiding that steganalyzers call random","feed_subtitle":"MRAG embeds a secret image into a JPEG cover while keeping detector accuracy near 50 percent.","key_machinery":"The central mechanism is the features angle-norm disentanglement loss applied to the surrogate steganalyzer's classified features, the activations before its final fully connected layer. The loss maximizes cosine similarity between cover and stego feature vectors while minimizing their mean-squared-error difference, so the perturbation shifts features along the direction the steganalyzer associates with intra-class variation rather than with class difference. This is paired with a multi-range architecture: a convolution-based invertible local branch, a transformer-based invertible global branch, and an adaptive fusion module, which together place the hidden secret in both local and global frequency representations. Coarse-grained and fine-grained frequency decompositions feed the two branches, and the whole pipeline is invertible so the same forward and backward passes hide and reveal.","core_discovery":"The paper's central claim is that steganalysis imperceptibility and high-capacity image hiding are compatible in JPEG covers when the hidden message is placed not as bit-level noise but as an adversarial perturbation shaped by both local and global statistics. MRAG uses an invertible local branch built from convolutions and an invertible global branch built from transformers to encode cover and secret into the JPEG frequency domain, then an adaptive fusion module produces the stego. A features angle-norm disentanglement loss pulls the angles of the surrogate steganalyzer's pre-classification features for cover and stego together while holding their norms fixed, which the paper argues encodes the secret into perturbations the steganalyzer treats as irrelevant. The reported result is that restored secrets reach over 40 dB PSNR, visual quality matches the best available prior method, and detection accuracy of three steganalyzers falls to roughly 50 percent, i.e., random guessing.","pith_inferences":["The paper evaluates steganalysis resistance with detectors trained on stego images from HRJS, a bit-level JPEG steganography method, not on MRAG's own stegos; a steganalyzer trained on MRAG-generated stegos is the decisive test left open, and its accuracy could be far from 50 percent.","The same adversarial angle-norm mechanism may transfer to other transform-coded image formats such as WebP or AVIF, since it acts on frequency-domain features rather than JPEG-specific DCT layout.","If independent replication confirms the numbers, image hiding in JPEG covers would offer a 24 bits-per-pixel payload channel, a capacity far beyond classic bit-level steganography, with practical implications for covert communication and watermarking."],"forward_implications":["Color JPEG covers become usable for image hiding without sacrificing secret fidelity: restored secrets surpass 40 dB PSNR, well above the previous JPEG-hiding method's level.","Detection accuracy near 50 percent across three steganalyzers means a detector trained on conventional bit-level JPEG stego statistics cannot separate MRAG stegos from covers.","Training only on one dataset and testing on others keeps restored-secret quality high, indicating the learned hiding is not tied to a single image distribution.","Because the pipeline is invertible, hiding and revealing are handled by the same forward and backward computation, avoiding a separate learned extractor."],"supporting_citations":[{"why":"Establishes deep image hiding as embedding a full RGB image into another same-size image, the paradigm MRAG extends.","marker":"Baluja 2017"},{"why":"Provides EFDR, the only prior JPEG-cover image hiding method, the main baseline for visual imperceptibility and restorability.","marker":"Yang and Liao 2023"},{"why":"Provides RIIS, a robust spatial image hiding baseline that exhibits visible artifacts on JPEG covers, motivating the JPEG-specific design.","marker":"Xu et al. 2022"},{"why":"Supplies UCNet, the color JPEG steganalyzer used as surrogate and evaluation detector.","marker":"Wei et al. 2022"},{"why":"Supplies EWNet, a grayscale JPEG steganalyzer adapted to color and used as another detection metric.","marker":"Su, Zhao, and He 2021"},{"why":"Supplies DBS2Net, the third steganalyzer used for the evaluation.","marker":"Hu and Wang 2024"},{"why":"Source of the angle-norm disentanglement observation on classifier features that motivates the adversarial loss.","marker":"Liu et al. 2018"},{"why":"Supplies HRJS, the bit-level JPEG steganography method whose stego images are used to train the evaluation steganalyzers.","marker":"Yang et al. 2023"},{"why":"Provides the additive and enhanced affine coupling formulation used in the invertible branches.","marker":"Xiao et al. 2020"}],"fun_headline_variants":["Stego that fools steganalyzers: 40 dB JPEG hiding","JPEG hiding: 40 dB PSNR, 50% detector accuracy","Adversarial stego: JPEG covers that defeat detection","Multi-range fusion hides images in JPEG at 40 dB","Random-looking stego: JPEG hiding with near-zero detection"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The steganalysis claim rests on the assumption that detectors trained on stego images from a different bit-level JPEG method are a fair test of MRAG, because no detector in the paper is ever trained on MRAG's own stego images.","fun_headline_variants_meta":{"raw":{"variants":["Stego that fools steganalyzers: 40 dB JPEG hiding","JPEG hiding: 40 dB PSNR, 50% detector accuracy","Adversarial stego: JPEG covers that defeat detection","Multi-range fusion hides images in JPEG at 40 dB","Random-looking stego: JPEG hiding with near-zero detection"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000291,"raw_usage":{"total_tokens":1729,"prompt_tokens":1004,"completion_tokens":725,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":620,"completion_tokens_details":{"reasoning_tokens":635}},"tokens_in":620,"tokens_out":725,"duration_ms":7274,"temperature":1.0,"reasoning_tokens":635,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T18:20:44.681935+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train a fresh steganalyzer on cover–stego pairs generated by MRAG itself and measure its detection accuracy; accuracy well above 50 percent, say above 80 percent, would contradict the steganalysis-imperceptibility claim. Re-running the paper's t-SNE feature-distribution experiment with that adaptive detector would show whether cover and stego features remain intermingled.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Establishes deep image hiding as embedding a full RGB image into another same-size image, the paradigm MRAG extends."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies UCNet, the color JPEG steganalyzer used as surrogate and evaluation detector."},{"cited_title":"M.; and Song, L","cited_arxiv_id":null,"evidence_quote":"Source of the angle-norm disentanglement observation on classifier features that motivates the adversarial loss."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the additive and enhanced affine coupling formulation used in the invertible branches."}],"review_version":1}