Mini-Hide: Generative Image Steganography via Flip Watermarking for Reducing BER

Abstract

Generative image steganography is a key technology for secure information transmission, but existing deep learning-based generative steganographic methods suffer from an extremely high bit error rate (BER) and degraded steganographic image quality in low-bit-rate embedding tasks in which secret information needs duplication or padding to match the model input size. In addition, it is difficult to balance BER reduction and imperceptibility of stego-images. To address these issues, this paper proposes a novel generative image steganography algorithm based on flip watermarking, with the core novelty of designing a mirror flipping preprocessing mechanism to achieve a redundant watermark and eliminate information errors caused by duplication or padding, and constructing an end-to-end Mini-Hide steganographic framework to integrate flip watermarking with generative steganography for the first time. Specifically, the proposed method first converts the binary bitstream of secret information into a square matrix, and performs vertical, horizontal and vertical–horizontal mirror flipping on the matrix to form a redundant basic watermark, which is then expanded to a secret image with the same size as the cover image. After that, the secret image is preprocessed by a preparation network and then input into an encoding network together with the cover image to generate a stego-image. Finally, the generated stego-image is input into the decoding network to extract the secret image. Subsequently, the inverse operation of flip watermarking is performed on the extracted secret image to recover the original binary bitstream. Extensive experiments are conducted on the public COCO dataset ($256\times 256$ pixels) with BER, PSNR, and SSIM, and the proposed method is compared with state-of-the-art generative steganographic methods. Quantitative results show that the proposed method achieves a $0\%$ BER for secret information of $8\times 8$ to $64\times 64$ bits, and the BER is only $0.00002\%$ for $256\times 256$-bit secret information; the PSNR of stego-images reaches 37.75 dB, and the SSIM hits 0.96, which are 7.07 dB and 0.02 higher than those of the classic HiDDeN method ($64\times 64$ bit) respectively. We also validated the flip watermark module by integrating into other methods; the results also show that the PSNR of FNNS-D is improved by 13.12 dB ($256\times 256$), and the BER of SteganoGAN is reduced by $99.99\%$ ($256\times 256$ bit). In addition, the proposed method breaks the embedding size limit of HiDDeN (≤$64\times 64$ bit) and supports up to $256\times 256$-bit secret information embedding with stable performance. This work significantly reduces the BER of generative image steganography while improving the visual quality of stego-images, provides a new preprocessing and optimization scheme for low-BER generative steganographic algorithm design, and also offers a universal lightweight module for performance improvement of existing steganographic methods, which has important theoretical and practical significance for enhancing the security and reliability of covert information transmission in the field of information security.

1. Introduction

Image steganography is a crucial branch in the field of information steganography, with its core process consisting of three key phases: information embedding, information transmission, and information extraction. In the information embedding phase, the secret information is first converted into a data format suitable for embedding (e.g., binary stream or image) and embedded into the cover signal (e.g, image, audio, or video) via specific steganographic algorithms. During the information transmission phase, the stego-signal is transmitted to the receiver through a public channel; this process typically requires ensuring no significant visual or auditory differences between the stego-signal and the original cover signal to avoid attracting attackers’ attention. In the information extraction phase, the receiver uses the corresponding extraction algorithm to recover the original secret information from the stego-signal. The core objective of this process is to achieve the secure transmission of secret information without arousing external suspicion.

Although existing steganographic methods can hide secret information, they suffer from relatively high detection rates, which seriously restricts the security of their practical applications. Most of these methods are based on simple algorithms (e.g., LSB [1], the Least Significant Bit replacement algorithm). While achieving a certain level of information hiding, the concealed data can be easily extracted through statistical feature-based analysis and other techniques. However, existing generative steganography methods, such as Balujia [2], HiDDeN [3], HiNet [4], etc., have made progress in terms of embedding capacity and imperceptibility, but perform poorly in steganographic tasks with secret information below 1 bit per pixel (bpp). This issue stems from the core design principle of these methods: embedding as much information as possible without compromising the quality of the cover medium. When applied to steganographic tasks with secret information below 1 bpp, the secret data typically requires duplication or padding to match the input size. Such processing easily introduces information errors during network transmission, not only leading to a significant increase in BER but also reducing steganographic efficiency. Furthermore, duplication and padding operations may further amplify errors during the information extraction phase, especially when the cover signal is subjected to noise interference or attacks. Therefore, determining how to reduce the BER while ensuring high imperceptibility has become a critical and urgent issue to be addressed in the field of image steganography.

To address the aforementioned issues, this paper proposes a novel generative image steganographic method based on flip watermarking, aiming to balance steganalysis resistance and bit error rate (BER) reduction. Compared with existing methods, the proposed approach embeds secret information in the form of flip watermark images, optimizing the information embedding process. Meanwhile, leveraging the generative capability of generative steganography, it generates highly imperceptible stego-images while reducing the BER. Extensive experiments have verified the effectiveness of the proposed method, which significantly improves the performance of steganographic tasks. This research not only provides an effective solution for the steganography field but also offers new perspectives and ideas for the further development of information steganographic technologies. The main contributions are summarized as follows:

(1)

A flip watermarking-based preprocessing method is proposed for the binary bitstream of secret information, which converts the binary bitstream into a square matrix and performs vertical, horizontal, and vertical–horizontal mirror flipping to construct a redundant watermark structure. This structure is then expanded to match the size of the cover image, fundamentally solving the problems of high BER and information errors caused by duplication/padding operations for size matching in traditional methods, and realizing efficient and low-error embedding of secret information.

(2)

The study systematically elaborates the intrinsic mechanism by which the redundant structure achieved through flipped watermarking reduces the global BER: it introduces an implicit regularization effect for steganographic perturbations and spatial correlation, optimizes gradient propagation to disperse error propagation during network training, and establishes a dual safeguard mechanism (nonlinear filtering, dynamic range alignment, hard-threshold binarization) for information recovery in the decoding phase. These findings provide a new theoretical basis for the design of low-BER steganographic algorithms.

(3)

By combining flip watermarking technology with generative image steganography, the study realizes the organic integration of the error tolerance of watermarking and the imperceptibility of generative models, breaking the single design idea of traditional generative steganography, which only focuses on “maximizing embedding capacity”. It provides a new research direction for the development of high-security low-BER information steganographic technologies, and has important practical value for the secure transmission of secret information.

The structure of this paper is organized as follows: Section 2 introduces related work; Section 3 elaborates on the generative image steganographic method based on flip watermarking in detail; Section 4 presents the experimental tests of this research in detail; and Section 5 concludes the paper.

2. Related Work

2.1. Information Steganography

The research on information steganography encompasses the embedding of secret information in various forms, including text, images, audio, and video. Based on technical principles and development stages, steganographic methods can be categorized into two main types: steganographic methods based on spatial or frequency domain pixel modification, and deep learning-based steganographic methods. Both types have been continuously optimized for embedding capacity and imperceptibility, but there are still critical shortcomings in BER and stego-image quality, especially for low-bit-rate embedding tasks.

2.1.1. Steganographic Methods Based on Spatial or Frequency Domain Pixel Modification

The LSB method is one of the earliest and most widely used steganographic techniques. It embeds secret information by directly modifying the least significant bits of pixels in the cover image, offering core strengths of simple implementation, high computational efficiency and lossless cover image quality. Similar spatial domain-based approaches include the improved LSB algorithm proposed by Imaizumi et al. [5], multi-bit plane steganography by Nguyen et al. [6], PVD-based steganography by Pan et al. [7], and the Hide-and-Seek [8] algorithm, while histogram shifting steganography [9] and palette steganography [10] are typical variants that optimize embedding capacity on the basis of LSB.

However, such methods are vulnerable to detection by professional steganalyzers: first, pixel-level modification will introduce obvious statistical feature changes in the cover image, which can be easily detected by modern steganalysis techniques (e.g., difference image histogram detection [11], preserved statistics-based steganalysis [12]), leading to extremely low security in practical applications; second, the embedding process lacks redundant design for information recovery, and the BER will rise sharply when the stego-image is subjected to noise interference or geometric distortion; third, the embedding capacity is limited by the pixel bit depth, and it is difficult to adapt to the high-capacity and low-BER requirements of modern covert communication. Studies by Dumitrescu et al. [13], Böhme [12], and Zhang et al. [11] have all confirmed that traditional steganographic methods cannot meet the security and robustness requirements of practical scenarios due to the above defects.

2.1.2. Deep Learning-Based Steganographic Methods

To overcome the limitations of traditional steganographic methods, researchers have proposed novel steganographic approaches based on deep neural networks, which leverage end-to-end learning frameworks to learn the optimal perturbation distribution of cover images, thus generating stego-images that are more difficult to detect. This category of methods has become the mainstream of current research, and has evolved into four main branches—handcrafted feature-based deep steganography, GAN-based generative steganography, invertible neural network (INN)-based steganography, and diffusion/flow-based steganography—each with distinct strengths and targeted weaknesses.

Handcrafted feature-based deep steganography: HUGO [14], WOW [15] and S-UNIWARD [16] are representative works. Their strengths lie in the design of adaptive distortion functions—HUGO prioritizes pixel modification with minimal distortion, while WOW and S-UNIWARD embed information in texture-rich regions of cover images (spatial/frequency domain), which effectively improves the imperceptibility of stego-images. However, their distortion functions are manually designed and thus lack generalization ability, and the embedding process is still based on pixel-level modification, so the anti-steganalysis ability is limited, and the BER is not optimized in the algorithm design.

GAN-based generative steganography: Generative Adversarial Networks (GANs [17]) have brought a paradigm shift to image steganography by generating stego-images through adversarial training, which significantly enhances imperceptibility. AdaSteg [18] realizes adaptive local information hiding via deep reinforcement learning, and SSGAN [19] even synthesizes cover images from scratch to obscure the source of secret information. Nevertheless, such methods have obvious limitations in low-bit-rate tasks: to match the model input size, secret information needs to be duplicated or padded, which directly leads to a sharp increase in BER; in addition, the training of GAN models is prone to mode collapse, which reduces the stability of steganographic performance.

INN-based steganography: Represented by Glow [20,21], RIIS [22], HiNet [4] and DeepMIH [23], this branch uses reversible mapping to realize efficient embedding and extraction of secret information, with high embedding capacity and low computational cost of recovery. However, their reversible network structure is sensitive to noise interference, and the BER will escalate rapidly when the stego-image is damaged; meanwhile, the INN-based model focuses on the design of invertible mapping and ignores the preprocessing optimization of secret information, so it cannot solve the BER problem caused by duplication/padding in low-bit-rate tasks.

Diffusion/flow-based steganography: With the rise in diffusion models and flow-based theory, CRoSS [24] realizes the conversion of secret images to cover images via a public–private key mechanism, and GSN [25] directly generates realistic cover images for covert communication, with high security and no need for explicit stego-image generation. Flow-based methods [26,27,28,29] also show advantages in image hiding and recovery due to their excellent feature modeling ability. However, these models suffer from high training cost, low embedding speed, and limited embedding capacity; in addition, similarly to other deep learning methods, they lack targeted optimization for BER in low-bit-rate tasks.

In recent years, the performance of deep learning-based steganographic methods in terms of imperceptibility has been continuously improved, as shown in

Table 1. Performance comparison of existing SOTA deep learning-based steganography and watermarking methods in terms of PSNR and SSIM. S and W respectively denote steganography and watermarking.

Year	Model	Pub.	Type	PSNR (dB)	SSIM
2023	RoSteALS [30]	CVPR	S	34.460	0.890
2023	LISO [31]	ICLR	S	33.830	0.900
2023	ARWGAN [32]	TIM	W	36.660	0.969
2023	Adaptor [33]	TSCVT	W	37.630	0.953
2024	DWT-GAN [34]	ESWA	S	44.570	0.993
2024	SE-NDEND [35]	BSPC	W	45.8492	0.9874
2025	DenseJIN [36]	ITCS	S	40.253	0.978
2025	EUIN-Net [37]	JISA	S	34.960	0.980
2025	SNR [38]	Neurocomputing	S	44.1131	0.9876
2026	I2IStega [39]	SP	S	36.160	0.910
2026	RWP [40]	NN	W	32.99	0.952
2026	HHN-NDEND [41]	ESWA	W	47.683	0.989

, where the latest SOTA methods (e.g., DWT-GAN, SNR) even achieve a PSNR of over 44 dB and an SSIM of over 0.98. However, these methods all take PSNR and SSIM as the core optimization objectives; for low-bit-rate embedding tasks, the problem of high BER caused by secret information duplication/padding has not been effectively solved, and it is difficult to balance the three core requirements of imperceptibility, embedding capacity and low BER. This is the most critical research gap in the current generative image steganography field.

2.2. Flip Watermarking Methods

The concept of flip watermarking originates from periodic watermarking, which is a classic technology for copyright protection and information authentication. A representative example is the periodic watermarking scheme proposed by Voloshynovskiy et al. [42], which arranges watermark units in a periodic structure, and its main advantage is that the periodicity can be identified via the autocorrelation function (ACF) or magnitude spectrum (MS), thus realizing the recovery of watermarks damaged by geometric distortions. However, the periodic structure can easily be detected, and the robustness to nonlinear geometric warping is insufficient.

Building on periodic watermarking, Ma et al. [43] proposed an improved symmetric watermarking scheme, which performs flipping operations on watermark units and introduces a mask calculation mechanism during the flipped tiling stage. This flip watermarking scheme makes up for the defects of periodic watermarking, with strong resistance to geometric warping distortions and high watermark robustness; the redundant structure of watermark units that have undergone mirror flipping also provides a new idea for error reduction in information transmission. Nevertheless, existing watermark flipping methods have two main limitations: first, they are only applied to the field of watermarking, and have not been combined with image steganography technology to solve the core problems of steganography (e.g., BER, embedding capacity); second, the structure for generating flipped watermarks is not optimized for the input requirements of generative steganographic models, and cannot be directly adapted to the end-to-end steganographic framework.

To the best of our knowledge, there is no research that combines flip watermarking with generative image steganography—this is an important research blank between the two fields. The redundant watermark structure achieved by mirror flipping has a natural advantage in reducing information transmission errors, which can just solve the high BER problem of generative steganography in low-bit-rate tasks; meanwhile, the generative steganographic framework can make up for the defect of flip watermarking in imperceptibility, thus realizing the mutual complementarity of the two technologies.

2.3. Novelty of the Proposed Method Against Prior Works

To clearly highlight the uniqueness and innovation of the proposed flip watermarking-based generative image steganography method, this subsection systematically compares the proposed method with existing SOTA steganography (S) and watermarking (W) methods (Table 1) and classic generative steganography methods, and clarifies the improvements and differences from the perspectives of technical integration, problem solving, performance optimization and framework design. The key innovations and improvements are summarized as follows:

(1)

First integration of flip watermarking and generative image steganography: Existing flip watermarking methods are only used for watermarking, and existing generative steganography methods lack the design of redundant error reduction for secret information. The proposed method is the first to combine these two technologies, and optimizes the flipped-watermark-generation structure to adapt to the input requirements of the generative steganographic model, filling the research gap between the two fields.

(2)

Balancing three core indicators of steganography with a multi-objective loss function: The proposed method constructs a Mini-Hide framework consisting of a preparation network, an encoding network and a decoding network, and designs a total loss function fusing hiding loss and decoding loss. This framework realizes the simultaneous optimization of low BER, high imperceptibility and large embedding capacity, which makes up for the defect whereby existing SOTA methods cannot balance the three core indicators.

(3)

Universal optimization module for existing steganographic methods: The flip watermarking module designed in this paper is a lightweight and general module, and can be directly integrated into existing classic generative steganography methods. The experimental results show that the module can significantly reduce the BER of existing methods and improve the PSNR/SSIM indicators, making it a valuable optimization scheme for the existing steganography method system.

3. Methodology

This section elaborates on the core methodology of this paper, sequentially introducing the model structure and the generation process of flip watermarking, and finally summarizing the overall steganographic workflow and loss function configuration.

3.1. Model Structure

The proposed model is constructed based on Balujia [2], consisting of three core sub-networks—a preparatory network, an encoding network, and a decoding network—aiming to achieve efficient image steganography. Specifically, the preparatory network comprises 6 convolutional layers, each followed by a ReLU activation function, and is designed to extract the initial features of the secret image (denoted as $I_s$). The encoding network serves as the core module of the model, consisting of 16 pairs of “convolutional layer + ReLU activation function layer” (each pair follows the structure of a convolutional layer immediately succeeded by a ReLU activation function layer). Its function is to fuse the secret image features output by the preparatory network with the cover image, generating the final stego-image (denoted as $I_{stego}$) to complete information hiding. The decoding network shares an identical structure with the encoding network, whose core role is to recover the original secret image from the stego-image.

3.2. The Proposed Flip Watermarking

Before embedding secret information into the cover image, it needs to be first converted into an image watermark format suitable for embedding. Inspired by the method proposed by Ma et al. [19], this paper designs a differentiated watermark generation method, whose process is illustrated in Figure 1. Through the custom watermark generation function, this method converts secret information into a watermark image. During the conversion process, the secret information to be hidden is firstly transformed into a binary matrix $W_o\in {\{0,1\}}^{m\times m}$, where the elements take values of 0 or 1, representing black and white pixels, respectively. To expand the secret information and form a secret watermark image, the generated binary matrix $W_o$ is subjected to mirror flipping to produce four flipped versions. This process can be described by Equations (1)–(3) as follows:

$$W_v=fli{p}_{vertical}\left(W_o\right),$$

(1)

$$W_h=fli{p}_{horizontal}\left(W_o\right),$$

(2)

$$W_m=fli{p}_{horizontal}\left(fli{p}_{vertical}\left(W_o\right)\right),$$

(3)

where $fli{p}_{horizontal}$ and $fli{p}_{vertical}$ represent horizontal mirror flipping and vertical mirror flipping, respectively. Then, we obtain a basic watermark $W_b$ by concatenating $W_o$ with $W_h$, $W_v$ and $W_m$ as follows:

$$W_b=\left[\left.\begin{array}{cc}{W}_o& W_h\\ W_v& W_m\end{array}\right]\right.\in {\{0,1\}}^{2m\times 2m}.$$

(4)

Since the size of the base watermark may still be smaller than the dimensions $H\times W$ of the cover image, it may remain insufficient to match the size of the cover image. Therefore, the basic watermark $W_b$ needs to be copied multiple times until it is stitched to a macro watermark the same size as the cover image and saved as the final flipped watermark image. According to the image dimensions, the number of copies of the basic watermark and the cropping range after tiling can be calculated as

$$n_h=\left[{\displaystyle \frac{H}{2k}}\right],n_w=\left[{\displaystyle \frac{W}{2k}}\right].$$

(5)

3.2.1. Watermark Decoding

The process of watermark decoding consists of three key steps:

Step 1: Watermark Image Preprocessing: The receiving end converts the decoded watermark image into a grayscale image and eliminates color space discrepancies through dynamic range alignment. This process is described as follows:

$${\widehat{X}}_r={\displaystyle \frac{X_r}{255}}\times (max\left(W_b\right)-min\left(W_b\right))+min\left(W_b\right)$$

(6)

where $X_r$ denotes the received decrypted secret watermark image.

Step 2: Hard-Decision Binarization: Threshold segmentation is performed on the preprocessed image to recover the binary watermark matrix, as shown in Equation (7):

$$X_{bin}=\mathrm{I}({\widehat{X}}_r>0.5),$$

(7)

where $\mathcal{I}(·)$ is the indicator function, which maps pixel values to the set $\{0,1\}$.

Step 3: Secret Information Extraction: Based on the watermark unit size recorded during watermark generation, the complete macroblock region is cropped, and the original secret block in the top-left corner is extracted, as defined in Equation (9):

$$a_{rec}=X_{bin}[0:m,0:m],$$

(8)

where $\widehat{\mathbf{a}}$ denotes the recovered secret information, and $m\times m$ is the size of the original secret information.

3.2.2. Effects of Flip Watermarking

The redundant structure obtained by flip watermarking achieves error localization and reduces the global bit error rate (BER) through the following mechanisms:

(1) Regularization Effect of Mirror Redundancy: Flip watermarking expands secret information by performing vertical flip, horizontal flip, and vertical–horizontal flip, where each bit is duplicated to four different mirrored positions $W_o,W_h,W_v,W_m$ in the watermark image. During the process of training the neural network, this mirror redundancy structure introduces an implicit regularization effect, mainly reflected in the consistency of steganographic perturbations and regularization of spatial correlation. For the consistency of steganographic perturbations, if the steganographic methods among $W_o,W_h,W_v,W_m$ are inconsistent, the error between the stego-image and the cover image will increase, degrading steganographic quality. Therefore, the neural network will spontaneously learn that maintaining consistent perturbations across mirrored copies” is the optimal strategy, thereby reducing unnecessary steganographic noise and improving information recovery capability. For the regularization of spatial correlation, due to the symmetry of the watermark image in multiple directions, the network tends to adopt smooth perturbation patterns during optimization, avoiding over-modifying local pixels. This essentially acts as implicit regularization, stabilizing the steganographic embedding method and thus reducing the BER.

Mathematical Modeling of Mirror Redundancy Regularization Effect: Flip watermarking generates four mirrored versions of the original binary matrix $W_o\in {\{0,1\}}^{m\times m}$—$W_o$ (original), $W_h$ (horizontal flip), $W_v$ (vertical flip), $W_m$ (vertical–horizontal flip)—and concatenates them into the basic watermark $W_b\in {\{0,1\}}^{2m\times 2m}$. We define the steganographic pixel perturbation of the cover image at position $(i,j)$ as:

$$\mathrm{\Delta }(i,j)=I_{\mathrm{stego}}(i,j)-I_c(i,j)$$

(9)

where $I_c$ and $I_{\mathrm{stego}}$ represent the cover image and stego-image, respectively.

For the mirrored positions $(i,j)$, $(i,2m-j+1)$, $(2m-i+1,j)$ and $(2m-i+1,2m-j+1)$ in $W_b$, the perturbation consistency constraint imposed by the model’s hiding loss $L_C=\parallel I_c-I_{\mathrm{stego}}\parallel$ (Euclidean norm) can be expressed as:

$$\mathrm{\Delta }(i,j)=\mathrm{\Delta }(i,2m-j+1)=\mathrm{\Delta }(2m-i+1,j)=\mathrm{\Delta }(2m-i+1,2m-j+1)+\epsilon$$

(10)

where $\epsilon$ is the perturbation error, and the model optimizes $L_C$ to minimize $\epsilon \to 0$.

BER reduction derivation: If perturbations at mirrored positions are inconsistent ($\epsilon \gg 0$), the stego-image will produce unnecessary visual noise, leading to pixel value distortion in the watermark region during decoding and an increase in bit error probability $P_e$. By enforcing perturbation consistency, flip watermarking reduces the random noise of the watermark region by $\mathcal{O}\left({\epsilon }^2\right)$, and the global BER is reduced as follows:

$$\mathrm{BER}={\displaystyle \frac{1}{N}}\sum _{k=1}^N{P}_e\left(k\right)\propto {\displaystyle \frac{1}{N}}\sum _{k=1}^N\epsilon {\left(k\right)}^2$$

(11)

where N is the total number of bits of secret information. The mirror redundancy structure makes each bit of secret information correspond to four mirrored pixels, so the error tolerance threshold of a single bit is increased by 4 times, and the probability of a single bit error is reduced from $P_e$ to $P_e^4$.

(2) Optimization Effect of Gradient Propagation: During the training of the encoding/decoding network, the gradient of the total loss $L_{\mathrm{total}}=L_C+\beta L_R$ with respect to the watermark pixel $W_b(i,j)$ is ${\nabla }_{W_b(i,j)}{L}_{\mathrm{total}}$. For the symmetric structure of $W_b$, the gradient at mirrored positions satisfies:

$${\nabla }_{W_b(i,j)}{L}_{\mathrm{total}}={\nabla }_{W_b(i,2m-j+1)}{L}_{\mathrm{total}}={\nabla }_{W_b(2m-i+1,j)}{L}_{\mathrm{total}}={\nabla }_{W_b(2m-i+1,2m-j+1)}{L}_{\mathrm{total}}$$

(12)

This means the gradient of the loss function is uniformly propagated to the entire mirror region instead of being concentrated in a local pixel area.

Robustness improvement derivation: Local gradient concentration (a common problem in traditional steganographic methods) leads to overfitting of local pixel perturbations, making the stego-image sensitive to noise interference and geometric attacks. The uniform gradient propagation of flip watermarking makes the steganographic perturbation a smooth global pattern, and the perturbation variance of the watermark region is:

$$\mathrm{Var}\left(\mathrm{\Delta }\right)={\displaystyle \frac{1}{4m^2}}\sum _{i,j=1}^{2m}{(\mathrm{\Delta }(i,j)-\overline{\mathrm{\Delta }})}^2\ll \mathrm{Var}\left({\mathrm{\Delta }}_{\mathrm{non}-\mathrm{flip}}\right)$$

(13)

where $\overline{\mathrm{\Delta }}$ is the average perturbation of the watermark region, and $\mathrm{Var}\left({\mathrm{\Delta }}_{\mathrm{non}-\mathrm{flip}}\right)$ is the perturbation variance of non-flip watermarking. A smaller perturbation variance means the stego-image is less affected by external interference, thus improving robustness.

(3) Dual Safeguard Mechanism for Information Recovery: Flip watermarking not only optimizes the steganographic process but also provides additional error suppression capability during the decoding phase, mainly reflected in the following aspects: dynamic range alignment and hard-decision binarization, which eliminate systematic deviations and reduce decoding errors. A strict mathematical derivation for each step is given below:

Dynamic Range Alignment: This step eliminates the color space deviation between the decoded watermark image $X_r$ and the original basic watermark $W_b$. The aligned pixel value is

$${\widehat{X}}_r={\displaystyle \frac{X_r}{255}}\times \left(max\left(W_b\right)-min\left(W_b\right)\right)+min\left(W_b\right)={\displaystyle \frac{X_r}{255}}$$

(14)

since $W_b\in \{0,1\}$, $max\left(W_b\right)=1$ and $min\left(W_b\right)=0$. This step eliminates the systematic deviation $\delta =X_r/255-X_r$ in the original pixel value, reducing the deviation-induced error probability by 100% for all pixels.

Hard-Decision Binarization: We use the indicator function $I(·)$ to map the aligned pixel value to binary 0/1:

$$X_{\mathrm{bin}}=I\left({\widehat{X}}_r>0.5\right)=\left\{\begin{array}{cc}1,\hfill & {\widehat{X}}_r>0.5\hfill \\ 0,\hfill & {\widehat{X}}_r\le 0.5\hfill \end{array}\right.$$

(15)

The decoding error probability after binarization is defined as:

$$P_{\mathrm{dec}}=Pr\left({\widehat{X}}_r>0.5\mid W_b=0\right)+Pr\left({\widehat{X}}_r\le 0.5\mid W_b=1\right)$$

(16)

Dynamic range alignment makes ${\widehat{X}}_r$ concentrate in the neighborhood of 0 or 1, and the probability density function (PDF) of ${\widehat{X}}_r$ satisfies $f\left({\widehat{X}}_r\right|W_b=0)\approx \delta \left({\widehat{X}}_r\right)$, and $f\left({\widehat{X}}_r\right|W_b=1)\approx \delta ({\widehat{X}}_r-1)$ ($\delta (·)$ denotes the Dirac delta function), so $P_{\mathrm{dec}}\to 0$.

3.3. Mini-Hide

The steganographic workflow of the proposed method, Mini-Hide, consists of the following main steps: secret information preprocessing, flipped watermark generation, image embedding, image transmission, decoding and extraction, and secret information recovery. The workflow is illustrated in Figure 2.

Step 1: Secret Information Preprocessing: First, this paper converts the secret information in binary form to be hidden in a square matrix. This step serves as the foundation for subsequent steganographic processes, as it determines the type and size of the embedded data.

Step 2: Flipped Watermark Generation: Next, a watermark generation algorithm is utilized to convert the binary secret information into a flipped watermark image.

Step 3: Image Embedding: Once the flipped watermark image is generated, it is input into the preparatory network together with the cover image. The encoding network embeds the watermark image into the cover image in an imperceptible manner, generating a disguised cover image, i.e., the stego-image. This process ensures the visual imperceptibility of the secret information while maintaining the integrity of the cover image.

Step 4: Image Transmission: The disguised cover image can be transmitted and shared like ordinary images. Since the embedded watermark is invisible, it does not arouse any suspicion.

Step 5: Decoding and Extraction: At the receiving end, the receiver uses the decoding network to extract the embedded flipped watermark image.

Step 6: Secret Information Recovery: Finally, the extracted flipped watermark image is converted back to binary data through a decoding function.This decoding function is the inverse operation of the watermark generation process, including inverse transformation and mapping from the matrix to binary data. Thus, the entire steganographic workflow is completed.

3.4. Loss Functions

To optimize the steganographic model proposed in this study, this paper constructs a multi-objective optimization framework, aiming to balance the improvement of secret image recovery capability and the maintenance of cover image integrity. The comprehensive loss function of this study consists of two components: one is the hiding loss, designed to enhance the hiding effectiveness of the model; the other is the decoding loss, which aims to improve the recovery performance of the model and further boost the security of steganography.

3.4.1. Hiding Loss

The hiding loss is applied in the secret encoding process, intended to ensure that after the secret watermark image is embedded into the cover image, the resulting stego-image is as similar as possible to the original cover image. Its mathematical expression is given by:

$$L_C(X_c,X_s)=\left|\right|X_c-X_s\left|\right|,$$

(17)

where $X_c$ and $X_s$ denote the original cover image and the stego-image output by the model, respectively, and $\left|\right|·\left|\right|$ represents the Euclidean norm. By minimizing $L_C$, the model is trained to minimize the visual impact on the cover image, thereby enhancing the imperceptibility of steganography.

3.4.2. Decoding Loss

The decoding loss is designed to evaluate the model’s ability to recover secret information, quantified by calculating the difference between the secret image decoded by the decoding network and the original secret image. Its mathematical expression is given by

$$L_R(X_m,X_r)=\left|\right|X_m-X_r\left|\right|,$$

(18)

where $X_m$ and $X_r$ denote the original secret image and the secret image output by the decoding network, respectively. By minimizing $L_R$, the network is trained to accurately recover the original secret image from the stego-image.

3.4.3. The Total Loss Function

To balance the importance of the two loss functions, this study adopts a weighted average approach to fuse them into a total loss function. By adjusting the weight parameter $\beta$, the relative importance of the two loss functions in the total loss can be controlled. The mathematical expression of the total loss function is given as

$$L_{\mathit{total}}=L_C+\beta L_R,$$

(19)

where $\beta$ is a hyperparameter used to balance the impacts of the two loss functions. In the experiments of this study, the optimal $\beta$ value is selected through cross-validation.

3.5. Model Training

The proposed method was trained with Pytorch 2.0.1 and CUDA 11.8 on a server equipped with two NVIDIA RTX 3090s (24G), an Intel Xeon Gold 6330, and 128G RAM. We chose Adam as the optimizer. The batch size and training epochs were set to 32 and 1000, respectively. The learning rate was set to $1\times {10}^{-3}$, and it decayed by $10\%$ at intervals of 100 epochs. The loss weight was $\beta \in [0.1,1.0]$. Optimal values were determined via 5-fold cross-validation.

4. Experiments and Results

In this section, the experimental setup, datasets, experimental methods, and results of this study are depicted in detail. The goal is to evaluate the performance of our model in steganographic tasks with secret information of varying sizes and compare the performance differences among different methods.

4.1. Experimental Setup

This study designs four experimental schemes, using the COCO dataset and a self-generated watermark image dataset (size: $256\times 256$). Each scheme undergoes 1000 training and testing iterations, with the test results averaged. The details of the schemes are as follows:

(1)

Mini-Hide: A total of 3200 images are randomly selected from the COCO dataset and divided into two groups (cover images and secret images) for training. In the testing phase, watermark images generated by the proposed method are used.

(2)

CMini-Hide: In the training phase, 1600 images are separately selected from the COCO dataset as cover images and secret images. For testing, watermark images generated by Ma et al. [43]. method are used for validation.

(3)

BSMini-Hide: A total of 1600 images from the COCO dataset are used as cover images. Watermark images containing $256\times 256$-bit secret information are generated using the proposed watermark generation algorithm for training. Testing also employs watermark images generated by the proposed method.

(4)

BCmin-Hide: A total of 1600 images are selected from the COCO dataset as cover images. Watermark images containing $256\times 256$-bit secret information, generated by [43], are used as secret images for training. Testing adopts watermark images generated by [43].

It should be additionally noted that due to the particularity of [43], if the secret information exceeds $64\times 64$ bits during watermark image generation, the algorithm steps will be incomplete. Therefore, no comparative experiments are conducted for secret information exceeding this size.

Three evaluation metrics are adopted to measure the performance of the proposed model: BER, PSNR, and SSIM. BER is mainly used to evaluate whether the model can accurately recover the original secret information during watermark extraction. PSNR assesses the degree of image quality preservation after watermark embedding and extraction. As a supplementary metric, SSIM aims to evaluate the model’s overall performance from a more comprehensive perspective.

4.2. Experimental Results

4.2.1. Comparative Method Settings

This study uses 1000 randomly generated watermark images as experimental test subjects to evaluate the proposed watermarking technology. Comparisons with other existing deep learning-based steganographic methods, including Balujia [2], HiDDeN [3], Baluja [44], SteganoGAN [45], FNNS [46], SE-NDEND [35], RWP [40], and HHN-NDEND [41], demonstrate that the proposed method significantly outperforms these state-of-the-art approaches.

To ensure test fairness, the original settings of the steganographic methods from other papers were kept unchanged during testing, and the training methods described in the original papers were followed as closely as possible.

4.2.2. Comparison of Steganographic Quality

This study first conducted tests on the PSNR with the comparative results presented in

Table 2. PSNR comparison of carrier stego-images with different secret message sizes (bit) using various steganography methods.

Models	8 × 8 PSNR ↑	16 × 16 PSNR ↑	32 × 32 PSNR ↑	64 × 64 PSNR ↑	128 × 128 PSNR ↑	256 × 256 PSNR ↑
HiDDeN [3] (2018)	32.14 ± 0.31	29.70 ± 0.30	31.07 ± 0.31	30.98 ± 0.30	–	–
SteganoGAN [45] (2019)	16.32 ± 0.16	16.32 ± 0.16	16.31 ± 0.16	16.32 ± 0.16	16.30 ± 0.16	16.39 ± 0.17
FNNS-D [46] (2022)	35.96 ± 0.28	35.59 ± 0.27	34.98 ± 0.28	34.33 ± 0.28	32.07 ± 0.27	27.70 ± 0.29
SE-NDEND [35] (2024)	45.85 ± 0.43	45.19 ±0.43	44.67 ±0.43	43.28 ± 0.43	40.03 ± 0.43	34.62 ± 0.43
RWP [40] (2026)	32.99 ± 0.37	32.54 ±0.37	31.75 ±0.36	31.32 ± 0.35	30.17 ± 0.35	26.38 ± 0.32
HHN-NDEND [41] (2026)	47.68 ± 0.44	46.91 ±0.43	46.26 ±0.44	45.43 ± 0.41	43.86 ± 0.41	38.20 ± 0.39
Mini-Hide	27.92 ± 0.25	27.76 ± 0.25	27.88 ± 0.25	27.89 ± 0.25	27.86 ± 0.25	27.88 ± 0.25
CMini-Hide	28.74 ± 0.26	28.59 ± 0.26	28.61 ± 0.26	32.18 ± 0.27	–	–
BSMini-Hide	37.72 ± 0.30	37.74 ± 0.30	37.75 ± 0.30	37.71 ± 0.30	37.75 ± 0.30	37.75 ± 0.30
BCmin-Hide	36.85 ± 0.29	36.88 ± 0.29	36.75 ± 0.29	37.71 ± 0.30	–	–

. A comprehensive analysis of the experimental data reveals that the proposed watermarking technology exhibits excellent performance in terms of the PSNR metric. This result indicates that steganography based on encoding secret information into watermark images possesses distinct advantages in visual quality and distortion control. In addition, it is evident that the training schemes of BSMini-Hide and BCmin-Hide achieved better PSNR results than those of Mini-Hide and CMini-Hide, and the same trend is observed in the subsequent SSIM test results. Regarding HiDDeN [3], it could not be compared when the secret information exceeded $64\times 64$ bits due to its design constraints–it does not support embedding information exceeding 0.2 bits per pixel (bpp). Therefore, this technology is not suitable for comparative analysis when the size of secret information scales beyond $128\times 128$ bits. Furthermore, the test results of the SSIM are shown in

Table 3. Comparison of SSIM between cover images and stego-images with different bit sizes of secret information under various steganography methods.

Models	8 × 8 SSIM ↑	16 × 16 SSIM ↑	32 × 32 SSIM ↑	64 × 64 SSIM ↑	128 × 128 SSIM ↑	256 × 256 SSIM ↑
Balujia [2] (2017)	0.88 ± 0.02	0.86 ± 0.02	0.86 ± 0.02	0.87 ± 0.02	0.83 ± 0.02	0.82 ± 0.02
HiDDeN [3] (2018)	0.94 ± 0.01	0.92 ± 0.01	0.94 ± 0.01	0.94 ± 0.01	—	—
SteganoGAN [45] (2019)	0.69 ± 0.02	0.68 ± 0.02	0.66 ± 0.01	0.63 ± 0.01	0.60 ± 0.01	0.60 ± 0.01
FNNS-D [46] (2022)	0.94 ± 0.01	0.94 ± 0.01	0.93 ± 0.01	0.92 ± 0.01	0.85 ± 0.02	0.66 ± 0.03
SE-NDEND [35] (2024)	0.98 ± 0.02	0.98 ± 0.01	0.97 ± 0.01	0.94 ± 0.02	0.89 ± 0.02	0.73 ± 0.03
RWP [40] (2026)	0.95 ± 0.01	0.95 ± 0.01	0.93 ± 0.01	0.91 ± 0.02	0.84 ± 0.02	0.70 ± 0.03
HHN-NDEND [41] (2026)	0.99 ± 0.01	0.97 ± 0.01	0.94 ± 0.01	0.93 ± 0.02	0.90 ± 0.02	0.81 ± 0.03
Mini-Hide	0.83 ± 0.01	0.82 ± 0.01	0.82 ± 0.12	0.82 ± 0.02	0.82 ± 0.02	0.82 ± 0.02
CMini-Hide	0.86 ± 0.01	0.86 ± 0.01	0.86 ± 0.01	0.93 ± 0.02	—	—
BSMini-Hide	0.95 ± 0.01	0.94 ± 0.01	0.96 ± 0.01	0.96 ± 0.01	0.96 ± 0.01	0.96 ± 0.01
BCmin-Hide	0.95 ± 0.01	0.94 ± 0.01	0.95 ± 0.01	0.96 ± 0.01	—	—

.

Figure 3 presents the steganographic effect diagrams of the proposed method. As illustrated in Figure 3, for different sizes of secret information, corresponding watermark images are generated and embedded into cover images to obtain stego-images. It can be clearly observed that the stego-images are almost indistinguishable from the original cover images. Additionally, the proposed method compares the residual maps between stego-images and cover images under different secret information embedding scenarios. It should be noted that due to the similar residual distributions of different variants of the Mini-Hide method, only the residual map of one variant is presented as a reference, as shown in Figure 4. From the residual maps, it can be observed that after embedding secret information of varying sizes, the pixel changes in the residual parts are minimal, mainly concentrated in high-frequency regions (e.g., edges and details), while being almost invisible in low-frequency regions (e.g., sky and flat roads). This demonstrates that the proposed method can effectively preserve the overall structure and visual quality of the image.

Although the aforementioned PSNR and SSIM test results tend to indicate that the training schemes of BSMini-Hide and BCmin-Hide are slightly superior, the exact opposite trend is observed in the subsequent bit error rate tests. The experimental results in Table 3 confirm that the training scheme where both cover images and secret images are selected from the COCO dataset achieves better BER performance than BSMini-Hide and BCmin-Hide.

4.2.3. Comparison of Steganographic Bit Error Rates

Finally, this study further compares the bit error rates (BERs) of various algorithms. The BER is defined as the ratio of the number of erroneous bits in the decoded secret information to the total number of bits in the original secret information. The average value is calculated based on 1000 experimental tests. Detailed comparative results are presented in

Table 4. Comparison of steganographic decoding error rates (ER) for secret messages of different bit sizes across various steganography methods.

Models	8 × 8 ER (%) ↓	16 × 16 ER (%) ↓	32 × 32 ER (%) ↓	64 × 64 ER (%) ↓	128 × 128 ER (%) ↓	256 × 256 ER (%) ↓
Balujia [2] (2017)	1.10000 ± 0.03800	1.10000 ± 0.03900	0.10000 ± 0.00600	0.01000 ± 0.00100	0.00080 ± 0.00005	0.00300 ± 0.00040
HiDDeN [3] (2018)	0.08750 ± 0.00150	0.00100 ± 0.00010	0.00080 ± 0.00005	0.00180 ± 0.00010	–	–
SteganoGAN [45] (2019)	0.44032 ± 0.02381	0.39610 ± 0.01872	0.32509 ± 0.01564	0.19246 ± 0.00893	0.08946 ± 0.00478	0.03904 ± 0.00259
FNNS-D [46] (2022)	0.05523 ± 0.00241	0.041327 ± 0.00157	0.02464 ± 0.00138	0.00547 ± 0.00029	0.00017 ± 0.00001	0.00013 ± 0.00001
SE-NDEND [35] (2024)	0.05000 ± 0.00189	0.03800 ± 0.00143	0.02200 ± 0.00092	0.00500 ± 0.00017	0.00015 ± 0.00001	0.00011 ± 0.00001
RWP [40] (2026)	0.04500 ± 0.00165	0.03500 ± 0.00128	0.02000 ± 0.00087	0.00450 ± 0.00015	0.00013 ± 0.00001	0.00009 ± 0.00001
HHN-NDEND [41] (2026)	0.00010 ± 0.00009	0.00008 ± 0.00007	0.00006 ± 0.00005	0.00005 ± 0.00004	0.00002 ± 0.00002	0.00003 ± 0.00003
Mini-Hide	0.00000 ± 0.00000	0.00000 ± 0.00000	0.00000 ± 0.00000	0.00000 ± 0.00000	0.00001 ± 0.00001	0.00002 ± 0.00001
CMini-Hide	0.00000 ± 0.00000	0.00000 ± 0.00000	0.00000 ± 0.00000	0.00000 ± 0.00000	–	–
BSMini-Hide	0.00000 ± 0.00000	0.00000 ± 0.00000	0.00048 ± 0.00002	0.00007 ± 0.00001	0.00021 ± 0.00001	0.00024 ± 0.00001
BCmin-Hide	0.00000 ± 0.00000	0.00000 ± 0.00000	0.00000 ± 0.00000	0.00007 ± 0.00001	–	–

. It should be clarified that a lower BER indicates superior performance of the method. Methods found in this study to exhibit excellent BER performance are highlighted in bold. It can be observed that the BER of the proposed watermarking methods is generally maintained at an extremely low level, where “0” indicates an exact BER of 0 rather than a rounded value.

Based on the comprehensive analysis of the above experiments, the following conclusion is drawn: the watermarking-based steganographic method proposed in this paper significantly outperforms other existing steganographic methods in terms of BER.

4.2.4. Performance Gains of Mini-Hide

This subsection verifies the comprehensive advantages of the proposed method by comparing and analyzing the performance gains of the Mini-Hide watermarking method against mainstream existing methods (SteganoGAN, FNNS-D, Baluja) in two dimensions: BER and visual imperceptibility (PSNR/SSIM). Gain experiments were not conducted on HiDDeN due to incompatibility between its information embedding mechanism and the proposed method. Specifically, the watermark generation module of the proposed method was integrated into other mainstream methods for verification. The gain effects are presented as follows:

Table 5. The Mini-Hide watermark module’s PSNR gain for different steganography methods (with varying sizes of secret information).

Models	8 × 8 PSNR ↑	16 × 16 PSNR ↑	32 × 32 PSNR ↑	64 × 64 PSNR ↑	128 × 128 PSNR ↑	256 × 256 PSNR ↑
Balujia + Mini-Hide	37.57	37.68	37.71	37.72	37.71	37.73
SteganoGAN + Mini-Hide	20.12	20.11	20.10	20.10	20.10	20.11
FNNS-D + Mini-Hide	42.50	42.63	43.30	43.46	42.13	40.82

shows the PSNR gain effects of different methods,

Table 6. The Mini-Hide watermark module’s SSIM gain for different steganography methods (with varying sizes of secret information).

Models	8 × 8 (bit) SSIM ↑	16 × 16 (bit) SSIM ↑	32 × 32 (bit) SSIM ↑	64 × 64 (bit) SSIM ↑	128 × 128 (bit) SSIM ↑	256 × 256 (bit) SSIM ↑
Balujia + Mini-Hide	0.96	0.97	0.97	0.96	0.97	0.97
SteganoGAN + Mini-Hide	0.73	0.73	0.73	0.72	0.72	0.72
FNNS-D + Mini-Hide	0.99	0.99	0.99	0.99	0.99	0.99

presents the SSIM gain effects, and

Table 7. Error rate (ER) comparison of fusion models on images with various bit sizes.

Models	8 × 8 (bit) ER (%) ↓	16 × 16 (bit) ER (%) ↓	32 × 32 (bit) ER (%) ↓	64 × 64 (bit) ER (%) ↓	128 × 128 (bit) ER (%) ↓	256 × 256 (bit) ER (%) ↓
Balujia + Mini-Hide	0.00001	0	0	0.00001	0.00001	0
SteganoGAN + Mini-Hide	0.03125	0.00391	0.00098	0.00024	0.00006	0.00002
FNNS-D + Mini-Hide	0.00014	0	0.00009	0.00002	0	0

illustrates the BER gain effects. By comparing Table 2, Table 3 and Table 4 with the gain tables, it can be observed that the Mini-Hide watermarking method can significantly reduce the decoding BER of existing methods and effectively improve image visual quality.

To evaluate the robustness of the proposed method against common Gaussian noise and JPEG compression attacks in steganographic tasks, we conducted quantitative tests on the PSNR, SSIM and BER for secret information with sizes ranging from 8 × 8 to 256 × 256 bits under different attack intensities, including Gaussian noise with $\sigma =0.01,0.03,0.05$ and JPEG compression with quality factors $Q=75,85,95$, as shown in

Table 8. Quantitative comparison of Gaussian noise and JPEG compression attacks on different image sizes in terms of PSNR (Mini-Hide).

Attack	8 × 8	16 × 16	32 × 32	64 × 64	128 × 128	256 × 256
Mini-Hide	27.92	27.76	27.88	27.89	27.86	27.88
Gaussian Noise ($\sigma$ = 0.01)	27.91	27.74	27.86	27.87	27.84	27.86
Gaussian Noise ($\sigma$ = 0.03)	27.89	27.72	27.84	27.86	27.84	27.84
Gaussian Noise ($\sigma$ = 0.05)	27.86	27.68	27.81	27.84	27.81	27.81
JPEG Compression (Q = 75)	27.87	27.69	27.81	27.83	27.80	27.81
JPEG Compression (Q = 85)	27.90	27.72	27.85	27.86	27.83	27.85
JPEG Compression (Q = 95)	27.91	27.74	27.87	27.87	27.85	27.87

,

Table 9. Quantitative comparison of Gaussian noise and JPEG compression attacks on different image sizes in terms of SSIM (Mini-Hide).

Attack	8 × 8	16 × 16	32 × 32	64 × 64	128 × 128	256 × 256
Mini-Hide	0.83	0.82	0.82	0.82	0.82	0.82
Gaussian Noise ($\sigma$ = 0.01)	0.83	0.82	0.82	0.82	0.82	0.81
Gaussian Noise ($\sigma$ = 0.03)	0.83	0.82	0.82	0.81	0.81	0.81
Gaussian Noise ($\sigma$ = 0.05)	0.82	0.81	0.81	0.80	0.80	0.79
JPEG Compression (Q = 75)	0.82	0.81	0.80	0.79	0.79	0.78
JPEG Compression (Q = 85)	0.83	0.82	0.82	0.81	0.80	0.80
JPEG Compression (Q = 95)	0.83	0.82	0.82	0.82	0.82	0.82

and

Table 10. Quantitative comparison of Gaussian noise and JPEG compression attacks on different image sizes in terms of BER (Mini-Hide).

Attack	8 × 8	16 × 16	32 × 32	64 × 64	128 × 128	256 × 256
Mini-Hide	0	0	0	0	0.00001	0.00002
Gaussian Noise ($\sigma$ = 0.01)	0	0	0	0	0.00001	0.00002
Gaussian Noise ($\sigma$ = 0.03)	0	0	0	0.000002	0.000012	0.000023
Gaussian Noise ($\sigma$ = 0.05)	0	0	0	0.000008	0.000017	0.00003
JPEG Compression (Q = 75)	0	0	0	0.00001	0.00002	0.000029
JPEG Compression (Q = 85)	0	0	0	0.000003	0.000014	0.000022
JPEG Compression (Q = 95)	0	0	0	0	0.00001	0.00002

. The experimental results show that the Mini-Hide model exhibits excellent anti-interference performance, with all key performance metrics suffering only minimal degradation under various attack scenarios. Specifically, the PSNR of the model remains above 27.81 dB in all attack settings, with only a slight gradual decrease as attack intensity increases, and there is almost no fluctuation in PSNR values across different secret information sizes. For SSIM, the model achieves nearly consistent results with the attack-free state under low-intensity attacks ($\sigma \le 0.03$, $Q\ge 85$); a mild reduction is only observed under high-intensity attacks ($\sigma =0.05$, $Q=75$), and the minimum SSIM still remains at 0.78, which fully reflects the model’s strong ability to preserve the structural similarity of stego-images under interference. In terms of BER—the core metric for secret information recovery—the Mini-Hide model already maintains an ultra-low BER level in the attack-free state, with 0% BER for 8 × 8 to 32 × 32-bit secret information and only 0.00001% and 0.00002% BER for 128 × 128 and 256 × 256-bit secret information, respectively. Under low-intensity attacks ($\sigma =0.01$, $Q=95$), the model’s BER shows no detectable changes compared with the attack-free state; as attack intensity increases, only the BER of secret information with sizes of 64 × 64 bits and above has a marginal rise, while small-sized secret information (8 × 8–32 × 32 bits) consistently maintains a 0% BER. It is worth noting that all BER increments across different secret information sizes are extremely slight, and no obvious error amplification phenomenon occurs in the model during the information recovery process. In summary, the Mini-Hide model has strong robustness against Gaussian noise and JPEG compression attacks, and it can still ensure the high visual quality of stego-images and ultra-low bit error rate for secret information recovery under the interference by such common attacks.

4.3. Ablation Study

The quantitative results of the Flip vs. No-Flip experiment are presented in

Table 11. Performance comparison of flip watermarking (Mini-Hide) vs. no flipping (Mini-Hide-no-flip).

Secret Info Size (bit)	Model	BER (%)	PSNR (dB)	SSIM	$\mathit{\Delta }\mathbf{BER}$ (%)	$\mathit{\Delta }\mathbf{PSNR}$ (dB)	$\mathit{\Delta }\mathbf{SSIM}$
$8\times 8$	Flip	0	27.92	0.83	0.0921	−0.28	−0.01
	No-Flip	0.0921	28.20	0.84
$16\times 16$	Flip	0	27.76	0.82	0.0857	−0.31	−0.01
	No-Flip	0.0857	28.07	0.83
$32\times 32$	Flip	0	27.88	0.82	0.0789	−0.29	−0.01
	No-Flip	0.0789	28.17	0.83
$64\times 64$	Flip	0	27.89	0.82	0.0642	−0.27	−0.01
	No-Flip	0.0642	28.16	0.83
$128\times 128$	Flip	0.00001	27.86	0.82	0.00949	−0.25	−0.01
	No-Flip	0.0095	28.11	0.83
$256\times 256$	Flip	0.00002	27.88	0.82	0.00418	−0.23	−0.01
	No-Flip	0.0042	28.11	0.83

Note: $\mathrm{\Delta }\mathrm{BER}={\mathrm{BER}}_{\mathrm{no}-\mathrm{flip}}-{\mathrm{BER}}_{\mathrm{flip}}$, $\mathrm{\Delta }\mathrm{PSNR}={\mathrm{PSNR}}_{\mathrm{flip}}-{\mathrm{PSNR}}_{\mathrm{no}-\mathrm{flip}}$, $\mathrm{\Delta }\mathrm{SSIM}={\mathrm{SSIM}}_{\mathrm{flip}}-{\mathrm{SSIM}}_{\mathrm{no}-\mathrm{flip}}$. All BER values are exact without rounding.

, which includes the BER, PSNR, and SSIM of the two models for all secret information sizes and the corresponding performance change rates. The key results are highlighted (all BER values are exact, not rounded):

Key Quantitative Findings

(1) BER Reduction (Core Effect): The flip watermarking module reduces the BER by $0.00418\%$ to $0.0921\%$ for all secret information sizes, and achieves $\mathbf{0}\%$ BER for small-to-medium secret information (8 × 8 to 64 × 64 bits). In contrast, the no-flip model has a significantly higher BER that decreases with an increase in secret information size (consistent with the error amplification characteristic of traditional duplication/padding processing). (2) Slight Visual Quality Trade-off: The flip model has a minor drop in PSNR ($0.23$–$0.31$ dB) and SSIM ($0.01$) compared with the no-flip model. This slight trade-off is intentional and reasonable: the mirror redundancy structure of flip watermarking introduces minimal visual perturbations to the cover image, but in return achieves a dramatic reduction in BER. (3) Scalability Advantage: For large-scale secret information (128 × 128/256 × 256 bits), the no-flip model’s BER still reaches $0.0095\%/0.0042\%$, while the flip model’s BER is only $0.00001\%/0.00002\%$ ($\mathbf{99}.\mathbf{89}\%/\mathbf{99}.\mathbf{52}\%$ BER reduction), which verifies the excellent scalability of the flip watermarking module for large-capacity steganography—an advantage that traditional duplication/padding processing does not have.

4.4. Discussions

This section systematically interprets the experimental results of the proposed flip watermarking-based generative image steganography method (Mini-Hide), and objectively analyzes the core performance advantages, intrinsic trade-offs between redundancy and imperceptibility, inherent limitations of the method, practical application scenarios, and feasible future research directions.

4.4.1. Interpretation of BER Improvements

The most significant performance gain of the proposed Mini-Hide method is the reduction in the bit error rate of secret information recovery, which is the core solution to the research gap pertaining to high BER in existing generative steganography methods. The experimental results in Table 7 show that the Mini-Hide method achieves $0\%$ BER for small-to-medium secret information (8 × 8 to 64 × 64 bits), and only $0.00001\%$ and $0.00002\%$ BER for large-scale secret information (128 × 128 and 256 × 256 bits), which are far superior values to those achieved by state-of-the-art steganography methods. The fundamental reasons for this BER improvement are threefold, and are mutually reinforcing: Mirror redundancy of flip watermarking eliminates random bit errors: Each bit of the original secret information is mapped to four mirrored positions in the watermark image, forming 4-fold information redundancy. This structure introduces implicit regularization into the network training process, forcing the model to maintain consistent steganographic perturbations at mirrored positions (Equation (10)), thus eliminating unnecessary pixel noise and random bit errors caused by unstructured perturbations in traditional duplication/padding processing (Table 11 shows that the no-flip model has a BER of $0.0642\%$ for 64 × 64 bits).

Uniform gradient propagation suppresses error amplification: The symmetric structure of the flip watermark ensures that the loss gradient is uniformly propagated to the entire watermark region (Equation (12)), avoiding local gradient concentration in traditional methods that leads to overfitting of pixel perturbations. This disperses the propagation of local bit errors and prevents error amplification for large-scale secret information.

Decoding-stage error suppression optimizes recovery accuracy. The dedicated decoding process eliminates systematic deviations caused by color space discrepancies and floating-point pixel values, reducing the decoding error probability to near 0 (Equation (16)). This forms a dual error suppression mechanism with the embedding-stage optimization, further ensuring the accuracy of secret information recovery.

In addition, the performance gain experiment (Table 4, Table 5 and Table 6) shows that integrating the flip watermarking module into mainstream methods can reduce their BER by 90–$99.9\%$, which verifies that the BER improvement effect of flip watermarking is universal and transferable, not limited to the Mini-Hide model itself. This fully demonstrates the rationality and effectiveness of the flip watermarking design for solving the high BER problem in generative steganography.

4.4.2. Trade-Offs Between Redundancy and Imperceptibility

The flip watermarking method achieves ultra-low BER by introducing mirror redundancy, and this redundancy inevitably brings a slight trade-off with the imperceptibility of steganography, which is evaluated by PSNR and SSIM. The experimental results (Table 11) quantitatively show that compared with the no-flip model (without redundancy), the Mini-Hide model has a 0.23–0.31 dB drop in PSNR and a 0.01 drop in SSIM for all secret information sizes, which is the direct cost of introducing flip redundancy. However, this trade-off is reasonable, acceptable, and non-detrimental to steganographic security.

4.5. Limitations

Based on the experimental results and practical application tests, the proposed Mini-Hide method may have the following potential deficiencies: redundancy-induced computational and capacity constraints for ultra-large-scale secret information, insufficient robustness against strong geometric attacks, and slight imperceptibility loss for high-resolution cover images. The flip watermarking method relies on 4-fold mirror redundancy and tiling redundancy to reduce BER, and when the secret information size exceeds 512 × 512 bits when the size of cover images is 256 × 256, the repeated tiling of the basic watermark will increase the computational complexity and lower the redundancy. The proposed flip watermarking method only considers mirror symmetry, and lacks a dedicated geometric distortion correction mechanism (e.g., feature point matching, affine transformation correction) in the decoding stage, so it is sensitive to geometric attacks. The Mini-Hide method is optimized for 256 × 256 cover images, which is the mainstream size in steganography, and when applied to high-resolution cover images such as 512 × 512 and 1024 × 1024, the PSNR drop may increase due to the large number of watermark tilings.

4.6. Potential Applications

The proposed flip watermarking-based generative steganography method has low BER and good imperceptibility, and its application scenarios are highly matched with the demand for secure and covert data transmission in various fields, the method has important practical application value in the power system, and can be extended to digital media, government affairs, and military fields.

5. Conclusions

This study proposes a novel generative image steganography algorithm based on flip watermarking, aiming to solve the critical problem of high BER in existing deep learning-based generative steganography methods. The core innovation of the method is to design a flip watermarking preprocessing strategy for secret binary bitstreams, which constructs a mirror redundancy structure through vertical, horizontal, and vertical–horizontal flipping, and combines it with a three-subnetwork generative model to form the end-to-end Mini-Hide steganography framework. Extensive experimental results show that the proposed method achieves low BER and maintains good steganographic imperceptibility. Integrating the flip watermarking module into mainstream steganography methods can also significantly reduce their BER and improve their visual quality, verifying the universality and effectiveness of the flip watermarking technology. The in-depth discussion of the experimental results further clarifies the core reasons for BER improvement, the rationality of the trade-off between redundancy and imperceptibility, and the inherent limitations of the method, and expands the practical application scenarios. In the future, we will focus on solving the limitations of the current method, optimize the model from the aspects of adaptive redundancy, attack robustness, lightweight design and multi-modal fusion, and further improve the practical application value of the method in the field of information security.