Beyond Distortion Robustness: Rethinking Severe Cropping as Erasure-Resilient Message Embedding

arXiv:2608.18567v1 [cs.CR] 19 Aug 2026

Beyond Distortion Robustness: Rethinking Severe Cropping as Erasure-Resilient Message Embedding Bo Pang∗

Weibin Kong∗

Juntu Dong∗

bo_pang@hrbeu.edu.cn Harbin Engineering University Harbin, Heilongjiang, China

3360731163@hrbeu.edu.cn Harbin Engineering University Harbin, Heilongjiang, China

1930312281@hrbeu.edu.cn Harbin Engineering University Harbin, Heilongjiang, China

Minghan Li

Zhongping Zhang†

minghan@hrbeu.edu.cn Harbin Engineering University Harbin, Heilongjiang, China

zhongping@hrbeu.edu.cn Harbin Engineering University Harbin, Heilongjiang, China

Abstract

Keywords

Robust message embedding in images is important for multimedia security applications such as copyright protection and content tracing. Existing methods are largely developed under a distortion robustness paradigm, where the embedded signal remains spatially present but is degraded by noise, blur, or compression. Severe cropping poses a fundamentally different challenge because it removes part of the carrier itself, causing partial payload disappearance rather than mere signal corruption. In this paper, we revisit robust message embedding from an erasure-resilience perspective and present CREST, a proof-of-concept framework for severe-croppingrobust embedding. CREST combines coding-theoretic redundancy with neural embedding and recovery by expanding a compact QR message into a redundant spatial payload via LT fountain coding and coupling it with cropping-aware embedding and fragment recovery. Experiments on COCO, DIV2K, and VOC2012 show that CREST improves recovery under severe cropping while maintaining competitive visual quality. Under mixed distortions with an area retention ratio of 0.7, CREST improves TRA from 18.52% to 68.45% and reduces EMR from 13.88% to 4.21% over the strongest baseline. On COCO2017, CREST still achieves 48.55–65.12% TRA when only 30–50% of the image area is retained, whereas all compared baselines fail to recover the message1 . These results suggest that severe cropping is better understood as an erasure problem rather than a conventional distortion problem, motivating the joint design of neural embedding and coding-based recovery.

robust message embedding, image steganography, multimedia security, fountain codes, normalizing flow, cropping resilient

CCS Concepts • Security and privacy → Information-theoretic techniques; Digital rights management; • Computing methodologies → Neural networks. ∗ Denotes equal contribution. † Corresponding author. 1 Code: https://github.com/ZPZhangLab/CREST-ACMMM2026

This work is licensed under a Creative Commons Attribution 4.0 International License. MM ’26, Rio de Janeiro, Brazil © 2026 Copyright held by the owner/author(s). ACM ISBN 979-8-4007-2213-4/2026/11 https://doi.org/10.1145/3767308.3832542

ACM Reference Format: Bo Pang, Weibin Kong, Juntu Dong, Minghan Li, and Zhongping Zhang. 2026. Beyond Distortion Robustness: Rethinking Severe Cropping as ErasureResilient Message Embedding. In Proceedings of the 34th ACM International Conference on Multimedia (MM ’26), November 10–14, 2026, Rio de Janeiro, Brazil. ACM, New York, NY, USA, 10 pages. https://doi.org/10.1145/3767308. 3832542

Host Image Traditional methods Cropped Image Stego Image

Secret

Crop

A kitten hugging a teddy bear.

Fountain-Coded Payload

Decoded QR

Stego Image

Cropped Image

Decoded QR

Crop

CREST (Ours)

Figure 1: Under severe cropping and global distortions, conventional distortion-robust methods degrade sharply (top), whereas CREST maintains more reliable decoding through erasure-resilient message embedding (bottom).

1

Introduction

Robust message embedding in images is a core problem in multimedia security, with applications including copyright protection [16, 47], content tracing [20, 32], and physical-to-digital content linking [10, 29]. Recent learning-based methods have significantly improved the ability to hide machine-readable information in natural images while surviving common degradations such as JPEG compression, Gaussian noise, blur, and printing [10, 19, 26– 29, 35, 38, 41, 47]. In most of these settings, however, the embedded signal is still spatially present: it may be weakened, blurred, or

MM ’26, November 10–14, 2026, Rio de Janeiro, Brazil

contaminated, but it is not physically removed. As a result, existing robust embedding pipelines are predominantly developed under a distortion robustness paradigm [19, 27, 28, 35, 38, 47], as shown in the top row of Figure 1. Severe local cropping does not fit this paradigm well. Unlike global distortions that perturb the image while preserving its spatial support, cropping directly removes part of the carrier and therefore destroys part of the embedded payload itself [22, 25, 37]. Once a sufficiently large region is discarded, decoding can fail catastrophically because the remaining fragments no longer contain enough usable information for reliable recovery. From this viewpoint, cropping is fundamentally not just another distortion. Rather, it is a form of spatial erasure: the key difficulty lies not only in denoising or synchronization, but in recovering a message after part of its support has disappeared [22, 25]. This observation motivates the central premise of this paper: cropping robustness in message embedding should be revisited from an erasure-resilience perspective. When severe cropping behaves like partial payload erasure, coding-theoretic redundancy becomes a natural design tool [4, 17, 24, 39, 40]. In principle, one can spread the message across a larger redundant spatial representation so that recovery remains possible from surviving image fragments. However, this idea also introduces a second challenge. Enlarging the payload substantially increases the amount of information that must be embedded, which raises model complexity, computational cost, and perceptual risk [2, 10, 41]. Therefore, the problem is not simply how to improve robustness under cropping, but how to jointly address cropping-induced information loss and redundancyinduced embedding overhead. In this paper, we instantiate this perspective through CREST, a Cropping-Resilient and Efficient STeganographic framework, as shown in Figure 1 (bottom row). Rather than treating cropping as a minor extension of distortion robustness, CREST serves as a proof-of-concept system for fountain-coded erasure-resilient message embedding [4, 17, 24]. At the message level, the secret message is expanded into a redundant spatial payload through LT fountain coding, enabling recovery from partial observations [4, 17, 24, 29, 41]. At the extraction level, pilot-guided localization and residual enhancement are introduced to stabilize tile parsing and improve the reliability of fragment recovery under severe cropping [5, 28, 29, 35]. At the training level, cropping-aware curriculum learning further strengthens robustness under progressively harsher erasure conditions [10, 28, 29, 41]. Finally, we incorporate a lightweight distilled attention-flow design to reduce model complexity introduced by the redundant payload. This formulation leads to a different way of thinking about robust multimedia embedding. Under the conventional view, cropping is often handled as a special case of geometric distortion or synchronization failure [19, 29, 47]. Such a treatment may remain effective when the cropped region is relatively small, but it becomes increasingly inadequate under severe cropping, where a substantial fraction of the payload may simply disappear [22, 25, 37]. Under our view, cropping should instead be addressed through the joint design of neural embedding, spatial redundancy, and coding-based reconstruction [4, 17, 24, 27]. This shift is important because it changes both the objective and the system design: the goal is no longer merely to preserve a fragile hidden signal under perturbation, but

Bo Pang, Weibin Kong, Juntu Dong, Minghan Li, and Zhongping Zhang

to ensure recoverability even when part of the embedded support is physically absent. Extensive experiments on COCO, DIV2K, and VOC2012 validate this perspective. The proposed framework achieves substantially stronger recovery under severe cropping while maintaining competitive visual quality and favorable efficiency. For example, under mixed distortions with an area retention ratio of 0.7, CREST improves TRA from 18.52 to 68.45 and reduces EMR from 13.88 to 4.21 compared with state-of-the-art baselines. On COCO2017, when only 30–50% of the image area is retained, CREST still achieves a TRA around 48–65, whereas competing methods fail to recover the message. More importantly, the results suggest a broader research direction: robust message embedding under localized content loss may be better approached as a hybrid problem at the intersection of multimedia representation learning and erasure-resilient communication, rather than as a straightforward extension of distortionrobust steganography [27, 39, 41]. Our main contributions are summarized as follows: • We argue that severe cropping in robust message embedding is better understood as a spatial erasure problem rather than a conventional distortion problem, and we introduce an erasureresilience perspective for this setting. • We present CREST, a proof-of-concept robust embedding framework that combines LT-coded redundant payload construction, pilot-guided localization, enhanced residual recovery, and croppingaware training for severe-cropping scenarios. • We show that the redundancy required for erasure resilience can be coupled with a lightweight distilled attention-flow design to achieve a more favorable robustness–efficiency trade-off. • Experiments on multiple datasets demonstrate that CREST substantially improves recovery under severe cropping while maintaining competitive visual quality and efficiency.

2

Related Work

Robust Image Steganography. Recent robust image steganography has largely evolved toward deep end-to-end and invertible embedding frameworks [16, 23, 47]. Subsequent studies improve robustness through physical-world embedding [29], applicationoriented embedding [10], invertible robust hiding [35], frequencyaware design [19], printer-proof optimization [28], and generative or attention-flow-based models [26, 41]. More recent work further considers coding-aware or provable robustness [27, 38]. Related multimedia learning tasks also investigate image manipulation, fine-grained signal analysis, and efficient representation [44–46]. Despite these advances, most robust embedding methods assume that the hidden signal remains spatially present but is degraded by noise, blur, compression, or other distortions [41]. This assumption becomes less suitable when severe cropping physically removes part of the embedded support. Cropping Robustness and Erasure-Resilient Recovery. Croppingrobust watermarking and message embedding have been studied under screen-shooting, partial-capture, and geometric-attack scenarios [5, 8, 9, 20, 22, 25, 32]. Most existing approaches primarily address synchronization or localization, whereas severe cropping additionally raises the question of whether sufficient information survives for decoding. This connects the problem to erasure-resilient

Beyond Distortion Robustness: Rethinking Severe Cropping as Erasure-Resilient Message Embedding

MM ’26, November 10–14, 2026, Rio de Janeiro, Brazil

Figure 2: Overview of CREST. (a) A CRC32-augmented QR message is LT-encoded into a redundant fountain-code payload. (b) Teacher and student ITF-AACB branches embed the payload into the host image. (c) Training-time distillation aligns their ViT features using Flow-RAA and Flow-AFP. (d) Inverse embedding, pilot-guided parsing, LT decoding, and final CRC32 verification recover the QR message. (e) Training applies noise, color/brightness/contrast variations, blur, JPEG compression, and cropping. (f–g) Flow-AFP and Flow-RAA construct the teacher target and aligned student features, respectively. communication, where digital fountain and LT codes recover messages from sufficient subsets of encoded symbols [4, 24]. Codingbased redundancy has also been explored in watermarking and steganography [17, 18, 27, 38–40], but remains only weakly integrated with modern neural embedding under severe spatial loss. Efficiency in Flow-Based Embedding. Efficiency in flow-based embedding differs from generic model compression because the same structured mapping must support both forward embedding and stable inverse recovery [11, 15, 16, 23, 35, 41]. Aggressive compression may therefore impair inverse stability, a known issue in invertible networks [3]. Existing efficiency-oriented approaches typically preserve the invertible structure through distillation or efficient flow designs [12, 14, 30, 31, 33]. In our setting, efficiency is meaningful when computational savings do not compromise message recoverability under distortion and cropping.

3 Method 3.1 Overview We propose CREST, an end-to-end robust message embedding framework for severe-cropping scenarios. The central idea is to address cropping-induced information loss from an erasure-resilience perspective while explicitly controlling the embedding overhead introduced by redundancy. Unlike conventional robust embedding pipelines that mainly target degradations (e.g., noise, blur, or compression), CREST further considers the case where part of the embedded spatial support may be physically removed.

As illustrated in Figure 2, CREST couples robustness at the message, spatial, and neural embedding levels. At the message level, the secret payload is transformed into redundant coded symbols through LT fountain coding to support recovery from partial observations (Section 3.2). At the spatial level, each coded symbol is mapped to a self-descriptive tile with pilot patterns and metadata, enabling localization, parsing, and fragment selection after cropping (Section 3.3). At the neural embedding level, the tiled payload is hidden into the host image through an attention-flow-based backbone, together with a distilled embedding strategy and a residual enhancement module that improve extraction stability and deployment efficiency (Sections 3.4 and 3.5). The surviving valid tiles are then assembled into a linear system over 𝐺𝐹 (2) for message reconstruction (Section 3.6). From this viewpoint, CREST separates the problem into two coupled stages: the survival of recoverable coded fragments under cropping, and exact message reconstruction from those fragments. The resulting rank-based recoverability perspective also motivates our progressive curriculum design (Section 3.7).

3.2

Fountain-Coded Payload Construction

Payload Preparation. Given a secret message 𝑀 ∈ {0, 1}1369 , represented here as a 37 × 37 binary payload grid consistent with a Version-5-style QR layout, we first append a 32-bit Cyclic Redundancy Check (CRC) for end-to-end integrity verification: 𝐷 = 𝑀 ∥CRC32(𝑀),

(1)

where ∥ denotes concatenation. The augmented bitstream 𝐷 is then zero-padded to a multiple of the predefined block length 𝐿 = 192

MM ’26, November 10–14, 2026, Rio de Janeiro, Brazil

Bo Pang, Weibin Kong, Juntu Dong, Minghan Li, and Zhongping Zhang

bits and partitioned into 𝐾 source blocks. In our implementation,   |𝐷 | + 𝑝 𝐾= = 8, (2) 𝐿 where 𝑝 is the padding length. Each source block is denoted as 𝐵𝑘 ∈ {0, 1}192 . LT Encoding with Systematic Redundancy. Although Luby Transform (LT) codes[42] are theoretically rateless, the finite spatial resolution of the visual carrier constrains the number of embedding symbols that can be instantiated in practice. We therefore truncate the fountain stream to a fixed grid of 𝑁 = 196 symbols, corresponding to a redundancy factor of 24.5× (196/8). Each encoded symbol 𝑆𝑖 is computed as the XOR sum of a pseudo-randomly selected subset of source blocks: Ê 𝑆𝑖 = 𝐵𝑗, (3) 𝑗 ∈ S𝑖

where the degree 𝑑𝑖 = |S𝑖 | is sampled from a modified robust soliton distribution. For the ultra-short block regime considered here (𝐾 = 8), standard soliton distributions often do not accumulate full rank efficiently under heavy erasures. We therefore empirically optimized the degree distribution via Monte Carlo simulation to maximize decoding probability in this setting: 𝑃 (1) = 0.10, 𝑃 (2) = 0.35, 𝑃 (3) = 0.30, 𝑃 (4) = 0.15, 𝑃 (5) = 0.07, and 𝑃 (𝑑 ∼ Uniform(1, 𝐾)) = 0.03. To accelerate the waterfall phase of LT decoding under severe cropping, we further impose systematic redundancy: the first 4𝐾 = 32 symbols are forced to be unmodified copies of the original source blocks (𝑑 = 1), increasing the probability that the base rank is preserved in the surviving spatial fragments.

3.3

Spatial Tiling and Aperiodic Pilot Alignment

Tile Bit Layout and Symbol Permutation. Each symbol is visually mapped to a 16 × 16 pixel tile, allocating 256 bits. Rows 0–1 are reserved for alignment pilots (32 bits). Rows 2–15 encode the symbol metadata—Seed (16 bits), Degree (8 bits), and 8 auxiliary filler bits—followed by the 192-bit payload 𝑆𝑖 . This self-descriptive layout ensures that any surviving tile can be parsed independently. To prevent a localized crop from destroying all systematic blocks, we apply a globally fixed permutation 𝜋 = PRNGseed ({0, . . . , 195}) to uniformly scatter the symbols across the 14 × 14 image grid. Aperiodic Pilot Pattern. Geometric distortions and cropping destroy the global coordinate system, introducing phase ambiguity during tile extraction. We therefore place an aperiodic pilot sequence in the top two rows of every tile: p0 = [1, 1, 1, 0, 1, 0, 0, 1, 1, 0, 1, 1, 0, 0, 0, 1],

(4)

p1 = p0 = [0, 0, 0, 1, 0, 1, 1, 0, 0, 1, 0, 0, 1, 1, 1, 0],

(5)

where · denotes bitwise negation. Unlike periodic patterns, p0 is chosen to have strong aperiodic autocorrelation properties, producing a distinct correlation peak that facilitates robust tile localization.

3.4

Distilled Robust Embedding

While the redundant fountain payload improves recoverability under severe cropping, it inevitably increases the embedding burden.

Directly scaling the embedding backbone would lead to higher inference costs and noticeable visual artifacts. To mitigate this, we introduce a training-only distilled embedding branch (Figure 2b and c), transferring robustness-aware behavior from a stronger teacher to a lightweight student pathway. 𝑆 𝑇 Specifically, given the stego images 𝐼 stego (student) and 𝐼 stego (teacher), we extract stage-wise features using two Vision Transformer (ViT) [6] encoders. Distillation is enforced in the feature space: the student features are refined by a Flow-Adapted Residual Attention Alignment (Flow-RAA) module, while the teacher features are transformed by a Flow-Adapted Attention-based Feature Propagation (Flow-AFP) module to serve as supervision targets. This design allows the student to inherit robustness-critical behavior without increasing test-time complexity. Flow-Adapted Residual Attention Alignment (Flow-RAA). At the 𝑙-th distillation stage, the student ViT outputs a token set 𝑆 } 𝑁𝑡 , where 𝑁 is the number of tokens. As illustrated in Figure 2, {𝐹𝑙,𝑖 𝑡 𝑖=1 Flow-RAA first projects each token, concatenates the projected tokens into a global representation, applies self-attention to model long-range dependencies, and then maps the attended feature back to the token space: n o 𝑁𝑡  𝑆 𝑍𝑙𝑆 = Concat 𝜙 proj (𝐹𝑙,𝑖 ) , (6) 𝑖=1

𝑍ˆ𝑙𝑆 = SA(𝑍𝑙𝑆 ),   𝑆 𝑁𝑡 {𝐹˜𝑙,𝑖 }𝑖=1 = Split 𝜙 out (𝑍ˆ𝑙𝑆 ) ,

(7) (8)

where 𝜙 proj (·) and 𝜙 out (·) correspond to the two Proj operations in Figure 2, and SA(·) denotes the self-attention block. Unlike directly matching token-wise local features, Flow-RAA explicitly aggregates cross-token interactions to capture globally consistent coded structures crucial for crop resilience. The stagelevel student descriptor is then obtained via average pooling:   𝑆 𝑁𝑡 𝐹˜𝑙𝑆 = Pool {𝐹˜𝑙,𝑖 }𝑖=1 , (9) which serves as the student-side representation for distillation at stage 𝑙. Flow-Adapted Attention-based Feature Propagation (FlowAFP). Flow-AFP constructs a teacher-side supervision signal that is better aligned with the student representation. Rather than forcing the student to mimic the raw teacher feature directly, Flow-AFP models inter-stage variation in the teacher branch and propagates it onto a student-guided reference. At the 𝑙-th stage, Flow-AFP takes as input the propagated student 𝑆 , the teacher feature from the feature from the previous stage 𝐹 prev 𝑇 previous stage 𝐹 prev , and the current teacher feature 𝐹 𝑇 . We first compute the teacher-side feature increment 𝑇 Δ𝐹𝑙𝑇 = 𝐹 𝑇 − 𝐹 prev ,

(10)

which corresponds to the subtraction operation in Figure 2. The 𝑆 obtained increment is then fused with 𝐹 prev by a lightweight fusion block:   𝑆 𝑅𝑙𝑇 = 𝜓 fuse 𝐹 prev , Δ𝐹𝑙𝑇 ,

(11)

where 𝜓 fuse (·) denotes the Fusion Block in Figure 2. Finally, the fused residual is added back to the propagated student feature to

Beyond Distortion Robustness: Rethinking Severe Cropping as Erasure-Resilient Message Embedding

3.6

produce the teacher target: 𝑆 𝐹˜𝑙𝑇 = 𝐹 prev + 𝑅𝑙𝑇 .

(12)

The subtraction operation effectively suppresses stage-independent bias, isolating newly introduced features, while the residual addition 𝑆 . This yields a smoothed teacher anchors the teacher target to 𝐹 prev 𝑇 descriptor 𝐹˜𝑙 perfectly aligned with the student’s representational space. With the outputs of Flow-RAA and Flow-AFP, the distillation loss at the 𝑙-th stage is defined as (𝑙 ) Ldist = 𝐹˜𝑙𝑆 − 𝐹˜𝑙𝑇 1 ,

(13)

and the overall distillation objective is Ldist =

𝑁𝑑 ∑︁

(𝑙 ) Ldist ,

(14)

𝑙=1

where 𝑁𝑑 is the number of distillation stages. Since the teacher branch is used only during training, the proposed distilled embedding strategy improves the robustness–efficiency trade-off without introducing additional inference overhead to the final student embedding network.

3.5

Residual Enhancement and Fragment Extraction

The 224 × 224 robust payload image is embedded into the host image using the Attention Affine Coupling Blocks (AACBs) [41] of the AttnFlow model. During extraction, the distorted stego image is passed through the inverse AACBs, yielding a noisy continuous residual prediction 𝐼 res . A key difficulty arises from the mismatch between continuous image degradations and discrete 𝐺𝐹 (2) decoding. While JPEG artifacts, blur, and sensor noise perturb the recovered residual in a continuous domain, the downstream algebraic solver is highly sensitive to bit-flip errors after binarization. To reduce this mismatch, we introduce a lightweight enhancement module, denoted as Enhancer1Ch (Fenh ), before the binarization step. Unlike generic image denoisers, Fenh operates only on the extracted single-channel residual and exploits the strong structural prior induced by the fountain-encoded tile layout. The enhancement process is formulated as  
𝐼 enh = clamp 𝐼 res + 𝛼 · tanh Fenh (𝐼 res ) , 0, 1

(15)

where 𝛼 is a learnable scaling parameter. The tanh activation helps sharpen ambiguous gray values toward the two binary states. Trained under progressive cropping-aware perturbations, Fenh suppresses high-frequency artifacts and restores clearer tile boundaries in the continuous domain. When combined with Otsu’s adaptive binarization and pilot-guided filtering, the enhancement module encourages a more decoding-friendly degradation pattern: mildto-moderate perturbations are corrected before thresholding, while severely corrupted fragments are more likely to be rejected as erasures. In this way, the continuous distortion process is shifted toward an erasure-dominant regime that better matches the assumptions of fountain decoding.

MM ’26, November 10–14, 2026, Rio de Janeiro, Brazil

GF(2) Decoding

Grid Alignment and Extraction. Given the enhanced residual 𝐼 enh , we apply Otsu’s binarization and perform a 2D sliding window search over all 16 × 16 possible phase offsets: ∑︁ (𝑜 𝑥∗ , 𝑜 𝑦∗ ) = arg max match(𝑡, 𝑜 𝑥 , 𝑜 𝑦 , p0, p1 ), (16) (𝑜 𝑥 ,𝑜 𝑦 )

𝑡∈T

where T denotes candidate tiles under the current phase hypothesis, and match(·) measures pilot consistency with the reference patterns p0 and p1 . The optimal offset dynamically locks onto the remaining tile grid while discarding partial tiles at crop boundaries. Only tiles whose extracted pilot rows exactly match p0 and p1 are retained, serving as a pilot-consistency filter for tile acceptance. Gaussian Elimination over GF(2). The valid metadata seeds rebuild the pseudo-random bipartite graph, forming a linear system A · x = y over 𝐺𝐹 (2), where A ∈ {0, 1}𝑚×𝐾 is the coefficient matrix, x = [𝐵 0, . . . , 𝐵𝐾 −1 ]𝑇 denotes the unknown source blocks, and y contains the observed payloads from the 𝑚 extracted tiles. We apply Gaussian elimination with XOR operations. If rank(A) = 𝐾, the system is fully determined, and the recovered bitstream is verified against the 32-bit CRC.

3.7

Recoverability Analysis and Curriculum Motivation

By mapping the problem to an erasure channel, the decoding probability becomes closely related to the rank of the recovered linear system. Under a random crop with area retention ratio 𝑟 , the expected number of surviving tiles is E[𝑚] = 𝑟 · 𝑁 . Because we enforce four copies of each systematic block among the first 4𝐾 = 32 symbols, under an independence approximation, the probability of losing all copies of any specific systematic block under 𝑟 = 0.4 is reduced to (1 − 0.4) 4 ≈ 0.129. The remaining LT-coded symbols then help fill the missing degrees of freedom. Consequently, as long as 𝑚 ≥ 𝐾 + 𝜖, where 𝜖 denotes a small decoding overhead, the coefficient matrix tends to reach full rank, which explains the stable recovery behavior observed before the final breakdown threshold. This rank-based view also motivates our curriculum design. Severe cropping imposes a highly discontinuous optimization signal in early training because small extraction errors may translate into unrecoverable rank deficiency after binarization and decoding. We therefore adopt a progressive cropping-aware training strategy that starts from relatively mild erasure conditions and gradually increases the difficulty, allowing the embedding and enhancement modules to first learn stable localization and residual reconstruction before adapting to harsher cropping regimes.

4 Experiments 4.1 Experimental Settings We evaluate CREST on three public datasets: COCO2017 [21], DIV2K [1], and VOC2012 [7]. These datasets cover diverse scene content and image statistics, enabling evaluation across both robustness and visual quality. Following the common setting in robust message embedding, all images are resized to 224 × 224. The comparison includes six baselines: ISN [23], HiNet [16], StegaStamp [29], DeepMIH [13], PRIS [36], and RMSteg [41]. All

MM ’26, November 10–14, 2026, Rio de Janeiro, Brazil

Bo Pang, Weibin Kong, Juntu Dong, Minghan Li, and Zhongping Zhang

Table 1: Breakdown analysis under coupled regime of mixed distortions and spatial cropping. As the retained image area decreases, CREST degrades more gracefully than competing methods and substantially delays the recovery breakdown boundary. The best results are in bold. See Section 4.2 for discussion.

Mixed + 𝑟 𝑎𝑟𝑒𝑎 1.0

Mixed + 𝑟 𝑎𝑟𝑒𝑎 0.7

Mixed + 𝑟 𝑎𝑟𝑒𝑎 0.5

Mixed + 𝑟 𝑎𝑟𝑒𝑎 0.3

Mixed + 𝑟 𝑎𝑟𝑒𝑎 0.15

TRA ↑

EMR ↓

TRA ↑

EMR ↓

TRA ↑

EMR ↓

TRA ↑

EMR ↓

TRA ↑

EMR ↓

COCO2017

DeepMIH [13] PRIS [36] RMSteg [41] CREST (Ours)

25.1 50.1 62.4 74.2

4.514 2.6 2.506 1.912

0.00 0.00 18.52 68.45

45.21 36.54 13.88 4.21

0.00 0.00 0.00 65.12

48.33 40.12 26.45 4.88

0.00 0.00 0.00 48.55

52.14 46.88 38.12 6.15

0.00 0.00 0.00 14.20

58.60 51.35 48.90 8.75

DIV2K

DeepMIH [13] PRIS [36] RMSteg [41] CREST (Ours)

21 51 78 85

4.049 2.499 1.65 1.45

0.00 0.00 24.36 76.50

42.15 33.78 11.45 3.55

0.00 0.00 2.15 72.30

46.50 38.60 21.60 3.95

0.00 0.00 0.00 55.40

49.30 43.25 34.50 5.20

0.00 0.00 0.00 18.65

55.45 48.90 45.20 7.10

VOC2012

DeepMIH [13] PRIS [36] RMSteg [41] CREST (Ours)

24.6 50.8 60 73.5

4.633 2.622 2.603 1.915

0.00 0.00 15.25 65.80

46.80 37.12 14.65 4.85

0.00 0.00 0.00 62.45

50.15 42.30 28.30 5.20

0.00 0.00 0.00 42.10

54.60 48.15 41.25 7.05

0.00 0.00 0.00 11.35

61.20 53.60 50.15 9.80

Dataset

Method

competing methods are evaluated under aligned distortion settings using their respective test pipelines. We consider two evaluation regimes. The first is a coupled distortionand-cropping setting, where stego images are first subjected to digital distortions and then evaluated under different area retention ratios. This setting is used to probe the breakdown boundary of message recovery under simultaneous continuous corruption and spatial erasure. The second is a general distortion setting, which evaluates robustness, image quality, and deployment efficiency under Gaussian noise, JPEG compression, and mixed distortions. For image quality, we report PSNR, SSIM [34], and LPIPS [43]. For decoding robustness, we report TRA (Text Recovery Accuracy) and EMR (Error Module Rate) [41]. In addition, we report FPS, GFLOPs, and Params to evaluate deployment efficiency.

4.2

Coupled Distortions and Cropping

Since CREST achieves near-perfect recovery under pure severe cropping (Figure 3), we focus on the ultimate extreme stress test: a coupled regime of mixed continuous distortions and aggressive spatial erasures (𝑟 𝑎𝑟𝑒𝑎 ). As reported in Table 1 and Figure 4, CREST consistently dominates across all datasets. Even without cropping (𝑟 𝑎𝑟𝑒𝑎 = 1.0), CREST outperforms the strongest baseline, RMSteg [41]. Crucially, this performance gap widens drastically once spatial erasure is introduced. By 𝑟 𝑎𝑟𝑒𝑎 = 0.5 (discarding half the image), CREST maintains highly robust recovery (e.g., 65.12% TRA on COCO2017), whereas all competing methods drop to 0.00% TRA. This coupled setting exposes a fundamental vulnerability in conventional distortion-robust designs: they suffer catastrophic avalanche failures when spatial support is removed. For instance, DeepMIH and PRIS fail immediately at 𝑟 𝑎𝑟𝑒𝑎 = 0.7, and RMSteg plummets from 62.4% to 0.00% by 𝑟 𝑎𝑟𝑒𝑎 = 0.5 on COCO2017. In stark contrast, CREST exhibits a graceful, mathematically interpretable breakdown trajectory. As 𝑟 𝑎𝑟𝑒𝑎 is pushed to the extreme

limit of 0.15, the recovery rate steadily declines (from 68.45% down to 14.20% on COCO2017) rather than failing abruptly. This confirms the efficacy of our erasure-resilient paradigm: pilot-guided filtering helps convert continuous extraction errors into discrete erasures, enabling the fountain decoder to sustain recovery as long as the surviving valid tiles fulfill the minimum rank requirement.

4.3

General Distortion, Quality, and Efficiency

Although CREST is primarily designed for severe cropping, it is still important to verify that the proposed erasure-resilient design does not incur prohibitive overhead under conventional distortions. We therefore evaluate image quality, robustness, and deployment efficiency under Gaussian noise, JPEG compression, and mixed distortions. The quantitative and qualitative results are shown in Table 2 and fig. 5. As shown in Table 2, CREST remains competitive in image fidelity despite introducing substantial redundancy for recoverability, achieving PSNR/SSIM/LPIPS of 28.854/0.8735/0.1351 under regular conditions. The visual comparisons in Figure 5 further show that CREST preserves clear semantic structures without introducing obvious additional artifacts. More importantly, CREST achieves the highest FPS and lowest GFLOPs among methods with reported runtime statistics, reaching 47.52 FPS with 74.694 GFLOPs, while also using substantially fewer parameters than RMSteg (114.74 vs. 196.79). This indicates that the distilled attention-flow design offsets much of the redundancy cost and yields a favorable robustness–efficiency trade-off. CREST also remains robust under representative conventional distortions. In particular, it achieves 85.3 TRA under Gaussian noise with 𝜎 = 0.1 and 99.5 TRA under JPEG compression with 𝑄 = 20, while maintaining competitive performance under mixed distortions. Overall, these results show that CREST improves severecropping robustness without sacrificing practical image quality or deployment efficiency beyond the pure cropping scenario.

Beyond Distortion Robustness: Rethinking Severe Cropping as Erasure-Resilient Message Embedding

MM ’26, November 10–14, 2026, Rio de Janeiro, Brazil

Figure 3: Qualitative decoding results under random pure-cropping attacks with different side retention ratios. Without additional distortions, CREST maintains stable message recovery across different crop locations and crop sizes, indicating that its decoding performance is less sensitive to spatial position under severe cropping. See Section 4.2 for discussion.

Figure 4: Qualitative comparison under the coupled regime of mixed distortions and spatial cropping. As the retained area decreases, competing methods rapidly lose decodable structure, whereas CREST preserves cleaner decoded QR patterns over a wider range of hostile conditions, indicating a delayed recovery breakdown boundary. See Section 4.2 for discussion.

4.4

Ablation Study

We analyze the contributions of three key components in CREST: pilot-guided alignment, spatial anti-clustering, and progressive cropping curriculum learning. The quantitative results are summarized in Table 3. Ablation on Aperiodic Pilot Alignment. As shown in Table 3(a), removing pilot alignment causes decoding success to collapse across all crop ratios. Even at a mild crop ratio of 𝑟 = 0.9, the success rate drops from 100.0% to 5.5%. This result confirms that reliable phase locking is essential for stable tile extraction and subsequent 𝐺𝐹 (2) reconstruction under severe cropping. Ablation on Spatial Anti-Clustering. As shown in Table 3(b), both layouts achieve perfect recovery in the ideal channel, but the non-permuted layout degrades much faster once extraction errors are introduced. For example, at a 15% extraction error rate, the

success rate drops to 55.0% without permutation, versus 91.0% with permutation. This shows that global permutation effectively reduces spatial clustering of systematic blocks and mitigates localized rank deficiency. Ablation on Cropping Curriculum Learning. As shown in Table 3(c), training with a fixed severe crop ratio leads to worse optimization behavior, with higher losses and inferior perceptual quality. In contrast, the proposed curriculum achieves lower losses and better visual metrics, indicating a smoother optimization trajectory and a better robustness–imperceptibility trade-off. Overall, the ablation results support the design logic of CREST: pilot alignment ensures reliable localization, spatial permutation improves fragment diversity under localized erasures, and curriculum learning stabilizes training under progressively harsher cropping conditions.

MM ’26, November 10–14, 2026, Rio de Janeiro, Brazil

Bo Pang, Weibin Kong, Juntu Dong, Minghan Li, and Zhongping Zhang

Table 2: Quantitative comparison under representative general distortions in terms of image quality, robustness, and deployment efficiency. The best result in each column is highlighted in bold. Superscripts indicate the column-wise rank among all methods, with 1 being the best rank and ties assigned the same rank. TRA and EMR are reported in percentage scale. Although CREST is primarily designed for severe cropping, it remains competitive under conventional distortions while achieving favorable computational efficiency among the compared methods. See Section 4.3 for discussion. Regular

Method ISN [23] HiNet [16] StegaStamp [29] StegaStamp+ [29] DeepMIH [13] PRIS [36] RMSteg [41] CREST (Ours)

𝜎 = 0.1

𝜎 = 0.15

JPEG Q=20

JPEG Q=40

Mixed

PSNR↑

SSIM↑

LPIPS↓

FPS↑

GFLOPs↓

Params↓

TRA↑

EMR↓

TRA↑

EMR↓

TRA↑

EMR↓

TRA↑

EMR↓

TRA↑

EMR↓

32.175 31.629 21.215 21.173 22.664 28.713 32.883 28.8544

0.8765 0.8662 0.7027 0.6903 0.7717 0.8573 0.9109 0.87353

0.3266 0.3423 0.3055 0.3418 0.2993 0.1800 0.0707 0.13512

22.59 29.65 30.63 47.521

270.517 215.389 107.620 74.6941

5.40 4.18 196.79 114.743

72.8 82.7 5.1 48.1 15.6 80.4 79.4 85.31

1.563 1.077 6.152 3.298 2.856 1.818 1.235 1.1872

17.8 16.2 0.0 1.5 0.0 0.0 21.6 15.44

5.020 3.724 10.570 6.500 8.727 28.500 3.306 5.1004

99.1 98.6 95.1 95.3 5.1 69.3 99.5 99.51

0.721 0.573 1.259 1.104 3.443 1.742 0.117 0.1041

99.9 99.7 97.7 96.9 97.0 99.0 100.0 100.01

0.184 0.099 0.798 0.833 0.773 0.208 0.038 0.0492

71.3 67.7 55.7 69.3 25.1 50.1 85.9 74.22

3.131 3.426 3.843 2.975 4.514 2.600 0.861 1.9122

Table 3: Ablation studies on key mechanisms in CREST. (a) Impact of pilot alignment on decoding success rate; (b) Monte Carlo simulation of spatial anti-clustering under coupled physical stress (15% edge crop); (c) Comparison of training convergence across different optimization strategies. See Section 4.4 for discussion.

(a) Ablation on Aperiodic Pilot Alignment Crop Ratio

w/ Alignment

w/o Alignment

Δ

100.0 100.0 100.0

5.5 1.5 0.5

+94.5 +98.5 +99.5

0.9 0.7 0.5

(b) Ablation on Spatial Anti-Clustering Extraction Error Rate 0% (Ideal Channel) 10% 15% 20%

w/o Perm

w/ Perm

Rank Failure

100.0% 78.0% 55.0% 31.5%

100.0% 98.5% 91.0% 83.5%

0 2200 4500 6850

(c) Ablation on Cropping Curriculum Learning

5

Training Strategy

Epoch

Steg Loss ↓

QR Loss ↓

SSIM ↑

LPIPS ↓

RMSteg Fixed Crop (𝑟 = 0.5) Ours (Curriculum)

5 5 5

0.0176 0.0108 0.0072

0.0099 0.0065 0.0020

0.9211 0.9608 0.9833

0.0456 0.0081 0.0031

Ours (Curriculum)

10

0.0065

0.0018

0.9851

0.0024

Conclusion

In this paper, we revisited robust message embedding under severe local cropping from an erasure-resilience perspective. We argued that, unlike conventional distortions that degrade but preserve the embedded spatial support, severe cropping causes partial payload disappearance and should therefore be addressed as a recoverability problem under missing support. To instantiate this perspective, we proposed CREST, a cropping-resilient and efficient steganographic framework that combines redundancy-enhanced payload construction, cropping-aware robust embedding, and coding-based recovery. Extensive experiments on COCO2017, DIV2K, and VOC2012 demonstrate that CREST substantially improves recovery under

Figure 5: Visual comparison of stego-image quality under mixed distortions. CREST maintains competitive visual quality despite the redundancy introduced for robust recovery. See Section 4.3 for discussion. severe cropping while maintaining competitive stego-image quality and favorable efficiency. More broadly, our results suggest that robust message embedding under severe cropping may be better approached through the joint design of neural embedding and erasureresilient decoding, rather than as a straightforward extension of conventional distortion robustness. We believe this paradigm shift paves the way for highly reliable real-world applications, such as physical-to-digital document tracing and tamper-resistant copyright protection. Future work will explore extending this framework to handle more complex physical-world erasures, such as severe perspective warping combined with localized occlusions.

Acknowledgments This work was supported by the Fundamental Research Funds for the Central Universities at Harbin Engineering University under Grant No. 3072025CFJ0401.

Beyond Distortion Robustness: Rethinking Severe Cropping as Erasure-Resilient Message Embedding

References [1] Eirikur Agustsson and Radu Timofte. 2017. Ntire 2017 challenge on single image super-resolution: Dataset and study. In Proceedings of the IEEE conference on computer vision and pattern recognition workshops. 126–135. [2] Richard Apau, Michael Asante, Frimpong Twum, James Ben Hayfron-Acquah, and Kwame Ofosuhene Peasah. 2024. Image Steganography Techniques for Resisting Statistical Steganalysis Attacks: A Systematic Literature Review. PLOS ONE 19, 9 (2024), e0308807. doi:10.1371/journal.pone.0308807 [3] Jens Behrmann, Paul Vicol, Kuan-Chieh Wang, Roger Grosse, and Jörn-Henrik Jacobsen. 2021. Understanding and Mitigating Exploding Inverses in Invertible Neural Networks. In Proceedings of The 24th International Conference on Artificial Intelligence and Statistics (AISTATS) (Proceedings of Machine Learning Research, Vol. 130). 1792–1800. [4] John W. Byers, Michael Luby, Michael Mitzenmacher, and Ashutosh Rege. 1998. A Digital Fountain Approach to Reliable Distribution of Bulk Data. In Proceedings of the ACM SIGCOMM Conference. 56–67. [5] Fang Cao, Daidou Guo, Tianjun Wang, Heng Yao, Jian Li, and Chuan Qin. 2024. Universal screen-shooting robust image watermarking with channel-attention in DCT domain. Expert Systems with Applications 238 (2024), 122062. doi:10.1016/j. eswa.2023.122062 [6] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. 2021. An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale. In International Conference on Learning Representations (ICLR). [7] Mark Everingham, SM Ali Eslami, Luc Van Gool, Christopher KI Williams, John Winn, and Andrew Zisserman. 2015. The Pascal Visual Object Classes Challenge: A Retrospective. International Journal of Computer Vision 111, 1 (2015), 98–136. [8] Han Fang, Zhaoyang Jia, Zehua Ma, Ee-Chien Chang, and Weiming Zhang. 2022. PIMoG: An Effective Screen-Shooting Noise-Layer Simulation for Deep-LearningBased Watermarking Network. In Proceedings of the 30th ACM International Conference on Multimedia. 2267–2275. doi:10.1145/3503161.3548049 [9] Han Fang, Yupeng Qiu, Kejiang Chen, Jiyi Zhang, Weiming Zhang, and Ee-Chien Chang. 2023. Flow-Based Robust Watermarking with Invertible Noise Layer for Black-Box Distortions. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 37. 5054–5061. doi:10.1609/aaai.v37i4.25633 [10] Jiayun Fu, Bin B. Zhu, Haidong Zhang, Yayi Zou, Song Ge, Weiwei Cui, Yun Wang, Dongmei Zhang, Xiaojing Ma, and Hai Jin. 2022. ChartStamp: Robust Chart Embedding for Real-World Applications. In Proceedings of the 30th ACM International Conference on Multimedia (ACM MM). 2786–2795. doi:10.1145/ 3503161.3548286 [11] Aidan N. Gomez, Mengye Ren, Raquel Urtasun, and Roger B. Grosse. 2017. The Reversible Residual Network: Backpropagation Without Storing Activations. In Advances in Neural Information Processing Systems (NeurIPS). [12] Alexey A. Gritsenko, Rianne van den Berg, Mostafa Dehghani, Casper Kaae Sønderby, and Tim Salimans. 2021. IDF++: Analyzing and Improving Integer Discrete Flows for Lossless Compression. In International Conference on Learning Representations (ICLR). [13] Zhenyu Guan, Junpeng Jing, Xin Deng, Mai Xu, Lai Jiang, Zhou Zhang, and Yipeng Li. 2022. DeepMIH: Deep invertible network for multiple image hiding. IEEE Transactions on Pattern Analysis and Machine Intelligence 45, 1 (2022), 372– 390. [14] Emiel Hoogeboom, Jorn W. T. Peters, Rianne van den Berg, and Max Welling. 2019. Integer Discrete Flows and Lossless Compression. In Advances in Neural Information Processing Systems (NeurIPS). [15] Jörn-Henrik Jacobsen, Arnold W. M. Smeulders, and Edouard Oyallon. 2018. i-RevNet: Deep Invertible Networks. In International Conference on Learning Representations (ICLR). [16] Junpeng Jing, Xin Deng, Mai Xu, Jianyi Wang, and Zhenyu Guan. 2021. HiNet: Deep Image Hiding by Invertible Network. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV). [17] J"org Keller and Ewelina Marciniszyn. 2022. Improved Concept and Implementation of a Fountain Code Covert Channel. Journal of Wireless Mobile Networks, Ubiquitous Computing, and Dependable Applications 13, 3 (2022), 25–36. doi:10.22667/JOWUA.2022.9.30.025 [18] Paweł Korus, Jarosław Białas, and Andrzej Dziech. 2014. A New Approach to HighCapacity Annotation Watermarking Based on Digital Fountain Codes. Multimedia Tools and Applications 68, 1 (2014), 59–77. doi:10.1007/s11042-011-0986-8 [19] Yuhang Lan, Fei Shang, Jianhua Yang, Xiangui Kang, and Enping Li. 2023. Robust Image Steganography: Hiding Messages in Frequency Coefficients. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 37. 14955–14963. doi:10. 1609/aaai.v37i12.26746 [20] Xuanyu Liang, Guojun Liu, Yuan Si, Xiaoxing Hu, and Zhi Qian. 2025. ScreenMark: Watermarking Arbitrary Visual Content on Screen. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 39. 26273–26280. doi:10.1609/aaai.v39i25. 34825

MM ’26, November 10–14, 2026, Rio de Janeiro, Brazil

[21] Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. 2014. Microsoft coco: Common objects in context. In European conference on computer vision. Springer, 740–755. [22] Zhuangjifei Liu, Jiaohua Qin, Xuyu Xiang, Yuanjing Luo, and Yun Tan. 2025. Postencoding Enhancement: A Screen-Shooting Resistant Watermarking Scheme with Feature Enhancement and Hybrid Distortion Simulation. Knowledge-Based Systems 322 (2025), 113673. [23] Shao-Ping Lu, Rong Wang, Tao Zhong, and Paul L. Rosin. 2021. Large-capacity Image Steganography Based on Invertible Neural Networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). 10816–10825. [24] Michael Luby. 2002. LT Codes. In 43rd Symposium on Foundations of Computer Science (FOCS). 271–280. doi:10.1109/SFCS.2002.1181950 [25] Zehua Ma, Han Fang, Xi Yang, Kejiang Chen, and Weiming Zhang. 2025. RoPaSS: Robust Watermarking for Partial Screen-Shooting Scenarios. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 39. 19332–19339. doi:10.1609/ aaai.v39i18.34128 [26] Yinyin Peng, Yaofei Wang, Donghui Hu, Kejiang Chen, Xianjin Rong, and Weiming Zhang. 2024. LDStega: Practical and Robust Generative Image Steganography based on Latent Diffusion Models. In Proceedings of the 32nd ACM International Conference on Multimedia (ACM MM). 3001–3009. doi:10.1145/3664647.3681635 [27] Yuang Qi, Kejiang Chen, Na Zhao, Zijin Yang, and Weiming Zhang. 2025. Provably Secure Image Robust Steganography via Cross-Modal Error Correction. In Proceedings of the AAAI Conference on Artificial Intelligence. 26354–26362. [28] Farhad Shadmand, Iurii Medvedev, Luiz Schirmer, Joao Marcos, and Nuno Goncalves. 2024. StampOne: Addressing Frequency Balance in Printer-proof Steganography. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW). [29] Matthew Tancik, Ben Mildenhall, and Ren Ng. 2020. StegaStamp: Invisible Hyperlinks in Physical Photographs. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). [30] Aaron van den Oord, Yazhe Li, Igor Babuschkin, Karen Simonyan, Oriol Vinyals, Koray Kavukcuoglu, George van den Driessche, Edward Lockhart, Luis Cobo, Florian Stimberg, Norman Casagrande, Dominik Grewe, Seb Noury, Sander Dieleman, Erich Elsen, Nal Kalchbrenner, Heiga Zen, Alex Graves, Helen King, Tom Walters, Dan Belov, and Demis Hassabis. 2018. Parallel WaveNet: Fast HighFidelity Speech Synthesis. In Proceedings of the 35th International Conference on Machine Learning (ICML) (Proceedings of Machine Learning Research, Vol. 80). 3918–3926. [31] Steven Walton, Valeriy Klyukin, Maksim Artemev, Denis Derkach, Nikita Orlov, and Humphrey Shi. 2025. Distilling Normalizing Flows. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops. 3362–3371. [32] Guanjie Wang, Zehua Ma, Chang Liu, Xi Yang, Han Fang, Weiming Zhang, and Nenghai Yu. 2024. MuST: Robust Image Watermarking for Multi-Source Tracing. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 38. 5364–5371. doi:10.1609/aaai.v38i6.28344 [33] Siyu Wang, Jianfei Chen, Chongxuan Li, Jun Zhu, and Bo Zhang. 2022. Fast Lossless Neural Compression with Integer-Only Discrete Flows. In Proceedings of the 39th International Conference on Machine Learning (ICML). 22562–22575. [34] Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. 2004. Image Quality Assessment: From Error Visibility to Structural Similarity. IEEE Transactions on Image Processing 13, 4 (2004), 600–612. [35] Youmin Xu, Chong Mou, Yujie Hu, Jingfen Xie, and Jian Zhang. 2022. Robust Invertible Image Steganography. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). [36] Hang Yang, Yitian Xu, Xuhua Liu, and Xiaodong Ma. 2024. PRIS: Practical robust invertible network for image steganography. Engineering Applications of Artificial Intelligence 133 (2024), 108419. doi:10.1016/j.engappai.2024.108419 [37] Nana Yang, Yi Chen, Hongxia Wang, Guowei Shen, Chun Guo, Yunhe Cui, Yong Liu, and Hanzhou Wu. 2025. End-to-end Robust and Transparent Image Watermarking Method for Screen-Shooting Scenarios. Journal of Electronic Imaging 34, 2 (2025). [38] Zijin Yang, Kejiang Chen, Kai Zeng, Weiming Zhang, and Nenghai Yu. 2024. Provably Secure Robust Image Steganography. IEEE Transactions on Multimedia 26 (2024), 5040–5053. doi:10.1109/TMM.2023.3330098 [39] Qiyi Yao, Kai Zeng, Weiming Zhang, and Kejiang Chen. 2025. Reliable Robust Adaptive Steganographic Coding Based on Nested Polar Codes. IEEE Transactions on Signal Processing 73 (2025), 12–25. [40] Qiyi Yao, Weiming Zhang, Kejiang Chen, and Nenghai Yu. 2024. LDGM CodesBased Near-Optimal Coding for Adaptive Steganography. IEEE Transactions on Communications 72, 4 (2024), 2138–2151. [41] Huayuan Ye, Shenzhuo Zhang, Shiqi Jiang, Jing Liao, Shuhang Gu, Dejun Zheng, Changbo Wang, and Chenhui Li. 2025. Robust Message Embedding via Attention Flow-Based Steganography. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). 12840–12849. [42] Xiaojun Yuan and Li Ping. 2008. On Systematic LT Codes. IEEE Communications Letters 12, 9 (2008), 681–683. doi:10.1109/LCOMM.2008.080825

MM ’26, November 10–14, 2026, Rio de Janeiro, Brazil

[43] Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. 2018. The Unreasonable Effectiveness of Deep Features as a Perceptual Metric. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR). 586–595. [44] Zhongping Zhang, Yiwen Gu, Bryan A Plummer, Xin Miao, Jiayi Liu, and Huayan Wang. 2024. Movie genre classification by language augmentation and shot sampling. In 2024 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV). IEEE, 7260–7270.

Bo Pang, Weibin Kong, Juntu Dong, Minghan Li, and Zhongping Zhang

[45] Zhongping Zhang, Wenda Qin, and Bryan Plummer. 2024. Machine-generated text localization. In Findings of the Association for Computational Linguistics: ACL 2024. 8357–8371. [46] Zhongping Zhang, Jian Zheng, Zhiyuan Fang, and Bryan A Plummer. 2024. Textto-image editing by image information removal. In Proceedings of the IEEE/CVF winter conference on applications of computer vision. 5232–5241. [47] Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. 2018. HiDDeN: Hiding Data With Deep Networks. In Proceedings of the European Conference on Computer Vision (ECCV).

Related documents

• Beyond Distortion Robustness: Rethinking Severe Cropping as Erasure-Resilient Message Embedding#677748
• Beyond Distortion Robustness: Rethinking Severe Cropping as Erasure-Resilient Message Embedding#674538
• From Glance to Scrutiny: Progressive Distortion Reasoning for Fine-Grained Image Quality Assessment#985680
• Benchmarking Large Vision-Language Models on Fine-Grained Image Tasks: A Comprehensive Evaluation#139152
• GTAvatar: Bridging Gaussian Splatting and Texture Mapping for Relightable and Editable Gaussian Avatars#147644