RIS-MoE: robust and secure image steganography via latent-space optimization with mixture

Abstract Diffusion-based generative image steganography enables covert communication by synthesizing stego images without relying on cover images. However, existing latent-space methods still struggle to balance robustness, steganographic security, and visual fidelity, especially under practical channel distortions such as compression, blur, resizing, and noise. To address these challenges, we propose RIS-MoE, a robust and secure latent-space image steganography framework that integrates distortion-tolerant message representation with receiver-side adaptive latent restoration. At the sender side, a learnable orthogonal transformation converts the secret message into a distributed representation, which is embedded into the diffusion latent through a residual-guided Hide Network. At the receiver side, a plug-and-play Mixture-of-Experts (MoE) denoising module estimates the distortion composition and adaptively fuses specialized restoration experts before message extraction. Extensive experiments show that RIS-MoE achieves strong robustness under single, mixed, and real-world distortions. It maintains extraction accuracy above 90% under all evaluated simulated combined distortions and achieves 94.62% and 95.29% extraction accuracy after real-world Weibo and Instagram transmission, respectively. RIS-MoE also achieves competitive empirical resistance against spatial-domain, latent-domain, and diffusion-aware steganalyzers, while maintaining favorable visual quality with an FID of 7.35 and an LPIPS of 0.21 on Flickr8K. In addition, the proposed MoE module consistently improves representative latent-space steganography pipelines as a plug-and-play restoration component, demonstrating its transferability. The source code is publicly available at: https://github.com/angle-cell/RIS_MOE. Introduction Steganography is a technique for concealing secret information in digital media, including text (Fang et al. 2017), images (Filler and Fridrich 2011), video (Fan et al. 2022), and audio (Chen et al. 2023). While most research has focused on general-purpose media, recent studies have also explored information protection in specialized domains, such as medical and healthcare-related data (Lai et al. 2025, 2026). Existing methods can be broadly categorized into two paradigms: modification-based and generative image steganography. Modification-based image steganography conceals secret messages by modifying a cover image to produce a stego image (Pevnỳ et al. 2010; Holub and Fridrich 2012; Li et al. 2014; Holub et al. 2014; Jing et al. 2021; Zhu et al. 2018). Existing methods can be further categorized into two types: traditional approaches with manually designed embedding strategies, and deep-learning-based approaches. Traditional methods typically embed data in the spatial or transform domain under carefully designed distortion constraints (Pevnỳ et al. 2010; Holub and Fridrich 2012; Li et al. 2014; Holub et al. 2014). By contrast, deep-learning-based methods learn the embedding and extraction processes directly from data, including image-in-image (Jing et al. 2021) and text-in-image paradigms (Zhu et al. 2018). These methods generally provide higher embedding capacity and more flexible message representation. However, they rely on direct modification of the cover image. Such modification inevitably alters the statistical characteristics of the image and leaves embedding traces, increasing the risk of detection by steganalysis methods, i.e., techniques designed to detect hidden information in digital media (Fridrich and Kodovsky 2012; You et al. 2021). To overcome these limitations, generative image steganography has emerged as a new paradigm. Unlike modification-based image steganography, it directly generates stego images without requiring cover images. Early generative image steganography methods were primarily based on generative adversarial networks (GANs) (Liu et al. 2017; Zhang et al. 2020; Duan et al. 2018; Hu et al. 2018), which synthesize stego images directly from secret-conditioned inputs. While avoiding modifying existing cover images, GAN-based methods suffer from unstable training, convergence difficulties, limited image realism, and unsatisfactory extraction accuracy (Arjovsky et al. 2017; Hu et al. 2018), restricting their practical applicability. With the rapid development of diffusion models (Ho et al. 2020; Song et al. 2021; Lu et al. 2025), diffusion-based image generative steganography has emerged as a promising alternative. Compared with GANs, diffusion models usually offer a more stable generation process and superior image generation quality, providing a stronger foundation for generative image steganography. Existing diffusion-based generative image steganography methods mainly embed secret information into different stages of the diffusion process, such as the initial noise (Hu et al. 2024; Yang et al. 2025; Du et al. 2026), latent representations (Peng et al. 2024, 2026), or sampling trajectories (Mahfuz et al. 2025). Despite recent progress, these approaches still face several fundamental challenges, particularly in terms of undetectability, visual fidelity, and robustness under real-world channel distortions. First, secret embedding inevitably perturbs the generation process. The key challenge is to control such perturbations so that detectable statistical traces are minimized. Otherwise, resistance to steganalysis may be compromised. Second, the embedded information is often fragile under practical distortions. Real-world channel distortions do not follow a unified latent corruption model. Instead, distortions such as compression, blur, noise, and resizing introduce heterogeneous statistical shifts and structural perturbations in the latent space. This diversity makes it difficult to directly recover embedded information without distortion-aware adaptations, especially under mixed or complex channel distortions. Third, existing methods still struggle to balance security, robustness, and visual quality. It remains challenging to simultaneously achieve strong resistance to steganalysis, high robustness under complex distortions, and high-quality stego image generation. These limitations restrict the practical applicability of diffusion-based generative image steganography and motivate the development of a more robust and secure latent-space framework. To address these challenges, this paper proposes Robust and Secure Image Steganography with Mixture-of-Experts (RIS-MoE), a latent-space generative image steganography framework. The proposed framework improves robustness to complex channel distortions and enhances resistance to advanced steganalysis, while maintaining high image quality and stable generation performance. Figure 1 illustrates the overall architecture of RIS-MoE. At the sender side, the secret message is first transformed by a learnable orthogonal matrix to improve distortion tolerance through producing a more robust message representation. The transformed message is then fused with the latent variable from the final step of Denoising Diffusion Implicit Models (DDIM) through a U-Net-based encoder, enabling compact latent-space message embedding while preserving image quality. The fused latent is subsequently decoded by a VAE decoder to generate the stego image. At the receiver side, the transmitted image is mapped back into the latent space using a VAE encoder, and the corresponding initial latent is reproduced under the same prompt and deterministic sampling setting. To improve robustness to complex channel distortions, we introduce a plug-and-play mixture-of-experts (MoE) denoising module for latent restoration before message decoding. By adaptively restoring corrupted latent features, this module enhances message recovery performance under diverse degradations. Moreover, the proposed MoE denoising module is generic and can be integrated into other latent-domain image steganography frameworks, as demonstrated in Sect."Plug-and-play transferability". Experimental results show that the proposed framework achieves competitive resistance against spatial-domain, latent-domain, and diffusion-aware steganalysis, while maintaining strong robustness to various channel distortions, as further validated through real-world transmission scenarios. The contributions of this work can be summarized as follows: - We propose RIS-MoE, a latent-space generative image steganography framework that jointly considers sender-side distortion-tolerant message embedding and receiver-side latent restoration. Unlike existing methods that mainly embed messages into the initial noise, latent sampling process, or denoising trajectory, RIS-MoE explicitly addresses reliable message recovery after practical channel distortions while maintaining competitive visual quality and empirical steganographic security. - We introduce a plug-and-play Mixture-of-Experts (MoE) denoising module for distortion-aware receiver-side latent restoration. Different from existing methods that usually extract messages directly from the received latent or rely on a single recovery branch, the proposed MoE module estimates distortion composition and adaptively fuses specialized restoration experts, enabling more effective recovery under heterogeneous and mixed distortions. Its transferability is further validated by integrating it into representative latent-space steganography pipelines. - We conduct extensive evaluations under single distortions, combined distortions, and real-world social-media transmission scenarios. We also provide empirical security analyses against spatial-domain, latent-domain, and diffusion-aware steganalyzers, together with ablation studies and cross-model validation, to demonstrate the robustness, security, and generality of RIS-MoE. The rest of this paper is organized as follows. Section "Related work" reviews related works on modification-based and generative image steganography. Section "Preliminaries" provides the preliminaries of DDIM and Latent Diffusion Models (LDMs). Our proposed RIS-MoE framework, including the orthogonal transformation, mapping model, MoE denoising module, and progressive training strategy, is detailed in Sect."Proposed framework". Extensive experimental results and analyses are presented in Sect."Experiments". Finally, conclusions are drawn in Sect."Conclusion". Related work Modification-based image steganography Modification-based steganography remains the dominant paradigm in practical image steganography. It embeds secret payloads by modifying the cover image in either the spatial or transform domain. Early modification-based methods, such as least significant bit embedding, directly modify low-significance components, thereby introducing detectable statistical artifacts (Dumitrescu et al. 2003). Modern modification-based approaches (Pevnỳ et al. 2010; Holub and Fridrich 2012; Li et al. 2014; Holub et al. 2014) typically combine well-designed distortion functions, which assign embedding costs to cover elements, with distortion-minimization frameworks such as Syndrome-Trellis Codes (Filler et al. 2011) and steganographic Polar Codes (Li et al. 2020). These methods effectively reduce the embedding distortion introduced into cover images at a given payload, thereby improving steganographic security. Recent studies incorporate deep neural networks into the embedding process. End-to-end frameworks learn embedding strategies automatically. Adversarial training is often used to enhance undetectability against learned steganalyzers. For example, HiDDeN (Zhu et al. 2018) introduces an end-to-end embedding architecture, while HiNet (Jing et al. 2021) adopts an invertible neural network for image-in-image steganography. Despite these advances, modification remains an inherent limitation of this paradigm. Any modification unavoidably alters the underlying cover distribution, creating statistical discrepancies that can be exploited by sufficiently powerful steganalysis techniques (You et al. 2021; Hu et al. 2025; Levecque et al. 2026). As a result, increasing the embedding payload typically degrades undetectability, and achieving complete statistical indistinguishability is difficult. Generative image steganography Generative image steganography provides an alternative paradigm to modification-based image steganography. It embeds secret information into the image generation process rather than modifying an existing cover image, thereby avoiding explicit distortion introduced by such modifications. However, its steganographic security still depends on the fidelity of the generative model and the alignment between generated images and the natural image distribution. Early generative image steganography methods were mainly based on GANs (Liu et al., 2017; Zhanget al., 2020; Duan et al., 2018; Hu et al., 2018). These methods established the basic idea of synthesizing stego images directly from secret-conditioned latent variables, rather than modifying existing cover images. Representative studies encoded secret messages into noise vectors and generated stego images through GAN-based models (Hu et al. 2018; Peng et al. 2022). Subsequent works improve embedding capacity and extraction accuracy by redesigning the generator architectures, e.g., through channel splitting, feature fusion, and attention mechanisms (Jiang et al. 2020; Yu et al. 2021). Other studies explored controllable or invertible generation frameworks, such as Glow-based and contour-guided GAN models (Zhou et al. 2023a, b). However, GAN-based frameworks generally suffer from unstable training, limited image quality, and insufficient robustness under practical distortions, which restrict their practical applicability. With the emergence of diffusion models, diffusion-based generative steganography has become a more promising direction due to its more stable generation process and superior image synthesis quality. Existing diffusion-based methods can be broadly divided into three categories. Noise-level embedding methods encode secret information into the initial noise before the reverse diffusion process. Hu et al. (2024) employ an orthogonal transformation to encode the secret message into the initial noise. In addition, they introduce an ODE-based formulation to improve the reversibility of the diffusion process (Lu et al. 2025), enabling more reliable recovery of hidden information from the generated sample. Along the same line, Yang et al. (2025) modulate the initial noise with secret information without relying on ODE-based solvers. Du et al. (2026) follow the noise-level embedding paradigm, but adopt a learned distribution-matching strategy. Specifically, they use a neural network to encode the secret message into a representation that follows a standard Gaussian distribution, and further introduce a discriminator to determine whether the generated representation is consistent with the standard normal prior. In this way, the message-carrying noise can be better aligned with the distributional requirement of diffusion models. These methods usually preserve high visual quality, since the generation pipeline remains largely unchanged. However, perturbing the initial noise may still introduce detectable statistical traces (Levecque et al. 2026). Latent-level embedding methods inject secret information into latent representations during or before image generation. Peng et al. (2024) embed encrypted bits into the reverse process of a latent diffusion model by selecting truncated-Gaussian sampling intervals guided by the secret data, and then decode the resulting stego latent into the final image. Although this strategy provides a direct way to control hidden content, directly constraining the latent sampling process may affect the quality of generated images. More recently, MDStega (Peng et al. 2026) introduces minimum-distance guidance to improve the visual quality of generated stego images and alleviate extraction errors caused by PNG quantization. However, its robustness is mainly designed for quantization loss during image saving, and remains limited under broader practical distortions such as JPEG compression, resizing, blur, and noise. Overall, latent-level methods provide explicit control over hidden content, but still face challenges in reliable message recovery under complex transmission conditions. Sampling-path-based embedding methods hide secret information by controlling the denoising trajectory during the final sampling steps of diffusion generation. Unlike latent-level methods that directly manipulate latent representations, these methods convey secret bits through the selection of denoising paths. For example, Mahfuz et al. (2025) generate multiple candidate denoising paths from the same intermediate state using different random seeds, and then select the denoising result according to the secret message. In this way, secret bits are embedded through the choice of denoising route rather than by directly perturbing latent features. Such methods provide a flexible embedding mechanism, but their robustness is often limited under image distortions and practical transmission perturbations. Preliminaries In this section, we briefly introduce the preliminary knowledge required for our proposed framework. Diffusion models have demonstrated state-of-the-art (SOTA) performance in various image generation tasks. Our proposed framework requires capturing the statistical features of the latent space during the diffusion process. This enables us to establish a mapping between secret messages and the normal diffusion latent space. Therefore, we first review the mathematical formulation of DDIM in Sect."Denoising diffusion implicit models". Next, we introduce LDMs in Sect."Latent diffusion models". Denoising diffusion implicit models In recent years, diffusion models have become the most popular approach for image generation. They have surpassed GAN-based frameworks. This success is attributed to their remarkable generation quality. Diffusion models involve two main processes. These are forward diffusion and reverse generation. During the forward phase, noise is gradually added to an image. This process yields a noisy image that follows a Gaussian distribution. Subsequently, in the generation phase, the noisy image is progressively denoised. This step ultimately reconstructs a clean image. Subsequently, Denoising Diffusion Probabilistic Models (DDPM) (Ho et al. 2020) were introduced. They utilized diffusion models to create high-fidelity and detailed images. This breakthrough opened a new direction for image generation. However, the image generation process in DDPM involves numerous steps, making it computationally intensive. To improve sampling efficiency, Song et al. (2021) proposed DDIM, which adopts a non-Markovian formulation and significantly reduces the required number of sampling iterations. In DDPM, the diffusion process progressively adds Gaussian noise to the original image. This step-by-step process is governed by a transition probability. The diffusion process adds noise to the original image \(\mathbf{x}_0\) and generates a noise image \(\mathbf{x}_t\) close to the Gaussian distribution through the transition probability \(q(\mathbf{x}_t | \mathbf{x}_{t-1})\). The transition probability is formulated as follows: where \(\alpha _t \in (0,1)\) is determined by the variance schedule. The noise variance at step t is defined as \(\beta _t = 1 - \alpha _t\). Specifically, let \(\bar{\alpha }_t = \prod _{i=1}^{t} \alpha _i\). The marginal distribution at an arbitrary step t can be deduced as: In DDPM, the forward process strictly follows a Markov chain. However, the training objective depends only on the marginal distribution \(q(\textbf{x}_t | \textbf{x}_0)\). Exploiting this property, DDIM constructs a non-Markovian forward process that ensures the marginal distribution remains identical to that of DDPM. This relaxation enables deterministic and accelerated sampling. In this non-Markovian structure, the state \(\textbf{x}_{t-1}\) depends on \(\textbf{x}_t\) and is directly conditioned on the initial input \(\textbf{x}_0\). The specific probability distribution of this diffusion process is formulated as follows: where \(q_\sigma (\textbf{x}_{t-1} | \textbf{x}_t, \textbf{x}_0)\) is defined as a Gaussian distribution. For \(t>1\), we have: In practice, the initial image \(\textbf{x}_0\) is unknown during the reverse generation process. Therefore, it must be estimated from the current state \(\textbf{x}_t\). A neural network \(\varvec{\epsilon }_\theta (\textbf{x}_t, t)\) is trained to predict the noise at step t. Based on the marginal distribution defined in (2), the initial image can be approximated as follows: By substituting \(\textbf{x}_0^\prime\) into (4) and simplifying the terms, we can derive the specific generative distribution of DDIM: Using the reparameterization trick, a sample \(\textbf{x}_{t-1}\) can be drawn from this distribution. The final generative process is formulated as follows: where \(\varvec{\epsilon }_t \sim \mathcal {N}(0, \textbf{I})\) represents standard Gaussian noise. In DDIM, the parameter \(\sigma _t\) is set to 0 for all steps. Consequently, the random noise term \(\sigma _t \varvec{\epsilon }_t\) vanishes. This results in a completely deterministic sampling process from \(\textbf{x}_t\) to \(\textbf{x}_0\). Latent diffusion models Traditional diffusion models operate directly in the pixel space. This incurs high computational costs for high-resolution image generation. To address this, Rombach et al. (2022) proposed LDMs. Stable Diffusion 2.1, utilized in our proposed framework, is a representative LDM. LDMs employ a pre-trained autoencoder to map images into a lower-dimensional latent space. Given an image \(\textbf{x} \in \mathbb {R}^{H \times W \times 3}\), an encoder \(\mathcal {E}\) compresses it into a latent representation \(\textbf{Z} = \mathcal {E}(\textbf{x})\). The forward diffusion and reverse generation processes are then performed entirely within this latent space. Consequently, the latent variable \(\textbf{Z}_t\) replaces the pixel variable \(\textbf{x}_t\) in the aforementioned DDIM formulation. After the reverse denoising process, a decoder \(\mathcal {D}\) reconstructs the final image. The generated image is obtained as \(\tilde{\textbf{x}} = \mathcal {D}(\textbf{Z}_0)\). By shifting the generative process to the latent space, LDMs significantly improve computational efficiency. More importantly, this latent space provides an effective domain for embedding secret information in our framework. Proposed framework Framework To address the limited robustness of existing latent-domain steganography and the difficulty in balancing steganographic security, visual fidelity, and reliable message recovery, we propose RIS-MoE, a robust and secure latent-space image steganography framework. Rather than relying solely on fragile latent perturbation, RIS-MoE jointly considers distortion-tolerant message representation and adaptive latent recovery. In this way, the proposed framework improves resilience to heterogeneous channel distortions while reducing detectable deviations from the natural diffusion latent distribution, leading to a more favorable balance among robustness, visual quality, and steganographic security. As illustrated in Fig. 1, the proposed RIS-MoE consists of a sender-side embedding pipeline and a receiver-side extraction pipeline. At the sender side, the secret message \(\textbf{M}_\text {re}\) is first processed by the Orthogonal Transformation module to obtain a distortion-tolerant intermediate representation, while the DDIM sampling process provides the latent feature \(\textbf{Z}_0\) for message embedding. The Hide Network then fuses the transformed message representation \({\mathbf{M}}_{{\text{T}}}\) with \(\textbf{Z}_0\) to generate the stego latent \({\mathbf{Z}}_{{{\text{msg}}}}\), which is subsequently mapped back to the pixel space by a pre-trained VAE decoder to produce the final stego image. During transmission, the stego image is subject to various real-world channel distortions. At the receiver side, the distorted stego image is first encoded into the latent space using a pre-trained VAE encoder, yielding the corrupted latent \(\tilde{\textbf{Z}}_\text {msg}\). Meanwhile, the receiver reproduces the reference latent \(\textbf{Z}_0\) using the same text prompt and deterministic DDIM sampling configuration as the sender; this prompt and configuration are assumed to be pre-agreed or transmitted as side information. Any mismatch or corruption in these parameters may cause the reproduced latent to deviate from the sender-side latent, potentially degrading extraction accuracy. The corrupted latent \(\tilde{\textbf{Z}}_\text {msg}\) is then refined by the MoE denoising module to suppress channel-induced perturbations. Subsequently, the Reveal Network reconstructs the intermediate message representation \(\hat{\mathbf{M}}_\text{T}\) from the restored latent \(\hat{\textbf{Z}}_\text {msg}\) and the reproduced reference latent \(\textbf{Z}_0\), and the inverse Orthogonal Transformation is applied to recover the original secret message. Together, these two pipelines enable robust message embedding and reliable message extraction under distorted transmission conditions. The architectural designs and mathematical formulations of the Orthogonal Transformation, Mapping Model, and MoE Denoising module are detailed in the following subsections. Orthogonal transformation module The Orthogonal Transformation Module serves as the initial stage in the sender’s embedding pipeline. Its primary objective is to map the original discrete secret message into a continuous, distributed representation before it is fused with the image latent features. Drawing inspiration from spread-spectrum communication systems (Cox et al. 1997), we transform the secret message into a more distributed representation by multiplying it with a learnable orthogonal matrix. Let \(\textbf{M} \in \{0,1\}^{L}\) denote the binary sequence obtained by encrypting the secret message of length \(L\), where L is assumed to be a perfect square. The message is first converted from binary symbols to bipolar symbols, i.e., from \(\{0,1\}\) to \(\{-1,1\}\), and then reshaped into a square matrix \(\textbf{M}_{\textrm{re}} \in \{-1,1\}^{\sqrt{L}\times \sqrt{L}}\). The transformed message representation \(\textbf{M}_{\text {T}}\) is then formulated as: where \(\textbf{W}_{\text {orth}} \in \mathbb {R}^{D\times \sqrt{L}}\) is a learnable orthogonal weight matrix, and \(D\) denotes the target dimension aligned with the latent feature space. To preserve the signal energy of the secret message and ensure accurate inverse mapping at the receiver, the matrix \(\textbf{W}_\text {orth}\) is strictly constrained to maintain orthogonality during the optimization process. This constraint is expressed as: where \(\textbf{I}\) is the identity matrix. This orthogonal transformation effectively spreads the concentrated information of individual message bits across the entire high-dimensional latent space. This design yields two critical advantages for the RIS-MoE framework - Enhanced steganographic security: By distributing the message, the transformed representation statistically approximates isotropic Gaussian noise (Hu et al. 2024). This minimizes the detectable distribution shift when fused with the standard diffusion latent variables, thereby reducing detectability by advanced steganalysis techniques. - Improved robustness: Since each bit of the secret message is encoded globally across multiple dimensions of \(\textbf{M}_\text {T}\), localized distortions caused by channel perturbations only partially degrade the signal. The resulting spread-spectrum representation enables reliable recovery of the embedded message from the remaining uncorrupted latent components. Mapping model The discrete secret message is first orthogonally transformed into a distributed representation \(\textbf{M}_{\text {T}}\). To embed this representation into the generative latent space of the diffusion model, a simple projection is insufficient, since robust embedding requires both feature alignment and spatially coherent fusion with the latent representation. To this end, we propose a Mapping Model, as shown in Fig. 2, consisting of a Hide Network (Encoder) and a Reveal Network (Decoder). The Mapping Model is built upon a customized U-Net backbone. This choice is motivated by the fact that the latent space of a LDM preserves the spatial topology and semantic hierarchy of the target image. Consequently, message embedding and recovery require a network that can jointly capture fine-grained spatial details and multi-scale dependencies in the latent space. U-Net is well suited for this purpose, as its encoder-decoder architecture enables multi-scale feature interaction, and its symmetric skip connections help preserve subtle spatial details critical for latent-domain steganography. To further improve embedding quality and robustness, we augment the U-Net backbone with Residual Blocks (ResBlocks) (He et al. 2016) and Spatial Attention Modules (Zhang et al. 2019). ResBlocks enhance the stability of feature transformation and mitigate structural distortion introduced by message embedding, while skip connections preserve high-frequency information, thereby alleviating blurring and latent degradation during embedding. Moreover, since the U-Net backbone naturally produces hierarchical feature maps at multiple spatial resolutions, spatial attention is incorporated at different stages of the network to better handle localized distortions. By capturing long-range dependencies across spatial locations, the spatial attention mechanism helps the network better exploit globally relevant features, thereby improving robustness to localized perturbations. Hide network At the sender side, the Hide Network \(\mathcal {H}_{\theta }\) fuses the transformed message \(\textbf{M}_\text {T}\) with the clean latent representation \(\textbf{Z}_{0}\) generated by the standard diffusion process. Specifically, the Hide Network adopts a residual learning strategy to preserve the statistical properties of the original latent space while minimizing perceptible distortions. Instead of directly synthesizing the stego latent \(\textbf{Z}_\text {msg}\), the network concatenates \(\textbf{Z}_{0}\) and \(\textbf{M}_\text {T}\) along the channel dimension, and predicts a minimal residual perturbation \(\Delta \textbf{Z}\): where \(\oplus\) denotes channel-wise concatenation. The stego latent \(\textbf{Z}_\text {msg}\) is then calculated as The clean latent \(\textbf{Z}_0\) follows a specific prior distribution defined by the diffusion model. By learning only the latent perturbation \(\Delta \textbf{Z}\), the modification magnitude is effectively constrained, keeping \(\textbf{Z}_\text {msg}\) close to the original latent distribution. This reduces the statistical shift introduced by message embedding, thereby improving empirical resistance to steganalysis. Reveal network At the receiver side, the Reveal Network \(\mathcal {R}_{\phi }\) serves as the decoding module for recovering the transformed message representation from the restored latent features. Its objective is not to reconstruct the entire clean latent, but to infer the message-bearing perturbation embedded in the restored message-bearing latent. Given the reference latent \(\textbf{Z}_{0}\) and the restored message-bearing latent \(\hat{\textbf{Z}}_\text {msg}\), the Reveal Network is designed to recover the continuous transformed message \(\hat{\textbf{M}}_\text {T}\) for subsequent inverse orthogonal decoding. Specifically, the Reveal Network adopts a multi-channel input strategy to exploit both latent content and perturbation cues. It jointly takes the reference latent \(\textbf{Z}_{0}\), the restored latent \(\hat{\textbf{Z}}_\text {msg}\), and their explicit difference \((\hat{\textbf{Z}}_\text {msg}-\textbf{Z}_{0})\) as input, and predicts the transformed message representation as: This design provides a strong inductive bias for message extraction. Rather than relying solely on the restored latent, the network explicitly exploits both the reference latent and the latent difference induced by message embedding and channel distortion. As a result, it can focus more directly on the perturbation components relevant to the hidden message while reducing interference from image content and irrelevant distortion patterns. This explicit residual guidance enables more accurate isolation of the embedded signal and improves the robustness and reliability of message recovery under distorted transmission conditions. Mixture-of-experts denoising module Existing generative image steganography methods mainly focus on how to embed secret information into the generation process, whereas little attention has been paid to distortion-aware latent recovery at the receiver side. In most cases, message extraction is performed directly from the received latent (Yang et al. 2025; Hu et al. 2024; Mahfuz et al. 2025; Peng et al. 2024; Du et al. 2026; Peng et al. 2026; Du et al. 2026), to handle all channel degradations in a unified manner. However, practical transmission distortions such as compression, blur, noise, resizing, and their combinations introduce heterogeneous corruption patterns in the latent space. These distortions affect the latent representation in different ways. For example, JPEG compression tends to introduce quantization-related artifacts, blur suppresses high-frequency latent components, resizing changes spatial correspondence, and Gaussian noise introduces stochastic perturbations. Therefore, a single restoration branch may be insufficient to simultaneously model all these heterogeneous corruption patterns. This motivates our distortion-aware divide-and-conquer design, where different experts are encouraged to specialize in different degradation modes. To realize this approach, we design a Mixture-of-Experts denoising module \(\mathcal {M}_\rho\) for receiver-side latent restoration. At a high level, the proposed module consists of a routing network and multiple specialized restoration experts. The routing network estimates the distortion composition of the corrupted latent and adaptively activates the most relevant experts for recovery. By combining specialized experts through adaptive routing, the proposed module can better accommodate diverse corruption modes, providing a more flexible and robust latent recovery process before downstream message extraction. For the routing network, we employ a multi-label ResNet-34 (He et al. 2016) rather than a structure-agnostic classifier. This choice is motivated by the structure of the distorted latent itself: channel distortions remain spatially organized in latent space, and many degradation patterns exhibit local correlations and multi-scale characteristics. For instance, compression artifacts, blur-induced smoothing, and stochastic noise perturbations leave distinct spatial signatures in the latent tensor. Compared with simpler classifiers, a residual convolutional backbone is better suited to capturing these localized and hierarchical cues (He et al. 2016), while maintaining stable optimization and moderate computational cost. The routing network takes the distorted latent \(\tilde{\textbf{Z}}_\text {msg}\) as input and outputs a probability vector \(\textbf{P} = [p_1, p_2, \dots , p_K]\), where \(K\) denotes the number of predefined distortion categories. Because real transmission may involve compound distortions, the routing task is formulated as a multi-label prediction problem rather than a mutually exclusive classification problem. This allows multiple experts to be activated simultaneously when the observed latent exhibits mixed degradation characteristics. The overall architecture of the proposed MoE denoising module is illustrated in Fig. 3. Let \(E_k(\cdot )\) denote the k-th expert. To improve computational efficiency and suppress interference from irrelevant experts, we introduce a threshold-based sparse activation strategy. Only experts whose predicted probabilities exceed a trainable threshold \(\tau\) are activated. The denoised latent representation is computed as: where the normalized fusion weight \(w_k\) is defined as: Here, \(\mathbb {I}(\cdot )\) denotes the indicator function. If all probabilities fall below \(\tau\), the expert with the highest probability is selected as a fallback mechanism. This design enables the denoising module to adapt to single, mixed, and complex distortions in a unified manner. More importantly, the module operates entirely at the latent recovery stage: it takes a corrupted latent as input and outputs a refined latent for downstream decoding, without relying on the specific sender-side embedding rule. This decoupling makes it naturally compatible with latent-space steganography pipelines as a modular recovery component. The refined latent \(\hat{\textbf{Z}}_\text {msg}\) is then fed into the Reveal Network for message extraction, substantially improving robustness under practical transmission conditions. Progressive training strategy for stable optimization We propose a comprehensive multi-stage training strategy to ensure the stability and effectiveness of the RIS-MoE framework. Since end-to-end training of complex generative steganography models is often unstable, the training process is divided into independent pre-training phases followed by a three-stage joint optimization pipeline. The overall training procedure is summarized in Algorithm 1. Optimization objectives To guide the multi-stage training, we formulate a composite optimization objective. The total loss function \(\mathcal {L}_\text {total}\) balances extraction accuracy, visual fidelity, and steganographic security: Here, \(\lambda _\text {rec}\), \(\lambda _\text {lpips}\), and \(\lambda _\text {latent}\) are dynamically adjusted weighting coefficients across different training stages. - Message recovery loss (\(\mathcal {L}_\text {rec}\)): We attempt to achieve precise bit-level recovery using the Binary Cross-Entropy (BCE) loss. It measures the difference between the original sequence \(\textbf{M}\) and the predicted sequence \(\hat{\textbf{M}}\): $$\begin{aligned} \mathcal {L}_\text {rec} = \text {BCE}(\textbf{M}, \sigma (\hat{\textbf{M}})), \end{aligned}$$(16)where \(\sigma (\cdot )\) is the Sigmoid activation function. - Perceptual loss (\(\mathcal {L}_\text {lpips}\)): Modifying latent features may introduce visual artifacts. We map the latents back to the RGB space using the pre-trained VAE decoder \(\mathcal {D}\). We then apply the Learned Perceptual Image Patch Similarity (LPIPS) metric (Zhang et al. 2018). This minimizes the perceptual distance between the cover image \(\textbf{x} = \mathcal {D}(\textbf{Z})\) and the stego image \(\textbf{x}' = \mathcal {D}(\textbf{Z}_\text {msg})\): $$\begin{aligned} \mathcal {L}_\text {lpips} = \text {LPIPS}(\textbf{x},\textbf{x}'). \end{aligned}$$(17) - Diffusion latent distance loss (\(\mathcal {L}_\text {latent}\)): This loss is introduced to reduce latent-domain deviations caused by message embedding and thereby improve resistance to latent-domain steganalysis. Since steganalysis can exploit deviations from the natural diffusion process, we randomly sample several DDIM inversion steps and enforce consistency between the corresponding inverted latent representations of the cover latent \(\textbf{Z}\) and the stego latent \(\textbf{Z}'\). The loss is defined as: $$\begin{aligned} \mathcal {L}_\text {latent} = || \text {DDIM}_\text {inv}(\textbf{Z}) - \text {DDIM}_\text {inv}(\textbf{Z}') ||_2^2 . \end{aligned}$$(18) Pre-training of MoE components Before optimizing the Reveal Network, we independently pre-train the components of the MoE denoising module. This phase consists of two parallel steps. First, we train the routing network using a multi-label ResNet-34 architecture. It is trained on a large dataset of corrupted latents to accurately identify specific channel distortions. Second, we train the individual denoising experts. Each expert is an independent NAFNet (Chen et al. 2022) model exclusively trained to restore latents corrupted by a single specific distortion type (e.g., JPEG compression or Gaussian blur). This decoupled pre-training encourages each expert to learn specialized denoising behavior. Stage 1: Basic embedding and extraction This stage establishes the fundamental steganographic communication channel. The Hide Network and the Reveal Network are trained end-to-end without channel distortions. To stabilize early optimization, the orthogonal transformation is implemented using a fixed orthogonal matrix generated by Gram–Schmidt orthogonalization. During this stage, a dominant weight is assigned to the message recovery loss \(\lambda _{\text {rec}}\), while the perceptual loss \(\lambda _{\text {lpips}}\) and the diffusion latent distance loss \(\lambda _{\text {latent}}\) are kept small. This configuration forces the Mapping Model to prioritize reliable embedding and accurate message extraction, enabling rapid convergence and establishing a reliable encoding-decoding mapping. Stage 2: Security and fidelity refinement The second stage is designed to further improve visual imperceptibility and security in the generative steganography setting. The converged weights from Stage 1 are used for initialization, and the learning rate is reduced. The orthogonal transformation still uses the fixed Gram–Schmidt orthogonal matrix in this stage. In this stage, the weights of the perceptual loss \(\lambda _\text {lpips}\) and the diffusion latent distance loss \(\lambda _\text {latent}\) are increased. The training objective shifts from accurate message recovery to distribution alignment. The Hide Network is penalized for deviating from the natural diffusion generation trajectory, encouraging the stego latents to remain close to original latent distribution. This refinement improves perceptual fidelity and reduces detectability under steganalysis. Stage 3: Robustness optimization The final stage improves the robustness of the overall framework to complex and unpredictable channel distortions. The weights from Stage 2 are loaded, and the parameters of the Hide Network are frozen to preserve the steganographic security achieved in the previous stage. Different from the previous two stages, the fixed Gram–Schmidt orthogonal matrix is replaced here by a learnable orthogonal matrix, which is optimized together with the receiver-side modules under robustness-oriented training. The Reveal Network and the pre-trained MoE denoising module are then jointly optimized. During training, random and composite differentiable channel distortions are applied to the stego latents. The MoE denoising module adaptively routes and mitigates these distortions, while the Reveal Network learns to extract messages from the restored latents. This targeted distortion-aware training improves the robustness of RIS-MoE under practical transmission distortions. Experiments Experimental settings - 1. Implementation details: Stable Diffusion v2.1 is adopted as the default LDM, pre-trained on the LAION-5B (Schuhmann et al. 2022) dataset. For the three training stages detailed in Sect."Progressive training strategy for stable optimization", the loss weights (\(\lambda _{\text {rec}}\), \(\lambda _{\text {lpips}}\), \(\lambda _{\text {latent}}\)) are empirically set to (10, 1, 1) in Stage 1, (1, 5, 5) in Stage 2, and (1, 0, 0) in Stage 3, respectively. These stage-dependent weights are selected according to the optimization objective of each training stage. In Stage 1, a larger weight is assigned to \(\mathcal {L}_{\textrm{rec}}\) to establish a reliable embedding-and-extraction mapping. In Stage 2, the weights of \(\mathcal {L}_{\textrm{lpips}}\) and \(\mathcal {L}_{\textrm{latent}}\) are increased to improve perceptual fidelity and reduce latent-domain deviations. In Stage 3, the sender-side embedding network is frozen, and the optimization focuses on receiver-side robustness under channel distortions; therefore, the recovery-related objective is emphasized while the visual and latent consistency constraints are not further strengthened. The adopted coefficients were determined based on preliminary validation experiments and the relative magnitudes of different loss terms, aiming to balance extraction accuracy, visual fidelity, and empirical security. The trainable modules of RIS-MoE, including the message embedding, extraction, and MoE denoising module, are trained on the MS-COCO dataset (Lin et al. 2014), while the pre-trained LDM backbone remains fixed. All experiments are conducted in PyTorch on an NVIDIA L40 GPU. - 2. Evaluation datasets: The proposed RIS-MoE employs this pre-trained LDM without requiring any fine-tuning or retraining, and its performance is evaluated on four distinct datasets. DescGPT. ChatGPT, a large language model developed by OpenAI, is capable of generating highly descriptive text. Leveraging this capability, Hu et al. (2024) constructed the DescGPT dataset (Dataset 2024) by manually prompting ChatGPT to generate 654 detailed text prompts. LAION-10K. The LAION-5B (Schuhmann et al. 2022) dataset contains over five billion text-image pairs. We randomly sample 10,000 text prompts from this massive collection to construct a subset, denoted as LAION-10k. MS-COCO. The MS-COCO val2017 validation set (Lin et al. 2014) contains 5,000 images, each paired with five textual descriptions. For each image, we randomly select one description as the text prompt. Flickr8K. The Flickr8K (Hodosh et al. 2013) dataset comprises 8,092 natural images, each annotated with five text captions. We randomly select one caption per image to construct a set of 8,092 text prompts. - 3. Baseline methods: We compare RIS-MoE with six representative steganographic baselines: GRDH (Hu et al. 2024), LDStega (Peng et al. 2024), PsyDuck (Mahfuz et al. 2025), HiNet (Jing et al. 2021), MDStega (Peng et al. 2026) and DiffuCap (Du et al. 2026), covering noise-level embedding, latent-level embedding, sampling-path-based embedding, and deep-learning-based image steganography, respectively. GRDH. A noise-level generative steganography method that embeds the transformed message into the initial Gaussian noise of the diffusion process through orthogonal matrix mapping and improves reversibility via an ODE-based formulation. LDStega. A latent-level generative steganography method that hides secret bits by selecting truncated-Gaussian sampling intervals in the latent diffusion process. PsyDuck. A sampling-path-based generative steganography method that conveys secret bits by selecting different denoising trajectories during the final sampling steps. HiNet. A deep-learning-based non-diffusion baseline built on invertible neural networks that performs end-to-end image steganography in the pixel domain. MDStega. A training-free diffusion-based generative steganography method that conveys secret bits through distribution-preserving residual image sampling and recovers messages using a minimum-distance guidance rule. DiffuCap. A latent-level generative steganography method that maps the secret message into the latent representation of a latent diffusion model using a neural message encoder and recovers it through diffusion-based latent reconstruction. - 4. Evaluation metrics: We employ multiple metrics to evaluate the performance of the proposed RIS-MoE, including embedding capacity, extraction accuracy, robustness, steganographic security, and visual quality. Embedding capacity: Embedding capacity quantifies the amount of secret information embedded in an image. It is measured in bits per pixel (bpp), defined as the average number of embedded bits per pixel in the generated stego image: $$\begin{aligned} bpp = \frac{L}{W \times H}, \end{aligned}$$(19)where L denotes the message length in bits, and W and H represent the width and height of the generated image, respectively. Extraction accuracy: Extraction accuracy evaluates the reliability of message recovery. It is defined as the proportion of correctly extracted bits: $$\begin{aligned} acc = 1 - \frac{E}{L}, \end{aligned}$$(20)where E denotes the number of erroneous bits and L represents the length of the embedded message. A higher accuracy indicates more reliable extraction. Robustness: In real-world transmission, practical channel distortions may introduce heterogeneous perturbations that degrade the latent representation and interfere with reliable message extraction. To evaluate the robustness of RIS-MoE under such conditions, we measure the extraction accuracy under the following five common lossy distortions. - Resize. Image resizing alters the spatial resolution of images. We apply bilinear interpolation with scaling factors of 0.5, 0.75, 1.25, and 1.5. - JPEG Compression (JPEG). A widely used lossy image compression technique that reduces file size by removing high-frequency components. We adopt JPEG quality factors of 90, 70, and 50. - Median Blur (MBlur). A non-linear filtering operation that replaces each pixel with the median of its local neighborhood, thereby suppressing local variations. We evaluate its impact using kernel sizes of \(3 \times 3\), \(5 \times 5\), and \(7 \times 7\). - Gaussian Blur (GBlur). A low-pass filtering operation implemented via Gaussian convolution. We assess its impact using kernel sizes of \(3 \times 3\), \(5 \times 5\), and \(7 \times 7\). - Additive white Gaussian noise (AWGN). We simulate channel noise by adding Gaussian noise to pixel values, with standard deviations of 0.01, 0.05, and 0.10. Steganographic security: Steganographic security is evaluated empirically using four SOTA steganalysis methods that cover spatial-domain, latent-domain, and diffusion-aware detection. Specifically, SRNet (Boroumand et al. 2019) and SiaStegNet (You et al. 2021) are adopted as representative spatial-domain steganalyzers. DI-MLP (Hu et al. 2025) is included as a latent-domain steganalyzer based on DDIM inversion features. To further address recent diffusion-aware security concerns, we also include NS-DSer (Zhu et al. 2026), which analyzes diffusion-model noise-space features for detecting diffusion-based generative steganography. This setting enables a broader empirical assessment of RIS-MoE against conventional, latent-domain, and diffusion-aware steganalysis methods. Since generative steganography does not rely on a pre-existing cover image, we define the “cover” as the image generated by the standard unmodified diffusion process under identical settings, and the “stego” as the image generated by a generative steganography method with secret information embedded during the generation process. For the MS-COCO dataset, we generate 2000 cover images through the standard generation process and 2000 stego images. The resulting dataset is then partitioned into training, validation, and test sets in a ratio of 1600:200:200.In the experiments, we use the detection accuracy (denoted as \(\text {D}_\text {acc}\)) to evaluate the steganographic security of the compared methods, defined as: where \(P_\text {FA}\) and \(P_\text {MD}\) denote the false alarm rate and missed detection rate, respectively. Visual quality: Visual quality evaluates the realism and fidelity of the generated stego images. We adopt the Fréchet Inception Distance (FID) (Heusel et al. 2017) and LPIPS (Zhang et al. 2018) for evaluation. FID measures the distance between the feature distributions of reference images and generated stego images, where features are extracted using a pre-trained Inception-v3 network. A lower FID indicates higher visual quality. Additionally, LPIPS measures the perceptual distance between stego images and their corresponding reference images using deep feature representations. A lower LPIPS also indicates better perceptual quality. Embedding capacity We evaluate the embedding capacity of the proposed RIS-MoE framework. Our method embeds secret messages directly into the latent space of the Latent Diffusion Model. The dimensionality of this latent space is \(4 \times 64 \times 64\), corresponding to a maximum payload of 16,384 bits. The final decoded stego images have a spatial resolution of \(512 \times 512\). According to (19), our method achieves an embedding capacity of 0.0625 bpp. For a fair evaluation, all baseline methods are standardized to output \(512 \times 512\) stego images. For HiNet (Jing et al. 2021), we use a \(128 \times 128\) image as the secret payload, corresponding to 16,384 bits. Accordingly, the embedding capacity is 0.0625 bpp. This setup ensures a consistent comparison across robustness evaluations. For steganographic security, we report both the default 4,096bits setting and an additional high-payload 16,384bits setting. Extraction accuracy and robustness analysis Performance under distortion-free and single-distortion conditions Table 1 presents the extraction accuracy of RIS-MoE across four distinct datasets under both ideal and lossy channel conditions. Under PNG compression, the proposed method achieves consistently high extraction accuracy across all tested datasets. Specifically, the accuracy remains above 98.6% in all cases and reaches 99.36% on the Flickr8K dataset. These results verify the effectiveness of the proposed embedding and extraction pipeline under distortion-free conditions and provide a reliable baseline for the subsequent robustness evaluation. The robustness of RIS-MoE is further evaluated under five common lossy operations. As the distortion severity increases, the extraction accuracy gradually declines. For example, reducing the JPEG quality factor from 90 to 50 leads to a progressive decrease in recovery accuracy, and similar trends are observed as the blur kernel size or the Gaussian noise level increases. This behavior is expected, since stronger distortions introduce more severe perturbations during the image-to-latent remapping process and therefore make message recovery more difficult. Nevertheless, RIS-MoE remains comparatively stable across different distortion types. In particular, it shows strong resilience to resizing and Gaussian blur, with extraction accuracy generally remaining above 90%. Even under the most severe tested distortion conditions, such as Median Blur (\(7 \times 7\)) and Gaussian Noise (0.1), the proposed framework still maintains a usable recovery rate. This robustness can be attributed to two aspects of the proposed design. First, the orthogonal transformation spreads message information into a more distributed latent representation, reducing the sensitivity of individual bits to localized corruption. Second, the MoE denoising module adaptively restores corrupted latent features before decoding, thereby improving recovery under heterogeneous channel distortions. Comparison with baseline methods All experiments in this part are conducted on the LAION-10K dataset. We further compare RIS-MoE with six representative steganographic schemes, including GRDH (Hu et al. 2024), HiNet (Jing et al. 2021), LDStega (Peng et al. 2024), PsyDuck (Mahfuz et al. 2025), MDStega (Peng et al. 2026) and DiffuCap (Du et al. 2026). As reported in Table 2, RIS-MoE achieves higher extraction accuracy than these baselines under most evaluated single-distortion settings. Among the baselines, LDStega and PsyDuck exhibit particularly severe performance degradation under common distortions. A possible explanation is that these methods rely more heavily on fragile latent perturbations or diffusion-path manipulations, making the hidden message more vulnerable to compression, blur, and noise contamination. HiNet also shows clear vulnerability, especially under JPEG compression. This is likely because its message embedding is more directly coupled to pixel-domain image details, which are more severely affected by irreversible quantization and compression artifacts. MDStega achieves relatively high extraction accuracy under PNG format, which is consistent with its design goal of improving extraction robustness against image quantization. However, its performance drops sharply under most other distortions, especially resizing, JPEG compression, median blur, and Gaussian noise. In contrast, DiffuCap shows more stable robustness than LDStega, PsyDuck, and MDStega under most distortion settings. This may benefit from its neural message encoder, which learns a more structured mapping from secret messages to latent representations. Nevertheless, its extraction accuracy remains lower than that of RIS-MoE in most cases. GRDH demonstrates relatively competitive robustness among the baselines, suggesting that its message representation already possesses a certain degree of structural tolerance. However, RIS-MoE still achieves higher extraction accuracy in most settings. This advantage indicates that robustness does not only depend on how the message is embedded, but also on whether the distorted latent can be effectively restored before extraction. In this respect, the proposed MoE-based latent denoising strategy provides a clear advantage over the baselines. In addition, we evaluate RIS-MoE with different Stable Diffusion backbones. The results show that RIS-MoE still maintains strong robustness when transferred to Stable Diffusion v1.5. Unless otherwise specified, all other experiments in this paper are conducted based on Stable Diffusion v2.1. This is because the proposed method is not specifically tied to a particular Stable Diffusion version; instead, it mainly performs message embedding and latent restoration in the latent domain, which enables good transferability across different Stable Diffusion backbones. Performance under combined-distortion conditions Since real-world transmission rarely involves a single isolated distortion, we further evaluate all methods under combined distortions composed of multiple sequential operations, such as resizing followed by blurring and JPEG compression. Consistent with the previous evaluations, all experiments in this part are also conducted on the LAION-10K dataset. The corresponding results are reported in Table 3.Footnote 1 In addition, we conduct real-world social-media transmission experiments on Weibo and Instagram by uploading each stego image to the platforms and then downloading it after platform processing for message extraction and robustness evaluation. For these practical tests, RIS-MoE is compared only with GRDH, since the other baselines already exhibit substantially lower robustness under single-distortion settings, as shown in Table 2. Under these more challenging scenarios, RIS-MoE still demonstrates strong robustness. It maintains extraction accuracy above 90% across all simulated combined distortions, and achieves extraction accuracies of 94.62% and 95.29% in real-world Weibo and Instagram channels, respectively. These results are consistently higher than those of GRDH, which achieves 90.26% on Weibo and 92.38% on Instagram. By contrast, the remaining baselines suffer much more pronounced degradation once multiple distortions are combined. These results further confirm the advantage of the proposed design under practical transmission conditions. Unlike conventional single-branch restoration strategies, the MoE denoising module responds to diverse latent degradations more adaptively by activating different experts for distinct distortion characteristics. As a result, RIS-MoE is better able to suppress complex latent-space corruption and preserve the hidden message in challenging and unpredictable channels. Plug-and-play transferability To further assess whether the proposed MoE denoising module depends on the specific embedding rule of RIS-MoE, we integrate it into PsyDuck and LDStega, two representative latent-space generative image steganography methods. As illustrated in Fig. 4, for each baseline, the original message embedding and decoding mechanisms are kept unchanged, and the proposed MoE denoising module is inserted only at the latent recovery stage before message extraction. This setup isolates the contribution of the proposed module as a modular recovery component rather than as a redesign of the entire steganographic pipeline. Consequently, the proposed MoE denoising module can be seamlessly integrated into different latent-space image steganography frameworks without modifying their original embedding and decoding logic. As shown in Fig. 5, the proposed MoE denoising module consistently improves extraction accuracy under five combined-distortion settings. For PsyDuck, the recovery accuracy increases from 61.68 to 75.45% under "Resize 1.5 + Gaussian Blur 3 + JPEG 90", and from 56.15 to 76.23% under "Median Blur 3 + Resize 0.5 + Gaussian Blur 3". For LDStega, similar improvements are observed, for example, from 46.90 to 60.71% and from 46.42 to 64.84% under two representative combined-distortion settings. Similar performance gains are consistently observed across the remaining settings, indicating stable generalization of the proposed MoE denoising module across different embedding frameworks This improvement can be attributed to the decoupled design of the proposed MoE denoising module. Operating solely on the corrupted latent representation and independent of any specific embedding rule, it can be seamlessly integrated into the recovery stage of other latent-space image steganography methods. By estimating the distortion composition and adaptively combining specialized restoration experts, the module refines corrupted latents before downstream decoding. Overall, these results demonstrate that the proposed MoE denoising module is transferable across the evaluated latent-space image steganography frameworks and can effectively enhance robustness to complex channel distortions Steganographic security The steganographic security of RIS-MoE is evaluated using the four SOTA steganalyzers introduced in Sect."Experimental settings", including SRNet (Boroumand et al. 2019), SiaStegNet (You et al. 2021), DI-MLP (Hu et al. 2025), and NS-DSer (Zhu et al. 2026). These detectors cover spatial-domain, latent-domain, and diffusion-aware image steganalysis. All methods are compared under a fixed embedding payload of 4096 bits, providing a practical yet challenging setting for detectability evaluation. As reported in Table 4, where a detection accuracy close to 50% indicates random guessing, the compared baselines exhibit different vulnerabilities under the evaluated steganalyzers. Specifically, HiNet (Jing et al. 2021) and PsyDuck (Mahfuz et al. 2025) are particularly vulnerable to DI-MLP, while LDStega (Peng et al. 2024) shows weak resistance against SRNet and NS-DSer. In contrast, RIS-MoE achieves lower detection accuracy than most baselines under the evaluated steganalyzers, indicating improved empirical resistance to steganalysis. This improvement is consistent with the design of RIS-MoE. Message embedding is performed in the latent space, avoiding direct pixel-space modification and better preserving natural image statistics after decoding. Additionally, the secret message is transformed by a learnable orthogonal matrix into a distributed representation before fusion with the diffusion latent, thereby reducing concentrated embedding traces and minimizing detectable distribution shifts. Furthermore, the Hide Network adopts a latent perturbation strategy by predicting only a minimal latent perturbation \(\Delta \textbf{z}\) rather than directly synthesizing a fully modified latent. As a result, the stego latent remains closer to the original latent distribution, suppressing the statistical deviations that can be exploited by spatial-domain, latent-domain, and diffusion-aware steganalyzers. Compared with methods relying on more direct image-space modification (Jing et al. 2021; Zhu et al. 2018) or less constrained latent manipulation (Peng et al. 2024; Mahfuz et al. 2025), RIS-MoE imposes tighter control over embedding perturbations and preserves the latent distribution more effectively. Consequently, the generated stego samples are empirically more difficult for steganalyzers to distinguish from cover samples. However, RIS-MoE does not consistently achieve detection performance close to random guessing, especially under DI-MLP, indicating that residual steganographic traces remain in the generated stego images. Therefore, the results should be interpreted as demonstrating improved resistance to the evaluated steganalyzers rather than complete statistical indistinguishability. To further examine steganographic security under a larger embedding payload, we conduct an additional evaluation under the 16,384-bit setting. This payload corresponds to the full latent dimensionality of \(4 \times 64 \times 64\), i.e., 0.0625 bpp for \(512 \times 512\) generated images. It represents a more aggressive payload than the 4096-bit setting used in Table 4. Among the evaluated steganalyzers, DI-MLP is particularly relevant to this setting because it analyzes diffusion inversion features and achieves the highest detection accuracy against RIS-MoE in Table 4. Therefore, we use DI-MLP as the representative steganalyzer for the high-payload evaluation. Following Li et al. (2026), we further consider a small-sample steganalysis setting. For each setting, N cover images and N stego images are used to train the steganalyzer, where \(N \in \{5,20,50,100,150,200,500,1000\}\). Here, \(N=5\) means that only 5 cover images and 5 stego images are available for training. A detection accuracy close to 50% indicates random guessing, and values closer to 50% therefore indicate stronger empirical security. As shown in Fig. 6, RIS-MoE remains close to random guessing when only a few training samples are available. Specifically, the detection accuracies are 48% and 54% when \(N=5\) and \(N=20\), respectively. This indicates that RIS-MoE does not expose easily learnable traces to DI-MLP in the small-sample regime, even under the 16,384-bit payload. As N increases, the detection accuracy gradually rises, suggesting that larger training sets enable the steganalyzer to learn residual embedding traces more effectively. Compared with HiNet and PsyDuck, RIS-MoE shows a clear security advantage, since these two methods can be detected with very high accuracy even when the training set is small. In contrast, RIS-MoE maintains much lower detection accuracy under the same training-sample settings. RIS-MoE also achieves lower detection accuracy than DiffuCap and MDStega for most values of N, showing stronger resistance to DI-MLP in this high-payload small-sample setting. It can be observed that GRDH consistently achieves the lowest detection accuracy, which is consistent with its provable-security design and the results in Table 4. However, this stronger detector-level security is accompanied by weaker robustness under practical channel distortions, as reported in Tables 2 and 3. Therefore, compared with GRDH, RIS-MoE provides a more balanced trade-off between steganographic security and robustness. LDStega also shows strong resistance to the latent-domain DI-MLP steganalyzer. However, this result is detector-specific. As shown in Table 4, LDStega is much more vulnerable to spatial-domain and diffusion-aware steganalyzers such as SRNet and NS-DSer. Moreover, as shown in Fig. 7, LDStega produces visually abnormal stego images and obtains worse FID and LPIPS scores than RIS-MoE. Thus, although LDStega performs well against DI-MLP, it does not provide a balanced trade-off among steganographic security, visual quality, and practical robustness. In practical scenarios, the full 16,384-bit per-image payload represents a relatively demanding setting, since many applications require only a much smaller message size. In addition, collecting hundreds or thousands of paired cover/stego samples generated by the same hidden method is difficult for a real-world steganalyzer. Under the same number of training samples, RIS-MoE generally achieves lower detection accuracy than most compared methods, including HiNet, PsyDuck, DiffuCap, and MDStega, indicating stronger resistance to DI-MLP in this high-payload setting. Under this practical small-sample condition, RIS-MoE maintains competitive resistance to DI-MLP while preserving the robustness and visual-quality advantages demonstrated in Sect."Visual quality". These results further support the practical security of RIS-MoE in realistic high-payload steganalysis scenarios. Ablation studies Robustness ablation study To further evaluate the contributions of the trainable orthogonal transformation (OT) and the MoE denoising module, we conduct an ablation study under the same distortion settings. Following the established setup, all experiments in this part are performed on the LAION-10K dataset. The corresponding results are reported in Table 5. Four variants are considered: the full model with both OT and MoE, the variant without trainable OT, the variant without MoE, and the variant without both modules. As shown in Table 5, the full model consistently achieves the highest extraction accuracy across all evaluated distortions, indicating that both components contribute positively to robustness. When the trainable OT is removed, the performance drops moderately under most settings, with more noticeable degradation under JPEG compression and Gaussian noise. For example, the extraction accuracy decreases from 87.45 to 82.55% under JPEG quality factor 50, and from 81.57 to 76.62% under Gaussian noise level 0.1. These results suggest that the trainable OT helps construct a more distortion-tolerant message representation by distributing the embedded information across latent dimensions, thereby reducing the sensitivity of individual bits to local distortions. A larger performance drop is observed when the MoE denoising module is removed. Compared with the full model, the variant without MoE decreases from 98.03 to 92.47% under JPEG quality factor 90, from 87.45 to 80.57% under JPEG quality factor 50, and from 81.57 to 73.08% under Gaussian noise level 0.1. This trend demonstrates that the MoE denoising module plays a dominant role in robustness improvement, as it explicitly restores corrupted latent features before message decoding and is therefore particularly effective under severe channel distortions. When both modules are removed, the performance remains consistently inferior to that of the full model and becomes especially weak under challenging distortions such as strong JPEG compression and Gaussian noise. Although the degradation is not uniformly larger than that of the single-module variants in every setting, the overall results still confirm that the trainable OT and the MoE denoising module provide complementary benefits. In summary, the ablation study verifies that the trainable OT mainly improves robustness by enhancing the distortion tolerance of the embedded representation, while the MoE denoising module provides larger gains by adaptively recovering distorted latent features before extraction. Steganographic security ablation study To further verify the contribution of the Orthogonal Transformation (OT) module to steganographic security, we conduct an ablation experiment by removing OT while keeping the remaining embedding and extraction pipeline unchanged. The results are reported in Table 6. Compared with the full RIS-MoE model, the variant without OT consistently leads to higher detection accuracy across all evaluated steganalyzers. In particular, the detection accuracy increases by approximately 10 percentage points under most steganalyzers after removing OT, indicating that the embedded traces become more distinguishable when the secret message is directly fused into the latent representation without orthogonal spreading. This result demonstrates that OT plays an important role in reducing detectable embedding artifacts. By transforming the binary secret message into a distributed representation before latent fusion, OT spreads the message information across latent dimensions rather than concentrating it into localized or bit-wise patterns. Such a distributed representation better matches the statistical characteristics of diffusion latents and reduces the distribution shift introduced by message embedding. Consequently, stego samples generated with OT are more difficult for spatial-domain, latent-domain, and diffusion-aware steganalyzers to distinguish from cover samples. In contrast, when OT is removed, the message representation becomes less dispersed and the embedding perturbation is more directly correlated with the original binary message. This makes the resulting stego latent easier to exploit by steganalyzers, leading to higher detection accuracy. Therefore, the OT ablation results confirm that the proposed orthogonal message transformation contributes not only to robustness but also to empirical steganographic security. Visual quality Visual quality is a critical criterion in image steganography. It directly reflects the perceptual fidelity between generated stego images and natural cover images. All evaluations in this subsection are conducted on the Flickr8K dataset. We adopt FID and LPIPS for quantitative evaluation, where lower values indicate better visual fidelity. The quantitative and qualitative comparison results are jointly presented in Fig. 7. As shown in Fig. 7, the proposed method achieves an LPIPS score of 0.21, outperforming GRDH (0.80), LDStega (0.75), and PsyDuck (0.24). For FID, our method achieves 7.35, which is substantially lower than LDStega (41.59) and PsyDuck (8.14), and remains comparable to GRDH (6.41). Although HiNet reports lower FID and LPIPS values, qualitative inspection reveals noticeable unnatural textures in the central regions of some generated images. By contrast, the stego images generated by RIS-MoE exhibit more natural visual appearance and better perceptual consistency with the reference images. These results suggest that RIS-MoE achieves a favorable balance between quantitative fidelity and visual realism. Computational complexity and efficiency analysis To further evaluate the practical applicability of the proposed RIS-MoE framework, we compare its computational complexity and inference efficiency with representative baseline methods. All methods are evaluated under the same hardware environment, image resolution, and batch-size setting. We report three metrics: FLOPs, inference latency, and peak GPU memory consumption. FLOPs reflect the theoretical computational cost, inference latency measures the end-to-end running time, and peak GPU memory indicates the maximum memory usage during inference. The results are reported in Table 7. RIS-MoE introduces several additional modules, including the Hide Network, Reveal Network, routing network, and denoising experts. Therefore, its computational cost is higher than lightweight pixel-domain hiding methods such as HiNet. This is expected because RIS-MoE performs message embedding, receiver-side latent restoration, and message extraction within a diffusion-based generative framework. Nevertheless, compared with several diffusion-based generative steganography baselines, RIS-MoE achieves a practical inference cost. Specifically, RIS-MoE requires 3817.79 ms for inference, which is lower than GRDH, PsyDuck, DiffuCap, and LDStega. Its peak GPU memory consumption is 6.76 GB, which is also lower than GRDH, DiffuCap, and LDStega. It can be observed that FLOPs and actual inference latency are not strictly proportional for diffusion-based steganography methods. This is because the end-to-end running time is affected not only by neural network computation, but also by sequential DDIM denoising or inversion procedures. For example, although GRDH has lower FLOPs than RIS-MoE, its extraction stage needs to invert the received image back to the noise space before message recovery, which introduces additional sequential diffusion operations. By contrast, RIS-MoE performs receiver-side extraction directly in the latent space: the received image is encoded by the VAE encoder, restored by the MoE denoising module, and decoded by the Reveal Network. Thus, RIS-MoE avoids a full inversion-to-noise extraction process. This helps explain why RIS-MoE can achieve lower inference latency than GRDH even though it contains additional Hide/Reveal and MoE modules. The computational overhead of RIS-MoE mainly comes from three parts: the sender-side Hide Network, the receiver-side Reveal Network, and the MoE denoising module. Since the Hide and Reveal Networks adopt U-Net-like architectures with residual and attention blocks, they contribute non-negligible computation. The MoE denoising module further introduces receiver-side overhead through the routing network and activated denoising experts. However, the threshold-based sparse activation strategy avoids executing all experts for every input. Let \(\mathcal {A}\) denote the set of activated experts. The computational cost of the MoE restoration stage can be expressed as: where \(\mathcal {C}_{\textrm{router}}\) denotes the cost of the routing network and \(\mathcal {C}_{E_k}\) denotes the cost of the k-th denoising expert. This formulation indicates that the expert-related cost depends on the number of activated experts rather than the total number of candidate experts. Therefore, the proposed sparse routing mechanism improves scalability when more experts are introduced. Overall, RIS-MoE is computationally heavier than lightweight pixel-domain hiding methods, but remains practical compared with diffusion-based generative steganography baselines. More importantly, the additional computational cost is accompanied by clear robustness gains under heterogeneous, mixed, and real-world channel distortions. These results demonstrate that RIS-MoE provides a favorable trade-off between inference efficiency and robust message recovery. Conclusion This paper proposed RIS-MoE, a robust and secure latent-space image steganography framework. To address the limited robustness of existing latent-domain methods and their difficulty in balancing security, visual fidelity, and reliable message extraction, RIS-MoE jointly integrates a learnable orthogonal transformation for distortion-tolerant message representation and a plug-and-play MoE denoising module for adaptive latent restoration before message recovery. Extensive experiments demonstrated that the proposed framework achieves strong extraction robustness under diverse single distortions, mixed distortions, and real-world social-media transmission scenarios. Meanwhile, RIS-MoE maintains favorable visual quality and competitive empirical resistance against spatial-domain, latent-domain, and diffusion-aware steganalyzers. Additional plug-and-play evaluations further verified that the proposed MoE denoising module can generalize across representative latent-space steganography pipelines. These results suggest that robust latent recovery is an important yet underexplored direction in generative image steganography. Beyond the specific RIS-MoE framework, the proposed receiver-side restoration strategy provides a practical perspective for improving covert communication reliability under realistic transmission conditions. Data availability No new data or materials were created or analyzed in this study. The findings are derived entirely from the manuscript’s content and the referenced literature. Notes Each combined-distortion setting is denoted by a sequence of distortion types and their parameter values, ordered according to the applied operations. For example, “AWGN 0.1” denotes additive white Gaussian noise with a noise level of 0.1. References Arjovsky M, Chintala S, Bottou L (2017) Wasserstein Generative adversarial networks. International Conference on Machine Learning (ICML). pp 214–223 Boroumand M, Chen M, Fridrich J (2019) Deep residual network for steganalysis of digital images. IEEE Transactions on Information Forensics and Security (TIFS) 14(5):1181–1193 Chen L, Wang R, Dong L, Yan D (2023) Imperceptible adversarial audio steganography based on psychoacoustic model. Multimedia Tools Appl (MTA) 82(17):26451–26463 Chen L, Chu X, Zhang X, Sun J (2022) Simple baselines for image restoration. European Conference on Computer Vision (ECCV). pp 17–33 Cox IJ, Kilian J, Leighton FT, Shamoon T (1997) Secure spread spectrum watermarking for multimedia. IEEE Transactions on Image Processing (TIP) 6(12):1673–1687 Hu, X. DescGPT Dataset. [Dataset] [Online]. 2024. Available: https://github.com/HXX5656/mas_GRDH/blob/main/text_prompt_dataset/chatgpt_dataset.txt Du R, Wang N, Xiong C, Qin C, Zhang X (2026) High-capacity image steganography via latent diffusion models. IEEE Signal Processing Letters (SPL) 33:401–405 Du R, Wang N, Xiong C, Qin C, Zhang X (2026) High-capacity image steganography via latent diffusion models. IEEE Signal Processing Letters (SPL) 33:401–405 Duan X, Song H, Qin C, Khan M (2018) Coverless steganography for digital images based on a generative model. Comput Mater Continua (CMC) 55(3):483–493 Dumitrescu S, Wu X, Wang Z (2003) Detection of LSB steganography via sample pair analysis. IEEE Trans Signal Process 51(7):1995–2007 Fan P, Zhang H, Zhao X (2022) Adaptive QIM with minimum embedding cost for robust video steganography on social networks. IEEE Transac Inf Forensics Secur (TIFS) 17:3801–3815 Fang T, Jaggi M, Argyraki K (2017) Generating steganographic text with LSTMs. Annu Meet Assoc Comput Linguist (ACL). pp 100–106 Filler T, Fridrich J (2011) Design of Adaptive steganographic schemes for digital images. Media Watermark Secur Forensics (MWSF) 7880:140–153 Filler T, Judas J, Fridrich J (2011) Minimizing additive distortion in steganography using syndrome-trellis codes. IEEE Transactions on Information Forensics and Security (TIFS) 6(3):920–935 Fridrich J, Kodovsky J (2012) Rich Models for steganalysis of digital images. IEEE Transactions on Information Forensics and Security (TIFS) 7(3):868–882 He K, Zhang X, Ren S, Sun J (2016) Deep Residual Learning for Image Recognition. 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR). pp 770–778 Heusel M, Ramsauer H, Unterthiner T, Nessler B, Hochreiter S (2017) GANs Trained by a two time-scale update rule converge to a local nash equilibrium. Proceedings of the 31st International Conference on Neural Information Processing Systems (NeurIPS). pp 6629–6640 Ho J, Jain A, Abbeel P (2020) Denoising diffusion probabilistic models. Adv Neural Inf Process Syst (NeurIPS) 33:6840–6851 Hodosh M, Young P, Hockenmaier J (2013) Framing image description as a ranking task: data, models and evaluation metrics. J Artif Intell Res (JAIR) 47(1):853–899 Holub V, Fridrich J, Denemark T (2014) Universal distortion function for steganography in an arbitrary domain. EURASIP J Inf Secur (JIS) 2014(1):1–13 Holub V, Fridrich J (2012) Designing steganographic distortion using directional filters. 2012 IEEE International Workshop Information Forensics and Security (WIFS). pp 234–239 Hu X, Li S, Ying Q, Peng W, Zhang X, Qian Z (2024) Establishing robust generative image steganography via popular stable diffusion. IEEE Transac Inf Forensics Secur (TIFS) 19:8094–8108 Hu D, Wang L, Jiang W, Zheng S, Li B (2018) A novel image steganography method via deep convolutional generative adversarial networks. IEEE Access 6:38303–38314 Hu X, Jin J, Dai S, Li S, Zhang X, Qian Z (2025) Diffusion model is a good steganalyzer: Magnifying Subtle Perturbations in Image Data. European Conference on Artificial Intelligence (ECAI). pp 476–483 Jiang W, Hu D, Yu C, Li M, Zhao Z-Q (2020) A new steganography without embedding based on adversarial training. Proceedings of the ACM Turing Celebration Conference (TURC). pp 219–223 Jing J, Deng X, Xu M, Wang J, Guan Z (2021) HiNet: Deep Image Hiding by Invertible Network. 2021 IEEE/CVF International Conference on Computer Vision (ICCV). pp 4713–4722 Lai Q, Hua H, Yang L (2025) Encryption design and analysis of 3-D medical models in internet of medical things using a novel memristive hyperchaotic map. IEEE Internet of Things Journal (IoTJ) 12(18):39019–39028 Lai Q, Qin M, Zhao X-W (2026) Reconfigurable multiscroll memristive neural network with application to telemedicine privacy protection. IEEE Transacation on Cybernetic (TCYB) 56(4):1910–1919 Levecque E, Noirault A, Pevny T, Butora J, Bas P, Cogranne R (2026) Targeted pooled latent-space steganalysis applied to generative steganography, with a fix. 2026 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). pp 13452–13456 Li G, Li S, Luo Z, Qian Z, Zhang X (2026) On cover independent deep neural network steganography. IEEE Transactions on Dependable and Secure Computing (TDSC) 23(3):4559–4573 Li W, Zhang W, Li L, Zhou H, Yu N (2020) Designing near-optimal steganographic codes in practice based on polar codes. IEEE Transactions on Communications (TCOM) 68(7):3948–3962 Li B, Wang M, Huang J, Li X (214) A New Cost Function for Spatial Image Steganography. In: 2014 IEEE International Conference on Image Processing (ICIP), pp. 4206–4210 Lin T-Y, Maire M, Belongie S, Hays J, Perona P, Ramanan D, Dollár P, Zitnick CL (2014) Microsoft COCO: Common Objects in Context. European Conference on Computer Vision (ECCV). pp 740–755 Liu M, Zhang M, Liu J, Zhang Y, Ke Y (2017) Coverless information hiding based on generative adversarial networks. arXiv:1712.06951 Lu C, Zhou Y, Bao F, Chen J, Li C, Zhu J (2025) DPM-Solver++: Fast solver for guided sampling of diffusion probabilistic models. Machine Intelligence Research (MIR) 22(4):730–751 Mahfuz A, Channing G, Wilk M, Torr P, Pizzati F, Witt CS (2025) PSyDUCK: Training-free steganography for latent diffusion.arXiv:2501.19172 Peng F, Chen G, Long M (2022) A robust coverless steganography based on generative adversarial networks and gradient descent approximation. IEEE Transac Circuits Syst Video Technol (TCSVT) 32(9):5817–5829 Peng Y, Wang Y, Hu D, Chen K, Rong X, Zhang W (2024) LDStega: Practical and robust generative image steganography based on latent diffusion models. Proceedings of the 32nd ACM International Conference on Multimedia (MM). pp 3001–3009 Peng Y, Gu C, Hu D, Wang Y, Pan C, Rong X, Yin Z (2026) Generative image steganography with minimum-distance guidance. IEEE Transactions on Dependable and Secure Computing (TDSC). pp 1–14 Pevnỳ T, Filler T, Bas P (2010) Using high-dimensional image models to perform highly undetectable steganography. International Workshop Information Hiding (IH). pp 161–177 Rombach R, Blattmann A, Lorenz D, Esser P, Ommer B (2022) High-resolution image synthesis with latent diffusion models. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp 10684–10695 Schuhmann C, Beaumont R, Vencu R, Gordon C, Wightman R, Cherti M, Coombes T, Katta A, Mullis C, Wortsman M, Schramowski P, Kundurthy S, Crowson K, Schmidt L, Kaczmarczyk R, Jitsev J (2022) LAION-5B: An open large-scale dataset for training next generation image-text models. Proceedings of the 36th International Conference on Neural Information Processing Systems (NeurIPS). pp 25278-25294 Song J, Meng C, Ermon S (2021) Denoising diffusion implicit models. International Conference on Learning Representations (ICLR). pp 1–22 Yang H, Wang H, Li J, Zhang F (2025) SDS-TG: Secure diffusion steganography in text-guided generative images. 2025 IEEE International Conference on Multimedia and Expo (ICME). pp 1–6 You W, Zhang H, Zhao X (2021) A siamese CNN for image steganalysis. IEEE Transactions on Information Forensics and Security (TIFS) 16:291–306 Yu C, Hu D, Zheng S, Jiang W, Li M, Zhao Z-Q (2021) An improved steganography without embedding based on attention GAN Peer-to-peer networking and applications 14(3):1446–1457 Zhang Z, Fu G, Liu J, Fu W (2020) Generative information hiding method based on adversarial networks. In: The 8th International Conference on Computer Engineering and Networks (CENet2018), pp. 261–270 Zhang H, Goodfellow I, Metaxas D, Odena A (2019) Self-attention generative adversarial networks. Proceedings of the 36th International Conference on Machine Learning (ICML). pp 7354–7363 Zhang R, Isola P, Efros AA, Shechtman E, Wang O (2018) The unreasonable effectiveness of deep features as a perceptual metric. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR). pp 586–595 Zhou Z, Dong X, Meng R, Wang M, Yan H, Yu K, Choo K-KR (2023) Generative steganography via auto-generation of semantic object contours. IEEE Transactions on Information Forensics and Security (TIFS) 18:2751–2765 Zhou Z, Su Y, Li J, Yu K, Wu QMJ, Fu Z, Shi Y (2023) Secret-to-image reversible transformation for generative steganography. IEEE Transactions on Dependable and Secure Computing (TDSC) 20(5):4118–4134 Zhu J, Kaplan R, Johnson J, Fei-Fei L (2018) HiDDeN: Hiding data with deep networks. European Conference on Computer Vision (ECCV). pp 682–697 Zhu J, Chen Z, Liu J, Yang L, Zhou Y, Luo W, Xie X (2026) Rethinking security of diffusion-based generative steganography.arXiv:2602.10219 Acknowledgements We would like to express our gratitude to all those who contributed to this study. Special thanks go to anonymous reviewers for their supervision and helpful comments. Funding This work was supported by NSFC under 62272456. Author information Authors and Affiliations Contributions G. Yang: conceptualization, methodology, formal analysis, writing original draft, software. R. Duan: resources, investigation. H. Zhang: methodology, funding acquisition, writing review & editing. J. Gan: project administration, validation. X. Yi: visualization, data curation. Y. Cao: visualization, supervision. All authors read and approved the final manuscript. Corresponding author Ethics declarations Competing interests The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper. Additional information Publisher's Note Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations. Rights and permissions Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article's Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article's Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/. About this article Cite this article Yang, G., Duan, R., Zhang, H. et al. RIS-MoE: robust and secure image steganography via latent-space optimization with mixture-of-experts denoising. Cybersecurity 9, 209 (2026). https://doi.org/10.1186/s42400-026-00626-y Received: Accepted: Published: Version of record: DOI: https://doi.org/10.1186/s42400-026-00626-y