Pith. sign in

REVIEW 3 major objections 7 minor 90 references

VisGuard: Securing Visualization Dissemination through Tamper-Resistant Data Retrieval

T0 review · 3 major / 7 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read VisGuard claims that chart images can hide a metadata link that stays recoverable after cropping and local editing.

desk verdict VisGuard is a well-built system with a solid recovery result inside its tested envelope, but the 'substantial tampering' headline overstates a method whose anchor-template-matching bottleneck fails under mixed heavy tampering. read the letter →

arxiv 2507.14459 v1 pith:X4EJTY4V submitted 2025-07-19 cs.CV

Huayuan Ye , Juntong Chen , Shenzhuo Zhang , Yipeng Zhang , Changbo Wang , Chenhui Li This is my paper · ORCID
classification cs.CV
keywords visualizationimagedataretrievalsteganographytamper-resistantembeddingcroppingresistanceinvertibletamperinglocalizationmetadatadeeplearning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Visualization charts circulate mainly as static images, which strips away source code, interaction, and provenance. VisGuard's central claim is that a short metadata link — 324 bits, enough for a URL or a source reference — can be hidden imperceptibly in a chart image and decoded even after the image has been locally edited or cropped during distribution. In the paper's measurements, bit accuracy stays above 99.6% under local tampering up to 60% of the image, and stays between 87.9% and 98.8% when the image is cropped to 15–35% of its original size. The mechanism is to store each bit redundantly, spread bit information across the whole image with an invertible transform, and hide a fixed anchor image whose decoded form reveals the crop parameters before the data are read. If the claim holds, charts could carry their own source, authorship, and verification data through normal sharing, and edited charts could be detected by comparing a decoded reference with the received image.

What carries the argument

Three components carry the argument. Repetitive data tiling (RDT) repeats each data module in a $c_h \times c_w$ grid and averages all copies at decode time, so local damage can be voted out. Invertible information broadcasting (IIB) tokenizes the tiled data with a vision transformer, multiplies the tokens by a learnable matrix $M$ whose inverse is applied during retrieval, and thereby spreads each bit's influence across the whole image so no single region holds the complete information. Anchor-based crop localization embeds a fixed anchor image using a second invertible network; after tampering, the decoded anchor is matched against the original with an $\ell^1$-plus-SSIM objective solved by gradient descent, giving crop parameters that let the decoder pad the image and convert cropping into local tampering. A feature-enhancement network compensates for corrupted features before data decoding, and an additive watermark strategy produces the full-resolution stego image without resizing artifacts.

What would settle it

Reproduce the paper's failure setting — a stego chart cropped to 10% of its area and then locally masked over roughly 60% of the surviving area — and measure both crop-estimation IoU and final bit accuracy; the paper's own failure case predicts an incorrect cropping estimate and a large drop in bit accuracy. A sharper test is to compare final bit accuracy with and without ground-truth crop parameters: if the gap is large, the anchor-matching stage is the limiting component.

Watch

Extended reading notes

Core claim

VisGuard is presented as the first visualization-image data retrieval method whose embedded link survives both local tampering and cropping. The pipeline encodes binary metadata as a tiled data image, transforms it through an invertible information-broadcasting module so every bit is diffused across tokens, hides the result in the host chart with a transformer-based steganographic coupling network, and then embeds a fixed anchor image with a second invertible network. On retrieval, the anchor is decoded first, its best-matching location in the original anchor is found by template matching, and the tampered image is padded back into its original coordinate frame so that cropping becomes local damage. Quantitatively, the paper reports 99.81–99.61% bit accuracy under 15–60% local tampering and 98.79–87.92% under 65–85% cropping, with the highest visual fidelity among the compared steganography methods, and uses the recovered link for chart reconstruction, tampering localization, and provenance. The paper also reports its own boundary: under extreme mixed tampering, such as 95% cropping with local edits, the crop-estimation stage itself becomes the failing component.

Load-bearing premise

The whole recovery chain assumes the decoded anchor image still looks enough like a cropped-and-resized view of the original anchor that template matching finds the right crop parameters; heavy local tampering or extreme cropping breaks that match first, before the data redundancy itself is exhausted.

Editorial extensions

If this is right

  • A 324-bit link can reliably carry a URL or short code reference through moderate online tampering, so chart authors could embed source access without requiring that images stay intact.
  • Received charts can be screened for tampering by decoding the embedded reference and comparing it with the chart; the paper shows this localizes edits that are visually imperceptible.
  • Because each bit is replicated and broadcast, partial pixel loss degrades accuracy gradually rather than destroying a localized message; the reported accuracy under mixed tampering supports this.
  • An additive watermark computed at the source can be overlaid on any published chart, so even screenshots of a webpage carry retrievable metadata — the paper's source-end embedding scenario.
  • The anchor also supplies a crop-location estimate, so the decoding output can include not only the recovered data but a bounding box of where the received image sits within the original.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the anchor bottleneck is the real failure mode, a natural extension is to make crop localization independent of decoded-anchor quality, for example with multiple anchors at different scales or a descriptor-based matcher that degrades more gracefully than template matching.
  • The link-based design decouples recovery capacity from payload: because only a short link is embedded, the same machinery could carry pointers to much larger data as long as the link service is reachable, whereas full-payload embedding would not depend on any external link service.
  • A useful stress test beyond the paper's setup would be real screenshots with arbitrary aspect-ratio changes, JPEG recompression, and re-cropping; those conditions combine multi-step distortion with the crop-matching failure mode the paper identifies as the first to collapse.
  • One testable product idea is to use the same 324 bits to carry a compact manifest — author, timestamp, and checksum — and to raise a tampering alert directly from a failed anchor match, before any data decoding is attempted.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 7 minor

Summary. The paper proposes VisGuard, a deep-steganography framework for Visualization Image Data Retrieval (VIDR) that embeds a metadata link into a chart image and recovers it after tampering. The technical pipeline combines repetitive data tiling (RDT) for redundancy, an invertible information broadcasting (IIB) module for spreading data across spatial tokens, a normalizing-flow-style steganography network with a feature enhancement network, and an anchor-image scheme that localizes cropping through template matching. The evaluation, conducted on a combined InfoVIF and MASSVIS dataset with several external baselines retrained for comparability, reports high bit accuracy under local tampering up to 60% (Table 1), moderate cropping resistance up to about 80% (Table 2), and competitive stego-image quality and steganalysis security. The paper also demonstrates three application scenarios: interactive chart reconstruction, tampering detection and localization, and source-end embedding.

Significance. If the reported results hold, VisGuard is a meaningful advance for VIDR: it is, to my knowledge, the first method in this line of work whose embedded link survives both local editing and cropping of chart images, with clearly higher capacity than the tamper-resistant natural-image baselines. The paper's strengths include benchmarking against external methods retrained on public datasets, clean ablations isolating RDT, IIB, FEN, and anchor embedding (Table 4), and honest documentation of a failure case and limitations (Sec. 5.5, Fig. 16). The main weakness is that the abstract and introduction claim robustness to "substantial tampering" without stating the measured envelope, which is narrower for mixed and extreme tampering. I see no circularity concern: the central comparisons are against external baselines and the robustness claims are supported by the experimental data within the documented range.

major comments (3)
  1. [Abstract and Sec. 5.2.2 (Tables 2 and Fig. 14)] The abstract's unqualified statement that the embedded data link "remains recoverable even after substantial tampering" is broader than the verified envelope. Table 2 shows bit accuracy falling to 63.23% at 95% cropping for the 324-bit model, Fig. 14 shows cropping-estimation IoU collapsing as local tampering approaches 60-65%, and Fig. 16 documents a concrete failure at 95% cropping plus 60% local tampering. Sec. 5.5 itself concedes that the bottleneck is cropping estimation. The abstract and introduction should either state the validated ranges explicitly (e.g., roughly up to 80% cropping or up to 60% local tampering, with degraded performance under extreme mixed tampering) or be revised so that "substantial tampering" is not presented as an unqualified guarantee.
  2. [Sec. 3.3.2 Eq. (4) and Sec. 3.4.2] The cropping-resistance claim rests on template matching: the decoded anchor image must resemble a cropped-and-resized view of the original anchor, and Eq. (4) is solved by gradient descent. The paper's own results show this assumption is the first to fail: Fig. 14 documents the IoU collapse, and Fig. 16 shows the failure propagates into data decoding. Because Sec. 3.4.2 trains the decoder with only a small transition factor (tau=0.01), the data decoder is not trained to handle the large spatial misalignments that occur when template matching fails. This is a structurally different weakness from bit-level storage redundancy and it deserves either (i) explicit training with larger simulated transition errors or an iterative alignment refinement, or (ii) a clearly stated limitation that the reported accuracy is conditional on successful crop estimation.
  3. [Sec. 3.2.2 (IIB module)] The IIB module applies a learnable matrix M to the token tensor and inverts it during retrieval as M^{-1}, but the paper places no constraint on M to ensure invertibility or well-conditioning. If M becomes singular or ill-conditioned during training, the inverse is undefined or amplifies noise, and the paper provides neither an analysis nor a regularization. I ask the authors to add an invertibility constraint (for example, an orthogonal or soft-orthogonal parameterization of M) or to report condition-number statistics and demonstrate that the learned M is safely invertible across training runs.
minor comments (7)
  1. [Sec. 3.1] Typo: "dirives" should be "derives".
  2. [Sec. 3.2.3] Typo: "allows rhe concealment" should read "allows the concealment".
  3. [Sec. 2.1] Typo: "Some stuidies" should be "Some studies".
  4. [Sec. 4.3] Typo: "the visualziation" should be "the visualization".
  5. [Fig. 13] The four panels of Fig. 13 share the same axis labels and legend but the crop rate is only indicated in the text or by the panel position; adding a per-panel title or legend subtitle would make the figure self-contained.
  6. [Table 7] The unit "BPP×100" is not defined; please state the image size or total pixel count used for the bit-per-pixel computation, since different reference resolutions would change the reported values.
  7. [Eq. (4)] The subscript formatting "argmin_{cx,cy sx,sy}" is ambiguous; it should read "argmin_{c_x,c_y,s_x,s_y}".

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: VisGuard's robustness claims are externally benchmarked and do not reduce to their inputs.

full rationale

VisGuard's derivation chain is self-contained at the level of its central claims. The data embedding/retrieval pipeline (Secs. 3.2-3.3) is defined by explicit, invertible transformations (Eqs. 1-2) and trained end-to-end on public datasets (InfoVIF and MASSVIS) with a held-out 5:1 split (Sec. 5.1). Cropping resistance is an explicit template-matching procedure (Eq. 4), and its failure mode is acknowledged and measured (Sec. 5.5, Fig. 16); the mechanism does not depend on any prior output of the authors. Self-citations to InvVis [76], Ye et al. [77], and VisCode [83] appear as baselines, conceptual background, and one architectural choice (the attention-based TACB), but all compared methods are retrained on the same public data, so the robustness numbers in Tables 1-3 are not derived from those citations. No fitted parameter is renamed as a prediction, no uniqueness theorem is imported from the authors' prior work, and no equation reduces to its own input by construction. The paper's stated limitation (extreme-tampering bottleneck caused by cropping estimation) is a consistency check rather than a circular step.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central claim rests on five assumptions: Gaussianity of the flow latent (borrowed from prior flow steganography, unchecked here), representativeness of the training tampering simulation, template-matchability of the decoded anchor, invertibility and conditioning of the learned IIB matrix M, and the validity of resized additive watermarks at high resolution. It also depends on four hand-tuned parameter groups (RDT scale, loss weights, transition factor, and the tampering envelope thresholds) that jointly define the tested robustness scope. No invented entities of the rubric's kind are introduced; the anchor image, IIB matrix, and additive watermark are internal design artifacts without independent falsifiable handles.

free parameters (4)
  • RDT repetition scale and data image size = RDT(18,18,2,2) with 18x18 data image (324 bits)
    Chosen empirically as the capacity/robustness trade-off; the Sec 5.4 ablation shows RDT(3,3) and RDT(4,4) degrade PSNR from 40.6 to 39.0/37.9 while barely changing BA, so (2,2) is a tuned sweet spot rather than a derived value.
  • Loss weights lambda, lambda1..lambda5 = 0.1, 1.0, 0.01, 0.1, 0.6, 0.025
    Declared in Sec 5.1 as an "empirical configuration that achieves a relatively balanced model performance"; these balance stego image quality, data accuracy, and anchor accuracy.
  • Transition factor tau = 0.01
    Taken from StegaStamp (Sec 3.4.2) to simulate crop-estimation jitter; not re-justified for the anchor-based scheme.
  • Tampering envelope thresholds = epsilon_m=20% unmasked; epsilon_c=10% min crop; k in [1,4] masks
    Hand-set in Sec 3.4.2; they define the tampering distribution the model trains on and therefore bound the scope of the robustness claim.
assumptions (5)
  • domain assumption The transformed data tokens T_t,n output by the embedding network obey a Gaussian distribution, so decoding can initialize T-hat_t,n as random Gaussian noise (Sec 3.2.3).
    If the learned encoder's latent is not approximately Gaussian, the random initialization injects error at the start of every decode; the paper provides no empirical check of the Gaussianity assumption.
  • domain assumption Training-time tampering simulation (random texture masking, random cropping, transition jitter in Sec 3.4.2) is representative of real-world online dissemination tampering.
    The entire robustness claim is validated only against these simulated distortions; transfer to unmodeled tampering (resizing with interpolation, perspective, adversarial removal) is untested.
  • domain assumption Cropping estimation (Eq. 4) assumes the decoded anchor image is approximately a cropped-and-resized view of the original anchor, so L1 plus SSIM template matching recovers the crop parameters.
    Sec 5.5 and Fig 16 show this assumption degrades when local tampering corrupts the decoded anchor, which is the paper's own stated bottleneck.
  • ad hoc to paper The learnable broadcasting matrix M in IIB remains invertible and well conditioned, making M^{-1} (Sec 3.2.2) a noise-safe inverse.
    No conditioning constraint, regularization, or spectral check on M is described; a near-singular M would amplify tampering noise during retrieval.
  • domain assumption Additive stego watermark resizing (Sec 3.4.1) preserves decoding at arbitrary host resolution.
    The watermark is computed at 384x384 and resized to host resolution; the paper shows a qualitative benefit (Fig 7) but no accuracy measurement after watermark resizing at high resolutions.

how reviews work

0 comments
Cite this review

Pith. "Pith review of VisGuard: Securing Visualization Dissemination through Tamper-Resistant Data Retrieval." pith.science (2026). https://pith.science/paper/X4EJTY4V

@misc{pith2026250714459,
  author       = {Pith},
  title        = {Pith review of: VisGuard: Securing Visualization Dissemination through Tamper-Resistant Data Retrieval},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/X4EJTY4V}},
  note         = {Machine review of arXiv:2507.14459}
}
read the original abstract

The dissemination of visualizations is primarily in the form of raster images, which often results in the loss of critical information such as source code, interactive features, and metadata. While previous methods have proposed embedding metadata into images to facilitate Visualization Image Data Retrieval (VIDR), most existing methods lack practicability since they are fragile to common image tampering during online distribution such as cropping and editing. To address this issue, we propose VisGuard, a tamper-resistant VIDR framework that reliably embeds metadata link into visualization images. The embedded data link remains recoverable even after substantial tampering upon images. We propose several techniques to enhance robustness, including repetitive data tiling, invertible information broadcasting, and an anchor-based scheme for crop localization. VisGuard enables various applications, including interactive chart reconstruction, tampering detection, and copyright protection. We conduct comprehensive experiments on VisGuard's superior performance in data retrieval accuracy, embedding capacity, and security against tampering and steganalysis, demonstrating VisGuard's competence in facilitating and safeguarding visualization dissemination and information conveyance.

Figures

Figures reproduced from arXiv: 2507.14459 by the authors.

Figure 1
Figure 1. VisGuard is able to implicitly embed data into visualization images through a data link. The embedded data can be accurately restored even if [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Given the data to be embedded (in the form of a binary image), it first undergoes repetitive data tiling (RDT) (a) to enhance information redundancy. Then, the [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. The data encoding and decoding results with (first row) and without IIB [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗
Figures from the paper (10 more)
Figure 4
Figure 4. Figure 4: Model architecture of VisGuard. The upper part shows the data embedding process and the lower part shows the data retrieval process. [PITH_FULL_IMAGE:figures/full_fig_p004_4.png]
Figure 6
Figure 6. Figure 6: Demonstration of cropping estimation. Image cropping can be converted [PITH_FULL_IMAGE:figures/full_fig_p004_6.png]
Figure 7
Figure 7. Figure 7: Comparison of the stego image generated using and not using additive [PITH_FULL_IMAGE:figures/full_fig_p005_7.png]
Figure 8
Figure 8. Figure 8: Application interface for invertible visualization. Uses can create or edit [PITH_FULL_IMAGE:figures/full_fig_p006_8.png]
Figure 9
Figure 9. Figure 9: (A): How VisGuard supports visualization tampering detection and local￾ization. First, A stego image is generated by embedding a reference image (a). Then, the stego image undergoes dissemination and tampering (b). When re￾ceiving an image, users can decode the link to…
Figure 10
Figure 10. Figure 10: Our watermark-based pipeline to implement SEVDE. The watermark is [PITH_FULL_IMAGE:figures/full_fig_p006_10.png]
Figure 11
Figure 11. Figure 11: Data embedding quality compared with cat.A methods. The green and red blocks represent correctly and incorrectly decoded data modules, respectively. support any visualization authoring tools, such as D3 [9] and Vega-Lite [57]. In summary, this is a win-win strategy: n…
Figure 12
Figure 12. Figure 12: Stego image quality compared with cat.B methods. The differences are enhanced by 5 times for a better illustration [PITH_FULL_IMAGE:figures/full_fig_p008_12.png]
Figure 14
Figure 14. Figure 14: Left part: cropping estimation accuracy under mixed tampering. Right part: some cropping estimation results. The green frames and areas respectively denote the cropped and tampered regions under mixed tampering, while the red frames represent the estimation results. 0…
Figure 16
Figure 16. Figure 16: Failure case: severe tampering (in this example, 95% cropping + 60% [PITH_FULL_IMAGE:figures/full_fig_p009_16.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

90 extracted references · 38 canonical work pages

  1. [1]

    R. A. Al-Zaidy and C. L. Giles. A machine learning approach for semantic structuring of scientific charts in scholarly documents. InAAAI, pp. 4644–4649. AAAI Press, 2017. doi: 10.1609/AAAI.V31I1.19088 2

    work page doi:10.1609/aaai.v31i1.19088 2017

  2. [2]

    A. Ali, H. Touvron, M. Caron, P. Bojanowski, M. Douze, A. Joulin, I. Laptev, N. Neverova, G. Synnaeve, J. Verbeek, and H. Jégou. Xcit: Cross-covariance image transformers. InNeurIPS, pp. 20014–20027, 2021. doi: 10.48550/arXiv. 2106.09681 4

    arXiv doi:10.48550/arxiv.2106.09681 2021

  3. [3]

    Almohammad and G

    A. Almohammad and G. Ghinea. Stego image quality and the reliability of PSNR. InIPTA, pp. 215–220. IEEE, 2010. doi: 10.1109/IPTA.2010.5586786 7

    work page arXiv 2010

  4. [4]

    Almohammad, R

    A. Almohammad, R. M. Hierons, and G. Ghinea. High capacity steganographic method based upon JPEG. InARES, pp. 544–549. IEEE Computer Society, 2008. doi: 10.1109/ARES.2008.72 2

    work page doi:10.1109/ares.2008.72 2008

  5. [6]

    S. Baluja. Hiding images in plain sight: Deep steganography. InNIPS, pp. 2069– 2079, 2017. doi: 10.23880/ijfsc-16000223 2

    work page doi:10.23880/ijfsc-16000223 2017

  6. [7]

    break our steganographic system

    P. Bas, T. Filler, and T. Pevný. "break our steganographic system": The ins and outs of organizing BOSS. InInformation Hiding, vol. 6958 ofLecture Notes in Computer Science, pp. 59–70. Springer, 2011. doi: 10.1007/978-3-642-24178-9_5 8

    work page doi:10.1007/978-3-642-24178-9_5 2011

  7. [8]

    M. A. Borkin, Z. Bylinskii, N. W. Kim, C. M. Bainbridge, C. S. Yeh, D. Borkin, H. Pfister, and A. Oliva. Beyond memorability: Visualization recognition and recall. IEEE Trans. Vis. Comput. Graph., 22(1):519–528, 2016. doi: 10.1109/TVCG.2015 .2467732 7

    doi:10.1109/tvcg.2015 2016

  8. [9]

    Bostock, V

    M. Bostock, V . Ogievetsky, and J. Heer. D3 data-driven documents.IEEE Trans. Vis. Comput. Graph., 17(12):2301–2309, 2011. doi: 10.1109/TVCG.2011.185 7

    doi:10.1109/tvcg.2011.185 2011

Show all 90 references
  1. [10]

    C. N. Bui, S. M. Yoon, and H. Lee. Multi bit plane image steganography. InIWDW, vol. 4283 ofLecture Notes in Computer Science, pp. 61–70. Springer, 2006. doi: 10.1007/11922841_6 2

    2006 doi

  2. [11]

    Carr and E

    D. Carr and E. R. Tufte. The visual display of quantitative information.Techno- metrics, p. 118, 1987. doi: 10.2307/1269894 1, 6

    1987 doi

  3. [12]

    Z. Chen, Y . Wang, Q. Wang, Y . Wang, and H. Qu. Towards automated infographic design: Deep learning-based auto-extraction of extensible timeline.IEEE Trans. Vis. Comput. Graph., 26(1):917–926, 2020. doi: 10.1109/TVCG.2019.2934810 1, 2

    2020

  4. [13]

    K. L. Cheng, Y . Xie, and Q. Chen. Iicnet: A generic framework for reversible image conversion. InICCV, pp. 1971–1980. IEEE, 2021. doi: 10.1109/ICCV48922 .2021.00200 2

    1971

  5. [14]

    Delforouzi and M

    A. Delforouzi and M. Pooyan. Adaptive digital audio steganography based on integer wavelet transform. pp. 283–286, 2007. doi: 10.1109/IIH-MSP.2007.69 2

    2007 doi

  6. [15]

    B. Delina. Information hiding: A new approach in text steganography. InProceed- ings of the International Conference on Applied Computer and Applied Computa- tional Science, World Scientific and Engineering Academy and Society (WSEAS 2008), pp. 689–695, 2008. doi: 10.2139/ssrn...

    2008 doi

  7. [16]

    L. Dinh, D. Krueger, and Y . Bengio. NICE: non-linear independent components estimation. InICLR (Workshop), 2015. doi: 10.48550/arXiv.1410.8516 2, 3, 4

    2015 doi arXiv

  8. [17]

    L. Dinh, J. Sohl-Dickstein, and S. Bengio. Density estimation using real NVP. In ICLR (Poster), 2017. doi: 10.48550/arXiv.1605.08803 2

    2017 doi arXiv

  9. [18]

    C. Dong, X. Chen, R. Hu, J. Cao, and X. Li. Mvss-net: Multi-view multi-scale supervised networks for image manipulation detection.IEEE Trans. Pattern Anal. Mach. Intell., 45(3):3539–3553, 2023. doi: 10.1109/TPAMI.2022.3180556 2

    2023

  10. [19]

    Dosovitskiy, L

    A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly, J. Uszkoreit, and N. Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. In ICLR, 2021. doi: 10.48550/arXiv.2010.1...

    2021 doi arXiv

  11. [20]

    Egri and T

    G. Egri and T. Zickler. Stegapos: Preventing unwanted crops and replacements with imperceptible positional embeddings.arXiv preprint arXiv:2104.12290, 2021. doi: 10.48550/arXiv.2104.12290 2, 4

    2021 doi arXiv

  12. [21]

    Flower, J

    A. Flower, J. W. McKenna, and G. Upreti. Validity and reliability of graphclick and datathief iii for data extraction.Behavior modification, 40(3):396–413, 2016. doi: 10.1177/0145445515616105 2

    2016 doi

  13. [22]

    J. J. Fridrich, M. Goljan, and R. Du. Detecting LSB steganography in color and gray-scale images.IEEE Multim., 8(4):22–28, 2001. doi: 10.1109/93.959097 2

    2001 doi

  14. [24]

    J. Fu, B. B. Zhu, H. Zhang, Y . Zou, S. Ge, W. Cui, Y . Wang, D. Zhang, X. Ma, and H. Jin. Chartstamp: Robust chart embedding for real-world applications. InACM Multimedia, pp. 2786–2795. ACM, 2022. doi: 10.1145/3503161.3548286 1, 2, 9

    2022

  15. [25]

    I. J. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. C. Courville, and Y . Bengio. Generative adversarial nets. InNIPS, pp. 2672– 2680, 2014. doi: 10.1145/3422622 2

    2014 doi

  16. [26]

    Z. Guan, J. Jing, X. Deng, M. Xu, L. Jiang, Z. Zhang, and Y . Li. Deepmih: Deep invertible network for multiple image hiding.IEEE Trans. Pattern Anal. Mach. Intell., 45(1):372–390, 2023. doi: 10.1109/TPAMI.2022.3141725 2

    2023

  17. [28]

    Holub and J

    V . Holub and J. J. Fridrich. Digital image steganography using universal distortion. InIH&MMSec, pp. 59–68. ACM, 2013. doi: 10.1145/2482513.2482514 8

    2013

  18. [29]

    Hota and J

    A. Hota and J. Huang. Embedding meta information into visualizations.IEEE Trans. Vis. Comput. Graph., 26(11):3189–3203, 2020. doi: 10.1109/TVCG.2019. 2916098 2

    2020 doi

  19. [30]

    X. Hu, Q. Ying, Z. Qian, S. Li, and X. Zhang. DRAW: defending camera-shooted RAW against image manipulation. InICCV, pp. 22377–22387. IEEE, 2023. doi: 10.1109/ICCV51070.2023.02050 2

    2023

  20. [31]

    Huang, Z

    G. Huang, Z. Liu, L. Van Der Maaten, and K. Q. Weinberger. Densely connected convolutional networks. InProceedings of the IEEE conference on computer vision and pattern recognition, pp. 4700–4708, 2017. doi: 10.48550/arXiv.1608.06993 4

    2017 doi arXiv

  21. [32]

    Imaizumi and K

    S. Imaizumi and K. Ozawa. Multibit embedding algorithm for steganography of palette-based images. InPSIVT, vol. 8333 ofLecture Notes in Computer Science, pp. 99–110. Springer, 2013. doi: 10.1007/978-3-642-53842-1_9 2

    2013 doi

  22. [34]

    Kaplan, S

    J. Kaplan, S. McCandlish, T. Henighan, T. B. Brown, B. Chess, R. Child, S. Gray, A. Radford, J. Wu, and D. Amodei. Scaling laws for neural language models. arXiv preprint arXiv:2001.08361, 2020. doi: 10.48550/arXiv.2001.08361 7

    2001 doi arXiv

  23. [35]

    Kawaguchi and R

    E. Kawaguchi and R. O. Eason. Principles and applications of bpcs steganography. InMultimedia Syst. Appl., vol. 3528, pp. 464–473. SPIE, 1999. doi: 10.1117/12. 337436 2

    1999 doi

  24. [36]

    D. P. Kingma and P. Dhariwal. Glow: Generative flow with invertible 1x1 convo- lutions. InNeurIPS, pp. 10236–10245, 2018. doi: 10.48550/arXiv.1807.03039 2

    2018 doi arXiv

  25. [37]

    Y . Lan, F. Shang, J. Yang, X. Kang, and E. Li. Robust image steganography: Hiding messages in frequency coefficients. InAAAI, pp. 14955–14963. AAAI Press, 2023. doi: 10.1609/AAAI.V37I12.26746 8

    2023 doi

  26. [38]

    B. Li, M. Wang, J. Huang, and X. Li. A new cost function for spatial image steganography. InICIP, pp. 4206–4210. IEEE, 2014. doi: 10.1109/ICIP.2014. 7025854 2, 8

    2014 doi

  27. [39]

    Loshchilov and F

    I. Loshchilov and F. Hutter. Decoupled weight decay regularization. InICLR (Poster), 2019. doi: 10.48550/arXiv.1711.05101 7

    2019 doi arXiv

  28. [40]

    M. Lu, J. Lanir, C. Wang, Y . Yao, W. Zhang, O. Deussen, and H. Huang. Modeling just noticeable differences in charts.IEEE Trans. Vis. Comput. Graph., 28(1):718– 726, 2022. doi: 10.1109/TVCG.2021.3114874 7

    2022

  29. [41]

    S. Lu, R. Wang, T. Zhong, and P. L. Rosin. Large-capacity image steganography based on invertible neural networks. InCVPR, pp. 10816–10825. Computer Vision Foundation / IEEE, 2021. doi: 10.1109/CVPR46437.2021.01067 2, 4, 7

    2021

  30. [42]

    X. Ma, B. Du, X. Liu, A. Y . A. Hammadi, and J. Zhou. Iml-vit: Image manipulation localization by vision transformer.arXiv preprint arXiv:2307.14863, 2023. doi: 10.48550/arXiv.2307.14863 2

    2023 doi arXiv

  31. [43]

    X. Mao, X. Hu, W. Peng, Z. Gan, Z. Qian, X. Zhang, and S. Li. From covert hiding to visual editing: Robust generative video steganography. InACM Multimedia, pp. 2757–2765. ACM, 2024. doi: 10.1145/3664647.3681149 2

    2024

  32. [44]

    G. G. Méndez, M. A. Nacenta, and S. Vandenheste. ivolver: Interactive visual language for visualization extraction and reconstruction. InCHI, pp. 4073–4085. ACM, 2016. doi: 10.1145/2858036.2858435 2

    2016

  33. [45]

    Mielikäinen

    J. Mielikäinen. LSB matching revisited.IEEE Signal Process. Lett., 13(5):285–287,

  34. [46]

    Mishra, F

    M. Mishra, F. Adhikary, and M. Lt Dr. Digital image tamper detection techniques-a comprehensive study.arXiv preprint arXiv:1306.6737, 2013. doi: 10.48550/arXiv. 1306.6737 8

    2013 doi arXiv

  35. [47]

    C. Mou, Y . Xu, J. Song, C. Zhao, B. Ghanem, and J. Zhang. Large-capacity and flexible video steganography via invertible neural network. InCVPR, pp. 22606–22615. IEEE, 2023. doi: 10.1109/CVPR52729.2023.02165 2

    2023

  36. [48]

    Niimi, R

    M. Niimi, R. O. Eason, H. Noda, and E. Kawaguchi. High capacity and secure digital steganography to palette-based images. InICIP (2), pp. 917–920. IEEE,

  37. [49]

    Paszke, S

    A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga, A. Desmaison, A. Köpf, E. Z. Yang, Z. DeVito, M. Raison, A. Tejani, S. Chilamkurthy, B. Steiner, L. Fang, J. Bai, and S. Chintala. Pytorch: An imperative style, high-...

    2019 doi arXiv

  38. [50]

    Pevný, T

    T. Pevný, T. Filler, and P. Bas. Using high-dimensional image models to perform highly undetectable steganography. InInformation Hiding, vol. 6387 ofLecture Notes in Computer Science, pp. 161–177. Springer, 2010. doi: 10.1007/978-3-642 -16435-4_13 2

    2010 doi

  39. [51]

    Poco and J

    J. Poco and J. Heer. Reverse-engineering visualizations: Recovering visual encod- ings from chart images.Comput. Graph. Forum, 36(3):353–363, 2017. doi: 10. 1111/CGF.13193 1, 2

    2017

  40. [52]

    J. Poco, A. Mayhua, and J. Heer. Extracting and retargeting color mappings from bitmap images of visualizations.IEEE Trans. Vis. Comput. Graph., 24(1):637–646,

  41. [53]

    J. Qin, J. Wang, Y . Tan, H. Huang, X. Xiang, and Z. He. Coverless image steganography based on generative adversarial network.Math., 8(9):1394, 2020. doi: 10.3390/math8091394 2

    2020 doi

  42. [54]

    Rombach, A

    R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer. High-resolution image synthesis with latent diffusion models. InCVPR, pp. 10674–10685. IEEE,

  43. [55]

    A. K. Sahu, K. Umachandran, V . D. Biradar, O. Comfort, V . S. V . Hema, F. Odimegwu, and S. M. A. A study on content tampering in multimedia wa- termarking.SN Comput. Sci., 4(3):222, 2023. doi: 10.1007/S42979-022-01657-1 8

    2023 doi

  44. [56]

    Sander, P

    T. Sander, P. Fernandez, A. Durmus, T. Furon, and M. Douze. Watermark anything with localized messages.arXiv preprint arXiv:2411.07231, 2024. doi: 10.48550/ arXiv.2411.07231 1, 2, 4, 5, 7

    2024 doi arXiv

  45. [57]

    Satyanarayan, D

    A. Satyanarayan, D. Moritz, K. Wongsuphasawat, and J. Heer. Vega-lite: A grammar of interactive graphics.IEEE Trans. Vis. Comput. Graph., 23(1):341–350,

  46. [58]

    Savva, N

    M. Savva, N. Kong, A. Chhajta, L. Fei-Fei, M. Agrawala, and J. Heer. Revision: automated classification, analysis and redesign of chart images. InUIST, pp. 393–402. ACM, 2011. doi: 10.1145/2047196.2047247 2

    2011

  47. [59]

    Shadmand, I

    F. Shadmand, I. Medvedev, L. Schirmer, J. Marcos, and N. Gonçalves. Stampone: Addressing frequency balance in printer-proof steganography. InCVPR Workshops, pp. 4367–4376. IEEE, 2024. doi: 10.1109/CVPRW63382.2024.00440 2, 7

    2024

  48. [60]

    H. Shi, J. Dong, W. Wang, Y . Qian, and X. Zhang. SSGAN: secure steganography based on generative adversarial networks. InPCM (1), vol. 10735 ofLecture Notes in Computer Science, pp. 534–544. Springer, 2017. doi: 10.1007/978-3-319-77380 -3_51 2

    2017 doi

  49. [61]

    S. Song, C. Li, D. Li, J. Chen, and C. Wang. Graphdecoder: Recovering diverse network graphs from visualization images via attention-aware learning.IEEE Trans. Vis. Comput. Graph., 30(7):3074–3088, 2024. doi: 10.1109/TVCG.2022. 3225554 1, 2

    2024 doi

  50. [62]

    S. Song, C. Li, Y . Sun, and C. Wang. Vividgraph: Learning to extract and redesign network graphs from visualization images.IEEE Trans. Vis. Comput. Graph., 29(7):3169–3181, 2023. doi: 10.1109/TVCG.2022.3153514 2

    2023

  51. [63]

    M. D. Swanson, B. B. Zhu, and A. H. Tewfik. Multiresolution video watermarking using perceptual models and scene segmentation. InICIP (2), pp. 558–561. IEEE Computer Society, 1997. doi: 10.1109/ICIP.1997.638832 2

    1997

  52. [64]

    Tancik, B

    M. Tancik, B. Mildenhall, and R. Ng. Stegastamp: Invisible hyperlinks in physical photographs. InCVPR, pp. 2114–2123. Computer Vision Foundation / IEEE, 2020. doi: 10.1109/CVPR42600.2020.00219 2, 4, 5, 7, 8

    2020

  53. [65]

    W. Tang, B. Li, S. Tan, M. Barni, and J. Huang. Cnn-based adversarial embedding for image steganography.IEEE Trans. Inf. Forensics Secur., 14(8):2074–2087,

  54. [66]

    W. Tang, S. Tan, B. Li, and J. Huang. Automatic steganographic distortion learning using a generative adversarial network.IEEE Signal Process. Lett., 24(10):1547– 1551, 2017. doi: 10.1109/LSP.2017.2745572 2

    2017

  55. [67]

    C. F. Tsang and J. J. Fridrich. Steganalyzing images of arbitrary size with cnns. In Media Watermarking, Security, and Forensics. Society for Imaging Science and Technology, 2018. doi: 10.2352/ISSN.2470-1173.2018.07.MWSF-121 8

    2018

  56. [68]

    Vaswani, N

    A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, L. Kaiser, and I. Polosukhin. Attention is all you need. InNIPS, pp. 5998–6008, 2017. doi: 10.48550/arXiv.1706.03762 2

    2017 doi arXiv

  57. [69]

    Z. Wang, A. C. Bovik, H. R. Sheikh, and E. P. Simoncelli. Image quality assessment: from error visibility to structural similarity.IEEE Trans. Image Process., 13(4):600– 612, 2004. doi: 10.1109/TIP.2003.819861 5, 7

    2004

  58. [70]

    Y . Wu, G. Meng, and Q. Chen. Embedding novel views in a single JPEG image. InICCV, pp. 14499–14507. IEEE, 2021. doi: 10.1109/ICCV48922.2021.01425 2

    2021

  59. [71]

    C. Xiao, C. Zhang, and C. Zheng. Fontcode: Embedding information in text documents using glyph perturbation.ACM Trans. Graph., 37(2):15, 2018. doi: 10. 1145/3152823 2

    2018

  60. [72]

    G. Xu, H. Wu, and Y . Shi. Structural design of convolutional neural networks for steganalysis.IEEE Signal Process. Lett., 23(5):708–712, 2016. doi: 10.1109/LSP. 2016.2548421 8

    2016

  61. [73]

    Y . Xu, C. Mou, Y . Hu, J. Xie, and J. Zhang. Robust invertible image steganography. InCVPR, pp. 7865–7874. IEEE, 2022. doi: 10.1109/CVPR52688.2022.00772 2, 4

    2022

  62. [74]

    Y . Yang, R. Pintus, H. E. Rushmeier, and I. P. Ivrissimtzis. A 3d steganalytic algorithm and steganalysis-resistant watermarking.IEEE Trans. Vis. Comput. Graph., 23(2):1002–1013, 2017. doi: 10.1109/TVCG.2016.2525771 2

    2017

  63. [75]

    Z. Yang, K. Chen, K. Zeng, W. Zhang, and N. Yu. Provably secure robust image steganography.IEEE Trans. Multim., 26:5040–5053, 2024. doi: 10.1109/TMM. 2023.3330098 8

    2024

  64. [76]

    H. Ye, C. Li, Y . Li, and C. Wang. Invvis: Large-scale data embedding for invertible visualization.IEEE Trans. Vis. Comput. Graph., 30(1):1139–1149, 2024. doi: 10. 1109/TVCG.2023.3326597 1, 2, 4, 5, 7, 9

    2024

  65. [77]

    H. Ye, S. Zhang, S. Jiang, J. Liao, S. Gu, D. Zheng, C. Wang, and C. Li. Robust message embedding via attention flow-based steganography. InProceedings of the Computer Vision and Pattern Recognition Conference (CVPR), pp. 12840–12849, June 2025. doi: 10.48550/arXiv.2405.16414 2, 4

    2025 doi arXiv

  66. [78]

    W. You, H. Zhang, and X. Zhao. A siamese CNN for image steganalysis.IEEE Trans. Inf. Forensics Secur., 16:291–306, 2021. doi: 10.1109/TIFS.2020.3013204 8

    2021

  67. [79]

    J. Yu, X. Zhang, Y . Xu, and J. Zhang. Cross: Diffusion model makes controllable, robust and secure image steganography. InNeurIPS, 2023. doi: 10.48550/arXiv. 2305.16936 8

    2023 doi arXiv

  68. [80]

    X. Yu, T. Tan, and Y . Wang. Reliable detection of bpcs-steganography in natural images. InICIG, pp. 333–336. IEEE Computer Society, 2004. doi: 10.1109/ICIG. 2004.123 2

    2004 doi

  69. [81]

    Z. Yu, J. Ni, Y . Lin, H. Deng, and B. Li. Diffforensics: Leveraging diffusion prior to image forgery detection and localization. InCVPR, pp. 12765–12774. IEEE,

  70. [82]

    K. A. Zhang, A. Cuesta-Infante, L. Xu, and K. Veeramachaneni. Steganogan: High capacity image steganography with gans.arXiv:1901.03892, 2019. doi: 10. 48550/arXiv.1901.03892 2

    1901 doi arXiv

  71. [83]

    Zhang, C

    P. Zhang, C. Li, and C. Wang. Viscode: Embedding information in visualiza- tion images using encoder-decoder network.IEEE Trans. Vis. Comput. Graph., 27(2):326–336, 2021. doi: 10.1109/TVCG.2020.3030343 1, 2, 4, 7, 9

    2021

  72. [84]

    Zhang, P

    R. Zhang, P. Isola, A. A. Efros, E. Shechtman, and O. Wang. The unreasonable effectiveness of deep features as a perceptual metric. InCVPR, pp. 586–595. Computer Vision Foundation / IEEE Computer Society, 2018. doi: 10.1109/CVPR. 2018.00068 5, 7

    2018

  73. [85]

    Zhang, R

    X. Zhang, R. Li, J. Yu, Y . Xu, W. Li, and J. Zhang. Editguard: Versatile image watermarking for tamper localization and copyright protection. InCVPR, pp. 11964–11974. IEEE, 2024. doi: 10.1109/CVPR52733.2024.01137 1, 2, 7

    2024

  74. [86]

    Zhang, Z

    X. Zhang, Z. Tang, Z. Xu, R. Li, Y . Xu, B. Chen, F. Gao, and J. Zhang. Omniguard: Hybrid manipulation localization via augmented versatile deep image watermark- ing. InProceedings of the Computer Vision and Pattern Recognition Conference (CVPR), pp. 3008–3018, June 2025. doi:...

    2025 doi arXiv

  75. [87]

    Z. Zhou, M. M. R. Siddiquee, N. Tajbakhsh, and J. Liang. Unet++: A nested u-net architecture for medical image segmentation. InDLMIA/ML-CDS@MICCAI, vol. 11045 ofLecture Notes in Computer Science, pp. 3–11. Springer, 2018. doi: 10. 1007/978-3-030-00889-5_1 4

    2018

  76. [88]

    J. Zhu, R. Kaplan, J. Johnson, and L. Fei-Fei. Hidden: Hiding data with deep networks. InECCV (15), vol. 11219 ofLecture Notes in Computer Science, pp. 682–697. Springer, 2018. doi: 10.1007/978-3-030-01267-0_40 2

    2018 doi

  77. [89]

    W. Zhu, Z. Xiong, and Y . Zhang. Multiresolution watermarking for images and video.IEEE Trans. Circuits Syst. Video Technol., 9(4):545–550, 1999. doi: 10. 1109/76.767121 2 11

    1999

  78. [2002]

    doi: 10.1109/ICIP.2002.1040101 2

    2002 arXiv

  79. [2006]

    doi: 10.1109/LSP.2006.870357 2

    2006

  80. [2017]

    doi: 10.1109/TVCG.2016.2599030 6, 7

    2016

  81. [2018]

    doi: 10.1109/TVCG.2017.2744320 1, 2

    2017

  82. [2019]

    doi: 10.1109/TIFS.2019.2891237 2

    2019

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.