Assemblage: Chipping Away at Censorship with Generative Steganography
Tushar M. Jois, Cora Rowena Ruiz, Gabriel Kaptchuk
https://www.petsymposium.org/foci/2026/foci-2026-0005.php
https://github.com/spacelab-ccny/assemblage
Assemblage is a system for sending censorship-resistant messages through the medium of steganographically encoded AI-generated images posted to public forums. The sender of a message uses a diffusion model and the Pulsar generative image steganography scheme to generate a set of AI images that together encode the data of the message. The receiver recovers the message by browsing the forum, downloading the appropriate images, decoding the hidden information they contain, and reconstituting the original message. The sender and receiver share a secret key, so only the receiver can decode the hidden information (or indeed, tell that the images contain hidden information at all). Assemblage is much inspired by Collage (2010), which used heuristic steganography to send messages over services that host user-generated content, such as photo-sharing web sites. Assemblage uses provably secure steganography (Pulsar is to diffusion models what Meteor was to generative text models) and is meant to be used with forums that are dedicated to AI-generated images, such as the /r/aiArt subreddit.
In Assemblage, as in Collage, a single image that contains steganographic data is called a vector. One vector can convey only a limited amount of information (a few hundred bytes). Longer messages must be split into chunks and sent across multiple vectors. This process uses rateless erasure codes (specifically raptor codes), which produce an unlimited number of fixed-size encoding symbols from a source message, such that the message can be reconstructed once sufficiently many symbols are received. The sender posts enough vectors (i.e., images) so that the receiver can recover the message with high probability.
Pulsar encoding and decoding is fairly expensive, taking around 5–10 s in either direction to run on a personal computer. Assemblage mitigates this in two ways. The first is that the sender can do part of its work offline, generating several of the “local states” needed for steganographic encoding in advance, before there is a message to send. The other is that the receiver uses a perceptual hash as a prefilter to quickly identify which images are likely to correspond to one of its own local states, so it does not have to download and attempt to decode every image posted to the forum.
When we say that Pulsar steganography is secure, we are not saying that its output is indistinguishable from a real photograph or a drawing by a human artist—what we mean is its output is indistinguishable from other artificial images generated by the same diffusion model. In order to blend in, Assemblage vectors need to be posted in venues where images of that nature are common and expected. Section 4.1 is a survey of platforms that might be suitable, which include discussion forums like Reddit, image/video sharing platforms like DeviantArt and Imgur, and messaging systems like Discord and Telegram. Complicating the automated posting of images is the fact that some platforms have requirements for “metadata” to accompany each post, such as a title or comment. Some platforms apply unavoidable compression to uploaded images: in some cases the original message can still be recovered, but in others the compression alters the image data too much.
Thanks to the authors for reviewing a draft of this summary.