The field of information hiding encompassing steganography and digital watermarking has accumulated a significant body of rigorous results over the past three decades. Its theoretical foundations, information-theoretic bounds, and practical coding constructions were, however, developed under a tacit assumption: that data originates from physical sensors or human authors, and that the real world cannot be resampled at will. The rapid and widespread adoption of generative AI invalidates this assumption in ways whose consequences for the field are only beginning to be understood.

The stakes are high. Society relies on media data, such as images, audio, video, and text, to form beliefs and make consequential decisions. The ability to generate synthetic content that is perceptually indistinguishable from authentic media at negligible cost poses a serious threat to information integrity. Information hiding, and watermarking in particular, is widely regarded as a promising technical mitigation: if generators embed robust, verifiable marks, downstream detectors can help authorized parties identify synthetic content. This hope has already been translated into law. Article 50 of the EU's AI Act, the California AI Transparency Act, and the California Digital Content Provenance Standards Act all impose obligations around the marking of AI-generated media. Yet the security of such schemes, and the fundamental limits of what they can achieve, remain poorly characterized.

This Dagstuhl Seminar aims to bring together researchers from information hiding, cryptography, machine learning, signal processing, and computer vision to address this gap systematically. A first and necessary step is to establish common foundations: to combine the classical framework of information hiding — built on concepts such as the prisoners' problem, capacity-achieving codes, and adversarial warden models — with the vocabulary prevailing in the machine learning literature, where embedding and detection functions are treated as jointly learnable end-to-end.

The seminar's focus is on revisiting the core concepts of information hiding in the light of what generated media makes possible. Access to the generator as a conditional sampling oracle introduces degrees of freedom with no analogue in conventional hiding, where the cover object is given and cannot be resampled. The high dimensionality of neural network weight spaces opens potential new channels for key embedding. At the same time, learned marking schemes face unresolved questions about adversarial robustness and generalization under distribution shift. Determining which classical results remain valid, which require modification, and which must be reconsidered entirely is the scientific core of this event.

Beyond consolidation, the seminar will devote time to genuinely speculative directions. The intersection of tokenization with lossy compression, the shift from static to adaptive neural compression, and the progressive integration of generative components into camera and acquisition pipelines each raise questions that the existing literature has barely begun to address.

Expected outcomes include a consolidated terminology bridging the participating communities, a structured account of which foundational assumptions require revision for generated media, and a curated set of open problems to guide future research. The organizers also aim to produce a concise, accessible summary of what information hiding in generated media can and cannot realistically guarantee — a resource intended to inform both researchers entering the field and the policy processes that are already moving ahead of the science.

Creative Commons BY 4.0

Rainer Böhme, Tomas Pevny, and Luisa Verdoliva