Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
review_content: summary: This paper studies how to use models to hide data.
strengths_and_weaknesses: Strengthes: I checked the performance, which seems to be very impressive and is the main reason I argue for acceptance. The paper is also well written and organized. Reasoanble analysis is provided to justify the reported results. I do not see a clear weakness of this paper. Some papers might be worth a citation, such as UDH: universal deep hiding from NeurIPS2020. To my knowledge, it is not a common practice to publish this topic at NeurIPS. Maybe it is worth a discussion.
questions: Since I am not very familiar with this topic, I am willing to adjust my score based on the questions from other reviewers and rebuttal from the authors.
limitations: N.A.
review_title: null

final_score: rating: 5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
review_content: summary: This paper presents a new steganography model to recover the images from noise messages. It has two key contributions. First, it proposes a weight pool such that the model is assembled from the weights in this pool with the secret key v. People are hard to get the correct model with the key. Second, they design a trainable pipeline to co-train the generated model and classification model with the weight pool. The authors evaluate the model on three different datasets with SSIM, MSE, and Performance Difference metrics. 
strengths_and_weaknesses: Strengths 
1. The key idea sounds novel to me. The generation model is assembled from a weight pool by using the private key. Therefore, if stealers do not know the key, it is hard for them to get the correct generation model.
2. The authors proposed a novel training pipeline to train the generation model with the weight pool. 
3. The results look promising.
4. The authors provide the details to implement and train the model in the supplementary. 

Weakness:
1. There is no related work section. Please include related image steganography models and generative models in the related work.
2. I have a concern that this paper does not include any baselines. It is hard for me to get a sense of how good the proposed model is. [1] [2] use a similar metric to evaluate the steganography performance. Please consider comparing the model with them.
3. The algorithms in the supplement are a little hard to understand. Please consider adding some explanation. It is the key concept of the paper. Please also consider moving them to the main paper.

[1] Zhang, Kevin Alex, et al. "SteganoGAN: High capacity image steganography with GANs." arXiv preprint arXiv:1901.03892 (2019).
[2] Kishore, Varsha, et al. "Fixed Neural Network Steganography: Train the images, not the network." International Conference on Learning Representations. 2021.
questions: 1. How many secret keys did the authors use when training the model? I think if we use too few secret keys, the stealer might be easy to recover the model by credential stuffing.
2. How long will it take to train the model? Does training with the weight pool make the training process very slow?

limitations: This paper proposes an image steganography method. One possible negative societal impact is people might use it to steal secret information.
review_title: null

final_score: rating: 8: Strong Accept: Technically strong paper, with novel ideas, excellent impact on at least one area, or high-to-excellent impact on multiple areas, with excellent evaluation, resources, and reproducibility, and no unaddressed ethical considerations.
review_content: summary: This paper presents a method called Cans for encoding secret datasets into deep neural networks (DNNs) and transmitting them in a openly shared “carrier” DNN. In contrast to existing steganography methods encoding information into least significant bits, the authors encode the secret dataset into a trained publicly shared DNN model such that the public model will predict weights for secret key inputs (known to covert operatives), the weights are used to populate a secret DNN model and the secret DNN model predicts secret dataset for noisy inputs (known to covert operatives). The main advantage of the Cans encoding is that it can covertly transmit over 10000 real-world data samples within a carrier model which has 100× less parameters than the total size of the stolen data, and simultaneously transmit multiple heterogeneous datasets within a single carrier model, under a trivial distortion rate (< 10−5) and with almost no utility loss on the carrier model (< 1%). 
strengths_and_weaknesses: Strength: 
•	The authors nicely combine cryptographic application and DNN modeling.  The idea of hiding the secret dataset in a shared model parameters is very interesting.
•	The authors also nicely presented their experimental work with accuracy and robustness evaluations. 

Weaknesses: 
•	The paper is missing an integration of the main algorithmic steps (Fill, Propagate, Decode) with the overarching flow diagram in Fig 1 which creates a gap in the presentation.

•	The abstract and main text make inconsistent claims about the transmission capacity:
o	Abstract: “.. covertly transmit over 10000 real-world data samples within a carrier model which has 220× less parameters than the total size of the stolen data,”
o	Introduction: “… covertly transmit over 10000  real-world data samples within a carrier model which has 100× less parameters than the total size of the stolen data (§4.1),”

•	Definitions of metrics and illustrations of qualitative results are insufficiently described and included. 
o	For example, the equation for a earning objective in section 3.3 should be clearly described.  
o	Page 7: define performance difference and hiding capacity in equations. 
o	Fig 3 is too small for the information to be conveyed (At the 200% digital magnification of Fig 3, I can see some differences in image qualities). 
 
•	The choices and constructions of a secret key and noisy vectors are insufficiently described i.e., Are the secret keys similar to the public-private keys used in the current cryptography applications? What are the requirements on creating the noisy vectors? 

questions: •	Please, fix the typos including the title (Stegnography), “Under the umberalla of DLPS,”
•	How is encoding a secret dataset into a neural network model different from injecting a trojan into a neural network model, for instance, in the TrojAI program – see https://pages.nist.gov/trojai/docs/about.html?
•	Why is the method denoted as “capacity-aware” as opposed to “capacity-limited”? The encoding of secret dataset is either successful or not, but it is not probing the carrier model for its capacity, correct?
•	What is the weight pool restoration algorithm?
o	“We initialize the weight pool with a customized size 5× smaller than the carrier model, which allows us to implement a weight pool restoration algorithm to recover the pruned parameter by selecting the non-zero value from each weight pool copy, i.e., the fusion mechanism. “

limitations: •	How is the information redundancy built into the Fill, Propagate, Decode algorithms? 
o	In reference to the sentence “ Finally, by comparing the performance of the secret model with or without fusion, we conclude that the robustness of Cans largely comes from the information redundancy implemented in our design of the weight pool”
review_title: null

Meta-review: metareview: The reviewers are generally positive, with Reviewer Lxtr being mostly enthusiastic about the work. Both Reviewer Lxtr and 5E9b believe the work of encrypting and transmitting secrete data with DNN is novel and the work is well executed with thorough experimental results and technical details. The reviewers raised several questions about the related work and baselines, as well as algorithmic clarity. The authors should further address these points by incorporating additional discussions and results from the rebuttal in the revision.
confidence: Less certain
Decision: Accept