Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 7: Good paper, accept
review_content: This paper highlights and studies the interesting possibility of hiding information within neural network weights, which is a form of steganography. The sensitivity of different neural network layers to perturbations is evaluated, and based on this a technique for hiding information is proposed and demonstrated. It is shown that it is possible to hide information in the weights of a number of standard baseline neural networks without being easily detectable.

Overall this is an interesting paper, which highlighted a possibility which I was not aware of (although I do have a little familiarity with steganography). My only significant criticism is that I would really like to see a more thorough exploration and discussion of the information hiding capacity of neural networks. In particular it would be great if the authors could explore the relationship between the quantity of information that can be hidden and the size/number of parameters. As far as I can see, the sizes of the weights are only mentioned in passing once (on the first page of the paper), where they are said to be 'in the hundreds of megabytes' (an understatement these days), and the paper does not say how much information they were able to hide in weights. As a bare minimum I would ask that the authors state how much information they were able to hide (as in, how many megabytes), as well as the actual sizes of the weights for the neural networks used (rather than the vague 'hundreds of megabytes'). A more thorough exploration of the relationship between neural net size and stego capacity would be even better. Does it follow the 'square root law' typical in other settings (see e.g. http://www.cs.ox.ac.uk/andrew.ker/docs/ADK71B.pdf)? Perhaps this more thorough exploration can be deferred to future work.

Apart from this I have a number of more minor criticisms and suggested improvements:
 - Multiple issues with Figure 1.
   - In the first sentence of the caption: 'Fraction bit distributions', you should probably replace 'distributions' with 'histograms'.
   - The y-axis of at least one of the histogram plots should be labelled (I guess with 'frequency') so that it's clear what the numerical values represent.
   - Instead of 'top left three' you should be more specific and say 'top row, first three'.
 - Generally there were a lot of grammatical errors and spelling mistakes, and you should spend more time carefully proof-reading the paper. A (probably not exhaustive) list of examples:
   - The first sentence of the second paragraph on page 2 beginning 'Since the fraction bits' is not a valid sentence.
   - 'Neural' is misspelled in the first line of the last paragraph of page 3.
   - The title of Section 2 should be 'Background', not 'Backgrounds'
   - In first sentence of Section 4, what does 'their' refer to? Probably should replace 'their usefulness' with 'the usefulness of DNNs'
   - About two thirds of the way through the first paragraph in Section 4.4, in the sentence beginning 'In particular, ...'; 'fraction bits an...' that 'an' should be an 'and'. Also in 'we made further divided them into two types', delete 'made'.
   - The third sentence of the second paragraph of Section 5, beginning 'In particular, our experiment...' is not a valid sentence.
 - Don't use double parentheses for citations as you do on the last line of page 1. You can use semicolons to separate the citations from the other text inside the parentheses.
 - In the third paragraph of page 3, you say 'A trivial approach to hide... replace the least significant bits in the pixel values of the **secret** image...' I'm pretty sure you mean cover image there, not secret image.
 - In the second paragraph of page 4, could you explain the difference between watermarking and steganography?
 - In the fifth paragraph on page 5 you say '...a load of...', this is far too colloquial for an academic paper.
 - The investigation represented by Table 1 could have been more detailed. For example you could have tested (as others have done previously) whether outputs are more sensitive to weights closer to the input/output of the NN. You could also note that it's pretty obvious that a NN would be more sensitive to batchnorm parameters than others since these affect the scale and position of all of the outputs of a layer.
 - The way you structure the experiments section, with two short introductory paragraphs followed by subsections, could be streamlined. Merge the informative parts of the intro paragraphs into the subsections and then delete the intro paragraphs.
review_title: Very interesting, novel direction. Experiments could be more thorough.

final_score: rating: 7: Good paper, accept
review_content: This paper proposed a method to hide information in the parameters of neural network models. To avoid significant perturbation, the paper only considers embed the information in the fraction bits of the parameters. The paper considers hiding the information in either the least significant bits of the most significant bits. Hiding in the least significant bits is harder to be detected but the message can also be easily removed without much degradation in the model performance. On the other hand, information  hiding in the most significant fraction bits will be very hard to remove without model performance degradation but also harder to embed the message for the same reason. Sensitivity analysis to select least sensitive parameters to use and fine-tuning after embedding to recover the model performance can be two remedies.

Overall the paper is clearly written and the proposed method is well supported by the experiments. Some questions / comments below:
- How many files in each format are used to generate the plots in figure 1? Is it statistically significant?
- Sec 3.3 "In the experiment section, we partitioned the parameters of a model into two where the former is used to hide secrets into one part while the latter is fine-tuned." It's not clear to me what the criteria is for partitioning the parameters. Is it purely based on sensitivity analysis?
- Sec 4. "All the values reported in the table are the averaged ones across ten different runs.". Can the standard deviation be added to the results as well?
- Sec 4.1 "Since the number of BN parameters only account for less than 1% of the entire parameters, which indicates low capacity, we excluded BN parameters in later experiments." Does it mean all models used do not have BN layers?
- Re. Table 2: It's interesting to see some models are not sensitive to even MSFB perturbations. Any insight on the specific reason?
review_title: An approach to use the parameters of a neural network to hide information

final_score: rating: 3: Clear rejection
review_content: This paper investigates if neural network parameters, trained for a standard task such as image recognition, can be used as a cover medium in steganography. The authors contend that neural networks are a good choice of cover medium, mainly because the less important fractional bits of parameters follow a uniform distribution. This is empirically demonstrated in Figure 1 where the probability of least significant bits taking values 0 or 1 are 50% for VGG, ResNet, DenseNet (I assume these are ImageNet models judging from later experiments). The authors experiment with replacing either the least or most significant bits from the fractional part of parameter values. The motivation behind replacing the most significant bits is that it will be more difficult for an attacker to remove secret information; bits of lower significance could be removed or replaced with little effect on test accuracy, while removing more significant fractional bits will have a larger impact on accuracy. The downside of this approach is that replacing more important fractional bits with secrets will also have a larger impact on accuracy, but the authors show fine-tuning can somewhat alleviate this drawback. The authors then show simple MLPs trained to distinguish between standard and stego networks are only slightly better than a random coin flip. Overall, I thought the paper was generally well-written and contains some interesting ideas, but these positives are also accompanied by an unclear motivation, lack of positioning with respect to related work, and poor experimental evaluation.

My primary concern is the practical motivation for this idea. In steganography, it is normally assumed that both the cover and steg image/audio/network cannot both be revealed, otherwise a trivial comparison will reveal secret information is present thus breaking security of the scheme. Does this mean a new model needs to be trained each time two parties want to communicate? If so, this seems to represent a serious limitation, since training these models requires a non-trivial amount of effort, in comparison to say, generating an image or audio file as the cover. Furthermore, a problematic scaling law then appears, where larger models need to be trained (on presumably more complex tasks to recover some plausible deniability e.g. it would be suspicious to see a ResNet-50 trained on MNIST), to hide larger messages. These larger models are much more expensive to train, and again generating high-resolution images is a much cheaper option. Sharing large resolution images will generally consume less memory than very large neural networks. I wonder how the authors view the practicality of this work? It would have been great to compare this scheme with some standard steganography schemes on images or audio across desideratum such as bandwidth, robustness etc.

The authors may not be aware, but there has been work on information hiding in previous work. Song et al. (2017) [1] also investigate how information can be imperceptibly embedded and recovered from neural networks. In addition to experiments on embedding secrets in fractional bits, they have experiments in black-box settings. Could the authors comment on relationship between this work and Song et al. (2017) [1]? As far as I can tell, they are quite similar ideas.

I was a little disappointed that the authors didn't include any practical demonstrations, such as successful recovery of secrets as shown in Song et al. (2017) [1]? Steganographic scheme are evaluated by security, capacity and robustness, as the authors comment in Section 2.1, but most of the experiments in section 4 concentrate on capacity. How does the scheme stand-up against robustness attacks such as down-stream task fine-tuning, parameter pruning etc.? I was also confused by the experiment set-up in Section 4.4. For a fair experiment of distinguishability, I had expected a large number of cover and stego models to be trained (for some notion of confidence), and then use a steganalysis tool to distinguish between the two. I'm not sure training a steganalysis model on a single stego network allows for a fair interpretation of performance. 


[1] Song, Congzheng, Thomas Ristenpart, and Vitaly Shmatikov. "Machine learning models that remember too much." Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. 2017.

review_title: Stego Networks: interesting but unclear motivation

Meta-review: This work presents an original analysis of using the weights of a neural network as a medium on which to hide information. Although the paper offers a novel perspective, its motivation and applicability remain unclear. As reviewer 3 points out, the proposed method does not seem very practical for any particular application, and the authors do not give a practical demonstration that shows the usefulness of the approach. It's not clear how the paper should be positioned with respect to previous work, and the proposed method is not directly compared with standard steganography schemes on metrics such as bandwidth, robustness etc, making it difficult to assess the value of the contribution. For these reasons I recommend rejecting the paper in its current form.
Decision: Reject