Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 3: Reject: For instance, a paper with technical flaws, weak evaluation, inadequate reproducibility and incompletely addressed ethical considerations.
review_content: summary: This paper describes a technique for hiding images in images by means of SinGAN. The authors learn how to create a key-generated noise to be embedded into the cover image by exploiting SinGAN. Also discussion on robustness of the technique on discoverability is presented with some hints on obfuscation.
strengths_and_weaknesses: The main strength of this paper is the application of the SinGAN architecture to the problem of image hiding. This is a first. 
There are several weaknesses on the other hand: 
1) the paper looks like this is a preliminary result, they employed only the 20 images available in the SinGAN Github repository;
2) some part of the text are not clear: (i) the authors claim to put the secret into a "location" of the cover... where? how? not clear to me... (ii) experiments were carried out on the 20 images of the SinGAN repository but what about the comparing SOTA techniques? They are comparable? I know that HiNet works with images with higher dimensions and quality... I dont feel like the comparison is fair
3) experiments need to cover much more possibilities
4) usual stego metrics are not shown like "db" or "bpp"
5) Figure 2 is shown but not reference in text
questions: 1) Why did you use only SinGAN images for cover/secret? Can you do/propose some more examples?
2) How you carried out comparison with SOTA techniques? Did you do experiments on the same images or just reported each SOTA techniques paper results (I found the same PSNR/SSIM values in HiNet paper... I dont feel like this is a fair comparison).

limitations: The authors do not take adequately care of image size/resolution. In my opinion this is a great limitation of the work that should be addressed. Images elaborated are too small/low resolution to expose visible alterations... Maybe this is a limit... But we dont know because further experiments need to be carried out.
review_title: null

final_score: rating: 5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
review_content: summary: The task is about image-in-image steganography. Unlike previous methods which follow the autoencoder approach, they use GAN-based network to model the probability density of cover images, and hide a secret image in one particular location of the learned distribution. 
strengths_and_weaknesses: Strengths
(1) The idea of hiding message in the learned distribution is interesting. It is different from previous methods, which use an autoencoder scheme.
(2) Compared with previous work, the proposed method doesn’t need to transmit the decoder to receiver via a subliminal channel. Their model can be publicly transmitted and only the key needs to be sent via the subliminal channel.
(3) The proposed method doesn’t directly generate stego images, thus avoiding the issue of possible detection by steganalysis methods.
(4) Multiple images can be hided in one model for different receivers, which is a challenging task that has not been accomplished before.

Weakness
(1) The dataset contains only 20 images. 
(2) The other methods can use one model to accommodate different cover-secret images. But for the proposed method, it needs to train one sinGAN for each cover image. 
(3) The proposed method performs much worse than HiNet in terms of the extraction accuracy of the secret image.
(4) The extraction accuracy of secret image with obfuscating has low PSNR (20dB).
(5) The mapping between the secret noise (generated by the embedding key) and the secret image may not be bijective (i.e., one-to-one), which means it is possible to obtain the secret image with random sample. In this paper they randomly draw 100, 000 samples from each of the 20 trained stego SinGANs to prove the possibility of secret image leakage is less than 0.001%. But I think 20 is a small number, it is sufficient to prove the security.

questions: (1) Lines 197-201 are unclear. The proposed method performs worse than Weng19 and HiNet in terms of the extraction accuracy of secret image. It is claimed that secret-in-network hiding is generally considered much more difficult than secret-in-image hiding. But at line 97, the proposed method is classified as constructive image hiding, not secret-in-network hiding. The authors should explain clearly why the extraction accuracy is low. 
limitations: The other methods can use one model to accommodate different cover-secret images. But for the proposed method, it needs to train one sinGAN for each cover image.
review_title: null

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: The paper proposes a method to hide images in deep probabilistic models. The proposed method is novel and can be framed as a particular case of the existing methods. One of the significant properties of the proposed method is its ability to be used for multiple receivers. The authors introduce the problem by discussing the current different approaches to hiding data using DNNs and outline the contributions of the paper. Next, related work for each of the described current approaches is provided. The authors then give a mathematical model formulation and how the data hiding computations are carried out. The approach being novel cannot be directly compared to previous works and hence, the authors identify the closest baselines to the proposed model and using experimental results, show that the proposed model either performs better or is more efficient than the considered baselines. The authors also evaluate the model from a security perspective using three methods. Lastly, the authors describe experiments evaluating the models' ability to hide images for multiple receivers and obfuscate the secret image.
strengths_and_weaknesses: Typos:
1. Line 54: adopts -> adopt/adopted
questions: NA
limitations: NA
review_title: null

Meta-review: metareview: This paper studies a novel variation of image steganography. The proposed approach is different from prior work (mostly building on autoencoders) and uses a GAN and hide a secret image in one particular location of the learned distribution.

The central idea of the paper seems novel and interesting. The reviewers raised several concerns about limited evaluation and complexities of comparing to other methods that generate directly images. Overall, this paper seems to have novelty and interesting ideas and the benefits seem to overcome the limitations, based on the rebuttal and discussions. 

confidence: Certain
Decision: Accept