House of Cans: Covert Transmission of Internal Datasets via Capacity-Aware Neuron Steganography
Authors: Xudong Pan
Shengyao Zhang
Mi Zhang
Yifan Yan
Min Yang
Venue: NeurIPS 2022 Accept (2022)
Keywords: data stealing
deep learning privacy
AI security

Abstract: In this paper, we present a capacity-aware neuron steganography scheme (i.e., Cans) to covertly transmit multiple private machine learning (ML) datasets via a scheduled-to-publish deep neural network (DNN) as the carrier model. Unlike existing steganography schemes which treat the DNN parameters as bit strings, \textit{Cans} for the first time exploits the learning capacity of the carrier model via a novel parameter sharing mechanism. Extensive evaluation shows, Cans is the first working scheme which can covertly transmit over $10000$ real-world data samples within a carrier model which has $220\times$ less parameters than the total size of the stolen data, and simultaneously transmit multiple heterogeneous datasets within a single carrier model, under a trivial distortion rate ($<10^{-5}$) and with almost no utility loss on the carrier model ($<1\%$). Besides, Cans implements by-design redundancy to be resilient against common post-processing techniques on the carrier model before the publishing.

House of Cans: Covert Transmission of Internal Datasets via Capacity-Aware Neuron Steganography
Xudong Pan Fudan University
Shengyao Zhang
Fudan University
@dpan18@fudan edu. en
shengyaozhang210m 0m fudan. edu.
Mi Zhang Fudan University mi mi_ edu. cn
Yifan Yan
Min Yang
Fudan University
Fudan University
yanyf208fudan. edu. cn
mn_yang@fudan edu..eduuee cn
Abstract
In this paper, we present a capacity-aware neuron steganography scheme (i.c., Cans) covertly transmit multiple private machine learning (MI.) datasets via scheduled-to -hheduled-to-publish deep neural network (DNN) as the carrier model. Unlike existing steganography schemes which treat the DNN parameters Cans for the first time exploits the learning capacity of the carrier model via a novel parameter sharing mechanism. Extensive evaluation shows, Cans is the first working scheme which can covertly transmit over 10000 real-world data samples within a carrier model which has 220 less parameters than the total size of the stolen data, and simultancously transmit multiple heterogeneous datasets within single carrier model, under a trivial distortion rate (< 10-5) and with almost no utility loss on the carrier model (< 1%). Besides, Cans implements by-design redundancy to be resilient against common post-processing techniques on the carrier model before the publishing.
bit strings,
1 Introduction
Large machine learning (ML) datasets become critical assets for AI corporations 2 g As the preparation of datasets is highly time-consuming and labor-intensive, it is common and reasonable for relevant parties to hold the data as confidential properties [45). Despite being carefully curated in local data centers isolated from the open network (3) recent research shows model-level vulerabilities
still expose the private datasets under the risk of disclosure (e.g., 7
37
Once deep neural network (DNN) finishes its training process immediately becomes an exploitable source of data disclosure. By interacting with the trained model in full-Knowledge manner (i.e., with known parameters, model architecture, etc.) via the prediction API, previous works reveal the possibility of inferring sample-level sensitive information reconstructing raw training samples from the intermediate computation results (e.g.. features 33 and gradients 28 55 [6]) and the outputs of a trained model (9] 36, 35] [0]. For example, Carlini al. reveal and evaluate how sensitive texts (e.g., social security number) are memorized in DNN-based online services [9] (e.g., Google's Smart Compose [13 and more recent industry-level pretrained large language models [10] (e.g., OpenAl's GPT-2
private dataset, the model
34 Such vulnerabilities reflect the
tension between the confidential data and the openly accessible trained model. A natural question is, whether a private dataset with no exposed open interfaces can be impregnable against data stealing.
Our Work. In this paper, we reveal that severe leakage of the sensitive information can still happen even for private ML datasets with exposed public interface. To break the privacy barrier of MI. data
36th Conference on Neural Information Processing Systems (NcurIPS 2022).

---

with no exposed interface, we propose capacity- aware neuron stegnogrpahy, or Cans, which employs the scheduled-tor -ooeuuule-to-publish DNN model as carrier model for covert transmission of multiple secret models which have memorized the sensitive data (i.e., a generator-like DNN architecture 17 [3), which maps random noises to real data samples), for privacy breach. When an outside colluder exclusively decodes the memorization-oriente models from the carrier model, the ground-truth private data is dumped when feeding the secret models with the same set of random noises (e.g.. shared via a secret random seed).
Why not hiding the sensitive data directly? Steganography is a long- standing research area with mature algorithms for information hiding with multimedia contents (e.g., image M. text and audio [4]). Compared with them, the parameters of DNN is usually much larger (e.g.. the storage of a ResNet- 18 is about 45MB) and has stronger resilience against the modification of multiple least-significant bits (L.SB) positions 20 23.. However, previous hiding schemes mainly view the carrier medium, whether multimedia contents or DNN parameters [8 40
32
26 as bit strings for secret encoding, which hugely limits the potential of DNN as carrier. To the best of our knowledge, the state-of-the-an schemes only able to use about 20% ~ 50% size of a DNN for information hiding. For example, Song et al. find most existing data hiding techniques can hardly hide over 500 raw gray-scale images of 32 32 resolution (5. MB.5 in total) if the utility loss carrier ResNet-18 18 shall be under 3% [38] In other words, DNN as the carrier medium seems to lose its unique advantages in steganography. Our approach shows there is much more that can be done.
Cans-Hiding Models in Model. To fully exploit the enormous learning capacity of DNN, Cans presents a more capacious and flexible neuron steganography scheme which restores the uniqueness of using DNN as the carrier medium, especially in leaking a private dataset much larger than the carrier model itself or in leaking multiple private datasets simultaneously. Specifically, Cans implements a new parameter sharing mechanism based on weight pool, which stores an array of learnable and usable parameters. The parameters in a weight pool are designed to fill into different layers of any given DNN for multiple times, and allow cyclic access. In other words, multiple DNNs, including either the secret models and the carrier model, can be generated from the same weight pool by recycling the parameters inside ($3.2). To encode the secret models in the carrier model, we jointly train the carrier model along with the secret models with the parameters generated from the weight pool (3.3). During the learning process, the error propagates and accumulates to the corresponding parameter the weight pool, where the update finally happens. After the carrier model is published online, the colluder can decode the weight pool from the carrier model with a small number of secret integer keys, assemble the secret model(s), and finally dump the sensitive data samples (3..4).
Extensive evaluation validates, Cans is the first scheme which can covertly transmit over 10000 real-world data samples within carrier model which has 220x less parameters than the total size of the stolen data ($4.1). D. and simultaneously transmit multiple heterogeneous datasets within a single carrier model ( (...2. with almost utility loss the carrier model and no trivial distortion rate on the stolen data << 10-5). Besides, Cans naturally implements information redundancy [41] via the usage of smaller weight pool, which enhances the resilience against possible post-proe prot-processing techniques on the carrier model before its publishing ($4.3.
2 Preliminary
Notations. In our work, we call a database is a private ML datasel (simply referred to as a private dataset later) if it is prepared for training MI. models. Specially, depending on whether annotation exists, private datasets are categorized as the data for supervised learning, where the task is defined in space X' x y. or for unsupervised learning, where the task is defined solely in a space X. We call X' the input space, which is composed of raw data including but not limited to images, texts, or audios. In supervised learning, a learning model (== fo) X' + Y' aims to build the relation from an element in X to the label in )' (i.e., the label space). which consists of all the possible values in the annotation. For example, in a K-class image classification task, X' consists of a set of images to be classified, while y = {1..... ..... K}, i.e., the possible classes. In unsupervised learning tasks, fundamental goal is to learn the distribution of the input data X' with either parametric or non-parametric models. For example, in the branch of generative adversarial nets (GAN [17). parametric generative model g (Z: 0) E X is trained to map a random variable Z ~ (0, i.e., fixed Gaussian distribution, to fit the true data distribution supported at X. Finally, the training

---

process of both supervised learning and unsupervised learning involves the optimization of a loss function, denoted as {(:; with respect to the parameters of the learning model.
Data Hiding in the Deep Learning Era. Data hiding, or steganography, is long-standing research
area in security-related research 32 Previous research mainly studies how hide secret information
in multimedia contents via coding-theoretes [1] and deep learning approaches [47 49 48 (22).
With the recent development of open-souree model supply chains, several research works also exploit DNN as a new medium for hiding binary information. At the early stage, Uchida et al. 40 and Song al. 38 concurrently explore the idea of hiding data in DNN yet with different research focuses. To protect the intellectual property of DNN, Uchida et al. propose to embed a secret random binary message into the model parameters via conventional steganography techniques (e.g.. least-significant bits or sign encoding). By verifying whether a model contains the binary message, the ownership is established. Later, this seminal work catalyzes the orthogonal study of DNN watermarking Instead of model protection, Song et al. aim at hiding sensitive information about the private data into the model parameters during its training. Specifically, they directly convert subset of sensitive data inputs into binary form and encode them into the model parameters again with almost the same set of conventional steganography techniques [40]. Although the previous work is originally designed for stealing training data, we find their approach can be immediately extended to hiding the sensitive information of irrelevant private datasets into carrier model. In this sense, we include this attack as the baseline in our experiments ($4).
12
Security Settings. Below, we introduce the security settings of our work.
Attack Goal. Following existing works on breaking training data privacy via well-trained DNN models, define target private dataset is stolen if, the outside colluder attains subset of data inputs containing sensitive information of the private dataset.
Threat Model. Our attack considers the existence of inside attacker and outside colluder. Formally, we have the following assumptions on the ability of the attackers: (i) Accessible Targets: The insider has access the target private dataset(s); (ii) Existent Carrier: The insider is assigned with the task of training a DNN, which is scheduled to undergo an open sourcing process, on a non-target dataset; (iii) Receivable Carrier: The outsider knows which model to download after the publishing; (iv) Secure Collusion: The insider and the outsider can collude on several integer values and model architectures via secure channel (e.g., rendezvous).
Attack Taxonomy, Similar to conventional stegnography [3). hiding scheme using DNN shall meet the following require- ments. (i) Capacity: As a prerequisite of invoking covert trans- mission, we require the secret information can be encoded into the carrier model without incurring unacceptable utility loss. Intuitively, a hiding scheme has higher capacity if more secret information is encoded with the same level perfor- mance degradation. (ii) Decoding Efficiency: This requirement measures how much additional knowledge is required to suc- cessfully decode the hidden information from the carrier model. (iii) Effectiveness: After the secret information is decoded from our carrier model, the information is expected have almost no distortion (i.e., effective transmission). (iv) Robustness: In our context, we require the colluder can still decode the secret models and thus the privacy of the target datasets when the carrier model undergoes common post-processing techniques (e.g., pruning and finetuning). (v) Covertness: Finally, to reify the requirement of covertness, a third party should not be able to detect whether a published model contains secret models.
Weight Pool
W/
WA
W6
IP,1
W33
Weight Group
P.,1
W2
PM
W/
W/
4C
56
Bias
Scale
4
6
3
1%
Open Task Cursor Secret Task Cursor
Figure 1: The schematic diagram of a weight pool.
3

---

3 Capacity-Aware Neuron Steganography
3.1 Attack Overview
Fig provides overview of our attack pipeline, which is mainly divided into four stages. Before introducing each stage, we first present our designs of weight pool, a key data structure for encoding (decoding) the secret models into (from) the carrier model.
Notion a Weight Pool. As in Fig I a weight pool P maintains an array of [P] learnable scalar parameters. Corresponding to the different types (e-g., weight, bias, scale) of learnable parameters in DNN, the parameters
weight pool is also grouped in disjoint groups, i.e., P Pw U P. U Ps- Each weight group implements different random schemes when initialized. Given integer secret a weight pool P implements the following primitives to interact with a DNN f(::0):
(i) Fill(P, f. v) + P(: v): Fill associates each parameter in f with a parameter of the same type which from the weight pool P under the randomness specified by given secret key v. P(0, v) denotes the hash map from the original parameters in DNN to the parameters in the weight pool.
(ii) Propagate(P. 0), v) + 0: After an optimization step on Propagate collects the weight update on each parameter in DNN and propagates them to the corresponding positions in the weight pool according to the hash map P() Each parameter in the weight pool implements buffer to receive the updates.
(iii) Update(P))>> 0: Update updates each parameter in P by aggregating its update buffer and then reset the buffer.
(iv) Decode(f, w) P: This primitive decodes the weight pool from DNN f according to the secret key u.
Attack Pipeline. In the following, we denote the carrier DNN as C.
Stage 1: Initialization of weight pool. the first stage, a weight pool P initialized from scratch with an attacker-specifee size for each group.
Stage 2: Construction of Memorization- Orieettoo--OO Tasks (.2).. At the next stage, for all the target datasets Di..... M to steal (M 2 1), the attacker build generator-like DNN architecture which will Iearn to map sequence of noise vectors to the attacker-intereste The noise vectors are randomly sampled from a secret distribution with a fixed integer seed, which is exclusively known to the insider and the colluder. Finally, the attacker chooses an integer secret os and invokes the Fill primitive to replace the parameters in each secret model with the ones in P by invoking Fill(P, fk. Ug).
data inputs correspondingly.
Stage 3: Joint Training for Capacity-Aware Hiding ( ($3.3) Combining with the learning task (De, &c) of the carrier model C, the attacker jointly trains the carrier model and the secret models by optimizing the parameters in the weight pool P. Concisely, calculate the parameter updates in each model and then invoke Propagate(P) (P, fk) to accumulate the updates in each model to the corresponding update buffers. Subsequently, we invoke the Update primitive and resume the joint training to the next iteration. When the training finishes, the attacker removes all the traces in the code base and replaces the corresponding parameters in the carrier model with the values from the final weight pool. We denote the final carrier model as C*.
each iteration, we synchronously
Stage 4: Decoding Secrets from the Carrier Model (3.4). After the carrier model C* is published, the outsider colluder downloads C*, With the knowledge of the architectures of the secret models and the secret key 2/2 communicated via secure channel, the outsider first invokes Decode(C". 0k) to decode the weight pool P from the carrier model. Then, the colluder assembles the secret models and dumps the sensitive data with the secret models. In the following, we present the detailed technical designs for each stage above.
3.2 Construction of Memorization-Orieet Tasks
For stealing a subset of sensitive inputs, i.e., (r.)) from a private dataset, we propose to model the secret learning task in the supervised learning framework. Specially, we aim at training generator- like architecture f& which maps noise vectors from a predefined noise space Z to each one of the sensitive inputs. By choosing common noise distribution Ng on Z and secret integer 5 N4. the

---

Generator based Secret Modals
Scheduled to Publish Model
Internal
Face
Carrer Model
Weight Sturing
Joit Training
Interall Dataset
Deoode
Weight
Facuderandom Notse Vectors
Internal Dataset C
Weight Pool
Assembibe
Decoding
$
the Carrier Model
Copacity-Aware
Model Hidding
STOLEN
Memorization
Oriented Learning
Figure 2: Overview of our methodology.
attacker samples a sequence of noise vectors 21. ..,..., 2N ~ .Na when the random seed is specified as sg. By pairing the noise vector and the sensitive inputs as {(2g, x,)) N the attacker constructs the secret learning task below for sensitive data stealing ming, (0(()) == = Σi d(fx(2;; 0x), x;), srcchine-indeendemn
where d is distance metric defined on the input space. As pseudorandomness in most popular DL frameworks and operating systems [3] 27]. the colluder can deterministically replicate the noise sequence after knowing the specific noise distribution and the integer seed 8k- Unlike directly encoding sensitive inputs in model parameters (38), our approach circumvents the data heterogeneity problem in existing attacks by converting data hiding model hiding.
Fill Secret/Carrier Models with Weight Pool. With the carrier model and an initialized weight pool P, we first specify random integer U2 for each secret model f& from all the possible indices of the weight pool P, i.e., {1, 21...... PI}. We design this mechanism to prevent the secret models from being decoded by any party except for the outsider, despite the scarce chance of even guessing the secret model architecture. We then invoke the primitive Fill(P, Sú, U%) in Algorithm A. in the supplementary material replace the original parameters in fa by parameters in P. The obtained model is denoted fx with the substituted parameters as P(O,, (1))-
Intuitively, the Fill primitive loops over all the scalar parameters in the target model fa(:; 0) and assign it with the value of parameter selected from the weight pool. As [ the parameter selection cursor on each parameter group (e.g.. the weight group Pw) cycles from a starting index derived from the integer secret (e.g., 2kk mod (. ). For the carrier model, sample an integer secret Uc as well for the carrier model.
Remark 3.1 (Label Memorization). By viewing the labels of data samples from a supervised learning datusel as inlegers, we can construct similar secret learning lasks above for label memorization.
3.3 Joint Training for Capacity-Aware Hiding
After the secret and the carrier models are filled, the weight pool / is viewed a proxy to each secret/open learning task during the training. Without loss of generality, we suppose the carrier model C' is trained on a supervised learning task De == { N with a loss func- tion &c. Formally, the model hiding process aims solve the following joint learning objective: minp Ne. tive requires P to reach good consensus on N secret tasks and the open task. For example, when M = 1, it means that the sets of local optimum for Jc and Si should intersect with one another to guarantec ncar-optimal weight pool is attainable. For the first time, we empirically propose a joint training algorithm which solves the learning objective above to construct near-optimal weight pool. Each secret model assembled from the optimized weight pool exhibits similar utility compared with an identical model which is independently trained ($4.2).
1. NNNG & (C(,;; P(Oc, v:) + 37 E. (P(0s,, vx)).. Intuitively, the above objec-
Searching for the Optimized Weight Pool. To solve the joint learning objective, our proposed attack executes the following training iteration recurrently. Denote the weight pool at the f-th iteration as Pt. Concisely, at the 1-th iteration, we iterate over all the M secret tasks and the normal task to conduct the following key procedures: (i) For the k-th secret tasks, we first invoke Fill(P,, P, fk. vK) to instantiate f& with the current values of the weight pool. (ii) Then, we forward a training batch via the model (-; (0k, vx)), back- prok-pro the loss LA approximated on the training batch, and
5

---

To wind up the hiding phase, the attacker clears up any traces of malicious training code and imelevant intermediate outcomes, memorizes the secret keys (i.e., the random seeds {sL} } for generating noises, the starting indices {uR] and the architecture name for each task, the size of each group in the weight conduct one optimization step on the parameters of f& with an optimizer (e.g., Adam 11).. (iii)
Finally, we collect the weight update on each parameter and follow the mapping relation in P(: ve) to propagate the update to the corresponding weight pool parameter. The above procedures are also conducted on the carrier model.
The above procedures describe the Propagate primitive on each secret/open task (L4-15 in Algorithm A.2). The final step in one training iteration is invoke the Update primitive on the weight pool (L16-18 in Algorithm A.2). Technically, for each parameter in Pt. we maintain a buffer to store the weight updates from each task. The update buffer is aggregated obtain the global update value on the corresponding scalar parameter in Pt. In our experiments, we find aggregation by average is already sufficient to achieve effective attacks. After the parameter is updated, we clear the update buffers and resume the next training iteration.
pool) via a secure medium, and instantiates the carrier model by Fill(P", fc, Uc). We denote the final weight pool p
3.4 Decoding the Secrets from the Carrier Model
Recovering the Weight Pool. After the carrier model is published online with open access, the attacker immediately notifies the outside colluder download the carrier model and decode the secret models from the carrier model. Specifically, after colluding on the secret keys with the attacker via a secure channel (e.g., an in-person rendezvous), the outsider first decodes the weight pool based on the colluded knowledge of the weight pool sizes and the starting index uC, i.e., by the primitive Decode C, vc). Specifically, the colluder first collects the parameters of different groups from the carrier model. Then, the attacker slices, e.g., the weight parameters into segments of length Pw The last segment may need additional zero padding to hold the same length. Finally, the attacker conducts fusion operation on the N decoded segments, right-shift the fusion result by us mod |Parl, and permute it with a permutation inverse to the one in Fill to recover the final P... the weight pool. Similar operations are conducted on the bias and the scale groups. We introduce the fusion mechanism on the N decoded segments to implement resilience against proc-psrcsssing on the carrier model ($4.3). For example, when the colluder finds the carrier model is pruned, the fusion mechanism selects the non-zero value from each weight pool copy to restore the pruned values. More details on the decoding procedure are provided in Algorithm A.3 of in the supplementary material.
Assembling the Secrets. Finally, the colluder recovers the secret models fi, f.. fM by invoking the Fill primitive with the decoded weight pool in the previous part. For the private dataset on which the adversarial purpose functionality stealing, the attack objective is attained. Otherwise, for the k-th target dataset, the attacker uses the securely communicated knowledge of the fixed distribution and the integer random seed to replicate the set of random noise vectors ; Finally, he/she dumps each (z)) for approximately recovering the sensitive input 2,.
4 Evaluation Results
Datasets and Scenarios. We evaluate the performance of Cans on three real-world public datasets covering the scenarios of object classification, face recognition and speech recognition. Table [ summarizes the scenarios and the statistics. Below, we concisely introduce the dataset information and the construction of the memorization-bar based secret tasks.
Table 1: Datasets and scenarios. ( (14 indicates the metric is the higher/lower the better)
Dataset
# of Samples
Bytes per Sample
Limits of Existing Schemes
Reconstruction Metric
SpeechCormnand
100,503 107,818 60.000
62.5KB
Nmsx 699
Mean Square Error (MSE, L) SSIM (TVSSE ())
FaceScrub
588KB
Nms 76
CIFAR-10
12KB
Nma: 3638
SSIM 43 (1/MSE (L)
CIFAR-10 24 This dataset contains 60, 000 images of daily objects (e.g., cat, trunk and ship).
Each image is encoded in RGB and has the shape of 32 x 32.

---

This dataset contains 107, 818 face images of 530 male and female celebrities retrieved from the Internet. Each image is encoded in RGB and has the shape of 224 x 224.
FaceScrub [29]:
SpeechCommand (i.e., Speech) 44
This dataset contains 35 different voice commands spoken by multiple subjects, which is composed of over 100,000 audio files of 1 second length with a sampling frequency of 16kHz. Each audio encoded in a one-dimensional matrix of 16, 000.
In each secret task, we set the dimension of the pseudorandom noise vectors 100 and the secret model as an off-the-shelf generator-like architecture which is detailed in the supplementary materials.
Specification of the Carrier Model. We consider standard ResNet-18 19 the carrier model, and the training on the CIFAR-IO 24 dataset as the open task. The total number of parameters in a ResNet- 18 is about 11.7 million, 42.63MB in bytes.
Baselines. We consider the following classical steganography schemes which are first adapted the context of DNN by Song et al. 38
Seeast-ignificant-Biie -ittseaatt-tBt-bbeedd Hiding (LSB): With LSB, the attacker hides the secret information in the last K bits of the floating-poins representation of each parameter in DNN. Therefore, for DNN carrier with L parameters, the maximal hiding capacity of the LSB scheme is LK/ K/88 bytes. In the example of R8,Net-11, the attacker uses the last 16 bits (which incurs almost no Per f), the ResNet- 88 provides a capacity of about 38 samples from FaceScrub. This scheme provably incurs no distortion on the hidden secrets.
Sign-based Hiding (Sign): With Sign, the attacker hides the secret information in the sign bit of each parameter. Therefore, DNN carrier with L parameters provides hiding capacity of L/8 bytes in this scheme.
Covariance-basee Hiding (Covariance): With Covariance, the attacker hides the secret informa- tion by maximizing the Pearson covariance coefficients between the secret values as floating- paiint values and the model parameters. Therefore, DNN carrier with L parameters provides hiding capacity of 4L bytes in this scheme. It is worth to note, the latter two schemes are learning- -aased and have no guarantee on the distortion which may be incurred on the hidden secrets.
Remark 4.1. For fair comparisons, our experiments adopt the same encoding schemes for each type of datasets when invoking Cans and the baseline methods on DNN.
Evaluation Metrics. We measure the effectiveness of neuron steganography schemes with the following metrics: (i) Reconstruction Error: This metric measures the pairwise difference between the stolen and ground-truit samples. For each data type, the specific metric for the reconstruction error is listed in Table [ (ii) Performance Difference (APerf): APerf measures the difference between the carrier model encoded with secret models and an independently trained carrier model. lower Perf means model hiding causes more performance overhead to the carrier model or the secret model, which implies the carrier model has lower capacity. Moreover, a lower carrier model APerf means model hiding is less covert. (iii) Hiding Capacity: As in (38), we measure the hiding capacity by the byte size of data samples which can be hidden in the carrier model without incurring nontrivial A Peer (c.g.. 1% on our specified carrier model) or perceptible reconstruction errors (c.g.. 10-2 in MSE for images (3T).
4.1 Effectiveness of Cans
Stealing Single Dataset. First, we present evaluation results on stealing data samples from each single dataset with Cans and the baselines. Fig 3 reports the performance of Cans and the baselines when the number of stolen examples, i.c., N, increases from and 1024 on Facescrub. As Fi c) shows, Cans can steal over 1000 face images with an SSIM uniformly higher than 0.97 and with less than 1% accuracy loss on the carrier model. This substantially surpasses the performance of existing data hiding techniques. On the one hand, in the upper part of Fig 3(a). the corresponding result for Sign, Covariance and LSB is unable to be derived when N reaches 64, 128 and 128 respectively. is mainly because, when the number of target inputs hits such a size, either the information capacity in the sign bit, the covariance, or the bits can no longer afford the required capacity for hiding all the images (i.e., about 147MB, 3x of a ResNet-18), 8), which directly inhibits the baselines from being executed. contrast, based on parameter sharing instead of directly modifying the parameter for data hiding, Cans has no hard upper limit on its hiding capacity and is more flexible to more general data
7

---

HWW 150
Ad Care X0on)
Contancs
Sign
0.75
0.5-
0.28
0.0
0.25
0:25
0.0-
0.5
0.70
1.0
125
512
2048
4290
0152 12208
1.0
# Siolen Semples (CIFAR-10)
Stollan Samples (FaceSorub)
Oure
Ground
Ours
Ground Truth
Ou/s
64
Figure 3: (a)(b) Comparison between our approach and the baselines in terms of SSIM and the accuracy of the carrier model on CIFAR-10 and FaceScrub. (c)-(e) Sampled results with different data stealing approaches on the three datasets.
stealing scenarios. On the other hand, our proposed attack achieves the optimal SSIM (with the MSE of reconstruction constantly smaller than 10 3) compared with both the Sign and the Covariance encoding. Although the SSIM of LSB remains 1, it drastically hurts the performance of the carrier model when the number of inputs reaches 64. In this case, the LSB encoding has to totally modify the last 24 bits of all the FP32 parameters in ResNet- 18 to afford the required capacity, which degrades the carrier model to a totally random model. In comparison, the carrier model in Cans preserves most of its utility. Table [ additionally report the effectiveness of Cans in stealing audio data.
Table 2: Effectiveness of Cans in Table 3: Effectiveness of Cans in stealing multiple heteroge- stealing audio data from Speech.
ncous datasets simultancously.
Stolen Samples
MSE
APeif
Stolen Samples
Size
Distortion
APerf
2.7
-0.43%
CIFAR-10
4086
48MB
0.856 (SSIM)
1024
3.5 10
-0.19%
FaceScrub
128
73.5MB
0.992 (SSIM)
-084%
2048
4.2 10
-0.41%
Speech
1024
62.5MB
4.1 x 10 (MSE)
4096
4.8 10-4
-0.35%
In Total
5248
184MB 4.31x Size of ResNet-18
Stealing Heterogencous Datasets. Next, we evaluate the scenario of stealing secret samples from multiple heterogeneous datasets. Specifically, we construct memorizationnoriintee secret models for the three datasets and hide the secret models simultaneously in the ResNet- 18 carrier model with the aid of Cans. In our experiments, the size of stolen samples from each single dataset already exceed the size of the carrier model, which inhibits almost all existing approaches from working in this scenario. In contrast, Table (obleB]show show the average distortion with Cans each single dataset remains very close to the cases when stealing each dataset alone, while the decrease in the performance of the carrier model is controlled under 1%. For example, Speech, the average MSE of the recovered margin of the performance when stealing the
1024 audio segments is 4.1 x 10-4 in a 7 x 10 Speech data alone.
Visualization of Stolen Samples. For better intuition, we also qualitatively compare the results of our attack with Covariance and Sign encoding in Feg For example, as is shown, our reconstructed images and audios are almost perceptually indistinguishable with the ground-truth ones, which conforms to quantitative results in SSIM and MSE.
4.2 Exploring the Capacity Limits of Cans
Next, we explore the capacity limits of Cans when the number of stolen examples N increases on the FaceScrub dataset. As Fig shows, there is almost no distortion on the decoded images (i.e., SSIM remains close to 1.0) when N increase from to 1024, while the APr the carrier model is controlled below 1%. As the size of the stolen images further doubles from 1024 to 32768 (i.e., x40x of the size of the carrier model), we notice the SSIM gradually decreases from near 1.0 to about 0.6, during which the quality of the decoded images does not show clear deterioration. For

---

Weight Pruning
Pruning
ANAY
5SM foslr) 02M4 jubn toler
Pleatre Fidlng
-0.4.
5017 Sain
2000 (Ac) Saiin))
72222 2' 23 27 222"0"110""""0222 122
055 B.Y Pruning
U.-008 0.5
100
Namber of Stolen Sonpp
Number of Smilen Sampls
Figure 4: (a) Effectiveness of Cans when the number of stolen examples continually increases on FaceScrub. (b) Visualization of the recovered secret images from the decoded secret model when the size ratio between the hidden images and the carrier model increases from about 0.1 to 440x. (c)&(d) Decrease in the SSIM of the decoded images and the performance of the carrier model when undergoing weight and filter pruning.
example, the visualization results in (i) show, such deterioration would not inhibit the outsider from further exploiting the leaked information, i.c., the identity of the photo owner can be clearly recognized. In summary, Cans hides hundreds times more of information than the size of the carrier model without incurring non-trivial distortion on either the stolen data or the carrier model.
4.3 Robustness of Cans in Noisy Channels
Finally, we evaluate the robustness of Cans when the carrier model undergoes weight pruning 18 or filter pruning [25), i.c., where a 3 proportion of weight/filter parameters with the smallest norms are set to be zeros in each layer. In experiments, we hide 512 images from Facescrub (i.e., 294MB in total (6.8x of the ResNet-18 carrier) and vary the pruning ratio 3 from 0.1 to 0.9 on the carrier model. We initialize the weight pool with customized size 5x smaller than the carrier model, which allows us to implement a weight pool restoration algorithm to recover the pruned parameter by selecting the non-ze non-zero value from each weight pool copy, i.e., the fusion mechanism. Fig/4/ reports the reconstruction error of the stolen data from FaceScrub when & varies. As the results indicate, the SSIM of the recovered images remains over 0.5 (when the corresponding distortion level does not inhibit leakage as shown in Fig (ib) when the carrier model suffers a huge utility loss due to the large pruning ratio. For example, Fig when / in weight pruning reaches 0.3, the performance of the carrier model decreases by over 10%, while the SSIM of the decoded images decreases by 0.1 from the original SSIM 0.994, which therefore remains higher than 0.8. Finally, by comparing the performance of the secret model with or without fusion, we conclude that the robustness of Cans largely comes from the information redundancy implemented in our design of the weight pool. Consequently, only if a weight pool parameter is not always in the 3 smallest for all the layers, our decoding algorithm can always recover its value by referring the un un-pruned copy.
5 Conclusion
In this paper, we design capacity-aware neuron steganography, i.c., Cans, which is the first to enable the covert transmission of 100x more information compared with the size of the carrier model. We provide an extensive set of evaluation results to show, Cans is efficient, robust and covert in exploiting the enormous learning capacity of the DNN for information hiding, providing a much higher hiding capacity than known approaches.
L Limitations and Future Works. Despite the robustness against pruning, we admit Cans may be less robust when the architecture of the carrier model is modified. However, it is not a common practice of modifying the architecture of an already optimized model, except for some special cases that the corporation wants to further optimize the storage and computing efficiency by model compression (e.g.. pruning or quantization). Nevertheless, even with model compression, the compressed version is usually released along with the raw full-size model on most third- hhird-party platforms 4 I For future works, would meaningful to consider detect whether a published DNN hides information or not. For example, a detector may leverage statistical testing or learning baased detection [46]. However, this would rarely happen in real world as the purpose of training the model is for publishing, which means such model has not been trained or been available previously. How to detect a carrier model in such a zero-shot or few-shot scenario is an open challenge for mitigating Cans. To facilitate future research, we open-source code in https::///// /tttts::///aonoie httpp:/::////ooouuuss.. 4open. science/r/dated wwwdddaaaahiiinnnd wwwdnndddiiinnee 66D0/

---

On the Broader Impact. Cans reveals the practical threats of breaking the privacy of ML data even with no exposed interface. We hope our work would alarm Al corporations on the risks of unnecessary access to private internal datasets even if they are safely stored in the local network.
Acknowledgments
We would like to thank the anonymous reviewers for their insightful comments that helped improve the quality of the paper. This work was supported in part by the National Key Research and Development Program (2021 YFB3101200), National Natural Science Foundation of China (61972099, U1736208, U1836210, U1836213, 62172104, 62172105, 61902374, 62102093, 62 62102091), Natural Science Foundation of Shanghai (19ZR1 4048000.. Min Yang is faculty of Shanghai Institute of Intelligent Electronics & Systems, Shanghai Collaborative Innovation Center of Intelligent Visual Computing and Engineering Research Center of Cyber Security Auditing and Monitoring, Ministry of Education, China. Mi Zhang and Min Yang are the corresponding authors.
References
[1] Available Models-PaddleLite
http::/:.....rattteeccooo//////a intrrddcction/sppprrr_odddd html
Accessed: 2021-05-21.
[2] Building national research resource: A blueprint for the national research cloud. https
[3] Google's Approach to IT http///www/////////o/oooooooo/ta
9.22. ht222///w//maaa/oa//////o//ooogr pdf
[4] Models Machine Learning - bachine-learning/
Apple Developer.
https://devellporr.app appp::ppeelprrr.pp....p...p....e com/
[5] Reproducibility - PyTorch 1.10.0 Documentation. sttp:://pptorra..orr//ossssssss
notes cotes/randomness.c
[6] Yossi Adi, Carsten Baum, Moustapha Cissé, Benny Pinkas, and Joseph Keshet. Turning your weakness into a strength: Watermarking deep neural networks by backdooring. In USENIX Security Symposium, 2018
[7] Giuseppe Ateniese, Luigi V. Mancini, Angelo Spognardi, Antonio Villani, Domenico Vitali, and Giovanni Felici. Hacking smart machines with smarter ones: How to extract meaningful data from machine learning classifiers. Int. J. Secur. Networks, 10:137-150, 2015.
[8] Yoshua Bengio, Yann LeCun, and Geoffrey Hinton, Deep learning for ai. Communications of the ACM, 64:58 65, 2021.
[9] Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, and Dawn Xiaodong Song. The secret sharer: Evaluating and testing unintended memorization in neural networks. In USENIX Security Symposium, 2019.
[10] Nicholas Carlini, Florian Tramèr, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss Kather- ine Lee, Adam Roberts, Tom B. Brown, Dawn Xiaodong Song, Úlfar Erlingsson, Alina Oprea, and Colin Raffel. Extracting training data from large language models. In USENIX Security Symposium, 2021.
[11] Abbas Cheddad, Joan Condell, Kevin Curran, and Paul Me Kevitt. Digital image steganography: Survey and analysis of current methods. Signal Process., 90:727-752, 2010.
[12] Huili Chen, Bita Darvish Rouhani, Cheng Fu, Jishen Zhao, and Farinaz Koushanfar. Deepmarks: secure fingerprinting framework for digital rights management of deep learning models. Proceedings of the 2019 on International Conference Multimedia Retrieval, 2019.
10

---

[13] Mia Xu Chen, Benjamin N Lee. Gagan Bansal, Yuan Cao. Shuyuan Zhang, Justin Y. Lu, Jackie Tsay, Yinan Wang, Andrew M. Dai, Z. Chen, Timothy Sohn, and Yonghui Wu. Gmail smart compose: Real-time assisted writing, Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, 2019.
[14] Fatiha Djebbar and Beghdad Ayad. Comparative study digital audio steganography techniques. EURASIP Journal on Audio, Speech, and Music Processing, 2012:1-16, 2012.
[15] Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confidence information and basic countermeasures. In CCS, 2015.
[16] Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller. Inverting gradients how easy is it to break privacy in federated learning? In NeurIPS, 2020.
[17] Ian J. Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley Sherjil Ozair, Aaron C. Courville, and Yoshua Bengio. Generative adversarial nets. In NIPS, 2014.
[18] Song Han, Jeff Pool, et al. Learning both weights and connections for efficient neural network. ArXiv, 2015.
[19] Kaiming He, X. Zhang, Shaoging Ren, and Jian Sun. Deep residual learning for image recognition. 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 770-778, 2016.
[20] Benoit Jacob, Kligys, Bo Chen, Menglong Zhu, Matthew Tang, Andrew G. Howard, Hartwig Adam, and D. Kalenichenko. Quantization and training of neural networks for efficient integer- arithmetic-only inference. 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 2713,, 2018.
[21] Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization. CoRR, abs/1412.6980, 2015.
[22] Varsha Kishore, Xiangyu Chen, Yan Wang, Boyi Li, and Kilian Q Weinberger. Fixed neural network steganography: Train the images, not the network. In International Conference on Learning Representations, 2021.
[23] Raghuraman Krishnamoorthi. Quantizing deep convolutional networks for efficient inference:
A whitepaper. ArXiv, abs/1806.00 800.08342. 2018
[24] Alex Krizhevsky. Learning multiple layers of features from tiny images. 2009.
[25] Hao Li, Asim Kadav, et al. Pruning filters for efficient convnets. ArXiv, 2017.
[26] Tao Liu, Zihao Liu, Qi Liu, Wujie Wen, Wenyao Xu, and Ming Li. Stegonet: Turn deep neural network into a stegomalware. Annual Computer Security Applications Conference, 2020.
[27] Makoto Matsumoto and Takuji Nishimura. Mersenne twister: a 623-dimensionally equidis- tributed uniform pseudo-random number generator. ACM Trans. Model. Comput. Simul., 8:3-30, 1998.
[28) Luca Melis, Congzheng Song, Emiliano De Cristofaro, and Vitaly Shmatikov. Exploiting unintended feature leakage collaborative learning. 2019 IEEE Symposium on Security and Privacy (SP), pages 691-706 2019.
[29] Hongwei Ng and Stefan Winkler. A data-driven approach to cleaning large face datasets. 2014 IEEE International Conference on Image Processing (ICIP), pages 343-347, 2014.
[30] Xudong Pan, Mi Zhang, Shouling Ji, and Min Yang. Privacy risks of general-purpon language models. 2020 IEEE Symposium on Security and Privacy (SP), pages 1314-1331, 2020.
[31] Xudong Pan, Mi Zhang, Yifan Yan, Jiaming Zhu, and Min Yang. Exploring the security boundary of data reconstruction via neuron exclusivity analysis. In USENIX Security Symposium, 2022.
[32] Niels Provos and Peter Honeyman. Hide and seek: An introduction to steganography. IFEE Secur. Priv., 1:32-44, 2003,
11

---

[33] Alec Radford, Luke Metz, and Soumith Chintala. Unsupervised representation learning with deep convolutional generative adversarial networks. CoRR, abs/1511.06434 2016.
[34] Alec Radford, Jeff Wu, Rewon Child, David Luan, Dario Amodei, and Ilya Sutskever. Language models unsupervised multitask learners. 2019.
[35]
Adityanarayanan Radhakrishnan, Mikhail Belkin, and Caroline Uhler. Overparameterized neural networks implement associative memory. Proceedings of the National Academy of Sciences of the United States of America, 117:27162 27170, 2020.
[36] A. Salem, Apratim Bhattacharyya, Michael Backes, Mario Fritz, and Yang Zhang. Updates-leak: Data set inference and reconstruction attacks in online learning. USENIX Security, 2020.
[37] Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. Security & Privacy, pages 3-18, 2017.
[38] Congzheng Song, Thomas Ristenpart, and Vitaly Shmatikov. Machine learning models that remember too much. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, 2017.
[39] Florian Tramèr, Fan Zhang, Ari Juels, Michael K. Reiter, and Thomas Ristenpart. Stealing machine learning models via prediction apis. In USENIX Security Symposium, 2016.
[40] Yusuke Uchida, Yuki Nagai, Shigeyuki Sakazawa, and Shin ichi Satoh. Embedding watermarks into deep neural networks. Proceedings of the 2017 ACM on International Conference on Multimedia Retrieval, 2017.
[41] John von Neumann. Probabilistic logic and the synthesis of reliable organisms from unreliable components. Automata studies, 34:43 98, 1956.
[42] Tianhao Wang and Florian Kerschbaum. Riga: Covert and robust white-box watermarking of deep neural networks. Proceedings of the Web Conference 2021, 2021.
[43] Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. Image quality assessment: from error visibility to structural similarity. IEEE transactions on image processing, 13(4):600- 612, 2004.
[44] Warden. Speech Commands: A Dataset for Limited-Vocabulle Speech Recognition. ArXiv e-prints, April 2018.
[45] Donald L. Wenskay. Intellectual property protection for neural networks. Neural Networks, 1990.
[46] Xiaojun Xu, Qi Wang, Huichen Li, Nikita Borisov, Carl A. Gunter, and Bo Li. Detecting ai trojans using meta neural analysis. 202/ IEEE Symposium on Security and Privacy (SP), pages 103-120, 2021.
[47] Zhongliang Yang. Xiaoqing Guo, Zi-Ming Chen, Yongfeng Huang, and Yu-Jin Zhang. Rnn- stega: Linguistic steganography based on recurrent neural networks. IEEE Transactions on Information Forensics and Security, 14:1280-1295, 2019.
[48] Chaoning Zhang, Philipp Benz, Adil Karjauv, Geng Sun, and In-So Kweon. Udh: Universal deep hiding for steganography, watermarking, and light field messaging. In NewrlPS, 2020.
[49] Kevin Alex Zhang, Alfredo Cuesta-Infante Lei Xu, and Kalyan Veeramachaneni. Steganogan: High capacity image steganography with gans. ArXiv, 0ts/1901.0389) 2019.
[50] Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. In NewrIPS, 2019.
12

---

Checklist
1. For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper's
contributions and scope? [Yes]
(b) Did you describe the limitations of your work? [Yes] See Section 5
(c) Did you discuss any potential negative societal impacts of your work? [N/A]
(d) Have you read the ethics review guidelines and ensured that your paper conforms them?
[Yes]
you are including theoretical results...
(a) Did you state the full of assumptions of all theoretical results? [N/A]
(b) Did you include complete proofs of all theoretical results? [N/A]
3. If you experiments..
(a) Did you include the code, data, and instructions needed to reproduce the main experimental results (either in the supplemental material or as a URL)? [Yes] In a URL
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)? [Yes] More details provided in the supplemental material and the codebase.
(c) Did you report error bars (e.g., with respect to the random seed after running experiments multiple times)? [N/A]
(d) Did you include the total amount of compute and the type of resources used (c.g.. type of GPUs, internal cluster, or cloud provider)? [Yes] See the supplemental material.
you are using existing assets (e.g., code, data, models) or curating/releasing new assets...
(a) If your work existing assets, did you cite the creators? [Yes]
(b) Did you mention the license of the assets? [Yes]
(c) Did you include any new assets either the supplemental material or as a URL? [N/A]
(d) Did you discuss whether and how consent was obtained from people whose data you'l 're using/curating? [N/A]
(e) Did you discuss whether the data you are using/curating contains personally identifiable information or offensive content? [N/A]
you used crowdsourcing or conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, if applica-
ble? [N/A]
(b) Did you describe any potential participant risks, with links Institutional Review Board (IRB) approvals, if applicable? [N/A]
(c) Did you include the estimated hourly wage paid to participants and the total amount spent on participant compensation? [N/A]
13


Reviews:
[{"review_id": "eas_tQVjUQi", "reviewer": "Reviewer_Lxtr", "summary": "This paper presents a method called Cans for encoding secret datasets into deep neural networks (DNNs) and transmitting them in a openly shared “carrier” DNN. In contrast to existing steganography methods encoding information into least significant bits, the authors encode the secret dataset into a trained publicly shared DNN model such that the public model will predict weights for secret key inputs (known to covert operatives), the weights are used to populate a secret DNN model and the secret DNN model predicts secret dataset for noisy inputs (known to covert operatives). The main advantage of the Cans encoding is that it can covertly transmit over 10000 real-world data samples within a carrier model which has 100× less parameters than the total size of the stolen data, and simultaneously transmit multiple heterogeneous datasets within a single carrier model, under a trivial distortion rate (< 10−5) and with almost no utility loss on the carrier model (< 1%). ", "questions": "•\tPlease, fix the typos including the title (Stegnography), “Under the umberalla of DLPS,”\n•\tHow is encoding a secret dataset into a neural network model different from injecting a trojan into a neural network model, for instance, in the TrojAI program – see https://pages.nist.gov/trojai/docs/about.html?\n•\tWhy is the method denoted as “capacity-aware” as opposed to “capacity-limited”? The encoding of secret dataset is either successful or not, but it is not probing the carrier model for its capacity, correct?\n•\tWhat is the weight pool restoration algorithm?\no\t“We initialize the weight pool with a customized size 5× smaller than the carrier model, which allows us to implement a weight pool restoration algorithm to recover the pruned parameter by selecting the non-zero value from each weight pool copy, i.e., the fusion mechanism. “\n", "limitations": "•\tHow is the information redundancy built into the Fill, Propagate, Decode algorithms? \no\tIn reference to the sentence “ Finally, by comparing the performance of the secret model with or without fusion, we conclude that the robustness of Cans largely comes from the information redundancy implemented in our design of the weight pool” \n", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 4, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strength: \n•\tThe authors nicely combine cryptographic application and DNN modeling.  The idea of hiding the secret dataset in a shared model parameters is very interesting.\n•\tThe authors also nicely presented their experimental work with accuracy and robustness evaluations. \n\nWeaknesses: \n•\tThe paper is missing an integration of the main algorithmic steps (Fill, Propagate, Decode) with the overarching flow diagram in Fig 1 which creates a gap in the presentation.\n\n•\tThe abstract and main text make inconsistent claims about the transmission capacity:\no\tAbstract: “.. covertly transmit over 10000 real-world data samples within a carrier model which has 220× less parameters than the total size of the stolen data,”\no\tIntroduction: “… covertly transmit over 10000  real-world data samples within a carrier model which has 100× less parameters than the total size of the stolen data (§4.1),”\n\n•\tDefinitions of metrics and illustrations of qualitative results are insufficiently described and included. \no\tFor example, the equation for a earning objective in section 3.3 should be clearly described.  \no\tPage 7: define performance difference and hiding capacity in equations. \no\tFig 3 is too small for the information to be conveyed (At the 200% digital magnification of Fig 3, I can see some differences in image qualities). \n \n•\tThe choices and constructions of a secret key and noisy vectors are insufficiently described i.e., Are the secret keys similar to the public-private keys used in the current cryptography applications? What are the requirements on creating the noisy vectors? \n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "D2z4ZMMSjCW", "reviewer": "Reviewer_5E9b", "summary": "This paper presents a new steganography model to recover the images from noise messages. It has two key contributions. First, it proposes a weight pool such that the model is assembled from the weights in this pool with the secret key v. People are hard to get the correct model with the key. Second, they design a trainable pipeline to co-train the generated model and classification model with the weight pool. The authors evaluate the model on three different datasets with SSIM, MSE, and Performance Difference metrics. ", "questions": "1. How many secret keys did the authors use when training the model? I think if we use too few secret keys, the stealer might be easy to recover the model by credential stuffing.\n2. How long will it take to train the model? Does training with the weight pool make the training process very slow?\n", "limitations": "This paper proposes an image steganography method. One possible negative societal impact is people might use it to steal secret information.", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths \n1. The key idea sounds novel to me. The generation model is assembled from a weight pool by using the private key. Therefore, if stealers do not know the key, it is hard for them to get the correct generation model.\n2. The authors proposed a novel training pipeline to train the generation model with the weight pool. \n3. The results look promising.\n4. The authors provide the details to implement and train the model in the supplementary. \n\nWeakness:\n1. There is no related work section. Please include related image steganography models and generative models in the related work.\n2. I have a concern that this paper does not include any baselines. It is hard for me to get a sense of how good the proposed model is. [1] [2] use a similar metric to evaluate the steganography performance. Please consider comparing the model with them.\n3. The algorithms in the supplement are a little hard to understand. Please consider adding some explanation. It is the key concept of the paper. Please also consider moving them to the main paper.\n\n[1] Zhang, Kevin Alex, et al. \"SteganoGAN: High capacity image steganography with GANs.\" arXiv preprint arXiv:1901.03892 (2019).\n[2] Kishore, Varsha, et al. \"Fixed Neural Network Steganography: Train the images, not the network.\" International Conference on Learning Representations. 2021.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ["Privacy and Security (e.g., consent)"]}, "extra_text": {}}, {"review_id": "0jFiDYh8jwN", "reviewer": "Reviewer_kzME", "summary": "This paper studies how to use models to hide data.", "questions": "Since I am not very familiar with this topic, I am willing to adjust my score based on the questions from other reviewers and rebuttal from the authors.", "limitations": "N.A.", "rating": 5, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengthes: I checked the performance, which seems to be very impressive and is the main reason I argue for acceptance. The paper is also well written and organized. Reasoanble analysis is provided to justify the reported results. I do not see a clear weakness of this paper. Some papers might be worth a citation, such as UDH: universal deep hiding from NeurIPS2020. To my knowledge, it is not a common practice to publish this topic at NeurIPS. Maybe it is worth a discussion.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ["I don’t know"]}, "extra_text": {}}]

Author rebuttal:

Decision: Accept