Hiding Images in Deep Probabilistic Models
Authors: Haoyu Chen
Linqi Song
Zhenxing Qian
Xinpeng Zhang
Kede Ma
Venue: NeurIPS 2022 Accept (2022)

Abstract: Data hiding with deep neural networks (DNNs) has experienced impressive successes in recent years. A prevailing scheme is to train an autoencoder, consisting of an encoding network to embed (or transform) secret messages in (or into) a carrier, and a decoding network to extract the hidden messages. This scheme may suffer from several limitations regarding practicability, security, and embedding capacity. In this work, we describe a different computational framework to hide images in deep probabilistic models. Specifically, we use a DNN to model the probability density of cover images, and hide a secret image in one particular location of the learned distribution. As an instantiation, we adopt a SinGAN, a pyramid of generative adversarial networks (GANs), to learn the patch distribution of one cover image. We hide the secret image by fitting a deterministic mapping from a fixed set of noise maps (generated by an embedding key) to the secret image during patch distribution learning. The stego SinGAN, behaving as the original SinGAN, is publicly communicated; only the receiver with the embedding key is able to extract the secret image. We demonstrate the feasibility of our SinGAN approach in terms of extraction accuracy and model security. Moreover, we show the flexibility of the proposed method in terms of hiding multiple images for different receivers and obfuscating the secret image. 

Hiding Images in Deep Probabilistic Models
Haoyu Chen
Lingi Song
Department Computer Science City University of Hong Kong hany cityu. edu edu edu.hhi .k
Department of Computer Science City University of Hong Kong linqi song@eityu edu hk
Zhenxing Qian
Xinpeng Zhang
School of Computer Science
School of Computer Science
Fudan University zxqian@fudan, edu. cn
Fudan University
zhaugzinpeng@@uudn..ee
Kede Ma*
Department of Computer Science City University of Hong Kong kede. ma@mi edu hk
Abstract
Data hiding with deep neural networks (DNNs) has experienced impressive suc- cesses in recent years. A prevailing scheme train autoencoder, consisting of an encoding network to embed (or transform) secret messages in (or into) a carrier, and decoding network extract the hidden messages. This scheme may suffer from several limitations regarding practicability, security, and embedding capacity. In this work, we describe different computational framework hide images in deep probabilistic models. Specifically, we use DNN to model the probability density of cover images, and hide secret image one particular location of the learned distribution. As an instantiation, we adopt a SinGAN, pyramid of generative adversarial networks (GANs), learn the patch distribution of one cover image. We hide the secret image by fitting deterministic mapping from a fixed set of noise maps (generated by an embedding key) the secret image during patch distribution learning. The stego SinGAN, behaving as the original SinGAN, is publicly communicated; only the receiver with the embedding key is able extract the secret image. We demonstrate the feasibility of our SinGAN approach in terms extraction accuracy and model security. Moreover, we show the flexibility the proposed method in terms of hiding multiple images for different receivers and obfuscating the secret image.
1 Introduction
Data hiding generally refers to the process of hiding a form secret message another form of cover media, while minimizing the introduced distortions to the cover media [14, 47]. For human eavesdroppers, the measured distortion should be consistent with human judgments, penalizing errors that are most perceptually cognitively noticeable [55, 5]; for machine cavesdroppers, the distortion should be "invisible" in a way that bypasses digital steganalysis tools such as StegExpose [9] and more recent deep learning-based ones [10]. Only the informed receiver typically with shared embedding key (through a secure subliminal channel [50]) is able to extract the secret message. The
*Corresponding author.
36th Conference on Neural Information Processing Systems (NcurIPS 2022).

---

form of the secret message can be encrypted bit streams [15]. texts [30], audio signals [37], images [6]. and videos[52]. Similarly, the cover media can also be texts [8], audio signals [31], images [6], videos [52], neural networks [5, 56], and even human behaviours[66].
Like many problems in signal and image processing, data hiding has been revolutionized by the remarkable development of DNNs [6, 67, 28]. These methods typically follow an autoencoder approach with two key components: an encoding network and a decoding network. For secret-in- image hiding [6, 67]. the encoding network takes the cover image and the secret message as inputs, and generates a stego image with the hidden message (see Fig. (a)). For secret-in- in-network hiding [5, 56], the cover media becomes some pre-selected weight layers of the encoding network, and the secret message usually serves as watermark (see Fig. (b)). For constructive (or generative) image hiding [28], the encoding network directly maps the secret message to the stego image without reliance on any cover image (see Fig. (c)). In all cases, the decoding network is responsible for extracting the secret message. Despite demonstrated success, the autoencoder scheme may suffer from three main drawbacks. First, the decoding network, whose size may be significantly larger than that of the secret message, must be sent to the receiver side via the subliminal channel", making the paradigm less practical. Second, it is not hard to re-train existing DNN- steganalysis methods [10, 57] to identify stego images (or stego weight matrices), making the paradigm less secure. Third, it is difficult to hide multiple images for different receivers via the same encoding and decoding networks, making the paradigm less flexible.
Our Contributions. In this paper, we propose to hide images in deep probabilistic models, which is substantially different from the previous autoencoder scheme (see Fig. 1 (d)). The key idea is to use DNN to model the high-dimensiona. probability density of training cover images, and hide the secret image in one particular location of the learned distribution. The stego DNN for density estimation is
publicly communicated, from which we may draw samples that look like training cover images. Only guided sampling by the embedding key (shared between the sender and receiver) is able to reproduce the secret image.
We construct a specific example under the proposed probabilistic image hiding framework. Specif- ically, we adopt SinGAN [49], a pyramid of generative adversarial networks (GANs) [21], to implicitly learn the patch distribution of a single cover image. During distribution learning, we use the same SinGAN to fit a deterministic mapping from a fixed set of noise maps (generated by the shared embedding key) to the secret image, which completes the image hiding process. The stego SinGAN that behaves like the original one is publicly communicated. A single forward propagation suffices to extract the secret image by the receiver with the embedding key, and no decoding network is trained and transmitted. Experiments demonstrate that the proposed method is 1) feasible, extracting the secret image with improved accuracy (compared to the autoencoder-basse methods), 2) secure, behaving normally as the original SinGAN in several aspects, and 3) flexible, hiding multiple images for different receivers and obfuscating the secret image with graceful performance degradation.
2 Related Work
Depending on the applications, data hiding can be broadly divided into two subtopics: watermarking and steganography. Watermarking [24] aims to embed a digital watermark multimedia file for copyright protection and content management on social networks. Thus, watermarking techniques focus primarily on the robustness and perceptibility aspects of the embedded watermarks. Steganogra- phy [33, 47] aims to conceal a secret message within cover media mainly for covert communication. Thus, steganography pays more attention to the trade-off among embedding capacity, extraction accuracy, and model security. Here we provide a concise review of image hiding techniques, and refer the interested readers to [47, 14, 63] for more comprehensive surveys of the field.
Secret-in-Image Hiding. The most common image steganography modifies the least significant bits (LSBs) of images, either uniformly [13, 42] or adaptively [46, 25], guided by the design of novel distortion functions. Other representative techniques include pixel value differencing [60], histogram shifting [45, 64), and recursive code construction [65]. Transform domain steganography [48, 27, 7)) have also been proposed with improved capacity and security. Often, these methods leave traces in the form of certain statistical irregularities, which can be easily revealed by simple
"The decoding network. if shared via public channel, will be suspectable, as it is only trained to extract the secret message rather than performing typical machine learning tasks.

---

Cover Image
Encoding
Decoding Network
Network
Stegoo Image
Secret Viessage
Preparation
Message
Network
(a) Secret-in-image hiding. The preparation network is optional.
Encoding
Decoding Network
Secret Message
Network
Selected Weights
Secret Message
(b) Becret-in-netwong hiding. The secret message is usually in form a watermark.
Encoding Network
Decoding Network
Secret Message
Stego Image
Secret Message
(c) Constructive (or generative) image hiding.
Guided
Socret Image
Sampling
Secret Imagee
Density Estimation Network
Regular Sampling
Training Cover Images
Generated Cover Images
(d) Proposed framework for hiding images in deep probabilistic models.
Figure 1: Paradigms for hiding data using DNNs.
steganalysis algorithms as countermeasures [19, 41, 26]. Zhu et al. [67] proposed one of the first DNN-based autoencoder for unified watermarking and steganography with an optional noise layer. steganography with a preparation network to preprocess the secret image. Weng ef al. [59] further extended "video-in-video" steganography residual modeling. Normalizing flow- bow-based invertible architectures [18] have also been investigated for multiple image hiding [40, 32, 22]. Here, we deseribe different framework to accomplish similar but more challenging goal multiple image hiding for different users with several other advantages.
Baluja [6] extended it to timage-in-imase
temporal
Secret-in-Network Hiding. A prerequisite for secret-in-network hiding is that the hidden message should affect the network performance on the given machine learning task. As result, the message (mostly the watermark for intellectual property protection of the neural network) is com- monly embedded during network training. Typical strategies for this purpose include parameter regularization [53], backdooring [5], output watermarking [61], and weight selection [56]. The proposed framework can be seen as a form of secret-in-netweer network hiding, but with different goals (steganography instead of watermarking).
Constructive (Generative) Image Hiding. Traditional methods hide secret messages during the construction of some specific types of images, such as textures [62] and fingerprints [36]. Recent DNN-based constructive image hiding methods mainly aim construct the mapping between secret messages and stego images of more unconstrained content types [38, 58]. The proposed framework can be seen as form of constructive image hiding. where we hide secret image during the "construction" of probability density function, but with larger embedding capacity and improved model security.
3 Hiding Images in Deep Probabilistic Models
General Framework. Without loss of generality, we describe the general framework hiding a single image in deep probabilistic models. The straightforward extension multiple image hiding
is described in Sec. 4.3. We assume cover image dataset D (1(1), (()) ..... x (MM) where

---

Randomly Sampled Noise
Generated Cover Imaage
SinGAN
Embedding Key
Noise Generator
Fixed Noise
SinGAN
Secret Image
Figure 2: Hiding images in a SinGAN.
each image is drawn independently from an underlying image distribution p(æ). D may include a single image (where (+)) becomes the i-th image patch), images of specific class (e.g., textures, fingerprints, and faces), and images on the natural image manifold. Also given is a secret image ((*) of arbitrary content and embedding key &t shared by the sender and the receiver, which is typical setting in the prisoner's 's problem formulated by Simmons [50].
The proposed probabilistic image hiding framework consists of two main steps. First, we learn probability density function (x) over D, 'D (U( i.e., the combination of the cover image dataset and the secret image either explicitly via (approximate) maximum likelihood [35, 18, 51, 34] or implicitly via likelihood- free inference (e.g., density estimation by comparison) [43]. The learned the proposed framework, which is usually in the form of DNN (as the scoring function [20] or the sample generating function [43]). We may as well learn a reference probability density function (x(x)) on the cover image dataset D solely. To guarantee the security of our framework, (x(x) should be close to Pe(x) possible in some statistical distance (i.e., distribution -erruuuiioo-reevvinngnnn [12]). Provided that the adopted probability density estimator is robust (to the outlier image x (*))), which assigns an infinitesimal probability mass to (*)), the proposed framework is perfectly secure in any statistical distance sense. Second. we design guided sampling procedure (with the help of the embedding key k) to draw sample image (+() from Ps (x:) that looks identical to the secret image (=)), A third party without the embedding key is only able to generate samples that resemble cover images. It is noteworthy that the proposed framework does not require the learned (x) (or equivalently (x))) to be sufficiently close to the underlying p(æ), a daunting (if not impossible) task to complete as digital images reside in a very high-dimensional space. In other words, it is perfectly fine that the samples drawn from ps (ar) (without guidance) contain visually noticeable distortions as long as such distortions are shared by the samples drawn from (z()))
probability model p. (ax) is publicly communicated
Specific Example. Within the general framework of probabilistic image hiding, we provide a specific example that relies on GANs [21], family of implicit probability models, which are represented by a stochastic procedure of data sampling. Although more natural to work with in our context compared to prescribed probabilistic models [16], unconditional GANs have the notorious reputation of being difficult to train, especially when modeling image sets with diverse content complexities and rich semantics. Thus, make our work easily reproducible, we opt for a SinGAN [49] to learn the internal patch distribution of a single cover image (c) at various scales.
A SinGAN consists of a pyramid of generators (Gu. G....,
......GG GN }. where G,, takes the upsampled version of the generated image by G,+1 1 as well as an additive white Gaussian noise map 2,, of the same size as inputs, and produces an image sample at the n-th scale:
G. (Zn: (0=/-1) 1r).
N,
where r is the pre-defined upsampling ratio. The generation process starts at the coarsest scale (i.e., the --th scale), where the input is purely noise:
G. (zN).
(2)
and progressively makes use of all generators to produce the finest scale image a! with possibly
different size and aspect ratio of x
(c) [49]. Coupled with the generators is a pyramid of discriminators Doo }. and each D, is trained to discriminate between patches extracted from a(f (in
Eq. (1)) and (0) which a downsampled version of az(c) by a factor of 7 (i.e, downsampled n.
times by a factor of r).

---

where À is the trade-off parameter. The adversarial loss ladv is for penalizing the statistical difference between the patch distribution of the generated (:()) and that of the (downsampled) cover image (c) The reconstruction loss free is for stabilizing the training process by ensuring that x can be Table 2: Cover image quality. diver-
Table Extraction accuracy comparison when hiding one image. "1": larger is better, and vice versa.
sity, and weight distribution similarity between the original and stego SinGANs in terms of SIFID, DS, and KLD.
Method
#params
PSNR
SSIM
DISTS!
LSB
23.06
0.785
0,095
#images
SIFID
DSt
KLD
Baluja17
0.48M
25.91
0.874
0.102
HiDDeN
0.38M
27.99
0.897
0.096
0 (ref)
0.041
0.407
0
Weng19
42.6M
35.64
0,942
0.055
0.046
0.430
0.001
HiNet
4.05M
35.59
0.952
0.047
2
0.045
0.415
0.004
0.047
0.427
0.006
Ours
0.67M
36.84
0.958
0.038
4
0.051
0.438
0.008
The training objective for each scale is weighted combination of an adversarial term and a recon- struction term:
min max Ladv (G., Dnixlo)))))) Xerec (Gus 2()))
(3)
G. Dn
reconstructed from a specific set of input noise maps. Following the original SinGAN paper [49], we use the WGAN-GP loss [23] and the mean squared error (MSE) to implement fadv and frees respectively.
After training, the SinGAN is capable of generating new image samples that preserve the patch distribution of (()), with novel and plausible scene configurations and structures. Once the learning procedure of the SinGAN is clear, hiding the secret image (=))) during the patch distribution learning can be straightforwardly done by modifying the training objective from Eq. (3) to
min max ladv (Gn: Dn; (Gn 2(() Gn Dn
Xbrec (Gn::z((*)
(4)
That is, a reconstruction loss is replaced to enforce that specific set of input noise maps 2(4) (z(²) 2(1))
(s) is mapped the secret image (*) instead of the cover image (*) x can be generated by a standard Gaussian pseudo-random number generator [11] using the embedding key k as the seed. We may as well put back the reconstruction term for (c)), but we find this makes little difference during training and testing. We conjecture that the reconstruction loss in Eq. (4) not only enables hiding of the secret image, but also plays similar role in improving the training stability and convergence. For ease of description, we refer models optimized for Eq. (3) and Eq. (4) as the original and stego SinGANs, respectively.
To extract the secret image (*)), the receiver uses the shared embedding key to re-generate the noise maps z(*), which fed the publicly transmitted stego SinGAN for secret image extraction via a single forward propagation (see Fig. 2).
4 Experiments
In this section, we perform a series of experiments verify the promise of our SinGAN approach. First, we evaluate secret image extraction accuracy both quantitatively and qualitatively in comparison image-in-image hiding methods based on autoencoders. Second, we probe the security of the stego SinGAN by comparing it to the original one in terms of 1) quality and diversity of generated cover images, 2) marginal distribution similarity of model parameters [56], and 3) possibility of secret image leakage. Third, we experiment with our method in two more challenging scenarios: 1) hiding multiple images within a SinGAN for different users and 2) hiding the confent-obfuscated image. We implement the generators and discriminators of the SinGAN by medium-size DNNs, whose specifications and training details are given the Appendix. Our quantitative experiments make use of 200 test image pairs, whose details are also given in the Appendix.
5

---

(a) Cover (e)
(b) Secret (*) (c) Generated ((c) (d) Extracted (()) (c) 5
(x(*) {(0)
Figure 3: Visual results of our SinGAN approach. The second image of the last row is pixel-shuffled version of the second image the first row. Zoom in for improved visibility.
4.1 Extraction Accuracy
In image data hiding, extraction accuracy means how the secret image can be faithfully reproduced at the receiver side. Here, apply three objective image quality measures to quantitatively evaluate the signal fidelity, perceptual fidelity, and perceptual quality of the extracted secret image: the peak signal-to-noise ratio (PSNR), the structural similarity (SSIM) index [55], and the deep image structure and texture similarity (DISTS) measure [17]. Although our SinGAN approach the first of its kind in the proposed probabilistic image hiding framework, compare it with naïve LSB replacement method, and four image-in-iman
steganography methods- Baluja17 [6], HiDDeN [67]. Weng 19 [59] and (32) The LSB replacement method simply replaces the four LSB planes of the cover image with the four most significant bit (MSB) planes of the secret image. As the robustness is not our focus, re-train HiDDeN [67] for image hiding without the noise layer. Weng19 [59] is a DNN-based video steganography method, and only the image hiding branch is used for testing. HiNet [32] relies on a normalizing flow-based invertible DNN implement the encoder, such that the decoder is simply its inverse. We use the publicly available implementations for Balujal7 [1], HiDD:N[2], Weng19[3] and HiNet[4] with default training and testing' settings, and implement the LSB replacement by ourselves.
The extraction accuracy results are shown in Table where find that the proposed SinGAN approach performs favorably against existing autoencoder- baseed image-in-image steganography methods. We consider the obtained improvements significant because secret-in-networ. hiding is generally considered much more difficult than secret-in-image hiding, where the latter has significant spatial redundancy to be reduced. After all, the most recent secret-in-networkk hiding method [56] has a limited embedding capacity up to 6, 000 bits. We also show some representative visual results of our method in Fig. 3. It is clear that the stego SinGAN is able capture the internal patch distribution of the cover image, generating image samples with different but reasonable structures and configurations
IIt is important to note that the results of autoencoder-based methods in our paper (especially in terms of extraction accuracy Table 1) may be noticeably different from of the previous publications. This because we choose to quantize the stego image from the 8 x bits per pixel before transmitting it to the receiver side. If such quantization is not properly enforced, trivial hiding solutions may exist because there are just more space to accommodate the cover and secret images by simple concatenation.
seating--pin format of x to

---

(h) Original
(a) Cover Image
(c) Stego
Figure 4: Visual comparison of the generated cover images "Fire balloons" by the original and stego SinGANs. In our case, the secret the "Birds" image, as shown in the second row of Fig. 3.
of the same natural scene. Moreover, the extracted secret image by guided sampling is visually close to the original, which is adequate for use in the majority of real-world steganography applications.
4.2 Model Security
Steganographic analysis (i.e., steganalysis) aims to identify whether there are hidden messages in suspected media, which constitutes an indispensable part of steganography evaluation. Traditional statistics-bart based and recent DNN-based steganalysis methods [9, 10] are mostly designed to discrimi- nate between cover and stego images, thus not applicable when the cover media is a DNN. To the best of our knowledge, we are not aware of steganalysis algorithm that accepts full DNN (with millions of parameters) as input. Instead, we propose probe the security of our SinGAN approach from the following three different aspects.
Quality and Diversity of Generated Cover Images. In the proposed framework, the stego SinGAN is publicly transmitted, and thus it must function as the original SinGAN [49]. As the primary goal of SinGANs to model internal patch distributions, we examine and compare the quality and diversity of generated cover images by the original and stego SinGANs. To quantify quality, we adopt the single image Fréchet inception distance (SIFID) metric, as suggested in [49]. To quantify diversity, for each cover image, we compute the diversity score (DS) as the standard deviation (std) of each pixel values over 25 generated samples of the cover content, averaged over all pixels and normalized by the std of pixel intensities of the cover image [49]. The average quality and diversity results over 200 test image pairs are shown in Table 2, where we find that both SIFID and DS of the stego SinGAN are statistically indistinguishable from those of the original SinGAN based on hypothesis testing using /-statisties [44]. Fig. shows some randomly sampled examples from the original and stego SinGANs. which provides additional visual evidence that they learn very similar internal patch distributions of the cover image.
Marginal Distribution Similarity of Model Weights. As the proposed method essentially hides the secret image the learned weights of the stego SinGAN, is natural to ask whether its weight distributions significantly deviate from those of the original SinGAN. Following [56], we compute the Bullback-Leible divergence (KLD) between the marginal distributions of model parameters of the original and stego SinGANs, as shown in the last column of Table 2. We find that the marginal distributions of the two sets of model parameters are almost identical, as evidenced by a KLD close to zero. Similar results can be obtained if the marginal distributions are compared in per-stage fashion (see more results in the Appendix with visual comparison of histograms).
Possibility of Secret Image Leakage. One may also wonder the possibility of secret image leakage if an adversary constantly draws samples from the stego SinGAN. Such steganalysis arises naturally from the fact that there is no theoretical guarantee that the mapping between the secret noise (generated by the embedding key) and the secret image bijective (i.e., one-to-one). In other words, there might be some other sets of noise that are also mapped to the secret image, or at least some of its semantically meaningful content. Since the SinGAN is trained to be a black-bo sampler, it is difficult to provide a theoretical analysis of the possibility of secret image leakage. Nevertheless, we conduct an empirical study, which we randomly draw 100, 000 samples from each of the 200 trained stego SinGANs. Visual inspection of the thumbnails of generated samples indicates that secret image
7

---

Table Extraction accuracy of our method when hiding multiple images in one SinGAN.
Table 4: Extraction accuracy of our method with
image obfuscation.
#images
PSNR1
SSIM
DISTS
Obfuscation
PSNR
SSIM
DISTS
One
36.84
0,958
0.038
Two 35,91
0.946
0.043
No
36.84
0.958
0.038
Three 34.93
0.935
0,049
Yes
20.53
0.726
0.172
Four
34.03
0.923
0.055
(a) 1st Original
(b) Extracted
(c) Error (5x)
(d) 2nd Original
Extracted
Error (5x)
(g) Original
(h) Extracted
(i) Error (5x)
(j) 4th Original
(k) Extracted
(l) Error (5x)
Figure 5: Visual comparison between the original and extracted secret images from a SinGAN with four hidden images.
(or images with similar semantics) is revealed. Therefore, it safe to empirically conclude that the possibility of secret image leakage is less than 0.001 %.
In summary, we have empirically proven that the proposed SinGAN approach is secure: hiding full-size photographic image into SinGAN does not compromise the quality and diversity of generated cover images, nor skew the weight distribution. also survives constant sampling by an adversary. Such level of security verifies our claims that the secret image indeed occupies tiny portion of probability mass pa (x), and that (x(x) and pe(x) are statistically close.
4.3 Further Extensions
Hiding Multiple Images for Different Receivers. Hiding multiple images in a DNN is challenging: doing so for different receivers is even more challenging, and has not been accomplished before. Here the main difficulties lie not only in that more embedding capacity is required, but also that each receiver must only extract her/his piece of message, and cannot extract (or even affirm the existence of) other messages [56]. The proposed probabilistic image hiding framework provides straightforward and elegant extension to hide multiple images for different users, which follows similar two-step approach. First, learn probabilistic density function (x) over D = D (ar()))) ...., (x()))) where T the number secret images and is considerably smaller than M, the number of cover images. Second, design T guided sampling procedures using T different embedding keys K. (K(1),.. ..... (,))), shared to T different receivers. The learning goal remains the same: Pa (x) should be close in some statistical distance the reference distribution (x The described procedure is more easily understood using the SinGAN instantiation, where we just modify the objective function
((
Eq. (4) to
1 Σ froc (Gn; (((1)) min max Ladv (Gn, Dn; + X G, D.
(5)
t=1
After training, the 1-th receiver able to re-generate the f-th specific set noise maps (*x) using the shared embedding key k(() for the /-th secret image extraction. S/he is, by design, ignorant the presence (or absence) of other secret images. Even if the receiver is informed in some way that the current SinGAN contains multiple secret images, without extra embedding keys, s/he cannot extract images that are not intended to share with her/him.

---

We train SinGANs to hide up to four secret images, i.e., T (2,3.4). For each value of T, we train 200 SinGANs to hide different combinations of cover and secret images. The quality and diversity of the cover image, and the weight distribution similarity between the original and stego SinGANs are shown in Table 2, where we find that hiding multiple images does not seem to compromise the security of the proposed method. The extraction accuracy results and visual examples are shown in Table 3 and Fig. 5, respectively. With the number of increasing secret images, the extraction accuracy in terms of the three objective metries degrades gracefully. The visual appearances of the extracted secret images are similar to those of the original, showing great promise of our method in hiding multiple images for different receivers.
Obfuscating the Secret Image. Inspired by [6], we consider obfuscating the secret image by shuffling its pixels (i.e., image scrambling [54]), as a way of strengthening security. In this case, The shuffling key, together with the embedding key, is shared to the receiver. Table 4 shows the extraction accuracy results, where we see that pixel shuffing significantly increases the difficulty of image hiding. Nevertheless, from the last row of Fig. 3, we observe that the main content is clearly visible, despite somewhat noisy appearance.
5 Conclusion and Discussion
We have described a new computational framework for hiding images in deep probabilistic models, which is in stark contrast to previous steganography schemes. We provided an instantiation, where we used the SinGAN to build the internal patch distribution of the cover image, and hid the secret image during patch distribution learning. We conducted a series of experiments to demonstrate the feasibility of the proposed SinGAN approach in terms of extraction accuracy and model security. Moreover, our method is readily extended to hide multiple images for different receivers, a challenging task that has not been accomplished before. In addition, it works nicely with pixel shuffling, which adds additional security.
The current work opens the door to new class of image hiding methods, with many interesting problems to be explored. First, the extraction accuracy of our SinGAN approach still has quite some room for improvement. For applications that require precise recovery of the secret image, it is worth exploring more efficient network structures, optimized for perceptual losses that exploit the physiological properties of the human visual system. Second, our method naively bypasses the steganalysis tools specifically designed for secret-in-image steganography. Currently, we have designed three different tests to probe the model security. As SinGANS [49] can be applied in much wider range of image manipulation tasks such as super-resolutton and paint-to-image translation, the stego SinGAN should be tested in those applications as well for model security. More importantly, we expect future effort to be dedicated to building steganalysis methods that accept a full DNN as input and assess whether it contains secret messages. Third, so far, we have just given the theoretical intuition of the probabilistic image hiding framework, supplied with empirical evidence. It is of mathematical interest rigorously measure the statistical distance between Pa( and (z). in an attempt to answer important questions like 1) where the secret image is hidden in the network (or cquivalently the learned distribution) and 2) what the maximum number of secret images allowed for a given distance constraint (e.g., KLD(p.(2) || P. (x)) < e). Fourth, many other generative modeling methods [51] are worthy of deep investigation within the proposed framework to circumvent some of the limitations of the SinGAN approach. For example, we may model the (Stein) score function [39, 29] of (x) (i.e., the gradient of log (z)).. and develop guided Langevin-type sampling (by the embedding key) to extract the secret image.
Acknowledgments and Disclosure of Funding
The authors would like to thank Song Yang for inspiring discussion. This work was supported in part by the Hong Kong RGC ECS Grants 21213821 (to KDM) and 21212419 (to LQS). the National Natural Science Foundation of China under Grants 02071407, 61936214, U20B2051 and U1936214, the InnoHK initiative, the Govermment of the HKSAR, Laboratory for Al-Powered Financial Technologies, and the Tencent AI Lab thino-Bird Gift Fund.

---

References
[1] Deep steganography, 2017. [Source code]. Available: http://ggttt..cmmmmmmmmmmmmeeenr
[2] HiDDeN: Hiding data with deep networks, 2018. [Souree code]. Available: http:://github..om/jrrn//z/ hidden.
[3] Baanchh-Deee-Stegnogeeeeee 2019. [Source code]. Available: http:///iiabboooonnnuvviiggggggg
deep-steganograppy.
[4] HiNet: Deep image hiding by invertible network, 2021. [Source code]. tontontommi/liNet.
Available: https///github.com/
[5] Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning your weakness into a strength: Watermarking deep neural networks by backdooring. In USENIX Security Symposium, pages 1615 1631, 2018.
[6] Shumect Baluja. Hiding images in plain sight: Deep steganography. In Neural Information Processing Systems, 2017.
[7] Mauro Barni, Franco Bartolini, and Alessandro Piva. Improved wavelet-hased watermarking through pixel-wise masking. IEEF Transactions on Image Processing, 1065)783-791, 2001.
[8] Krista Bennett. Linguistic steganography: Survey, analysis, and robustness concerns for hiding information in text. CERIAS Tech Report, 2004.
[9] Benedikt Boehm. StegExpose-a tool for detecting LSB steganography. arXiv preprint arXiv:1410.6656 2014.
[10] Mehdi Boroumand, Mo Chen, and Jessica Fridrich. Deep residual network for steganalysis of digital images. IEEE Transactions on Information Forensics and Security, 14(5):1 181-1199,, 2018.
[11] Richard P Brent. Algorithm 488: A Gaussian pscudo-random number generator. Communications of the ACM, 17(12):7047766 1974.
[12] Christian Cachin. An inloormatiionthhoretfte model for stcganography. In International Workshop on Information Hiding, pages 306-318, 1998.
[13] Chi- Chi-Kwong Chan and Lee-Min Lee-Ming Cheng. Hiding data in images by simple LSB substitution. Pattern Recognition, 37(3):469 474, 2004.
[14] Abbas Cheddad, Joan Condell, Kevin Curran, and Paul Mc Kevitt. Digital image steganography: Survey and analysis of current methods. Signal Processing, 90(3):277-73 752227777,,.0 2010.
[15] Ingemar Cox, Matthew Miller, Jeffrey Bloom, Jessica Fridrich, and Ton Kalker. Digital Watermarking and Steganography. Morgan Kaufmann, 2007.
[16] Peter Diggle Richard J Gratton. Monte Carlo methods of inference for implicit statistical models. Journal of the Royal Statistical Society: Series B (Methodological), 46(2))992122 1984.
[17] Keyan Ding, Kede Ma, Shiqi Wang, and Eero Simoncelli. Image quality assessment: Unifying structure and texture similarity. IEEE Transactions on Pattern Analysis and Machine Intelligence, 445):2567-2581, 2022.
[18] Laurent Dinh, David Krueger, and Yoshua Bengio. NICE: Non-linear independent components estimation. arXiv preprint erXiv:/410.88 16, 2014.
[19] Jessica Fridrich, Miroslav Goljan, and Rui Du. Detecting LSB steganography color, and gcalescale images. IEEE Multimedia, 8(4):22-28, 2001.
[20] Tilmann Gneiting and Adrian Raftery. Strietly proper scoring rules, prediction, and estimation. Journal of the American Statistical Association, 102(477):359-37,, 2007.
[21] Ian Goodfellow, Jean Pouget-Abadic, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. Neurul Information Processing Syxtems, pages 2672-2680, 2014.
[22] Zhenyu Guan, Junpeng Jing, Xin Deng. Mai Xu, Lai Jiang, Zhou Zhang, and Yipeng Li. DeepMIH: Deep invertible network for multiple image hiding. IEEE Transactions on Pattern Analysis and Machine Intelligence, pages 1-1, 2022.
10

---

[23] Ishaan Guirajani, Faruk Ahmed, Martin Arjovsky, Vincent Dumoulin, and Aaron C Courville. Improved training of Wasserstein GANs. Neural Information Processing Systems, 30:5769-5779, 2017.
[24] Frank Hartung and Martin Kutter. Multimedia watermarking techniques. Proceedings of the IEEE, 87(7):1079 1077 1999.
[25] Vojtëch Holub and Jessica Fridrich. Designing steganographic distortion using directional filters. In IEEE International Workshop on Information Forensics and Security, pages 234-239, 2012.
[26] Vojtëch Holub and Jessica Fridrich. Random projections of residuals for digital image steganalysis. JEEE Transactions on Information Forensics and Security, 8(12):196- 2006, 2013.
[27] Chiou-Ting Hsu and Ja-Ling Wu. Hidden digital watermarks in images. IEEE Transactions on Image Processing, 8(1):58-66 68, 1999.
[28] Donghui Hu, Liang Wang. Wenjie Jiang, Shuli Zheng, and Bin Li. novel image steganography method via deep convolutional generative adversarial networks. IEEE Access, 6:38303-38314, 2018.
[29] Aapo Hyvärinen. Estimation of non-normalized statistical models by score matching. Journal of Machine Learning Research, 6(24);695-709, 2005.
[30] Firas Jassim. novel steganography algorithm for hiding text in image using five modulus method. arXiv preprint 107.02130 2013.
[31] P Jayaram, H R Ranganatha, and H S Anupama. Information hiding using audio steganography-a survey. The International Journal of Multimedia & Its Applicutions. 3:86-96, 06, 2011.
[32] Junpeng Jing, Xin Deng. Mai Xu, Jianyi Wang, and Zhenyu Guan. HiNet: Deep image hiding by invertible network. In IEEE/CVF International Conference on Computer Vision, pages 4733-4742, 2021.
[33] Neil F Johnson and Sushil Jajodia. Exploring steganography: Seeing the unseen. Computer, 31(2):26-34, 1998.
[34] Diederik P Kingma and Max Welling. Auto-encoding variational bayes. International Conference on Learning Representations, 2014.
[35] Hugo Larochelle and lain Murray. The neural autoregressive distribution estimator. In International Conference on Artificial Intelligence and Statistics, pages 29-37, 201 1.
[36] Sheng Li and Xinpeng Zhang. Toward construction based data hiding: From secrets to fingerprint images. IEEE Transactions on Image Processing, 28(3): 1497, 2019.
[37] Xin Li and Hong H Yu. Transparent and robust audio data hiding in cepstrum domain. In IEEE International Conference on Multimedia and Expo, pages 397-400, 2000.
[38] Ming-ming Liu, Min-qing Zhang, Jia Liu, Ying-nan Zhang, and Yan Ke. Coverless information hiding based on generative adversarial networks. arXiv preprint 17Xivv1712.06951, 2017.
[39] Qiang Liu, Jason Lee, and Michael Jordan. kernelized Stein discrepancy for goodness-of-ff tests. In International Conference on Machine Learning, pages 276-284, 2016.
[40] Shao-Ping Lu, Rong Wang, Tao Zhong, and Paul L Rosin. Large-capacity image steganography based on invertible neural networks. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10816-10825, 2021.
[41] Siwei Lyu and Hany Farid. Steganalysis using higher-order image statistics. IEEE Transactions on Information Forensies and Security, 1(1):111-119 2006.
[42] Jarno Mielikainen. LSB matching revisited. IEEE Signal Processing Letters, 13(5):285-287, 2006.
[43] Shakir Mohamed and Balaji Lakshminarayanan. Learning in implicit generative models. arXiv preprint arXiv:1610.0348. 2016.
[44] Douglas Montgomery and George C Runger. Applied Statistics and Probubility for Engineers. John Wiley & Sons, 2010.
[45] Zhicheng Ni. Yun- Min-Qing Shi, Nirwan Ansari, and Wei Su. Reversible data hiding, IEEE Transactions on Circuits and Systems for Video Technology, 16(3):354-36 362, 2006.

---

[46] Tomáš Pevný, Tomáš Filler, and Patrick Bas. Using high-dimensional image models to perform highly undetectable steganography. In International Workshop Information Hiding, pages 161-177, 2010.
[47] Niels Provos and Peter Honeyman. Hide and seek: An introduction to steganography. IEEE Security & Privacy, 1(3):32 44, 2003.
[48] Joseph Ô Ruanaidh, William J Dowling, and Francis M Boland. Phase watermarking of digital images. In IEEE International Conference on Image Processing, pages 239-242, 1996.
[49] Tamar Rott Shaham, Tali Dekel, and Tomer Michaeli. SinGAN: Learning generative model from single natural image. In IEEE/CVF International Conference on Computer Vision. pages 4570-4580, 2019.
[50] Gustavus J Simmons. The prisoners' problem and the subliminal channel. In Advances in Cryptology. pages 51-67, 1984.
[51] Yang Song and Diederik P Kingma. How train your energy-based models. urXiv:2101.03288 2021.
arXiv preprint
[52] Mitchell D Swanson, Bin Zhu, and Ahmed H Tewfik. Data hiding for video-in-video. In IEEF International Conference on Image Processing, pages 676-679, 1997.
[53] Yusuke Uchida, Yuki Nagai, Shigeyuki Sakazawa, and Shin ichi Satoh. Embedding watermarks into deep neural networks. In ACM International Conference on Multimedia Retrieval, pages 269-277, 2017.
[54] Dimitri Van De Ville, Wilfried Philips, Rik Van de Walle, and Ignace Lemahieu. Image scrambling without bandwidth expansion. IEEE Transactions Circuits and Systems for Video Technology, 14(6)8922-897, 2004.
[55] Zhou Wang, Alan C. Bovik, Hamid R Sheikh, and Eero P Simoncelli. Image quality assessment: from error visihility to structural similarity. IEEE Transactions on Image Processing, 13(4):600-612, 2004.
[56] Zichi Wang, Guorui Feng, Hanzhou Wu, and Xinpeng Zhang. Data hiding in neural networks for multiple receivers. IEEE Computational Intelligence Magazine, 16(4)700-84 2021.
[57] Zihan Wang, Neng Gao, Xin Wang, Ji Xiang, Daren Zha, and Linghui Li. HidingGAN: High capacity information hiding with generative adversarial network. Computer Graphics Forum, 38:393-401, 2019."
[58] Ping Wei, Ge Luo, Qi Song, Xinpeng Zhang, Zhenxing Qian, and Sheng Li. Generative steganographic flow. IEEE International Conference on Multimedia and Expo, pages 1-6, 2022.
[59] Xinyu Weng, Yongzhi Li, Lu Chi, and Yadong Mu. High-capacity convolutional vidco steganography with temporal residual modeling. In International Conference on Multimedia Retrieval, pages 87-95, 2019.
[60] Da Chun Wu and Wen-Hsiang Tsai. A steganographic method for images by pixel-value differencing. Pattern Recognition Letters, 14:1613-1622 2003.
[61] Hanzhou Wu, Gen Liu, Yuwei Yao, and Xinpeng Zhang. Watermarking neural networks with watermarked images. IEEE Transactions on Circuits and Systems for Video Technology, 31(7):2591 2601, 2020.
[62] Kuo-Chen Wu and Chung-Minne Wang. Steganography using reversible texture synthesis. IEEE Transac- tions on Image Processing, 24( 24(1):130-139, 2015.
[63] Chaoning Zhang, Chenguo Lin, Philipp Benz, Kejiang Chen, Weiming Zhang, and In So Kweon. brief survey on deep learning based data hiding, steganography and watermarking. arXiv preprint @XXiv22103.01607, 2021.
[64] Weiming Zhang, Xiaocheng Hu, Xiaolong Li, and Nenghai Yu. Recursive histogram modification: Establishing equivalency between reversible data hiding and lossless data compression. JEEE Transactions on Image Processing, 22(7): 27752275,, 2013.
[65] Weiming Zhang, Xiaocheng Hu, Xiaolong Li, and Nenghai Yu. Optimal transition probability of reversible data hiding for general distortion metrics and its applications. IEEE Tronsactions on Image Processing, 2441):294-304, 2014.
[66] Xinpeng Zhang. Behavior steganography in social network. In Advances in Intelligent Information Hiding and Multimedia Signal Processing, pages 21-23. 2017.
[67] Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. HiDDeN; Hiding data with deep networks. In European Conference on Computer Vision, pages 657-672, 2018
12

---

Checklist
1. For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper's
contributions and scope? [Yes]
(b) Did you describe the limitations your work? [Yes] In Section 4.2, we describe the
possibility of secret image leakage.
(c) Did you discuss any potential negative societal impacts your work? [No] This is new method for data hiding. The societal impacts of the proposed method are the same as those of the existing data hiding methods in general.
(d) Have you read the ethics review guidelines and ensured that your paper conforms to them? [Yes]
2. If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results? [N/A]
(b) Did you include complete proofs of all theoretical results? [N/A]
3. If you ran experiments..
(a) Did you include the code, data, and instructions needed to reproduce the main experi- mental results (either in the supplemental material or URL)? [Yes]
(b) Did you specify all the training details (c.g.. data splits, hyperparameters, how they were chosen)? [Yes] In supplemental material.
(c) Did you report error bars (e.g.. with respect the random seed after running experi-
ments multiple times)? [No] Because would too computational expensive.
(d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, cloud provider)? [Yes] In the appendix.
4. If you using existing assets (e.g., code, data, models) or curating/releasing
assets...
(a) If your work uses existing assets, did you cite the creators? [Yes]
(b) Did you mention the license of the assets? [Yes] In the appendix.
(c) Did you include any assets either in the supplemental material URL? [Yes]
(d) Did you discuss whether and how consent obtained from people whose data you're you're using/curating? [N/A]
(c) Did you discuss whether the data you are using/curating contains personally identifiable information or offensive content? [N/A]
5. If you used crowdsourcing or conducted research with human subjects...
(a) Did you include the full text of instructions given participants and screenshots, if applicable? [N/A]
(b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB) approvals, applicable? [N/A]
(c) Did you include the estimated hourly wage paid to participants and the total amount spent participant compensation? [N/A]
13


Reviews:
[{"review_id": "heUQ5AdGxY", "reviewer": "Reviewer_bS3X", "summary": "The paper proposes a method to hide images in deep probabilistic models. The proposed method is novel and can be framed as a particular case of the existing methods. One of the significant properties of the proposed method is its ability to be used for multiple receivers. The authors introduce the problem by discussing the current different approaches to hiding data using DNNs and outline the contributions of the paper. Next, related work for each of the described current approaches is provided. The authors then give a mathematical model formulation and how the data hiding computations are carried out. The approach being novel cannot be directly compared to previous works and hence, the authors identify the closest baselines to the proposed model and using experimental results, show that the proposed model either performs better or is more efficient than the considered baselines. The authors also evaluate the model from a security perspective using three methods. Lastly, the authors describe experiments evaluating the models' ability to hide images for multiple receivers and obfuscate the secret image.", "questions": "NA", "limitations": "NA", "rating": 7, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Typos:\n1. Line 54: adopts -> adopt/adopted", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "PsMmUYcWP5", "reviewer": "Reviewer_ShzF", "summary": "The task is about image-in-image steganography. Unlike previous methods which follow the autoencoder approach, they use GAN-based network to model the probability density of cover images, and hide a secret image in one particular location of the learned distribution. ", "questions": "(1) Lines 197-201 are unclear. The proposed method performs worse than Weng19 and HiNet in terms of the extraction accuracy of secret image. It is claimed that secret-in-network hiding is generally considered much more difficult than secret-in-image hiding. But at line 97, the proposed method is classified as constructive image hiding, not secret-in-network hiding. The authors should explain clearly why the extraction accuracy is low. ", "limitations": "The other methods can use one model to accommodate different cover-secret images. But for the proposed method, it needs to train one sinGAN for each cover image. ", "rating": 5, "confidence": 2, "soundness": 2, "presentation": 2, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths\n(1) The idea of hiding message in the learned distribution is interesting. It is different from previous methods, which use an autoencoder scheme.\n(2) Compared with previous work, the proposed method doesn’t need to transmit the decoder to receiver via a subliminal channel. Their model can be publicly transmitted and only the key needs to be sent via the subliminal channel.\n(3) The proposed method doesn’t directly generate stego images, thus avoiding the issue of possible detection by steganalysis methods.\n(4) Multiple images can be hided in one model for different receivers, which is a challenging task that has not been accomplished before.\n\nWeakness\n(1) The dataset contains only 20 images. \n(2) The other methods can use one model to accommodate different cover-secret images. But for the proposed method, it needs to train one sinGAN for each cover image. \n(3) The proposed method performs much worse than HiNet in terms of the extraction accuracy of the secret image.\n(4) The extraction accuracy of secret image with obfuscating has low PSNR (20dB).\n(5) The mapping between the secret noise (generated by the embedding key) and the secret image may not be bijective (i.e., one-to-one), which means it is possible to obtain the secret image with random sample. In this paper they randomly draw 100, 000 samples from each of the 20 trained stego SinGANs to prove the possibility of secret image leakage is less than 0.001%. But I think 20 is a small number, it is sufficient to prove the security.\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ["I don’t know"]}, "extra_text": {}}, {"review_id": "7DRMwIJzsBM", "reviewer": "Reviewer_4fNE", "summary": "This paper describes a technique for hiding images in images by means of SinGAN. The authors learn how to create a key-generated noise to be embedded into the cover image by exploiting SinGAN. Also discussion on robustness of the technique on discoverability is presented with some hints on obfuscation.", "questions": "1) Why did you use only SinGAN images for cover/secret? Can you do/propose some more examples?\n2) How you carried out comparison with SOTA techniques? Did you do experiments on the same images or just reported each SOTA techniques paper results (I found the same PSNR/SSIM values in HiNet paper... I dont feel like this is a fair comparison).\n", "limitations": "The authors do not take adequately care of image size/resolution. In my opinion this is a great limitation of the work that should be addressed. Images elaborated are too small/low resolution to expose visible alterations... Maybe this is a limit... But we dont know because further experiments need to be carried out.", "rating": 3, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 1, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "The main strength of this paper is the application of the SinGAN architecture to the problem of image hiding. This is a first. \nThere are several weaknesses on the other hand: \n1) the paper looks like this is a preliminary result, they employed only the 20 images available in the SinGAN Github repository;\n2) some part of the text are not clear: (i) the authors claim to put the secret into a \"location\" of the cover... where? how? not clear to me... (ii) experiments were carried out on the 20 images of the SinGAN repository but what about the comparing SOTA techniques? They are comparable? I know that HiNet works with images with higher dimensions and quality... I dont feel like the comparison is fair\n3) experiments need to cover much more possibilities\n4) usual stego metrics are not shown like \"db\" or \"bpp\"\n5) Figure 2 is shown but not reference in text", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}]

Author rebuttal:

Decision: Accept