Paper: INRSTEG: FLEXIBLE CROSS-MODAL LARGE CAPACITY STEGANOGRAPHY VIA IMPLICIT REPRESENTATIONS (ICLR-2024)

Reviewer comment (Evaluation):
Steganography pursues behavioral security, but the framework causes the size of the stego INR to be larger than the size of the normal cover INR, and an attacker may be able to detect the existence of INR steganography based on this anomalous behavior.

Author response:
We acknowledge that the size of stego INR compared to the size of normal cover INR may provide a potential indicator to attackers, as the number of secret data increases. However, it is important to note that, as mentioned in the paper, we can customize the size of secret INRs. We can fix the stego INR size by setting the size of secret INRs accordingly. Additional experiments regarding this scenario can help the understanding of our framework. Therefore in section 4.3, we will add additional experiments for image and audio where the stego INR size is fixed and the secret INR size decreases as the number of secret data increases.

Reviewer comment (Experiments):
Security experiments: although this paper can resist traditional image steganalysis, considering that it is similar to neural network steganography, it should be supplemented with experiments on resisting neural network steganalysis.

Author response:
In response to your concern, we would like to highlight that, at present, there are no established neural network steganalysis methods available. However, recognizing the importance of addressing potential vulnerabilities, we performed permutation operations and examined the weight distribution plots. The experiment aimed to demonstrate our framework's capability to disrupt potential neural network steganalysis. We acknowledge that developing a neural network steganalysis framework against our work could be an intriguing avenue for future research. We appreciate your suggestion and will consider it for future extension.

Reviewer comment (Experiments):
How robust is the framework? Can it resist network fine-tuning, pruning, and other operations?

Author response:
Our primary focus is to investigate in capacity, distortion, and security of cross-modal steganography, which achieves lossless retrieval of secret information. Therefore, as mentioned in the conclusion section, robustness will be studied for future work.

Reviewer comment (Writing):
The English writing should be improved to make this paper readable.

Author response:
We will enhance the English writing to improve the paper's readability as suggested.

Reviewer comment (Reproducibility):
I cannot clearly understand details of the proposed framework. I am confused about how to implement the lossless steganography.

Author response:
Although there is little loss during the representation transformation phase from discrete representations to INRs, our lossless steganography is achieved in terms of INRs as mentioned in the paper. Once the secret data is transformed into an INR, by placing secret INRs into the stego prep-INR and freezing it during training on the cover data, all weights of secret INRs remain intact throughout the process. Therefore the secret INR is retrieved without any loss.

Reviewer comment (Evaluation):
The experimental results do not evaluate the embedding capacity of the proposed method. I don’t know what is the key reason why the proposed steganography can achieve large capacity.

Author response:
Our framework achieves large capacity in two aspects. First, it enables cross-modal tasks even when the dimension or capacity of the secret data exceeds that of the cover data as described in the paper. In section 4.2, there are comprehensive experiments such as hiding 3D shapes in audio. Second, we can hide as much secret data as the sender desires. In the method section, the method of hiding two secret data is explained without loss of generality because multiple data (≥2) can be concealed in the same way using the described method. In section 4.3, we presented experiments of hiding three and four images within a single image. We will add hiding three and four audios within a single audio for clarification.

Reviewer comment (Evaluation):
The quality of the steganography methods is measured by how much information can be stored in how much space. For instance, image steganography methods report bits per pixel to state how many bits of information can be hidden in each pixel. Similarly, it would be worthwhile to know what the size of the cover data, the secret data is, and the INRs are. It is also a limitation that the INR can be quite large.

Author response:
The sizes of the cover data, secret data, and INRs are detailed in Section 4.1 Experimental Setting. In our experiments, we set the width of the secret data INR to 128 and 192, resulting in a stego INR width between 256 and 384, which is acceptable without suspicions. Additionally, as mentioned in the paper, we can customize the size of secret INRs. Therefore, if there is a fixed stego INR size, we can set the size of the secret INRs accordingly. We acknowledge that additional experiments regarding this scenario can help the understanding of our framework. Therefore in section 4.3, we will add additional experiments in the revision for image and audio where the stego INR size is fixed and the secret INR size decreases as the number of secret data increases.

Reviewer comment (Experiments):
There are multiple missing baselines like SteganoGAN [1] and LISO [2].

Author response:
We appreciate your comment regarding the missing baselines, SteganoGAN [1] and LISO [2]. These baselines primarily focus on concealing binary messages in images, a different objective compared to our work, which involves modalities such as image, audio, video, and 3D shapes transferable into INRs. While these baselines are excluded from direct comparisons due to this difference, we recognize their impact in the steganography field. Therefore, we will include SteganoGAN and LISO in the related works section to provide a more comprehensive overview.  
Also, one of our chosen baseline, DeepMIH, has demonstrated superiority over previous binary stream steganography methods, which implies the superior performance of our proposed method over those binary stream steganography.

Reviewer comment (Novelty):
The motivation for hiding data in INRs is not very clear.

Author response:
The motivation behind using INRs lies in their versatility, allowing us to adopt all modalities that can be transferred into INRs for both secret and cover data. This leads to a significant breakthrough in terms of data modality for steganography, which is thoroughly investigated in Section 4.2 Cross-modal Steganography.

Reviewer comment (Evaluation):
Why is hiding audio in audio worse than hiding audio in images?

Author response:
For the left table in Table 1, the cover/stego pair performance comparison should be executed within the same cover data modality as different data modalities cannot be compared in terms of performance. Within the same cover modality, we have highlighted the best-performing secret data modality as the secret data modality affects the cover/stego performance, which is explained in 4.2.  
The right table in Table 1 illustrates the secret/revealed secret pair performance. The secret/revealed secret performance remains the same for all experiments as our framework executes lossless secret INR retrieval. This table further provides insight into the representation performance of the INR for each modality.  
Hiding audio in audio and hiding audio in image therefore cannot be compared as they have different cover modalities. The secret/revealed secret performance of audio is the same as explained above. We believe the confusion was caused because the two tables were both placed under “Table 1”. Sorry for this confusion, and we will make this clear in our revision.

Reviewer comment (Reproducibility):
Did you train SiaStegNet and XuNet or use a pre-trained model? Do these models operate on INRs or the recovered cover data from the INR?

Author response:
We used a pre-trained model for both steganalysis tools, we are sorry that this wasn’t mentioned in the paper and we will mention this in the revised version. These steganalysis tools do not operate on INRs but are employed as there aren’t any existing steganalysis tools that operate on INRs. Therefore we evaluate them using the recovered cover data (stego data) from the stego INR. As our hiding framework on INRs does not reflect any distortions that indicate steganography in the reconstructed data, existing steganalysis tools are powerless.  
Additionally, recognizing the importance of addressing potential INR steganalysis tools, we perform permutation operations and analyze the weight distribution plots. This experiment aims to demonstrate our framework's capability to disrupt potential neural network steganalysis.

Reviewer comment (Experiments):
This paper did not do much protection/robustness analysis for the proposed method of encoding secret INRs into a cover INR. For instance, there is no discussion on what would happen if the cover INR is pruned during transmission.

Author response:
If the cover INR is pruned during transmission, the retrieval of the secret INR is still possible since pruning does not change the location of the weights.  However, the quality of the secret data may be diminished, as the weights of the secret INR will also be affected by the pruning process. We have mentioned robustness as a future work in the conclusion section of the paper. In this paper, we focus on capacity, distortion, and security of a cross-modal steganography framework designed for the lossless retrieval of secret INRs and to block existing steganalysis tools.

Reviewer comment (Theory):
Although after permutation the weight distribution seems inconspicuous, the paper does not address the possibility of sorting the weights. Since permutation of the weights does not affect intermediate activations and outputs, once sorted, could there be obvious changes that reveal secrets?

Author response:
As you mentioned, the permutation of weights secures the existence of secret data while not affecting the performance of the stego INR. Regarding your inquiry about sorting the weights, we are not sure what you mean by ‘once sorting the weights, will there be any obvious changes?’. Could you please clarify that question?

Reviewer comment (Evaluation):
The paper lacks attack analysis, such as considering the knowledge of attackers and how they might attack (to prevent the final owner from obtaining the correct secret data) or steal (to extract the secret).

Author response:
In the paper, we address potential risks regarding the visibility of the secret data in the weight space. To mitigate this, we employ permutation to eliminate boundaries in the weight space, thus concealing the presence of the secret data. Even though we assume that the attacker is aware that secret data are hidden using permutation, without the private key, the attacker has to employ brute-force guessing to locate the secret data. This is practically impossible when considering the number of possible variations explained in section 3.4. While our paper does not explicitly cover robustness analysis including attacks, we acknowledge this as a valuable extension and have suggested robustness as a future work. Future extensions of our work will cover robustness analysis including various attack scenarios, including those you've suggested.

Reviewer comment (Experiments):
What if the cover INR is pruned during transmission? Can the secret INR still be retrieved?

Author response:
If the cover INR is pruned during transmission, the retrieval of the secret INR is still possible since pruning does not change the location of the weights.  However, the quality of the secret data may be diminished, as the weights of the secret INR will also be affected by the pruning process. We have mentioned robustness as a future work in the conclusion section of the paper. In this paper, we focus on capacity, distortion, and security of a cross-modal steganography framework designed for the lossless retrieval of secret INRs and to block existing steganalysis tools.

Reviewer comment (Experiments):
How robust is the proposed method against attackers? For example, how does it perform against simple attacks like pruning or adding noise, or against more advanced efforts aimed at reconstructing/retrieving the secret INRs?

Author response:
In the paper, we address potential risks regarding the visibility of the secret data in the weight space. To mitigate this, we employ permutation to eliminate boundaries in the weight space, thus concealing the presence of the secret data. Even though we assume that the attacker is aware that secret data are hidden using permutation, without the private key, the attacker has to employ brute-force guessing to locate the secret data. This is practically impossible when considering the number of possible variations explained in section 3.4. While our paper does not explicitly cover robustness analysis including attacks, we acknowledge this as a valuable extension and have suggested robustness as a future work. Future extensions of our work will cover robustness analysis including various attack scenarios, including those you've suggested.