House of Cans : Covert Transmission of Internal Datasets via Capacity-Aware Neuron Steganography
Anonymous Author(s)
AffiliationAddress email
Abstract
In this paper, we present a capacity-aware neuron steganography scheme (i.e.,
Cans ) to covertly transmit multiple private machine learning (ML) datasets via ascheduled-to-publish deep neural network (DNN) as the carrier model .
Unlikeexisting steganography schemes which treat the DNN parameters as bit strings,
Cans for the first time exploits the learning capacity of the carrier model via anovel parameter sharing mechanism.
Extensive evaluation shows, Cans is the firstworking scheme which can covertly transmit over 10000 real-world data sampleswithin a carrier model which has 220 × less parameters than the total size of thestolen data, and simultaneously transmit multiple heterogeneous datasets withina single carrier model, under a trivial distortion rate ( < 10 − 5 ) and with almostno utility loss on the carrier model ( < 1% ).
Besides, Cans implements by-designredundancy to be resilient against common post-processing techniques on thecarrier model before the publishing.
Introduction
Large machine learning (ML) datasets become critical assets for AI corporations [2, 8].
As thepreparation of datasets is highly time-consuming and labor-intensive, it is common and reasonablefor relevant parties to hold the data as confidential properties [45].
Despite being carefully curated inlocal data centers isolated from the open network [3], recent research shows model-level vulerabilitiesstill expose the private datasets under the risk of disclosure (e g., [7, 15, 39, 37]).
Once a deep neural network (DNN) finishes its training process on a private dataset the modelimmediately becomes an exploitable source of data disclosure.
By interacting with the trainedmodel in a full-knowledge manner (i.e., with known parameters, model architecture etc.) or via theprediction API, previous works reveal the possibility of inferring sample-level sensitive informationor even reconstructing raw training samples from the intermediate computation results (e g., features[30] and gradients [28, 50, 16]) and the outputs of a trained model [9, 36, 35, 10].
For example,
Carlini et al.
reveal and evaluate how sensitive texts (e.g., social security number) are memorized in
DNN-based online services [9] (e.g., Google’s Smart Compose [13]) and more recent industry-levelpretrained large language models [10] (e.g., OpenAI’s GPT-2 [34]).
Such vulnerabilities reflect thetension between the confidential data and the openly accessible trained model.
A natural question is,whether a private dataset with no exposed open interfaces can be impregnable against data stealing.
Our Work.
In this paper, we reveal that severe leakage of the sensitive information can still happeneven for private ML datasets with no exposed public interface .
To break the privacy barrier of ML datawith no exposed interface, we propose capacity-aware neuron stegnogrpahy , or Cans , which employsthe scheduled-to-publish DNN model as a carrier model for covert transmission of multiple secretmodels which have memorized the sensitive data (i.e., a generator-like DNN architecture [17, 33],which maps random noises to real data samples), for privacy breach.
When an outside colluder
exclusively decodes the memorization-oriented models from the carrier model, the ground-truthprivate data is dumped when feeding the secret models with the same set of random noises (e.g.,shared via a secret random seed).• Why not hiding the sensitive data directly?
Steganography is a long-standing research area[32] with mature algorithms for information hiding with multimedia contents (e.g., image [11], text[47] and audio [14]).
Compared with them, the parameters of a DNN is usually much larger (e.g.,the storage of a ResNet-18 is about 45 MB) and has stronger resilience against the modification ofmultiple least-significant bits (LSB) positions [20, 23].
However, previous hiding schemes mainlyview the carrier medium, whether multimedia contents or DNN parameters [38, 40, 26], as bitstrings for secret encoding, which hugely limits the potential of DNN as a carrier.
To the best of ourknowledge, the state-of-the-art schemes are only able to use about 20% ∼ 50% size of a DNN forinformation hiding.
For example, Song et al. find most existing data hiding techniques can hardlyhide over 500 raw gray-scale images of 32 × 32 resolution ( 5 . 85 MB in total) if the utility loss on acarrier ResNet-18 shall be under 3% [38].
In other words, DNN as the carrier medium seems to loseits unique advantages in steganography.
Our approach shows there is much more that can be done.•
Cans –Hiding Models in Model.
To fully exploit the enormous learning capacity of DNN, Canspresents a more capacious and flexible neuron steganography scheme which restores the uniqueness ofusing DNN as the carrier medium, especially in leaking a private dataset much larger than the carriermodel itself or in leaking multiple private datasets simultaneously.
Specifically, Cans implementsa new parameter sharing mechanism based on weight pool , which stores an array of learnable andusable parameters.
The parameters in a weight pool are designed to fill into different layers of anygiven DNN for multiple times, and allow cyclic access.
In other words, multiple DNNs, includingeither the
secret models and the carrier model, can be generated from the same weight pool byrecycling the parameters inside (§3.2).
To encode the secret models in the carrier model, we jointlytrain the carrier model along with the secret models with the parameters generated from the weightpool (§3.3).
During the learning process, the error propagates and accumulates to the correspondingparameter in the weight pool, where the update finally happens.
After the carrier model is publishedonline, the colluder can decode the weight pool from the carrier model with a small number of secretinteger keys, assemble the secret model(s), and finally dump the sensitive data samples (§3.4).
Extensive evaluation validates, Cans is the first scheme which can covertly transmit over 10000real-world data samples within a carrier model which has 220 × less parameters than the total size ofthe stolen data (§4.1), and simultaneously transmit multiple heterogeneous datasets within a singlecarrier model (§4.2), with almost no utility loss on the carrier model and no trivial distortion rateon the stolen data ( < 10 − 5 ).
Besides, Cans naturally implements information redundancy [41] viathe usage of a smaller weight pool, which enhances the resilience against possible post-processingtechniques on the carrier model before its publishing (§4.3).
Preliminary
• Notations.
In our work, we call a database is a private ML dataset (simply referred to as a private
dataset later) if it is prepared for training ML models.
Specially, depending on whether annotation
exists, private datasets are categorized as the data for supervised learning , where the task is defined
in a space X × Y , or for unsupervised learning , where the task is defined solely in a space X .
Wecall X the input space, which is composed of raw data including but not limited to images, texts, or
audios.
In supervised learning, a learning model f ( · ; θ )(:= f θ ) :
X → Y aims to build the relation
from an element in X to the label in Y (i.e., the label space), which consists of all the possible
values in the annotation.
For example, in a K -class image classification task, X consists of a set ofimages to be classified, while Y = { 1 , . . .
, K } , i.e., the possible classes.
In unsupervised learningtasks, a fundamental goal is to learn the distribution of the input data in X with either parametricor non-parametric models.
For example, in the branch of generative adversarial nets (GAN [17]), aparametric generative model g ( Z ; θ ) ∈ X is trained to map a random variable Z ∼ N (0 , σ 2 ) , i.e.,a fixed Gaussian distribution, to fit the true data distribution supported at X .
Finally, the trainingprocess of both supervised learning and unsupervised learning involves the optimization of a lossfunction , denoted as ℓ ( · ; θ ) , with respect to the parameters of the learning model.• Data Hiding in the Deep Learning Era.
Data hiding, or steganography, is a long-standing researcharea in security-related research [32]. Previous research mainly studies how to hide secret information
in multimedia contents via coding-theoretic [11, 14] and deep learning approaches [47, 49, 48, 22].
With the recent development of open-source model supply chains, several research works also exploit
DNN as a new medium for hiding binary information. At the early stage, Uchida et al.
[40] and Songet al. [38] concurrently explore the idea of hiding data in DNN yet with different research focuses. To protect the intellectual property of DNN, Uchida et al. propose to embed a secret random binarymessage into the model parameters via conventional steganography techniques (e.g., least-significantbits or sign encoding).
By verifying whether a model contains the binary message, the ownership isestablished.
Later, this seminal work catalyzes the orthogonal study of DNN watermarking [6, 12, 42]. Instead of model protection, Song et al.
aim at hiding sensitive information about the private data intothe model parameters during its training. Specifically, they directly convert a subset of sensitive datainputs into a binary form and encode them into the model parameters again with almost the same setof conventional steganography techniques in [40]. Although the previous work is originally designedfor stealing training data, we find their approach can be immediately extended to hiding the sensitiveinformation of irrelevant private datasets into a carrier model.
In this sense, we include this attack asthe baseline in our experiments (§4).
• Security Settings.
Below, we introduce the security settings of our work.
Attack Goal.
Following existing works on breaking training data privacy via well-trained DNNmodels, we define a target private dataset is stolen if, the outside colluder attains a subset of datainputs containing sensitive information of the private dataset.
Threat Model.
Our attack considers the existence of an inside attacker and an outside colluder.
Formally, we have the following assumptions on the ability of the attackers: (i) Accessible Targets :
The insider has access to the target private dataset(s); (ii) Existent Carrier :
The insider is assignedwith the task of training a DNN, which is scheduled to undergo an open sourcing process, on anon-target dataset; (iii) Receivable Carrier :
The outsider knows which model to download after thepublishing; (iv) Secure Collusion : The insider and the outsider can collude on several integer valuesand model architectures via a secure channel (e.g., a rendezvous).
Attack Taxonomy.
Similar to conventional stegnography [32],a hiding scheme using DNN shall meet the following requirements.
(i) Capacity: As a prerequisite of invoking covert transmission, we require the secret information can be encodedinto the carrier model without incurring unacceptable utilityloss.
Intuitively, a hiding scheme has higher capacity if moresecret information is encoded with the same level of performance degradation.
(ii) Decoding Efficiency: This requirementmeasures how much additional knowledge is required to successfully decode the hidden information from the carrier model.(iii)
Effectiveness: After the secret information is decoded fromour carrier model, the information is expected to have almostno distortion (i.e., effective transmission).
(iv) Robustness:
Inour context, we require the colluder can still decode the secretmodels and thus the privacy of the target datasets when thecarrier model undergoes common post-processing techniques(e.g. , pruning and finetuning).
(v) Covertness: Finally, to reifythe requirement of covertness, a third party should not be ableto detect whether a published model contains secret models.
Capacity-Aware Neuron Steganography
[Figure]
3.1 Attack Overview
Fig.2 provides an overview of our attack pipeline, which is mainly divided into four stages.
Beforeintroducing each stage, we first present our designs of a weight pool , a key data structure for encoding(decoding)
the secret models into (from) the carrier model.• Notion of a Weight Pool.
As in Fig.1, a weight pool P maintains an array of | P | learnable scalarparameters.
Corresponding to the different types (e.g., weight, bias, scale) of learnable parameters in
DNN, the parameters in a weight pool is also grouped in disjoint groups, i.e., P = P w ∪ P b ∪ P s .
Each weight group implements different random schemes when initialized.
Given an integer secret v ,a weight pool P implements the following primitives to interact with a DNN f ( · θ ) :
(i) Fill ( P , f , v ) → P ( · , v ) :
Fill associates each parameter in f with a parameter of the same type which from the weight pool P under the randomness specified by a given secret key v .
P ( θ, v )denotes the hash map from the original parameters in DNN to the parameters in the weight pool.
(ii) Propagate ( P , f ( · ; θ ) , v ) → ∅ : After an optimization step on f , Propagate collects the weight
update on each parameter in a DNN and propagates them to the corresponding positions in the weight pool according to the hash map P ( · ; v ) .
Each parameter in the weight pool implements a buffer to receive the updates
(iii) Update ( P )
→ ∅ : Update updates each parameter in P by aggregating its update buffer and then reset the buffer. (iv) Decode ( f , v ) → P : This primitive decodes the weight pool from a DNN f according to the secret key v .
• Attack Pipeline.
In the following, we denote the carrier DNN as C .•
Stage 1: Initialization of weight pool.
At the first stage, a weight pool P is initialized from scratchwith an attacker-specified size for each group.
• Stage 2: Construction of Memorization-Oriented Tasks (§3.2).
At the next stage, for all the targetdatasets D 1 , . . .
, D M to steal ( M ≥ 1 ), the attacker build a generator-like DNN architecture whichwill learn to map a sequence of noise vectors to the attacker-interested data inputs correspondingly.
The noise vectors are randomly sampled from a secret distribution with a fixed integer seed, whichis exclusively known to the insider and the colluder.
Finally, the attacker chooses an integer
secretv k and invokes the Fill primitive to replace the parameters in each secret model with the ones in
P by invoking Fill ( P , f k , v k
• Stage 3: Joint Training for Capacity-Aware Hiding (§3.3)
Combining with the learning task( D C , ℓ C ) of the carrier model C , the attacker jointly trains the carrier model and the secret modelsby optimizing the parameters in the weight pool P .
Concisely, in each iteration, we synchronously calculate the parameter updates in each model and then invoke Propagate ( P , f k ) to accumulate theupdates in each model to the corresponding update buffers.
Subsequently, we invoke the Updateprimitive and resume the joint training to the next iteration.
When the training finishes, the attackerremoves all the traces in the code base and replaces the corresponding parameters in the carriermodel with the values from the final weight pool.
We denote the final carrier model as C ∗ .
• Stage 4: Decoding Secrets from the Carrier Model (§3.4).
After the carrier model C ∗ is published, the outsider colluder downloads C ∗ .
With the knowledge of the architectures of the secret models and the secret key v k communicated via a secure channel, the outsider first invokes Decode ( C ∗ ,v k ) to decode the weight pool P from the carrier model.
Then, the colluder assembles the secret models and dumps the sensitive data with the secret models.
In the following, we present the detailed technical designs for each stage above
3.2 Construction of Memorization-Oriented Tasks
For stealing a subset of sensitive inputs, i.e., { x i } Ni =1 , from a private dataset, we propose to model thesecret learning task in the supervised learning framework.
Specially, we aim at training a generatorlike architecture f k which maps noise vectors from a predefined noise space Z to each one of thesensitive inputs.
By choosing a common noise distribution N k on Z and a secret integer s k ∈ N + , theattacker samples a sequence of noise vectors z 1 , z 2 , . . .
, z N ∼ N k when the random seed is specifiedas s k .
By pairing the noise vector and the sensitive inputs as { ( z i , x i ) } Ni =1 , the attacker constructsthe secret learning task below for sensitive data stealing min θ k L k ( θ k ) :
= 1 N (cid:80) Ni =1 d ( f k ( z i ; θ k ) , x i ) ,where d is a distance metric defined on the input space.
As pseudorandomness is machine-independentin most popular DL frameworks and operating systems [5, 27], the colluder can deterministicallyreplicate the noise sequence after knowing the specific noise distribution and the integer seed s k .
Unlike directly encoding sensitive inputs in model parameters [38], our approach circumvents thedata heterogeneity problem in existing attacks by converting data hiding to model hiding.
Fill Secret/Carrier Models with Weight Pool.
With the carrier model C and an initialized weightpool P , we first specify a random integer v k for each secret model f k from all the possible indices [Table] [Table] [Figure]
of the weight pool P , i.e., { 1 , 2 , . . .
, | P |} .
We design this mechanism to prevent the secret modelsfrom being decoded by any party except for the outsider, despite the scarce chance of even guessingthe secret model architecture.
We then invoke the primitive Fill ( P , f k , v k ) in Algorithm A.1 in thesupplementary material to replace the original parameters in f k by parameters in P .
The obtainedmodel is denoted as ˜ f
k with the substituted parameters as P ( θ k , v k ) .
Intuitively, the Fill primitive loops over all the scalar parameters in the target model f k ( · ; θ ) andassign it with the value of a parameter selected from the weight pool.
As Fig.1 shows, the parameterselection cursor on each parameter group (e.g., the weight group P w ) cycles from a starting indexderived from the integer secret (e.g., v k mod | P w | ).
For the carrier model, we sample an integersecret v C as well for the carrier model.
Remark 3.1 (Label Memorization) .
By viewing the labels of data samples from a supervised learningdataset as integers, we can construct similar secret learning tasks as above for label memorization.
3.3 Joint Training for Capacity-Aware Hiding
After the secret and the carrier models are filled, the weight pool P is viewed as a proxy toeach secret/open learning task during the training.
Without loss of generality, we suppose thecarrier model C is trained on a supervised learning task D C :
= { ( x i , y i ) } N C
i =1 with a loss function ℓ C .
Formally, the model hiding process aims to solve the following joint learning objective:
[Equation] P [Equation] v k )) . .
Intuitively, the above objective requires P to reach a good consensus on N secret tasks and the open task.
For example, when
M = 1 , it means that the sets of local optimum for f C and f 1 should intersect with one another toguarantee a near-optimal weight pool is attainable.
For the first time, we empirically propose a jointtraining algorithm which solves the learning objective above to construct a near-optimal weight pool.
Each secret model assembled from the optimized weight pool exhibits similar utility compared withan identical model which is independently trained (§4.2).
Searching for the Optimized Weight Pool.
To solve the joint learning objective, our proposed attackexecutes the following training iteration recurrently.
Denote the weight pool at the t -th iteration as
P t .
Concisely, at the t -th iteration, we iterate over all the M secret tasks and the normal task toconduct the following key procedures: (i)
For the k -th secret tasks, we first invoke Fill ( P t , f k , v k )to instantiate f k with the current values of the weight pool.
(ii)
Then, we forward a training batchvia the model f k ( · ; P t ( θ k , v k )) , back-propagate the loss L k approximated on the training batch, andconduct one optimization step on the parameters of f k with an optimizer (e.g., Adam [21]).
(iii)
Finally, we collect the weight update on each parameter and follow the mapping relation in P ( · , v k )to propagate the update to the corresponding weight pool parameter.
The above procedures are alsoconducted on the carrier model.
The above procedures describe the Propagate primitive on each secret/open task (L4-15 in Algorithm
A.2).
The final step in one training iteration is to invoke the Update primitive on the weight pool(L16-18 in Algorithm A.2).
Technically, for each parameter in P t , we maintain a buffer to store theweight updates from each task.
The update buffer is aggregated to obtain the global update valueon the corresponding scalar parameter in P t .
In our experiments, we find aggregation by average is already sufficient to achieve effective attacks.
After the parameter is updated, we clear the updatebuffers and resume the next training iteration.
To wind up the hiding phase, the attacker clears up any traces of malicious training code and irrelevantintermediate outcomes, memorizes the secret keys (i.e., the random seeds { s k } for generating noises,the starting indices { v k } and the architecture name for each task, the size of each group in the weightpool) via a secure medium, and instantiates the carrier model by Fill ( P ∗ , f C , v C ).
We denote thefinal weight pool as P ∗ .
3.4 Decoding the Secrets from the Carrier Model
Recovering the Weight Pool.
After the carrier model is published online with open access, theattacker immediately notifies the outside colluder to download the carrier model and decode thesecret models from the carrier model.
Specifically, after colluding on the secret keys with the attackervia a secure channel (e.g., an in-person rendezvous), the outsider first decodes the weight pool basedon the colluded knowledge of the weight pool sizes and the starting index v C , i.e., by the primitive
Decode ( C, v C ) .
Specifically, the colluder first collects the parameters of different groups from thecarrier model.
Then, the attacker slices, e.g., the weight parameters into segments of length | P w | .
Thelast segment may need additional zero padding to hold the same length.
Finally, the attacker conductsa fusion operation on the N decoded segments, right-shift the fusion result by v k mod | P w | , andpermute it with a permutation inverse to the one in Fill to recover the final P w in the weight pool.
Similar operations are conducted on the bias and the scale groups.
We introduce the fusion mechanismon the N decoded segments to implement resilience against post-processing on the carrier model(§4.3).
For example, when the colluder finds the carrier model is pruned, the fusion mechanismselects the non-zero value from each weight pool copy to restore the pruned values.
More details onthe decoding procedure are provided in Algorithm A.3 of in the supplementary material.
Assembling the Secrets.
Finally, the colluder recovers the secret models f 1 , f 2 , . . .
, f M by invokingthe Fill primitive with the decoded weight pool in the previous part.
For the private dataset on whichthe adversarial purpose is functionality stealing, the attack objective is attained.
Otherwise, for thek -th target dataset, the attacker uses the securely communicated knowledge of the fixed distributionand the integer random seed to replicate the set of random noise vectors z 1 , . . .
, z N .
Finally, he/shedumps each f k ( z i ) for approximately recovering the sensitive input x i .
Evaluation Results
Datasets and Scenarios.
We evaluate the performance of Cans on three real-world public datasetscovering the scenarios of object classification, face recognition and speech recognition.
Table 1summarizes the scenarios and the statistics.
Below, we concisely introduce the dataset informationand the construction of the memorization-based secret tasks.
[Table]
• CIFAR-10 [24]: This dataset contains 60 , 000 images of daily objects (e
g., cat, trunk and ship).Each image is encoded in RGB and has the shape of 32 × 32 .•
FaceScrub [29]: This dataset contains 107 , 818 face images of 530 male and female celebritiesretrieved from the Internet.
Each image is encoded in RGB and has the shape of 224 × 224 .•
SpeechCommand (i.e., Speech ) [44]: This dataset contains 35 different voice commands spokenby multiple subjects, which is composed of over 100,000 audio files of 1 second length with asampling frequency of 16kHz.
Each audio is encoded in a one-dimensional matrix of 16 , 000 .
In each secret task, we set the dimension of the pseudorandom noise vectors as 100 and the secretmodel as an off-the-shelf generator-like architecture which is detailed in the supplementary materials.
Specification of the Carrier Model.
We consider a standard ResNet-18 [19] as the carrier model,and the training on the CIFAR-10 [24] dataset as the open task.
The total number of parameters in aResNet-18 is about 11 .
7 million, 42 .
63 MB in bytes.
Baselines.
We consider the following classical steganography schemes which are first adapted to thecontext of DNN by Song et al.
[38].• Least-Significant-Bits-based Hiding ( LSB ): With LSB , the attacker hides the secret information inthe last K bits of the floating-point representation of each parameter in a DNN.
Therefore, for aDNN carrier with L parameters, the maximal hiding capacity of the LSB scheme is LK/ 8 bytes.
In the example of ResNet-18, if the attacker uses the last 16 bits (which incurs almost no ∆ Perf ),the ResNet-18 provides a capacity of about 38 samples from FaceScrub.
This scheme provablyincurs no distortion on the hidden secrets.•
Sign-based Hiding ( Sign ): With Sign , the attacker hides the secret information in the sign bit ofeach parameter.
Therefore, a DNN carrier with L parameters provides hiding capacity of L/ 8 bytesin this scheme.•
Covariance-based Hiding ( Covariance ): With Covariance , the attacker hides the secret information by maximizing the Pearson covariance coefficients between the secret values as floating-pointvalues and the model parameters.
Therefore, a DNN carrier with L parameters provides hidingcapacity of 4 L bytes in this scheme.
It is worth to note, the latter two schemes are learning-basedand have no guarantee on the distortion which may be incurred on the hidden secrets.
Remark 4.1.
For fair comparisons, our experiments adopt the same encoding schemes for each typeof datasets when invoking Cans and the baseline methods on DNN.
Evaluation Metrics.
We measure the effectiveness of neuron steganography schemes with thefollowing metrics: (i) Reconstruction Error:
This metric measures the pairwise difference betweenthe stolen and ground-truth samples.
For each data type, the specific metric for the reconstructionerror is listed in Table 1.
(ii) Performance Difference ( ∆ Perf ): ∆ Perf measures the differencebetween the carrier model encoded with secret models and an independently trained carrier model.
A lower ∆ Perf means model hiding causes more performance overhead to the carrier model or thesecret model, which implies the carrier model has lower capacity.
Moreover, a lower carrier model∆ Perf means model hiding is less covert.
(iii)
Hiding Capacity:
As in [38], we measure the hidingcapacity by the byte size of data samples which can be hidden in the carrier model without incurringnontrivial ∆ Perf (e.g., < 1% on our specified carrier model) or perceptible reconstruction errors (e.g.,10 − 2 in MSE for images [31]).
4.1 Effectiveness of Cans
• Stealing a Single Dataset.
First, we present evaluation results on stealing data samples from eachsingle dataset with Cans and the baselines.
Fig.3 reports the performance of Cans and the baselineswhen the number of stolen examples, i.e., N , increases from 8 and 1024 on Facescrub.
As Fig.3(c)shows, Cans can steal over 1000 face images with an SSIM uniformly higher than 0 .
97 and with lessthan 1% accuracy loss on the carrier model.
This substantially surpasses the performance of existingdata hiding techniques.
On the one hand, in the upper part of Fig.3(a), the corresponding result for
Sign, Covariance and LSB is unable to be derived when N reaches 64 , 128 and 128 respectively.
It ismainly because, when the number of target inputs hits such a size, either the information capacityin the sign bit, the covariance, or the bits can no longer afford the required capacity for hiding allthe images (i.e., about 147 MB, 3 × of a ResNet-18), which directly inhibits the baselines from beingexecuted.
In contrast, based on parameter sharing instead of directly modifying the parameter for datahiding, Cans has no hard upper limit on its hiding capacity and is more flexible to more general datastealing scenarios.
On the other hand, our proposed attack achieves the optimal SSIM (with the MSEof reconstruction constantly smaller than 10 − 5 ) compared with both the Sign and the Covarianceencoding.
Although the SSIM of LSB remains 1 , it drastically hurts the performance of the carriermodel when the number of inputs reaches 64 .
In this case, the LSB encoding has to totally modify thelast 24 bits of all the FP32 parameters in ResNet-18 to afford the required capacity, which degradesthe carrier model to a totally random model.
In comparison, the carrier model in Cans preserves mostof its utility.
Table 2 additionally report the effectiveness of Cans in stealing audio data.• Stealing Heterogeneous Datasets .
Next, we evaluate the scenario of stealing secret samples frommultiple heterogeneous datasets.
Specifically, we construct memorization-oriented secret models for [Table] [Table] the three datasets and hide the secret models simultaneously in the ResNet-18 carrier model with theaid of Cans .
In our experiments, the size of stolen samples from each single dataset already exceedthe size of the carrier model, which inhibits almost all existing approaches from working in thisscenario.
In contrast, Table 3 show the average distortion with Cans on each single dataset remainsvery close to the cases when stealing each dataset alone, while the decrease in the performance of thecarrier model is controlled under 1% .
For example, on Speech, the average MSE of the recovered1024 audio segments is 4 .
1 × 10 − 4 in a 7 × 10 − 5 margin of the performance when stealing the Speech data alone. • Visualization of Stolen Samples .
For better intuition, we also qualitatively compare the results
of our attack with Covariance and Sign encoding in Fig.3(c)-(e).
For example, as is shown, our
reconstructed images and audios are almost perceptually indistinguishable with the ground-truth ones
,which conforms to our quantitative results in SSIM and MSE.
4.2 Exploring the Capacity Limits of Cans
Next, we explore the capacity limits of Cans when the number of stolen examples N increases onthe FaceScrub dataset.
As Fig.4(a) shows, there is almost no distortion on the decoded images (i.e.,
SSIM remains close to 1 . 0 ) when N increase from 8 to 1024 , while the ∆ Perf of the carrier modelis controlled below 1% .
As the size of the stolen images further doubles from 1024 to 32768 (i.e.,440 × of the size of the carrier model), we notice the SSIM gradually decreases from near 1 . 0 toabout 0 .
6 , during which the quality of the decoded images does not show clear deterioration.
Forexample, the visualization results in Fig.4(b) show, such deterioration would not inhibit the outsiderfrom further exploiting the leaked information, i.e., the identity of the photo owner can be clearlyrecognized.
In summary, Cans hides hundreds times more of information than the size of the carriermodel without incurring non-trivial distortion on either the stolen data or the carrier model.
4.3 Robustness of Cans in Noisy Channels
Finally, we evaluate the robustness of Cans when the carrier model undergoes weight pruning [18] orfilter pruning [25], i.e., where a β proportion of weight/filter parameters with the smallest norms areset to be zeros in each layer.
In our experiments, we hide 512 images from Facescrub (i.e., 294 MB [Figure] in total ( 6 . 8 × of the ResNet-18 carrier) and vary the pruning ratio β from 0 . 1 to 0 .
9 on the carriermodel.
We initialize the weight pool with a customized size 5 × smaller than the carrier model,which allows us to implement a weight pool restoration algorithm to recover the pruned parameter byselecting the non-zero value from each weight pool copy, i.e., the fusion mechanism.
Fig.4 reportsthe reconstruction error of the stolen data from FaceScrub when β varies.
As the results indicate, the
SSIM of the recovered images remains over 0 .
5 (when the corresponding distortion level does notinhibit leakage as shown in Fig.4(b)) when the carrier model suffers a huge utility loss due to thelarge pruning ratio.
For example, in Fig.4(c), when β in weight pruning reaches 0 .
3 , the performanceof the carrier model decreases by over 10% , while the SSIM of the decoded images decreases by0 .
1 from the original SSIM 0 . 994 , which therefore remains higher than 0 .
Finally, by comparingthe performance of the secret model with or without fusion, we conclude that the robustness of
Cans largely comes from the information redundancy implemented in our design of the weight pool.
Consequently, only if a weight pool parameter is not always in the β smallest for all the layers, ourdecoding algorithm can always recover its value by referring to the un-pruned copy.
Conclusion
In this paper, we design capacity-aware neuron steganography, i.e., Cans , which is the first to enablethe covert transmission of 100 × more information compared with the size of the carrier model.
Weprovide an extensive set of evaluation results to show, Cans is efficient, robust and covert in exploitingthe enormous learning capacity of the DNN for information hiding, providing a much higher hidingcapacity than known approaches.
Limitations and Future Works.
Despite the robustness against pruning, we admit Cans may be lessrobust when the architecture of the carrier model is modified.
However, it is not a common practiceof modifying the architecture of an already optimized model, except for some special cases that thecorporation wants to further optimize the storage and computing efficiency by model compression(e.g., pruning or quantization).
Nevertheless, even with model compression, the compressed versionis usually released along with the raw full-size model on most third-party platforms [4, 1].
For futureworks, it would meaningful to consider detect whether a published DNN hides information or not.
Forexample, a detector may leverage statistical testing or learning-based detection [46].
However, thiswould rarely happen in real world as the purpose of training the model is for publishing, which meanssuch a model has not been trained or been available previously.
How to detect a carrier model in sucha zero-shot or few-shot scenario is an open challenge for mitigating Cans .
To facilitate future research,we open-source our code in https://anonymous.4open.science/r/data-hiding-66D0/ .
On the Broader Impact .
Cans reveals the practical threats of breaking the privacy of ML dataeven with no exposed interface.
We hope our work would alarm AI corporations on the risks ofunnecessary access to private internal datasets even if they are safely stored in the local network.
Checklist
For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper’scontributions and scope?
[Yes](b) Did you describe the limitations of your work?
[Yes] See Section
(c) Did you discuss any potential negative societal impacts of your work?
[N/A]
(d) Have you read the ethics review guidelines and ensured that your paper conforms to them? [Yes]
If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results?
[N/A](b)
Did you include complete proofs of all theoretical results?
[N/A]3.
If you ran experiments...
(a) Did you include the code, data, and instructions needed to reproduce the main experimentalresults (either in the supplemental material or as a URL)?
[Yes] In a URL(b) Did you specify all the training details (e.g., data splits, hyperparameters, how they werechosen)?
[Yes] More details are provided in the supplemental material and the codebase.(c)
Did you report error bars (e.g., with respect to the random seed after running experimentsmultiple times)?
[N/A]
(d) Did you include the total amount of compute and the type of resources used (e.g., type ofGPUs, internal cluster, or cloud provider)?
[Yes] See the supplemental material.
[Table]
If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...
[Table]
(a) If your work uses existing assets, did you cite the creators?
[Yes]
[Table]
(b) Did you mention the license of the assets?
[Yes]
[Table]
(c) Did you include any new assets either in the supplemental material or as a URL?
[N/A]
[Table]
(d) Did you discuss whether and how consent was obtained from people whose data you’re
[Table]
using/curating?
[N/A]
[Table] (e) Did you discuss whether the data you are using/curating contains personally identifiable [Table] information or offensive content?
[N/A]
[Table]
If you used crowdsourcing or conducted research with human subjects...
[Table] (a) Did you include the full text of instructions given to participants and screenshots, if applica- [Table]
ble?
[N/A]
[Table] (b) Did you describe any potential participant risks, with links to Institutional Review Board [Table]
(IRB) approvals, if applicable?
[N/A]
[Table]
(c) Did you include the estimated hourly wage paid to participants and the total amount spent on
[Table]
participant compensation?
[N/A]
[Table]