{"id":"e81e2e1f-f185-45ea-ae7b-19c94e02f67f","arxiv_id":"2505.01749","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":1,"one_line_summary":"U-INR hides secret media inside the weights of an implicit neural network, with a private key determining which weights store the hidden data.","lead":"This paper proposes U-INR, a method that hides secret data inside the neuron weights of a neural network trained to represent images, videos, audio, or 3D scenes. A shared private key decides which weights hold the secret, so no separate encoder or decoder software is needed.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Algorithm 1 relies on an unspecified initialization function I(N[·], k_e); Section 7.1 only says Xavier initialization, so the receiver cannot deterministically regenerate M_e and the key-based extraction claim is not reproducible.","rationale":"I agree with the reader's weakest_assumption. The central claim has two parts: cross-modality hiding (empirically supported by Tables 1-3 and Figures 4-6) and key-based extraction (structurally dependent on mask regeneration). The second part is the less secure. Algorithm 1's use of an undefined I is an internal inconsistency: Section 4.2.2 says 'ensuring reproducibility' while Section 7.1 gives an initialization recipe that does not mention the key. The paper also states that users can use pre-shared Arabic numerals as the private key, but there is no description of how a numeral is converted into a random seed for Xavier, nor how the random generator is consumed (e.g., which RNG stream, order of layer initialization) so that both sender and receiver obtain identical W_e. Even a deterministic seed is insufficient unless the exact consumption order is specified, because RNG state depends on operation order. Hence the receiver's extraction cannot be independently reproduced from the manuscript. This is load-bearing: if the mask is wrong, eq. (11) reads out cover weights, and the method collapses to ordinary INR inference. I do not think this is a fatal mathematical flaw; it may be fixable by specifying I and releasing code. But as submitted, the evidence does not support the central claim, so the reject verdict stands. My stress-test does not change the reader's verdict. I also note the security claim against non-key-holders is asserted without steganalysis, but the reproducibility gap is more fundamental.","tokens_in":15920,"tokens_out":5531,"duration_ms":60699,"concrete_test":"Obtain the implementation of I from the authors or released code. If I(N[·], k_e) is not a deterministic function of k_e (e.g., k_e is not used to seed Xavier initialization), the concern is confirmed. If code is unavailable, attempt to reproduce Table 1 (S=0.3 secret PSNR on DIV2K) using the only specified initialization—plain Xavier with a fixed random seed chosen independently of the key—and then attempt extraction using the key alone; since the mask cannot be regenerated, extraction should fail. Separately, run Algorithm 1 twice with the same key and architecture but with two different random generator states for any unseeded operations; if the resulting masks are not bitwise identical, the extraction mechanism is not reproducible.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing step is the receiver's regeneration of the stega mask M_e from the private key k_e. Algorithm 1 (line 2) initializes weights W_e = I(N[·], k_e), but I is never defined anywhere in the paper. Section 7.1 states only that weights are initialized with Xavier [15], with no mention of using k_e to seed the random generator. The mask M_e is then the thresholded top-p magnitudes of W_e. If the receiver cannot reproduce the exact same W_e from k_e, sorting and thresholding will yield a different mask, and eq. (11) N[W⊙M_e](u) will select the wrong weights; the secret cannot be recovered. This is not a matter of tuning or baseline choice: it is the core functional claim that key-holders can extract. The same gap also affects the security claim, because the key's role reduces to selecting a mask, and if the mask is instead transmitted or stored implicitly, the stated 'no external extractor' property is weakened. Additionally, Algorithm 1 sorts by absolute value and uses strict '>'; if multiple initial weights share the p-th largest magnitude, the mask depends on sort order, so even a correctly seeded initialization needs a deterministic tie-break rule.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes U-INR, a steganography method that embeds secret data directly into the weights of an implicit neural representation (INR). The sender and receiver share a private key k_e; according to Algorithm 1, the key initializes the network weights, and the stega mask M_e is formed by thresholding the top S% of weights by absolute magnitude. Secret weights are then optimized to represent the secret data and frozen, while the remaining weights are optimized to represent the cover data. The receiver is supposed to regenerate M_e from k_e and extract the secret by evaluating the network with the complement of the mask zeroed, Eq. (11). Experiments cover images, video, audio, SDF, and NeRF, with image comparisons against HiDDeN, Baluja, HiNet, and PUSNet, plus a pruning-based robustness analysis.","tokens_in":16129,"tokens_out":5525,"duration_ms":57858,"significance":"If the protocol were fully specified and the security claims validated, the paper would make a useful contribution: unifying steganography across modalities through INR parameters, removing the explicit extractor as an attack surface, and reporting competitive or better image-recovery quality than existing DNN steganography methods. The cross-modality demonstrations on video, audio, SDF, and NeRF are a genuine step beyond single-modality INR steganography. However, the paper does not release code, and the central key-to-mask regeneration protocol is not specified precisely enough to reproduce, so the extraction and security claims cannot currently be verified from the manuscript alone.","major_comments":[{"comment":"Algorithm 1 initializes weights as W_e = I(N[·], k_e), but the initialization function I is never defined anywhere in the paper. Section 7.1 states only that weights are initialized with Xavier [15] and does not say that k_e is used to seed the random generator. This is load-bearing because the receiver must regenerate exactly the same W_e to sort and threshold it into M_e; if the receiver draws a different random initialization, the positions selected by Eq. (7) and Eq. (11) will not match the sender's mask, and secret extraction fails. The paper must specify a deterministic key-to-initialization mapping (e.g., a PRNG seeded with a hash of k_e) and state how ties at the threshold t_S are broken, since strict inequality with equal magnitudes makes the mask size and mask positions implementation-dependent.","section":"§4.2, Algorithm 1 line 2; §7.1"},{"comment":"The paper's own threat analysis undermines the claim that only key holders can locate the secret weights. Table 4 shows that magnitude-based pruning removes stega weights while leaving the secret representation essentially unchanged (PSNR stays at 33.86 through 20% pruning), and Fig. A.1 explicitly states that the secret-representation weights have relatively high values. An attacker who obtains the stega INR can therefore sort the weights by magnitude and recover a mask very similar to M_e without knowing k_e, then apply Eq. (11). The paper reports no steganalysis experiment, no key-less extraction attempt, and no adversarial evaluation of detectability, so the confidentiality claim in §4.4 is not supported. Please add an explicit attack model and experiments, or substantially weaken the security claims.","section":"§5.4, Table 4, Fig. A.1; §4.4 security claim"},{"comment":"The claimed generalization across modalities is demonstrated only by comparing the stega and secret representations with the original INR baseline, not with any existing modality-specific steganography method. For example, StegaNeRV [4] is discussed in §2 but not compared on video, and StegaNeRF-type methods are not compared on NeRF. Since the paper's headline contribution is 'unified' cross-modal steganography, the empirical support should include quantitative comparisons with representative modality-specific methods (or a clear statement that such comparisons are out of scope), otherwise the improvement claim in §1 ('advanced improvement compared to existing steganography methods') is limited to 2D images.","section":"§5.2, Tables 2 and 3"}],"minor_comments":[{"comment":"The phrase 'the practice of concealing for encrypted data transmission' is not grammatical; it should likely be 'the practice of concealing secret data for encrypted transmission' or similar.","section":"Abstract"},{"comment":"The symbol S is used both for the secret data and for the stega ratio, which is confusing; please use distinct notation, e.g., m for the secret message and S for the ratio.","section":"§3.0.2, Eq. (5)"},{"comment":"The sentence 'users can use pre-shared Arabic numerals as the private key k_e' is unclear: a private key in a cryptographic sense is normally a bit string, and 'Arabic numerals' does not specify an encoding; please clarify what key representation is used and how it is shared.","section":"§4.2.1"},{"comment":"The caption refers to an 'implicit neural network's weight-sharing mechanism,' but the method does not use weight sharing; the text describes masking and freezing of selected weights. Please align the caption with the actual mechanism.","section":"Figure 2 caption"},{"comment":"The audio results report MSE mean and standard deviation over 10 evaluations, but no such variance information is given for the image, video, SDF, or NeRF results; adding variance or multiple-seed reporting would strengthen the reproducibility claims.","section":"§5.2.5, Table 3"}],"recommendation":"major_revision","confidential_remarks":"The decisive issue is the unspecified keyed initialization in Algorithm 1. If the authors can specify the exact deterministic procedure (including the random seed and tie-breaking rule) and add a serious security evaluation, the paper could become viable. As written, the extraction protocol is not reproducible from the manuscript, and the security claim is contradicted by the paper's own magnitude-leakage evidence in Table 4. The missing comparisons with modality-specific baselines are a further gap that a revision should address."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague—\n\nThe useful kernel here is the key-derived mask: initialize the INR with a key-seeded RNG, sort the weights by magnitude, threshold at a stega ratio, and use the top positions as the secret mask. That specific mechanism is not in the prior INR-stego work I know, and the cross-modal experiments (image, video, audio, SDF, NeRF) give the paper a real empirical footprint. If the method works, it's a modest but solid contribution to neural-network data hiding.\n\nAlas, the central extraction claim is not reproducible from the manuscript. Algorithm 1 line 2 calls an initialization function I(N[·], k_e) that is never defined; Section 7.1 only says Xavier initialization. If the key does not seed the random generator, the receiver cannot regenerate the same W_e, hence not the mask M_e, hence not the secret. This is load-bearing, not a nit. The tie-break with strict inequality on equal-magnitude weights is a smaller version of the same problem. The paper also asserts security without steganalysis or any adversarial test; the pruning experiment is not a security test. And the evaluation compares against image stego nets like HiDDeN and HiNet, which are not weight-hiding methods; the nearest INR-stego baselines [11,33,53] are cited but never compared. Added to small cosmetic issues (audio arrows point wrong way, appendix has leftover 'JOURNAL 9'), the manuscript needs real revision.\n\nNone of this is fatal to the idea. The initialization mapping is a missing paragraph or ten lines of code; the security experiments are work, but the framework is plausible. I'd send it to a serious referee—it deserves reviewer time—but with the expectation of major revision, and I would not accept it as is. If the authors release code and specify the seeding, this could be a useful reference for INR-based hiding.","headline":"A genuinely new key-mask mechanism and broad INR experiments, but the missing key-to-initialization specification makes the core extraction claim unreproducible as written.","tokens_in":16688,"tokens_out":2408,"would_cite":false,"duration_ms":25974,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper proposes U-INR, a steganography scheme that stores cover and secret data of any modality in different neurons of a single implicit neural representation, with a private key regenerating the mask that locates the secret weights.","keywords":["digital steganography","data hiding","implicit neural representation","cross-modal steganography","key-based selection","stega mask","neural network privacy","NeRF"],"falsifier":"Train U-INR twice on identical cover and secret data with the same private key $k_e$, then try to recover the secret using a mask regenerated from a fresh run with the same key; if the two runs produce different masks or the recovered secret is unusably distorted, the claim that the key alone determines the secret's position is false.","tokens_in":15700,"feed_emoji":"🔐","tokens_out":8377,"duration_ms":79204,"temperature":0.7,"pith_summary":"The paper sets out to show that steganography does not need to be redesigned for every media type. Its method, U-INR, represents both the cover data and the secret payload inside the weights of a single implicit neural representation (an INR), so the same embedding and extraction procedure applies to images, video, audio, signed distance fields, and NeRF scenes alike. A private key shared between sender and receiver generates a binary stega mask that picks out the secret-carrying weights; the sender first fits the secret data to those masked weights and then fits the cover data to the rest, and the receiver regenerates the same mask to read the secret out. If the method works as claimed, steganography becomes format-agnostic and no longer needs external encoders or extractors, which are the components attackers currently exploit.","feed_headline":"One neural network now hides any media type in its weights","feed_subtitle":"A shared private key marks the neurons holding the secret, so there is no format-specific extractor to attack.","key_machinery":"The central object is the stega mask $M_e$, a binary vector over the INR's weights created by what the paper calls implicit consensus. Starting from the private key $k_e$, the network is initialized deterministically; the weights are then sorted by absolute value and a threshold $t_S$ is set at the $p$-th largest weight with $p = \\lfloor S \\cdot N \\rfloor$, marking every weight above the threshold as a secret position. This mask, used with the element-wise product $W \\odot M_e$, both tells the sender which weights to fit to the secret first and tells the receiver where to look for the secret later, without any side information being transmitted. Choosing the largest-magnitude weights is what keeps the network usable after a fraction $S$ of its parameters are devoted to the payload.","core_discovery":"The central claim is that hidden data can reside directly in the parameters of an INR rather than in the decoded output. U-INR derives a stega mask $M_e$ from a shared private key $k_e$: weights initialized from the key are sorted by absolute value, and the top $S \\cdot 100\\%$ are designated as the secret positions, with $S$ a steganographic ratio chosen by the user. The sender optimizes those masked weights against the secret data, then freezes them while the remaining weights are optimized against the cover data; the resulting stega representation is still an ordinary INR whose full inference reproduces the cover. A receiver who holds the key can regenerate $M_e$ and run inference on the masked weights alone to recover the secret. Because the same mask logic works for any data an INR can fit, the paper claims a single unified mechanism covers images, video, audio, signed distance fields, and 3D scenes while removing the extractor components that conventional methods expose to attackers.","pith_inferences":["Because the mask is derived from sorted weight magnitudes, the same implicit-consensus trick could be extended to embed several independent secrets at once by assigning different key-derived masks to disjoint slices of the sorted weights.","The security argument implicitly assumes the key space is large enough to resist brute-force mask search; a direct extension is to measure how many candidate keys an attacker must try before a wrong mask yields a recognizable secret.","The approach is not limited to the modalities tested: any field an INR can fit, such as a volumetric simulation or a high-dimensional sensor reading, should be embeddable by the same procedure without changing the algorithm.","Since the stega mask is visible in the magnitude distribution of the weights, a white-box observer could try to detect the secret by comparing weight statistics against a normally trained INR; the paper does not evaluate this detection scenario."],"forward_implications":["A single U-INR pipeline hides images, video, audio, signed distance fields, and NeRF scenes, since the payload lives in network weights rather than in a format-specific carrier.","The stega representation appears to ordinary inference as just the cover data, so an attentive receiver can only read the secret after regenerating the mask from the private key.","The stega ratio $S$ is a direct dial between cover fidelity and secret fidelity, with intermediate values around 30–70% giving the most balanced trade-off.","Under magnitude-based pruning, the secret weights survive longer than the cover weights, so the hidden payload is more robust to compression attacks than the steganographic cover itself.","Because no external extractor exists, there is no separate module for an attacker to corrupt or expose, which is the concrete security advantage over format-specific steganography."],"supporting_citations":[{"why":"Supplies the SIREN INR architecture and the audio/video datasets on which U-INR is implemented.","marker":"[51]"},{"why":"Supplies the NeRF formulation and scene datasets used to demonstrate 3D steganography.","marker":"[38]"},{"why":"Provides the image evaluation protocol and the purified unified steganographic network baseline that U-INR extends.","marker":"[29]"},{"why":"Gives HiDDeN, a deep image-hiding baseline that U-INR must match or exceed on image tasks.","marker":"[65]"},{"why":"Gives HiNet, an invertible-network image-hiding baseline used in comparison.","marker":"[22]"},{"why":"Supports the motivation that networks contain redundant weights at initialization, which underpins the choice to store secret data in high-magnitude weights.","marker":"[13]"},{"why":"Defines the prior cross-modality INR steganography approach whose explicit structural modification motivates U-INR's key-based, structure-preserving design.","marker":"[53]"},{"why":"Supplies the random-pruning and sparse-INR baseline used to test the robustness of the stega representation.","marker":"[24]"}],"fun_headline_variants":["Unified steganography via neuron weights, any data type","Key-based masking hides secrets inside INR parameters","One INR, any media: private key selects secret neurons","Steganography without extractors: secrets in neural weights","U-INR: hide arbitrary data in implicit neural representation"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the shared private key deterministically reproduces the same network initialization on the receiver's side; if the same key can yield different initializations, the receiver cannot reconstruct the stega mask and cannot locate the secret weights.","fun_headline_variants_meta":{"raw":{"variants":["Unified steganography via neuron weights, any data type","Key-based masking hides secrets inside INR parameters","One INR, any media: private key selects secret neurons","Steganography without extractors: secrets in neural weights","U-INR: hide arbitrary data in implicit neural representation"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000739,"raw_usage":{"total_tokens":3298,"prompt_tokens":944,"completion_tokens":2354,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":560,"completion_tokens_details":{"reasoning_tokens":2275}},"tokens_in":560,"tokens_out":2354,"duration_ms":15925,"temperature":1.0,"reasoning_tokens":2275,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T04:11:01.689451+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train U-INR twice on identical cover and secret data with the same private key $k_e$, then try to recover the secret using a mask regenerated from a fresh run with the same key; if the two runs produce different masks or the recovered secret is unusably distorted, the claim that the key alone determines the secret's position is false.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the SIREN INR architecture and the audio/video datasets on which U-INR is implemented."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the image evaluation protocol and the purified unified steganographic network baseline that U-INR extends."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Gives HiDDeN, a deep image-hiding baseline that U-INR must match or exceed on image tasks."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Gives HiNet, an invertible-network image-hiding baseline used in comparison."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines the prior cross-modality INR steganography approach whose explicit structural modification motivates U-INR's key-based, structure-preserving design."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the random-pruning and sparse-INR baseline used to test the robustness of the stega representation."}],"review_version":1}