Uncheatable Machine Learning Inference

Ashish Kundu; Josh Payne; Mustafa Canim

REVIEW 4 major objections 6 minor 15 references

Uncheatable Machine Learning Inference

T0 review · 4 major / 6 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper proposes client-side tests that give probabilistic evidence of whether an ML-as-a-service provider is cheating.

desk verdict A clear taxonomy of MLaaS cheating and a menu of plausible countermeasures, but every method is an untested sketch and the steganography pillar rests on an explicit, unsupported assumption. read the letter →

arxiv 1908.03270 v1 pith:LLXS6UCI submitted 2019-08-08 cs.LG cs.CRstat.ML

Mustafa Canim , Ashish Kundu , Josh Payne This is my paper · ORCID

classification cs.LGcs.CRstat.ML

keywords MLaaSclassificationasaserviceaccountabilitylevelagreementdeepsteganographyprobabilisticbenchmarkingadversarialrobustnessblockchainauditor

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes a set of methods by which a client can check whether an intermediary machine-learning service that claims to use a particular supplier's model is actually doing so. The central scenarios cover a trusted supplier with an untrusted intermediary, and an untrusted supplier making performance claims. The proposed toolbox includes steganographic probes that only the genuine model should decode, seed-based deterministic comparisons, probabilistic benchmarking with shared inputs, verifiable explanations or metaresults, and a black-box adversarial robustness metric. If these methods work, clients get probabilistic evidence of cheating and providers can write service-level agreements backed by verifiable quality measures.

What carries the argument

The central mechanism is the steganographic probe: an input image into which a secret message is embedded by a prep network and a hiding network, such that only the supplier's trained reveal/classifier model can decode it, while a cheaper substitute model would not. The paper also uses two secondary mechanisms: seeding, which makes model initialization and stochastic training reproducible so that identical outputs are comparable, and an adversarial query-counting procedure that measures robustness as the average number of black-box inputs needed to cross a per-class probability threshold. These mechanisms carry the verification arguments because each gives the client a comparison the cheating provider cannot easily fake.

What would settle it

Train an off-the-shelf classifier on a large set of normal inputs and the supplier-released container images, then test whether it can flag containers as anomalous; if such a cheap discriminator succeeds, the steganographic audit's central premise is false.

Watch

Extended reading notes

Core claim

The paper's central claim is that a client can, with high probability, determine whether an intermediary provider is substituting a cheaper model for the promised supplier's model, and can also benchmark an untrusted supplier's accuracy and robustness claims. For the trusted-supplier case it proposes steganographic probes generated by networks released by the supplier; when answers to probes are mostly correct, the provider is probably honest, and when they are mostly wrong, it is probably cheating. It also proposes deterministic verification by seeding, probabilistic accuracy comparison on identical inputs, and verification of supplier-generated metaresults such as explanations. For the untrusted-supplier case it proposes an adversarial procedure that measures how many black-box queries are needed to push inputs past a robustness threshold, giving a verifiable robustness score per class. The final component is a permissioned-blockchain QoS auditor in which oracles compute the model, reach consensus on its performance, and reward majority voters with tokens.

Load-bearing premise

The entire audit rests on the assumption that a cheating provider cannot build a cheaper model that recognizes the hidden-message inputs while still handling normal inputs well, a premise the paper states but does not test.

Editorial extensions

If this is right

If the steganographic probe method works, a client can run a series of probe and non-probe queries and get a statistically meaningful probability that the intermediary is or is not calling the claimed supplier.
If seeding is available, a single mismatched input-output pair between the provider and a directly queried, identically seeded supplier is enough to declare the provider fraudulent; all identical pairs certify it.
In the blackbox case, accuracy on k identical labeled inputs gives a confidence interval, so the client can trade query budget for certainty about cheating.
For an untrusted supplier, the published adversarial robustness score gives clients a quantitative, class-by-class QoS measure that can be written into an SLA.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Beyond the paper: the same probe logic could be turned into a continuous, automated audit, with a client or regulator randomly injecting steganographic probes into live traffic and aggregating results over time to catch providers that occasionally degrade service.
The paper's weakest point is also its most testable: one could attempt to train a cheap discriminator on released container images and probe outputs, and if that discriminator separates probes from normal inputs, the whole steganographic audit collapses.
The oracle-based blockchain auditor, if it works, is a general pattern: any service whose output can be recomputed by independent parties could be audited by the same token-incentivized consensus, not just classification models.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

This is a position paper, not a validated system. The authors identify a real problem—MLaaS intermediaries replacing the promised model with a cheaper one—and they lay out a taxonomy of trust scenarios plus a menu of countermeasures. The combination of steganographic probes, seeding, benchmarking, and a blockchain auditor is new as a package, and the framing around SLA verification for model quality is sensible. The paper reads clearly and gives credit to the right prior work.

What it does well is framing and scope. It correctly notes that existing MLaaS SLAs focus on uptime, not on model quality or robustness, and it breaks the problem into concrete sub-cases (trusted S with blackbox model, whitebox model, untrusted S, etc.). That is genuinely useful for anyone thinking about accountability in this space.

The soft spots are not minor. The steganography method in Section IV-A1 rests on an explicit assumption: that a cheaper model that can discriminate between message-class and object-class inputs is not viable. That assumption is stated without evidence, and it is load-bearing. Since the prep and hiding networks are released to the client, a cheating provider P can see them too and could train a simple discriminator to detect stego inputs, then pass the audit. The paper offers no argument, experiment, or reference to show why this is hard. The deterministic benchmarking claim in IV-A2—that any mismatched (x, y) pair proves fraud—ignores nondeterminism in floating-point arithmetic, GPU kernels, and possibly inference procedures. The probabilistic benchmarking section gives no sample-size analysis, no error rates, and no power calculations. The robustness metric is only a sketch.

None of the proposed methods is implemented or tested. There are no measurements, no proofs, and no system design details beyond a high-level blockchain description. The conclusion's promise that a client "will be able to determine a probability" of cheating is unsupported. The paper is a reasonable research proposal, but it does not establish that any of the methods works.

Who is this for? A researcher looking for open problems in cloud SLA verification or ML auditing might get ideas from the taxonomy. But they should not treat the proposals as ready-to-use. This is workshop material at best. I would not send it to full peer review in its current form. A serious editor could desk-reject it with an invitation to resubmit after implementing at least one method end-to-end and measuring its detection rate.

Referee Report

4 major / 6 minor

Summary. The paper addresses the problem of detecting fraudulent machine-learning-as-a-service (MLaaS) providers who claim to use a trusted supplier's model but actually use cheaper, lower-quality models. It proposes five methods: deep steganography based probes, deterministic seeding-based benchmarking, probabilistic accuracy benchmarking, verification via metaresults, black-box robustness benchmarking, and a permissioned blockchain-based auditor. The paper gives a high-level description of these methods but contains no equations beyond a loss function definition, no proofs, no algorithmic details, and no experimental evaluation. The conclusion asserts that clients will be able to determine a probability of provider cheating, but no such probability is formally derived.

Significance. If the proposed methods worked as described, the paper would make a useful contribution to MLaaS accountability, especially the idea of using steganographic probes and a distributed auditor for SLA verification. The paper identifies a real and increasingly relevant problem, and it gives credit to prior work. However, the lack of formal security analysis and empirical validation means that the significance is currently only potential. The paper's strengths are its clear problem statement and the breadth of proposed directions; its weaknesses are that each method rests on unverified assumptions and the deterministic benchmarking claim is incorrect in realistic settings.

major comments (4)

[IV-A2] The claim that 'if any pair is not identical, we can say that P is fraudulent' is false in any realistic deployment. Seeded pseudorandom number generators make training reproducible only when the entire software and hardware stack is identical; inference itself can be nondeterministic due to floating-point non-associativity, GPU kernel scheduling, and batched execution. A faithful P that truly forwards queries to S can therefore produce outputs that differ from C's locally recomputed outputs, causing the test to falsely accuse an honest provider. The authors should restrict the claim to a tightly controlled execution environment and account for the remaining nondeterminism.
[IV-A1] The security of the deep steganography audit rests entirely on the explicit assumption that a cheaper model that is not Mt and that can discriminate between inputs of the message class and object class is not viable. Because the protocol releases the prep and hiding networks to C, a cheating provider P can also obtain them and generate its own stego/non-stego training pairs. If P can train any binary classifier that distinguishes containers from ordinary inputs, P can simply return the message class for detected probes and pass the audit without ever querying S. The paper offers no argument, experimental evidence, or reference supporting the claimed infeasibility, so this load-bearing step is unsupported. The authors either need to provide a formal hardness assumption or an empirical evaluation against an actual steganalyzer.
[IV-A3] The probabilistic benchmarking method is not specified enough to support the paper's conclusion that a client can 'determine a probability of whether a MLaaS provider is cheating.' The text states that differences in accuracy may be evaluated 'with variance in mind, which is controlled by k' but does not define a test statistic, a significance level, a confidence interval, or a rule for declaring fraud. 'Mostly correct' and 'mostly incorrect' are not quantitative thresholds. The authors should provide a concrete hypothesis test, a formula for the required sample size k given a minimum detectable accuracy gap, and a bound on the false-positive rate.
[IV-C] The proposed robustness metric is not well-defined and therefore is not reproducible or measurable as stated. The phrase 'gradient of convergence to a certain robustness threshold' and the 'average number of input queries the adversarial model needs to make ... before we reach a certain classification probability' depend on unspecified algorithmic choices (query budget, step size, initialization, threshold) and on a uniform sampling distribution over the image space, which is not a well-defined probability measure. Moreover, the objective function introduced in this section does not follow from the minimax game that precedes it; the notation and derivation need to be corrected. A precise definition and a stability analysis are required before this can serve as a benchmark.

minor comments (6)

[General] The paper presents several proposals but never states their limitations or the conditions under which they fail; adding a 'Limitations' section would improve the clarity and honesty of the presentation.
[IV-A2] The phrase 'with high probability' is used without specifying the probability or the source of uncertainty; it should be made precise or removed.
[IV-A4] The assumption that metaresults cannot be forged without access to Mt is stated but never tied to a concrete cryptographic mechanism, such as digital signatures or a tamper-proof attestation protocol.
[IV-B] The description of the permissioned blockchain is too high-level; the claim that oracles are trusted or mutually untrusting and therefore will not collude is a strong assumption that needs justification, and the consensus and token mechanics are left unspecified.
[IV-C] The manuscript contains several typos and unclear passages, for example 'we are n concerned only with a dynamic generator model' in Section IV-C and the mislabeled 'Figure 3' and 'section III' in Section IV.
[Title] The title 'Uncheatable Machine Learning Inference' overstates the results: the proposed methods only reduce the probability of cheating under specific assumptions and do not make cheating impossible.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the paper is a design proposal whose protocols are definitions rather than derived predictions; the flagged steganography assumption is an unsupported correctness premise, not a circular reduction.

full rationale

The manuscript proposes accountability protocols for MLaaS and contains no quantitative derivation in which an output quantity is fitted and then re-predicted as a result. The probabilistic benchmarking method (Section IV-A3) defines a comparison protocol: C queries P and S with identical inputs and compares accuracy; this is a statistical testing procedure, not an equation that reduces to its own input. The deterministic seeding method (Section IV-A2) defines fraud as non-identical outputs given the same seed; that is an explicitly stated definitional test, and it is not disguised as an empirical prediction. The robustness metric (Section IV-C) is introduced as a definition: the number of adversarial queries needed to reach a robustness threshold, optionally passed through a sigmoid. Defining a metric is not circular derivation, even though the metric is described in terms of the adversarial model used to measure it. The one passage that must be flagged explicitly is in Section IV-A1 (Deep Steganography): 'In describing this procedure, we've assumed that generating a cheaper model that is not Mt and that can discriminate between inputs of the message class and object class is not viable.' This is a load-bearing security assumption for the steganographic audit, and the paper offers no experimental or theoretical support for it. If a cheating provider can train any discriminator between steganographic and ordinary inputs, the proposed test fails. However, the assumption is not a circular step: the paper does not fit a parameter to the test outcome and then claim that parameter as a predicted cheating probability. Under the hard rules, unsupported assumptions are correctness risks, not circularity. There are no self-citations that carry the argument, no uniqueness theorem imported from the authors' prior work, and no renamed empirical pattern presented as a new result. Accordingly, the circularity score is 0.

Assumptions & free parameters 3 free parameters · 6 assumptions · 0 invented entities

The proposed methods rely on six unvalidated capability assumptions about steganography, determinism, oracle behavior, differentiability, and unforgeability. No experiments or proofs check these assumptions, and no parameters are fit; the listed numbers are design choices.

free parameters (3)

beta (steganography loss weight)
Defined in the loss L(c,c',s,s') = ||c-c'|| + beta||s-s'|| in Section IV-A1; no numeric value is chosen in the paper and no data is fit, but the metric is hand-defined and would require tuning in any implementation.
robustness threshold
In Section IV-C, the robustness metric is the average number of adversarial queries to reach 'a certain classification probability' / threshold; the threshold is left undefined but is a hand-chosen parameter of the proposed metric.
k (number of probe samples)
In Section IV-A3, the client chooses k identical input pairs for probabilistic benchmarking; the paper gives no guidance on choosing k or the resulting confidence, so it functions as a free design parameter.

assumptions (6)

domain assumption Deep steganography can hide a message inside a cover so that the container is visually similar and the message is extractable only by the trained reveal network.
Section IV-A1 builds on [4] without questioning whether the model is robust against analysis by a fraudulent provider.
ad hoc to paper A fraudulent provider cannot train a cheaper model that identifies steganographic objects.
Explicitly assumed at the end of Section IV-A1: 'we've assumed that generating a cheaper model that is not Mt and that can discriminate between inputs of the message class and object class is not viable.'
domain assumption Seeded training is deterministic and reproduces identical model outputs across environments.
Section IV-A2 relies on seed-based reproducibility, which is not guaranteed for GPU or framework nondeterminism.
domain assumption Blockchain oracles are trusted and/or mutually untrusting and will not collude.
Section IV-B states this assumption explicitly: 'the oracles are trusted and/or mutually untrusting, and would therefore not collude to cheat the system.'
domain assumption The blackbox model Mt is differentiable, so adversarial gradients can be computed via queries.
Section IV-C's robustness method requires gradient access; the paper states Mt is differentiable, which may not hold for all deployed models.
ad hoc to paper Metaresults (explanations or QA keys) cannot be forged without access to Mt.
Section IV-A4: the method is 'predicated on the assumption that it is difficult for any provider P without access to Mt to create valid metaresults.'

how reviews work

0 comments

Cite this review

Pith. "Pith review of Uncheatable Machine Learning Inference." pith.science (2026). https://pith.science/paper/LLXS6UCI

@misc{pith2026190803270,
  author       = {Pith},
  title        = {Pith review of: Uncheatable Machine Learning Inference},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LLXS6UCI}},
  note         = {Machine review of arXiv:1908.03270}
}

abstract

Classification-as-a-Service (CaaS) is widely deployed today in machine intelligence stacks for a vastly diverse set of applications including anything from medical prognosis to computer vision tasks to natural language processing to identity fraud detection. The computing power required for training complex models on large datasets to perform inference to solve these problems can be very resource-intensive. A CaaS provider may cheat a customer by fraudulently bypassing expensive training procedures in favor of weaker, less computationally-intensive algorithms which yield results of reduced quality. Given a classification service supplier $S$, intermediary CaaS provider $P$ claiming to use $S$ as a classification backend, and customer $C$, our work addresses the following questions: (i) how can $P$'s claim to be using $S$ be verified by $C$? (ii) how might $S$ make performance guarantees that may be verified by $C$? and (iii) how might one design a decentralized system that incentivizes service proofing and accountability? To this end, we propose a variety of methods for $C$ to evaluate the service claims made by $P$ using probabilistic performance metrics, instance seeding, and steganography. We also propose a method of measuring the robustness of a model using a blackbox adversarial procedure, which may then be used as a benchmark or comparison to a claim made by $S$. Finally, we propose the design of a smart contract-based decentralized system that incentivizes service accountability to serve as a trusted Quality of Service (QoS) auditor.

Figures

Figures reproduced from arXiv: 1908.03270 by the authors.

**Figure 1.** A trusted intermediary P queries the promised supplier S when a request from C is received. exposes an API that takes as input an image and responds with a softmax probability distribution over the possible labels. The supplier claims to be using a deep neural network model with hundreds of layers trained on Tencent ML-Images2 but instead uses a Support Vector Machine (SVM) model trained on Cifar103 . SVMs are typi… view at source ↗

**Figure 2.** An untrusted, cheating intermediary P does not query the promised supplier S when a request from C is received, possibly returning cheaper classification results. II. PROBLEM DEFINITION We define a classification service supplier S to be a service entity that exposes an API that uses a model M that, when trained, computes a function Mt : X → Yˆ which takes as input an input object x ∈ X (e.g., a sequence of DNA, an … view at source ↗

**Figure 3.** We propose as a solution a set of five main methods described in section III. [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

Figures from the paper (3 more)

**Figure 4.** Figure 4: The flow of our proposed steganography-based MLaaS accountability [PITH_FULL_IMAGE:figures/full_fig_p004_4.png]

**Figure 5.** Figure 5: An outline of a decentralized MLaaS service accountability system [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]

**Figure 7.** Figure 7: One way of testing the robustness of a classification service is to [PITH_FULL_IMAGE:figures/full_fig_p006_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

15 extracted references · 7 canonical work pages

[1]

BERT: pre-training of deep bidirectional transformers for language understanding,

J. Devlin, M. Chang, K. Lee, and K. Toutanova, “BERT: pre-training of deep bidirectional transformers for language understanding,” CoRR, vol. abs/1810.04805, 2018. [Online]. Available: http://arxiv.org/abs/ 1810.04805

arXiv 2018
[2]

Cloud computingthe business perspective,

S. Marston, Z. Li, S. Bandyopadhyay, J. Zhang, and A. Ghalsasi, “Cloud computingthe business perspective,” Decision support systems , vol. 51, no. 1, pp. 176–189, 2011

work page 2011
[3]

Web service level agreement (wsla) language speciﬁcation,

H. Ludwig, A. Keller, A. Dan, R. P. King, and R. Franck, “Web service level agreement (wsla) language speciﬁcation,” Ibm corporation , pp. 815–824, 2003

work page 2003
[4]

Hiding images in plain sight: Deep steganography,

S. Baluja, “Hiding images in plain sight: Deep steganography,” in Advances in Neural Information Processing Systems 30 , I. Guyon, U. V . Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Garnett, Eds. Curran Associates, Inc., 2017, pp. 2069–2079. [Online]. Available: http://papers.nips.cc/paper/ 6802-hiding-images-in-plain-sight-deep-ste...

work page 2017
[5]

An overview of image steganography

T. Morkel, J. H. Eloff, and M. S. Olivier, “An overview of image steganography.” in ISSA, 2005, pp. 1–11

work page 2005
[6]

Reducing the dimensionality of data with neural networks,

G. E. Hinton and R. R. Salakhutdinov, “Reducing the dimensionality of data with neural networks,” science, vol. 313, no. 5786, pp. 504–507, 2006

2006
[7]

Explainable artiﬁcial intelligence (xai),

D. Gunning, “Explainable artiﬁcial intelligence (xai),” Defense Ad- vanced Research Projects Agency (DARPA), nd Web , vol. 2, 2017

work page 2017
[8]

Generative adversarial nets,

I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y . Bengio, “Generative adversarial nets,” in Advances in Neural Information Processing Systems 27 , Z. Ghahramani, M. Welling, C. Cortes, N. D. Lawrence, and K. Q. Weinberger, Eds. Curran Associates, Inc., 2014, pp. 2672–2680. [Online]. Available: http://papers...

work page 2014

Show all 15 references

[9]

Tensorﬂow: A system for large- scale machine learning,

M. Abadi, P. Barham, J. Chen, Z. Chen, A. Davis, J. Dean, M. Devin, S. Ghemawat, G. Irving, M. Isard et al., “Tensorﬂow: A system for large- scale machine learning,” in 12th {USENIX} Symposium on Operating Systems Design and Implementation ( {OSDI} 16), 2016, pp. 265–283

2016
[10]

Automatic differentiation in pytorch,

A. Paszke, S. Gross, S. Chintala, G. Chanan, E. Yang, Z. DeVito, Z. Lin, A. Desmaison, L. Antiga, and A. Lerer, “Automatic differentiation in pytorch,” 2017

2017
[11]

Caffe: Convolutional architecture for fast feature embedding,

Y . Jia, E. Shelhamer, J. Donahue, S. Karayev, J. Long, R. Girshick, S. Guadarrama, and T. Darrell, “Caffe: Convolutional architecture for fast feature embedding,” in Proceedings of the 22nd ACM international conference on Multimedia . ACM, 2014, pp. 675–678

2014
[12]

Hyperledger fabric: a distributed operating system for permissioned blockchains,

E. Androulaki, A. Barger, V . Bortnikov, C. Cachin, K. Christidis, A. De Caro, D. Enyeart, C. Ferris, G. Laventman, Y . Manevich et al. , “Hyperledger fabric: a distributed operating system for permissioned blockchains,” in Proceedings of the Thirteenth EuroSys Conference . AC...

2018
[13]

Architecture of the hyperledger blockchain fabric,

C. Cachin, “Architecture of the hyperledger blockchain fabric,” in Workshop on distributed cryptocurrencies and consensus ledgers , vol. 310, 2016, p. 4

2016
[14]

Practical black-box attacks against deep learning systems using adversarial examples,

N. Papernot, P. D. McDaniel, I. J. Goodfellow, S. Jha, Z. B. Celik, and A. Swami, “Practical black-box attacks against deep learning systems using adversarial examples,” CoRR, vol. abs/1602.02697, 2016. [Online]. Available: http://arxiv.org/abs/1602.02697

2016 arXiv
[15]

Adversarial examples in the physical world,

A. Kurakin, I. J. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” CoRR, vol. abs/1607.02533, 2016. [Online]. Available: http://arxiv.org/abs/1607.02533

2016 arXiv

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.

[1] [1]

BERT: pre-training of deep bidirectional transformers for language understanding,

J. Devlin, M. Chang, K. Lee, and K. Toutanova, “BERT: pre-training of deep bidirectional transformers for language understanding,” CoRR, vol. abs/1810.04805, 2018. [Online]. Available: http://arxiv.org/abs/ 1810.04805

arXiv 2018

[2] [2]

Cloud computingthe business perspective,

S. Marston, Z. Li, S. Bandyopadhyay, J. Zhang, and A. Ghalsasi, “Cloud computingthe business perspective,” Decision support systems , vol. 51, no. 1, pp. 176–189, 2011

work page 2011

[3] [3]

Web service level agreement (wsla) language speciﬁcation,

H. Ludwig, A. Keller, A. Dan, R. P. King, and R. Franck, “Web service level agreement (wsla) language speciﬁcation,” Ibm corporation , pp. 815–824, 2003

work page 2003

[4] [4]

Hiding images in plain sight: Deep steganography,

S. Baluja, “Hiding images in plain sight: Deep steganography,” in Advances in Neural Information Processing Systems 30 , I. Guyon, U. V . Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Garnett, Eds. Curran Associates, Inc., 2017, pp. 2069–2079. [Online]. Available: http://papers.nips.cc/paper/ 6802-hiding-images-in-plain-sight-deep-ste...

work page 2017

[5] [5]

An overview of image steganography

T. Morkel, J. H. Eloff, and M. S. Olivier, “An overview of image steganography.” in ISSA, 2005, pp. 1–11

work page 2005

[6] [6]

Reducing the dimensionality of data with neural networks,

G. E. Hinton and R. R. Salakhutdinov, “Reducing the dimensionality of data with neural networks,” science, vol. 313, no. 5786, pp. 504–507, 2006

2006

[7] [7]

Explainable artiﬁcial intelligence (xai),

D. Gunning, “Explainable artiﬁcial intelligence (xai),” Defense Ad- vanced Research Projects Agency (DARPA), nd Web , vol. 2, 2017

work page 2017

[8] [8]

Generative adversarial nets,

I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y . Bengio, “Generative adversarial nets,” in Advances in Neural Information Processing Systems 27 , Z. Ghahramani, M. Welling, C. Cortes, N. D. Lawrence, and K. Q. Weinberger, Eds. Curran Associates, Inc., 2014, pp. 2672–2680. [Online]. Available: http://papers...

work page 2014