Hiding Images in Diffusion Models by Editing Learned Score Functions

1. The biggest concern for me is the practical utility for Neural Network Steganography (which hide data in a neural network). What is the advantage to use a neural network as the container, rather than some other more lightweight container such as a single image?
2. Though a PEFT method is proposed to tackle the computational overhead and a secrecy loss is proposed to preserve the generative capalicity for benign samples, finetuning the neural network still seems not a good solution, as it will manipulate the parameters, making the approximated distribution inaccuracy. Why not fix the neural network and finetune the secret key $z_s$? Moreover, this paper aims to embed a specific image into the Unet of diffusion models. However, methods like ddim inversion or textual inversion can also embed a specific image back into the latent noise with almost perfect reconstruction accuracy. What is the advantage to finetune the parameters?
3. Though the method claim that multi-image hiding is supported, the experiments are conducted in a single image manner. More details about the experiments should be included: for example, the image amount of the hiding data, the amount of finetuning layers.
4. Small Typos:

• In line 214 $xs\rightarrow x_s$

• The novelty is limited, as the paper's contributions are built upon existing algorithms. For instance, efficiency is achieved using PEFT, and the only truly innovative aspects are the proposed secrecy loss and the method for selecting sensitive layers for PEFT.
• One aspect I find unclear is why your PEFT method outperforms FFT in Table 6.
• The ablation study lacks an analysis of the impact of the $\lambda$ parameter.

1. A simple application of the diffusion model is not novel enough.
2. The work lacks the contribution summary in the manuscript.
3. The designed hybrid PEFT method seems the recombination of existing algorithms.

1. The novelty of the proposed method is limited, as techniques like fine-tuning the U-Net of diffusion models to embed specific responses or remove certain content have already been extensively explored in related work (e.g., [1]), even though this reference is not cited.

2. Embedding information through the weights of diffusion models poses practical challenges; these weights typically range between 5GB and 10GB, which results in a considerably higher transmission load compared to image-domain steganography methods.

3. Approaches such as [2] that apply steganography directly within the parameter space of models should also be included in the comparisons to offer a more comprehensive evaluation.

4. Comparisons with image-based steganography methods may not be entirely fair, as these methods prioritize maintaining similarity between the cover and steganographic images, which could impact their performance metrics in steganographic capacity or secrecy.

5. Further evaluations on additional open-source diffusion models are recommended to strengthen the assessment and generalizability of the proposed approach.

[1] @InProceedings{Gandikota_2023_ICCV, author = {Gandikota, Rohit and Materzynska, Joanna and Fiotto-Kaufman, Jaden and Bau, David}, title = {Erasing Concepts from Diffusion Models}, booktitle = {Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV)}, month = {October}, year = {2023}, pages = {2426-2436} }

[2] @inproceedings{cui2024steganographic, title={Steganographic Passport: An Owner and User Verifiable Credential for Deep Model IP Protection Without Retraining}, author={Cui, Qi and Meng, Ruohan and Xu, Chaohui and Chang, Chip-Hong}, booktitle={Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition}, pages={12302--12311}, year={2024} }