Neural Positional Steganography

• Neural positional steganography is a technique that embeds secret data by modifying specific neuron, weight, or filter positions within deep networks.
• Techniques such as gradient-based filter insertion, key-driven masking, and implicit neural representation ensure lossless and undetectable information hiding.
• Empirical evaluations show high capacity, minimal distortion (e.g., <2% accuracy drop, PSNR≈38 dB), and robust resistance against steganalysis.

Neural positional steganography refers to a class of techniques in which the positional or structural configuration of weights, neurons, or filters in neural networks is exploited to embed, conceal, and transmit secret information, ranging from message payloads to entire neural models. Unlike traditional steganography that modifies digital signals or feature domains, neural positional steganography leverages the high-dimensional, over-parameterized structures of deep neural architectures, often achieving undetectable and losslessly recoverable information hiding. The core principle is the deliberate manipulation of positions—either neuron, filter, or weight coordinates—according to a secret key or embedding protocol to encode hidden data in ways tightly coupled to neural network architectures. Methods under this paradigm span deep model hiding, implicit neural representation–based data hiding, filter insertion, and key-driven positional masking.

1. Core Principles and Formalized Embedding Strategies

Neural positional steganography operates by reserving and manipulating specific positions in the parameter tensors or architectural layout of neural networks to encode secret information. This framework is instantiated in several leading research directions:

• Filter/Neuron Insertion in Supervised DNNs: In "Towards Deep Network Steganography: From Networks to Networks", specific convolutional filter positions are selected for the insertion of interference filters $\Delta W$ inside the secret DNN $F_{(\theta)}$, yielding an augmented stego model $G_{(\delta)}$ capable of performing a public task while losslessly embedding the secret model. The position selection is guided by the gradients of the secret network with respect to the stego task loss, with importance scores $p_j^l$ determining where insertions should be made (Li et al., 2023).
• Mask-Based Position Selection via Secret Keys: The U-INR steganography method generates a binary mask $M_e$ over the full set of network weights using a shared secret key $K$. Weights corresponding to $M_e[i]=1$ encode the secret signal, while the complement encodes cover data. This enables deterministic, key-driven identification of secret-bearing positions without requiring an external decoder (Song et al., 3 May 2025).
• Implicit Neural Representation Architecture Expansion: StegaINR embeds a secret function $f_s$ within an expanded over-parameterized MLP $f_t$, with precise neuron/weight indices tracked through per-layer bitmask keys $K$. By freezing these positions during stego-cover training, perfect extractability of the secret parameters is ensured (Liu et al., 2023).
• Positional Codes in CNN Steganalysis: In the context of cover domain image steganography, a CNN is used to compute a per-pixel cost map from the second derivatives of the network output, guiding the spatial distribution of embedding positions according to minimal detectability criteria (1711.02581).

These approaches achieve high capacity, extremely low bit error rate (often zero), and rigorous recovery guarantees, with undetectability tested via statistical and model-based steganalysis.

2. Canonical Workflows: Embedding and Extraction Algorithms

The detailed embedding/extraction pipeline is generally divided into secret selection, model expansion or modification, position hiding (for key security), and model optimization. The instantiations differ by neural architecture and targeted payload:

Scheme	Position Selection	Embedding Mechanism	Extraction Protocol
Filter Insertion (Li et al., 2023)	Gradient-based importance scoring on secret model	Insert $F_{(\theta)}$0 at top-$F_{(\theta)}$1 filter indices; hide positions via key and LSB side-channel	Key locates side filter; extracts position bitstream, removes $F_{(\theta)}$2 to recover secret
U-INR (Song et al., 3 May 2025)	Seeded absolute-magnitude rank of weight vector	Mask $F_{(\theta)}$3 determines which weights are assigned secret vs. cover, optimized in two stages	Reconstruct $F_{(\theta)}$4 from key, read secret by reusing network on reserved positions
StegaINR (Liu et al., 2023)	Per-layer binary bitmask generated by key $F_{(\theta)}$5	Frees core parameters for secret (frozen), trains expansion for cover	Key $F_{(\theta)}$6 extracts the original subnetwork; full recovery with zero BER
NeRF+Backdoor (Dong et al., 2023)	Continuous viewpoint parameter $F_{(\theta)}$7	Secret message mapped by overfitted extractor, trigger is viewpoint	Render secret view; extractor CNN reconstructs payload

Pseudocode and explicit update rules for each scheme are given in the respective references, and typical hyperparameters are reported (e.g., learning rate $F_{(\theta)}$8, expansion ratios, and optimization stages). Embedding complexity is generally linear in number of modifiable positions.

3. Security, Capacity, and Undetectability Analysis

All major positional steganography methods incorporate an explicit entropy analysis with respect to capacity, fidelity, and detectability:

• Capacity depends on the number of reserved parameters (e.g., expansion $F_{(\theta)}$9 in filter-based schemes, or stega ratio $G_{(\delta)}$0 in mask-based MLPs). U-INR demonstrates capacity up to $G_{(\delta)}$1 real degrees of freedom in an MLP with $G_{(\delta)}$2 and $G_{(\delta)}$3 (Song et al., 3 May 2025), while StegaINR routinely achieves $G_{(\delta)}$4–$G_{(\delta)}$5 bpp payload for 64$G_{(\delta)}$664 images (Liu et al., 2023).
• Fidelity/Distortion is evaluated by task metrics (e.g., classification accuracy drop $G_{(\delta)}$7–$G_{(\delta)}$8 (Li et al., 2023), PSNR/SSIM for continuous signals), and stego vs. clean models are nearly indistinguishable on typical utility functions (Liu et al., 2023, Song et al., 3 May 2025).
• Undetectability is empirically tested via statistical SVMs trained on weight histograms or randomly sampled weights; detection rates remain at random–chance (50–55%) for all assessed schemes (Li et al., 2023, Song et al., 3 May 2025, Liu et al., 2023).
• Security is strictly tied to key secrecy and the high entropy of position selection (e.g., viewpoint parameters for NeRF backdooring grant effective key entropy exceeding $G_{(\delta)}$9 bits, since deviations of $p_j^l$0 destroy extraction) (Dong et al., 2023). Attempts at brute-force enumeration or model tampering are practically infeasible in $p_j^l$1–$p_j^l$2-dimensional weight spaces.

4. Applications Across Modalities and Tasks

Neural positional steganography has been systematized for a broad range of data types and stego forms:

• Deep Model Hiding and Covert Model Transmission: Filter-interleaving and side-filter position encoding enable transmission of DNNs as innocuous stego-architectures for task obfuscation or private deployment (Li et al., 2023). Both intra-task and inter-task hiding scenarios are validated, including DnCNN denoising/segmentation and VGG-based classification.
• Implicit Neural Representation Steganography: U-INR and StegaINR generalize positional hiding to images, video, audio, SDFs, and NeRF-based 3D scenes (Song et al., 3 May 2025, Liu et al., 2023). The technique consistently achieves high-fidelity cover reconstructions ($p_j^l$3 dB, $p_j^l$4), and lossless secret recovery in all tested modalities, as measured by zero bit-error rate and ensemble steganalysis.
• Keyed Image Backdooring with NeRF: Encoding a secret message in a rendered NeRF viewpoint acts as a covert, trigger-based channel in 3D environments (Dong et al., 2023).
• Adaptive Image Steganography: Position-sensitive CNN cost maps facilitate embedding bitstreams with minimized distortion, outperforming HUGO, S-UNIWARD, and HILL in low-payload regimes (1711.02581).

5. Limitations, Trade-Offs, and Future Directions

Key limitations and open directions arise in capacity/fidelity balancing, robustness against advanced steganalysis, and operational efficiency:

• Payload–distortion trade-off: Increasing embedding ratio $p_j^l$5 or $p_j^l$6 improves secret/fidelity but degrades stego task performance past optimal points ($p_j^l$7–$p_j^l$8 in filter-based, $p_j^l$9 in U-INR) (Li et al., 2023, Song et al., 3 May 2025).
• Scaling and Modality Gaps: All-in-one frameworks like U-INR make positional steganography agnostic to input modalities, but require retraining for each secret-cover pair and rely on full-precision parameters; bit-level quantization or invertible architectures are potential improvements (Song et al., 3 May 2025).
• Decoder Artifacts and Side Channel Risks: Separate extractors (as in NeRF backdooring) are detectable as suspicious artifacts unless joint tasks are used; future work is needed in integrating extraction with benign tasks (Dong et al., 2023).
• Defenses and Attack Vectors: Capacity for pruning-resistant hiding is empirically verified, but adversarial model fingerprinting or histogram analysis could challenge undetectability; adaptive defense and attack strategies remain underexplored (Song et al., 3 May 2025).

6. Comparative Position in Steganography Research

The table below situates neural positional steganography relative to traditional and deep learning–based steganography, using empirical comparisons where available:

Method	Typical Capacity (bpp)	Secret BER	Stego Detection Rate
Traditional (e.g., HUGO)	≤0.5	0	16–33% EOOB
Deep image stego	8	0	55–99%
Model stego [Li et al.]	≈1.5	0	47–52%
StegaINR (Liu et al., 2023)	24–192	0	≈53%

Neural positional steganography substantially increases potential payload and generalizability, while empirically maintaining undetectable profiles and strict extraction guarantees. Methods based on implicit neural representations further enable a modality-agnostic unification across images, audio, and 3D scenes.

7. Outlook and Research Significance

Neural positional steganography leverages architectural degrees of freedom in DNNs and INRs for highly robust, key-driven, and statistically secure information hiding. The underlying theories of position selection (gradient importance, parameter rank, neuron masking) establish a principled foundation for next-generation covert communication, model watermarking, and privacy-preserving deployment. Current challenges center on scalable optimization, key management, and resisting emergent forms of model analysis and fingerprinting. A plausible implication is that as model-centric data modalities proliferate, positional strategies will be further integrated into secure AI systems and privacy-enhancing machine learning workflows.

For implementation, performance bounds, and direct algorithms, see (Li et al., 2023, Liu et al., 2023, Dong et al., 2023, Song et al., 3 May 2025), and (1711.02581).