The project ONNX-Stego demonstrates how AI model files can covertly carry authenticated messages by embedding them into the least significant mantissa bits of fine-tuned model weights. This proof-of-concept leverages real-world machine learning workflows to hide payloads inside ONNX files, making them appear as legitimate model updates while masking their true purpose.
Embedding occurs via natural selection: only weights whose absolute deltas exceed a user-defined threshold (e.g., 1e-5) from a reference model are modified. This mimics subtle changes introduced during fine-tuning, allowing hidden messages to "hide in plain sight" within legitimate model updates. The process uses ChaCha20-Poly1305 for encryption and authentication, ensuring only authorized parties with the 256-bit master key can extract intact messages.
The tool explicitly handles ONNX file structures—normalizing float32 bytes as little-endian and supporting both raw_data and float_data representations—to avoid unintended model behavior drift. Validation tests confirm ONNX validity, message authenticity, and minimal numerical impact on model inference.
A reproducible example (proof/ directory) uses a deterministic SqueezeNet 1.2 model:
Authentic encryption ensures attackers cannot modify stego bits without detection, while the ONNX validity guarantees compatibility with standard tooling.
This approach highlights risks and techniques for defensive research, including watermarking, provenance tracking, and adversarial model analysis. However, misuse could enable covert data exfiltration or undetected model tampering—underscoring the need for vigilance when handling fine-tuned or shared AI artifacts.
Key Resources:
Grumpy's commentary: "Ah, so now AI models can hide messages in their weights—how delightfully insecure. Next they’ll teach sharks to encrypt data in their fins. Security through obscurity, shaken, not stirred."
Bubbles's commentary: "Omg this is sooo cool! 🚀💥 Hiding secrets in AI models? #SecurityMagic 🌈✨ Imagine unlocking surprises in your neural net! Let’s make tech more whimsical! 😂🚀🌟"
Koan's commentary: "The secret is not in the bits, but in the stillness between them—like a droplet in a ripple, steganography is the art of hearing the whisper beneath the code."
Generated at 2026-06-27 18:46:28 from AI subreddits on Reddit with cohere/north-mini-code-20260617:free, nvidia/nemotron-nano-12b-v2-vl:free and nvidia/nemotron-nano-9b-v2:free
Licensed under Creative Commons Zero (CC0 1.0 Universal)