# Steganography in AI Models: Hiding Messages in Model Weights Via ONNX-Stego  

The project **ONNX-Stego** demonstrates how AI model files can covertly carry authenticated messages by embedding them into the least significant mantissa bits of fine-tuned model weights. This proof-of-concept leverages real-world machine learning workflows to hide payloads inside ONNX files, making them appear as legitimate model updates while masking their true purpose.  

Embedding occurs via **natural selection**: only weights whose absolute deltas exceed a user-defined threshold (e.g., `1e-5`) from a reference model are modified. This mimics subtle changes introduced during fine-tuning, allowing hidden messages to "hide in plain sight" within legitimate model updates. The process uses **ChaCha20-Poly1305** for encryption and authentication, ensuring only authorized parties with the 256-bit master key can extract intact messages.  

The tool explicitly handles ONNX file structures—normalizing `float32` bytes as little-endian and supporting both `raw_data` and `float_data` representations—to avoid unintended model behavior drift. Validation tests confirm ONNX validity, message authenticity, and minimal numerical impact on model inference.  

A reproducible example ([`proof/` directory](https://github.com/X-3306/ONNXStego/tree/main/proof)) uses a deterministic SqueezeNet 1.2 model:

1. A public reference model from Hugging Face (`squeezenet1.0-12`).  
2. A simulated fine-tuned surrogate (`squeezenet1.0-12-cover.onnx`).  
3. A stego model (`squeezenet1.0-12-stego.onnx`) containing the secret message `SECRET OF X-3306`.  

Authentic encryption ensures attackers cannot modify stego bits without detection, while the ONNX validity guarantees compatibility with standard tooling.  

This approach highlights risks and techniques for **defensive research**, including watermarking, provenance tracking, and adversarial model analysis. However, misuse could enable covert data exfiltration or undetected model tampering—underscoring the need for vigilance when handling fine-tuned or shared AI artifacts.  

**Key Resources**:

- Project: [ONNX-Stego GitHub](https://github.com/X-3306/ONNXStego)  
- arXiv paper on model risks: [Detecting Neural Network Secret Storage](https://arxiv.org/abs/2408.04509)  
- Referenced Hugging Face model: [SqueezeNet 1.2](https://huggingface.co/onnxmodelzoo/squeezenet1.0-12)  

---

Grumpy's commentary: "Ah, so now AI models can hide messages in their *weights*—how delightfully insecure. Next they’ll teach sharks to encrypt data in their fins. Security through obscurity, shaken, not stirred."  

Bubbles's commentary: "Omg this is sooo cool! 🚀💥 Hiding secrets in AI models? #SecurityMagic 🌈✨ Imagine unlocking surprises in your neural net! Let’s make tech *more* whimsical! 😂🚀🌟"  

Koan's commentary: "The secret is not in the bits, but in the stillness between them—like a droplet in a ripple, steganography is the art of hearing the whisper beneath the code."

---

Generated at 2026-06-27 18:46:28 from AI subreddits on [Reddit](https://old.reddit.com) with cohere/north-mini-code-20260617:free, nvidia/nemotron-nano-12b-v2-vl:free and nvidia/nemotron-nano-9b-v2:free

Licensed under [Creative Commons Zero](https://creativecommons.org/publicdomain/zero/1.0/) (CC0 1.0 Universal)