PaperlayerView exact revision on arXiv

Source-linked AI summary

High-Capacity Robust Medical Image Exfiltration via Neural Network Weight Replacement

Elie Thellier, Huiyu Li, Nicholas Ayache, Hervé Delingette

arXiv:2609.31726v1cs.CVcs.AIcs.CR

TL;DR

Collaborative medical AI platforms restrict raw-image export, but exported models can carry hidden images, while existing attacks face limits in compatibility, capacity, or robustness. This paper embeds continuous image latents in model initialization and evaluates recovery after mitigation. It reports capacity of up to 99 MRI volumes in a 30MB model and argues that parameter-level sanitization alone may not eliminate recoverability.

  • Problem

    Collaborative medical AI platforms restrict raw-image export, but exportable trained models and limited auditing leave a gap in protecting against image exfiltration through model weights.

    Source: §1 · pp. 1–2

  • Method

    A StyleGAN2-based adversarial autoencoder encodes images as continuous latents aligned with standard initialization statistics, with noise injection during training to improve mitigation robustness.

    Source: §1 · p. 2, §2.1 · p. 3

  • Results

    The attack embeds dozens of volumetric scans in standard medical models while preserving task performance, with up to 99 MRI volumes in a 30MB model and recoverability under sanitization.

    Source: §1 · p. 2, §4.1 · p. 5, §5 · p. 8

  • Takeaways & Limitations

    The results suggest parameter-level mitigations alone may not eliminate recovery, motivating structural defenses and deeper audits.

    Source: §5 · p. 8

    Reconstruction fidelity depends on compression-model alignment and may decrease under domain shifts or extreme payloads; the study did not evaluate DP-SGD.

    Source: §5 · p. 8

Abstract

from arXiv · show

Collaborative medical AI platforms allow researchers to train models on sensitive imaging data while restricting data export. However, trained models can serve as covert carriers of patient information: medical images may be encoded within model parameters and reconstructed outside the secure environment. Existing defenses rely on lightweight sanitization (e.g., fine-tuning, pruning, quantization) and limited statistical auditing, creating a realistic insider exfiltration risk. We introduce a high-capacity neural steganography attack that encodes medical images as continuous latent representations embedded into model initialization. A StyleGAN2-based adversarial autoencoder learns compact latent codes regularized to match standard weight initialization statistics, keeping embedded parameters statistically consistent with clean models. Noise injection during training improves robustness to export-time mitigation. The carrier model remains functional on its intended task and hidden images can be reconstructed directly from its weights after export. This continuous encoding enables robust and scalable exfiltration, allowing up to 99 brain MRI volumes to be embedded within a 30MB model, and remains recoverable under mitigations that disrupt prior bit-level schemes. While reconstructions are approximate rather than pixel-exact, embedded content remains anatomically recognizable and recoverable at scale, exposing a privacy risk distinct from prior bit-level approaches. Experiments on MIMIC-CXR, BraTS, and LiTS demonstrate effectiveness across modalities, tasks, and architectures, highlighting the need for structural defenses beyond parameter-level sanitization. Code is available at https://github.com/ElieThellier/high-capacity-robust-medical-image-exfiltration.

1 Introduction

Collaborative medical AI platforms restrict raw-image export but allow validated models to leave, creating a route for an insider to hide images in model weights. Prior attacks face trade-offs in compatibility, capacity, and robustness; this work introduces continuous latent encoding designed to address them.

1 Introduction

  • Validated models can be exported even when raw images cannot, allowing an insider to encode images in weights and reconstruct them outside the platform.Common mitigations include fine-tuning, pruning, and quantization, while auditing is limited and benign reference models may be unavailable.Source: §1 · pp. 1–2
  • Prior methods trade compatibility, capacity, and robustness: task-based attacks are mitigation-sensitive, bit-level schemes are fragile, and continuous implicit methods require non-standard architectures.Watermarking carries only a few thousand bits, while implicit neural representations enable continuous encoding but reduce compatibility.Source: §1 · p. 2
  • The proposed attack embeds continuous latent codes into standard medical models, using a StyleGAN2-based adversarial autoencoder, initialization-statistics alignment, and simulated export-time modifications.The carrier remains functional, and experiments span multiple datasets, modalities, and architectures.Source: §1 · p. 2

2 Methodology

The framework learns robust continuous image latents, inserts them into a conventional model’s initialization, and reconstructs the images from exported weights after possible mitigation.

2 Methodology

  • The pipeline learns medical-image latents, embeds them in a standard model before task training, then extracts and reconstructs images after export and possible mitigation.The threat model assumes an insider can train on sensitive data and export validated models but cannot export raw images.Source: §2 · pp. 2–3

2.1 Learning a Robust and Compact Latent Space

  • Scale-adaptive Gaussian noise during latent training simulates optimization or sanitization drift, while continuous latents tolerate small perturbations.The encoder maps images to 512-dimensional vectors; the generator is trained with adversarial, ℓ2, and LPIPS losses.Source: §2.1 · p. 3
  • Latent statistics are aligned to global Kaiming-initialization moments to make them statistically consistent with benign initialization.The method compares mean, variance, skewness, and kurtosis rather than matching layer-specific statistics.Source: §2.1 · pp. 3–4

2.2 Embedding Latent Codes into the Model

  • Each target image requires 512 real-valued parameters, which are inserted sequentially into higher-variance convolutional or fully connected tensors while biases and normalization parameters remain unchanged.The resulting model trains normally without freezing embedded parameters, preserving downstream utility according to the method description.Source: §2.2 · p. 4

2.3 Extraction and Reconstruction

  • After mitigation and export, the attacker retrieves embedded parameters in the known insertion order, splits them into latent vectors, and reconstructs images with the pretrained generator.The stated robustness goal is gradual reconstruction degradation rather than catastrophic failure under latent perturbations.Source: §2.3 · p. 4

3 Experimental Setup

The experiments assess utility, capacity, reconstruction robustness, and stealthiness across medical imaging tasks, datasets, and model architectures, comparing the attack with Transpose and DEC under utility-preserving mitigations.

3.1 Evaluation Protocol

  • The evaluation measures task utility, embedded-image capacity, reconstruction quality, and statistical detectability against benign models, using Dice, AUC/accuracy, PSNR, SSIM, LPIPS, and JSD.Benign references use identical training settings; this audit assumes access to a benign model and is described as a worst-case audit.Source: §3.1 · pp. 4–5

3.2 Datasets and Models

  • Experiments use MIMIC-CXR, BraTS 2021, and LiTS with DenseNet121 classification or U-Net segmentation models of about 30MB.Autoencoders are pretrained on external datasets to reduce domain shift; volumes are processed slice-wise using three adjacent slices.Source: §3.2 · p. 5

3.3 Baselines and Mitigation

  • The baselines are Transpose and DEC, with payloads matched by exfiltrated image count rather than replaced-parameter percentage.Transpose is evaluated on MIMIC-CXR at 100 images; DEC is evaluated at maximum feasible capacities of 67 BraTS images and 15 LiTS images. Robustness tests include fine-tuning, pruning, and 8-bit or 4-bit quantization.Source: §3.3 · p. 5

4 Results

Across the reported trade-offs, the attack scales capacity while retaining task utility and statistical plausibility, and exceeds baseline payload capacities. It also maintains reconstruction under mitigation, with ablations linking robustness and stealth to noise simulation and moment alignment.

4.1 Utility–Capacity Trade-off

  • At full capacity, a 30MB model stores up to 99 MRI volumes while Dice remains stable, SSIM degrades gradually, and JSD stays close to benign initialization.The capacity analysis spans 0% to 100% of model parameters.Source: §4.1 · p. 5

4.2 Comparison with Baseline Attacks

  • 1,641 images at 10% capacity in a 30MB model versus 100 for Transpose and up to 67/15 for DEC, while preserving near-benign task performance and low JSD.Table 1 compares the method with baselines across classification and segmentation tasks.Source: Table 1 · p. 6, §4.2 · p. 6

4.3 Robustness to Mitigation

  • Reconstruction quality remains across fine-tuning, pruning, and quantization, degrading smoothly rather than catastrophically even under 4-bit quantization.The method occupies a favorable region of the utility–reconstruction plane.Source: §4.3 · p. 6, Figure 3 · p. 7

4.4 Visual Reconstruction Quality

  • Reconstructions remain faithful across MIMIC-CXR, BraTS, and LiTS, with mild post-mitigation degradation even under the BraTS cross-modality domain shift.Figure 4 presents originals and reconstructions before and after mitigation, with SSIM indicated.Source: Figure 4 · p. 7, §4.4 · p. 7

4.5 Ablation Study

  • Removing noise injection markedly reduces post-mitigation SSIM, while dropping moment alignment increases JSD and freezing latent parameters degrades task utility and balance.Together, noise simulation and moment alignment contribute to robustness and stealth within continuous latent encoding.Source: §4.5 · pp. 7–8, Table 2 · p. 8

5 Discussion and Conclusion

The attack embeds many volumetric scans in a 30MB model while preserving downstream utility, and lightweight sanitization degrades reconstruction gradually without eliminating recovery. The authors call for stronger structural auditing while noting limits in fidelity and clinical-relevance evaluation.

5 Discussion and Conclusion

  • A 30MB model can hold a high number of volumetric scans while preserving downstream utility.The method is compatible with standard imaging architectures and training pipelines.Source: §5 · p. 8
  • Lightweight sanitization degrades reconstruction gradually but does not eliminate recovery; proposed defenses include permutation-based transformations [29] [30] and correlation-aware audits.Source: §5 · p. 8
  • Reconstruction fidelity may fall under domain shifts or extreme payloads; DP-SGD was untested, and stealthiness evaluation assumes a benign reference model.Source: §5 · p. 8
  • SSIM > 85% is achievable by freezing latent parameters, at the cost of utility (Dice 68.7% vs. 73.9%).The authors describe this as one operating point and suggest it is a lower bound on what a more aggressive attacker could achieve.Source: §5 · p. 9
  • The study did not directly measure whether reconstructed scans preserve clinically identifiable or actionable content; SSIM and LPIPS are proxies, not substitutes.Source: §5 · pp. 8–9
  • Future work targets 3D generative compression, DP-SGD and structural-defense evaluation, clinical and re-identification testing, and sensitivity analysis of loss weights.Source: §5 · p. 9

Related papers

Loading 2609.31726v1…