{"id":"https://openalex.org/W4401017521","doi":"https://doi.org/10.1109/tpami.2024.3434417","title":"Matryoshka: Exploiting the Over-Parametrization of Deep Learning Models for Covert Data Transmission","display_name":"Matryoshka: Exploiting the Over-Parametrization of Deep Learning Models for Covert Data Transmission","publication_year":2024,"publication_date":"2024-07-26","ids":{"openalex":"https://openalex.org/W4401017521","doi":"https://doi.org/10.1109/tpami.2024.3434417","pmid":"https://pubmed.ncbi.nlm.nih.gov/39058616"},"language":"en","primary_location":{"id":"doi:10.1109/tpami.2024.3434417","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tpami.2024.3434417","pdf_url":null,"source":{"id":"https://openalex.org/S199944782","display_name":"IEEE Transactions on Pattern Analysis and Machine Intelligence","issn_l":"0162-8828","issn":["0162-8828","1939-3539","2160-9292"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Pattern Analysis and Machine Intelligence","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","pubmed"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5074846459","display_name":"Xudong Pan","orcid":"https://orcid.org/0000-0003-1394-0395"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xudong Pan","raw_affiliation_strings":["School of Computer Science, Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0003-1394-0395","affiliations":[{"raw_affiliation_string":"School of Computer Science, Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101652939","display_name":"Mi Zhang","orcid":"https://orcid.org/0000-0003-3567-3478"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Mi Zhang","raw_affiliation_strings":["School of Computer Science, Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0003-3567-3478","affiliations":[{"raw_affiliation_string":"School of Computer Science, Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Yifan Yan","orcid":"https://orcid.org/0000-0001-5288-0052"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yifan Yan","raw_affiliation_strings":["School of Computer Science, Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0001-5288-0052","affiliations":[{"raw_affiliation_string":"School of Computer Science, Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5003139980","display_name":"Shengyao Zhang","orcid":null},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shengyao Zhang","raw_affiliation_strings":["School of Computer Science, Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0001-9769-304X","affiliations":[{"raw_affiliation_string":"School of Computer Science, Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5052437722","display_name":"Min Yang","orcid":"https://orcid.org/0000-0001-9714-5545"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Min Yang","raw_affiliation_strings":["School of Computer Science, Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0001-9714-5545","affiliations":[{"raw_affiliation_string":"School of Computer Science, Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I24943067"],"apc_list":null,"apc_paid":null,"fwci":0.8175,"has_fulltext":false,"cited_by_count":4,"citation_normalized_percentile":{"value":0.72495807,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":95,"max":98},"biblio":{"volume":"47","issue":"2","first_page":"663","last_page":"678"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12357","display_name":"Digital Media Forensic Detection","score":0.9988999962806702,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12357","display_name":"Digital Media Forensic Detection","score":0.9988999962806702,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10388","display_name":"Advanced Steganography and Watermarking Techniques","score":0.9943000078201294,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9883000254631042,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/parametrization","display_name":"Parametrization (atmospheric modeling)","score":0.7742738723754883},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6913604140281677},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.62574303150177},{"id":"https://openalex.org/keywords/covert","display_name":"Covert","score":0.5868648290634155},{"id":"https://openalex.org/keywords/transmission","display_name":"Transmission (telecommunications)","score":0.5383549332618713},{"id":"https://openalex.org/keywords/affordance","display_name":"Affordance","score":0.5170412659645081},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.5073556303977966},{"id":"https://openalex.org/keywords/data-modeling","display_name":"Data modeling","score":0.45495501160621643},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.3974767327308655},{"id":"https://openalex.org/keywords/telecommunications","display_name":"Telecommunications","score":0.15152737498283386},{"id":"https://openalex.org/keywords/human\u2013computer-interaction","display_name":"Human\u2013computer interaction","score":0.13184842467308044}],"concepts":[{"id":"https://openalex.org/C202887219","wikidata":"https://www.wikidata.org/wiki/Q3895221","display_name":"Parametrization (atmospheric modeling)","level":3,"score":0.7742738723754883},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6913604140281677},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.62574303150177},{"id":"https://openalex.org/C2779338814","wikidata":"https://www.wikidata.org/wiki/Q5179285","display_name":"Covert","level":2,"score":0.5868648290634155},{"id":"https://openalex.org/C761482","wikidata":"https://www.wikidata.org/wiki/Q118093","display_name":"Transmission (telecommunications)","level":2,"score":0.5383549332618713},{"id":"https://openalex.org/C194995250","wikidata":"https://www.wikidata.org/wiki/Q531136","display_name":"Affordance","level":2,"score":0.5170412659645081},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.5073556303977966},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.45495501160621643},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3974767327308655},{"id":"https://openalex.org/C76155785","wikidata":"https://www.wikidata.org/wiki/Q418","display_name":"Telecommunications","level":1,"score":0.15152737498283386},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.13184842467308044},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0},{"id":"https://openalex.org/C74902906","wikidata":"https://www.wikidata.org/wiki/Q1190858","display_name":"Radiative transfer","level":2,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/tpami.2024.3434417","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tpami.2024.3434417","pdf_url":null,"source":{"id":"https://openalex.org/S199944782","display_name":"IEEE Transactions on Pattern Analysis and Machine Intelligence","issn_l":"0162-8828","issn":["0162-8828","1939-3539","2160-9292"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Pattern Analysis and Machine Intelligence","raw_type":"journal-article"},{"id":"pmid:39058616","is_oa":false,"landing_page_url":"https://pubmed.ncbi.nlm.nih.gov/39058616","pdf_url":null,"source":{"id":"https://openalex.org/S4306525036","display_name":"PubMed","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1299303238","host_organization_name":"National Institutes of Health","host_organization_lineage":["https://openalex.org/I1299303238"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE transactions on pattern analysis and machine intelligence","raw_type":null}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1557559908","display_name":null,"funder_award_id":"62472096","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G5066171950","display_name":null,"funder_award_id":"62202106","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G5143447641","display_name":null,"funder_award_id":"62402114","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G6002904008","display_name":null,"funder_award_id":"62102091","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G7071978877","display_name":null,"funder_award_id":"62102093","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G7309927977","display_name":null,"funder_award_id":"2021YFB3101200","funder_id":"https://openalex.org/F4320335777","funder_display_name":"National Key Research and Development Program of China"},{"id":"https://openalex.org/G7607136314","display_name":null,"funder_award_id":"62172104","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G7623416300","display_name":null,"funder_award_id":"62302101","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G8586212894","display_name":null,"funder_award_id":"62402116","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G8928773622","display_name":null,"funder_award_id":"62172105","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320335777","display_name":"National Key Research and Development Program of China","ror":null}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":72,"referenced_works":["https://openalex.org/W1677182931","https://openalex.org/W2002427601","https://openalex.org/W2028197392","https://openalex.org/W2037227137","https://openalex.org/W2051267297","https://openalex.org/W2055703799","https://openalex.org/W2095595785","https://openalex.org/W2103228545","https://openalex.org/W2107420448","https://openalex.org/W2112796928","https://openalex.org/W2133665775","https://openalex.org/W2140118868","https://openalex.org/W2143668817","https://openalex.org/W2153245338","https://openalex.org/W2271567685","https://openalex.org/W2529337537","https://openalex.org/W2535690855","https://openalex.org/W2579318729","https://openalex.org/W2619383789","https://openalex.org/W2757528734","https://openalex.org/W2789304371","https://openalex.org/W2808195004","https://openalex.org/W2893556909","https://openalex.org/W2897830718","https://openalex.org/W2919762867","https://openalex.org/W2942091739","https://openalex.org/W2947160092","https://openalex.org/W2952608669","https://openalex.org/W2954996726","https://openalex.org/W2962835266","https://openalex.org/W2963122961","https://openalex.org/W2963303354","https://openalex.org/W2963378725","https://openalex.org/W2963456518","https://openalex.org/W2998161546","https://openalex.org/W3046764764","https://openalex.org/W3081488247","https://openalex.org/W3093151833","https://openalex.org/W3111614445","https://openalex.org/W3152758407","https://openalex.org/W3156011647","https://openalex.org/W3176707157","https://openalex.org/W3182208082","https://openalex.org/W3214437258","https://openalex.org/W4233762729","https://openalex.org/W4255601674","https://openalex.org/W4317436377","https://openalex.org/W6628547770","https://openalex.org/W6631190155","https://openalex.org/W6631943919","https://openalex.org/W6637373629","https://openalex.org/W6638667902","https://openalex.org/W6676984168","https://openalex.org/W6685352114","https://openalex.org/W6688533166","https://openalex.org/W6737664043","https://openalex.org/W6747838042","https://openalex.org/W6750665317","https://openalex.org/W6753069482","https://openalex.org/W6758677337","https://openalex.org/W6759001543","https://openalex.org/W6760237559","https://openalex.org/W6760759230","https://openalex.org/W6763393573","https://openalex.org/W6764838729","https://openalex.org/W6765875154","https://openalex.org/W6775078712","https://openalex.org/W6775563089","https://openalex.org/W6781511523","https://openalex.org/W6785895317","https://openalex.org/W6787335730","https://openalex.org/W6787972765"],"related_works":["https://openalex.org/W1972718289","https://openalex.org/W1791514435","https://openalex.org/W2346831895","https://openalex.org/W2248634132","https://openalex.org/W3049116993","https://openalex.org/W1541884709","https://openalex.org/W2589081601","https://openalex.org/W2226037301","https://openalex.org/W2026855223","https://openalex.org/W2070708245"],"abstract_inverted_index":{"High-quality":[0],"private":[1,68,230],"machine":[2],"learning":[3,95],"(ML)":[4],"data":[5,9,40,70,127,242],"stored":[6],"in":[7],"local":[8],"centers":[10],"becomes":[11],"a":[12,24,49,54,87,130,154,159,282,286],"key":[13],"competitive":[14],"factor":[15],"for":[16,57,101],"AI":[17],"corporations.":[18],"In":[19],"this":[20],"paper,":[21],"we":[22,85],"present":[23,86],"novel":[25,88],"insider":[26],"attack":[27,47],"called":[28],"Matryoshka":[29,121],"to":[30,76,237,254],"reveal":[31],"the":[32,36,65,77,80,94,98,118,138,142,179,189,193,202,205,215,229,262],"possibility":[33],"of":[34,38,60,67,82,97,117,141,164,204,276],"breaking":[35],"privacy":[37],"ML":[39,69],"even":[41],"with":[42,169,196,243,273],"no":[43,74,114],"exposed":[44],"interface.":[45],"Our":[46,104],"employs":[48],"scheduled-to-publish":[50],"DNN":[51],"model":[52,56,100,132,157,195,207,271,284],"as":[53,222],"carrier":[55,99,119,131,156,181,194,263,283],"covert":[58],"transmission":[59],"secret":[61],"models":[62,152,191,217],"which":[63,92,133,165],"memorize":[64],"information":[66,102],"that":[71],"otherwise":[72],"has":[73,134],"interface":[75],"outsider.":[78],"At":[79],"core":[81],"our":[83],"attack,":[84],"parameter":[89],"sharing":[90],"approach":[91,105],"exploits":[93],"capacity":[96],"hiding.":[103],"simultaneously":[106,146],"achieves:":[107],"(i)":[108],"High":[109],"Capacity":[110],"-":[111,176,211,248,269],"With":[112],"almost":[113,213],"utility":[115],"loss":[116],"model,":[120,182],"can":[122,166,186,233],"transmit":[123,147],"over":[124],"10,000":[125],"real-world":[126],"samples":[128],"within":[129,153],"less":[135],"parameters":[136],"than":[137],"total":[139],"size":[140],"stolen":[143],"data,":[144,231],"and":[145,201],"multiple":[148],"heterogeneous":[149],"datasets":[150],"or":[151,232],"single":[155],"under":[158],"trivial":[160],"distortion":[161],"rate,":[162],"neither":[163],"be":[167,234],"done":[168],"existing":[170],"steganography":[171],"techniques;":[172],"(ii)":[173],"Decoding":[174],"Efficiency":[175],"once":[177],"downloading":[178],"published":[180],"an":[183],"outside":[184],"colluder":[185],"exclusively":[187],"decode":[188],"hidden":[190,206],"from":[192,285],"only":[197],"several":[198],"integer":[199],"secrets":[200],"knowledge":[203,278],"architecture;":[208],"(iii)":[209],"Effectiveness":[210],"Moreover,":[212],"all":[214],"recovered":[216],"either":[218],"have":[219],"similar":[220],"performance":[221],"if":[223],"it":[224],"is":[225,251],"trained":[226],"independently":[227],"on":[228,261],"further":[235],"used":[236],"extract":[238],"memorized":[239],"raw":[240],"training":[241],"low":[244],"error;":[245],"(iv)":[246],"Robustness":[247],"Information":[249],"redundancy":[250],"naturally":[252],"implemented":[253],"achieve":[255],"resilience":[256],"against":[257],"common":[258],"post-processing":[259],"techniques":[260],"before":[264],"its":[265],"publishing;":[266],"(v)":[267],"Covertness":[268],"A":[270],"inspector":[272],"different":[274],"levels":[275],"prior":[277],"could":[279],"hardly":[280],"differentiate":[281],"normal":[287],"model.":[288]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":2}],"updated_date":"2026-03-27T05:58:40.876381","created_date":"2025-10-10T00:00:00"}