# Disarming Steganography Attacks Inside Neural Network Models

arXiv: https://arxiv.org/abs/2309.03071 · HTML: https://mlsanity.com/paper/2309.03071/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 6 Sep 2023.

## Built on by (most cited first, 3 of 3)

- [Model X-Ray: Detection of Hidden Malware in AI Model Weights using Few Shot Learning](https://mlsanity.com/paper/2409.19310/) (2024)
- [Zero-Trust Artificial Intelligence Model Security Based on Moving Target Defense and Content Disarm and Reconstruction](https://mlsanity.com/paper/2503.01758/) (2025)
- [MEASER: Malware embedding attacks on open-source LLMs](https://mlsanity.com/paper/2510.10486/) (2025)

## Abstract (arXiv)

Similar to the revolution of open source code sharing, Artificial Intelligence (AI) model sharing is gaining increased popularity. However, the fast adaptation in the industry, lack of awareness, and ability to exploit the models make them significant attack vectors. By embedding malware in neurons, the malware can be delivered covertly, with minor or no impact on the neural network's performance. The covert attack will use the Least Significant Bits (LSB) weight attack since LSB has a minimal effect on the model accuracy, and as a result, the user will not notice it. Since there are endless ways to hide the attacks, we focus on a zero-trust prevention strategy based on AI model attack disarm and reconstruction. We proposed three types of model steganography weight disarm defense mechanisms. The first two are based on random bit substitution noise, and the other on model weight quantization. We demonstrate a 100% prevention rate while the methods introduce a minimal decrease in model accuracy based on Qint8 and K-LRBP methods, which is an essential factor for improving AI security.