# High-Capacity Robust Medical Image Exfiltration via Neural Network Weight Replacement

arXiv: https://arxiv.org/abs/2609.31726 · HTML: https://mlsanity.com/paper/2609.31726/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 25 of its 32 references that are in the map.
- First posted on arXiv 22 Sep 2026.

## Builds on (most cited first, 25 of 25)

- [The Unreasonable Effectiveness of Deep Features as a Perceptual Metric](https://mlsanity.com/paper/1801.03924/) (2018)
- [Delving Deep into Rectifiers: Surpassing Human-Level Performance on ImageNet Classification](https://mlsanity.com/paper/1502.01852/) (2015)
- [Analyzing and Improving the Image Quality of StyleGAN](https://mlsanity.com/paper/1912.04958/) (2019)
- [Deep Learning with Differential Privacy](https://mlsanity.com/paper/1607.00133/) (2016)
- [MIMIC-CXR-JPG, a large publicly available database of labeled chest radiographs](https://mlsanity.com/paper/1901.07042/) (2019)
- [Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks](https://mlsanity.com/paper/1805.12185/) (2018)
- [The RSNA-ASNR-MICCAI BraTS 2021 Benchmark on Brain Tumor Segmentation and Radiogenomic Classification](https://mlsanity.com/paper/2107.02314/) (2021)
- [The Liver Tumor Segmentation Benchmark (LiTS)](https://mlsanity.com/paper/1901.04056/) (2019)
- [Machine Learning Models that Remember Too Much](https://mlsanity.com/paper/1709.07886/) (2017)
- [Fine-Tuning Is All You Need to Mitigate Backdoor Attacks](https://mlsanity.com/paper/2212.09067/) (2022)
- [3D-StyleGAN: A Style-Based Generative Adversarial Network for Generative Modeling of Three-Dimensional Medical Images](https://mlsanity.com/paper/2107.09700/) (2021)
- [The Brain Tumor Sequence Registration (BraTS-Reg) Challenge: Establishing Correspondence Between Pre-Operative and Follow-up MRI Scans of Diffuse Glioma Patients](https://mlsanity.com/paper/2112.06979/) (2021)
- [Spread-Transform Dither Modulation Watermarking of Deep Neural Network](https://mlsanity.com/paper/2012.14171/) (2020)
- [Data Lakes: A Survey of Functions and Systems](https://mlsanity.com/paper/2106.09592/) (2021)
- [Purified and Unified Steganographic Network](https://mlsanity.com/paper/2402.17210/) (2024)
- [Robust and Large-Payload DNN Watermarking via Fixed, Distribution-Optimized, Weights](https://mlsanity.com/paper/2208.10973/) (2022)
- [Steganography of Steganographic Networks](https://mlsanity.com/paper/2302.14521/) (2023)
- [Transpose Attack: Stealing Datasets with Bidirectional Training](https://mlsanity.com/paper/2311.07389/) (2023)
- [Hiding Functions within Functions: Steganography by Implicit Neural Representations](https://mlsanity.com/paper/2312.04743/) (2023)
- [NeuPerm: Disrupting Malware Hidden in Neural Network Parameters by Leveraging Permutation Symmetry](https://mlsanity.com/paper/2510.20367/) (2025)
- [On Hiding Neural Networks Inside Neural Networks](https://mlsanity.com/paper/2002.10078/) (2020)
- [On the Steganographic Capacity of Selected Learning Models](https://mlsanity.com/paper/2308.15502/) (2023)
- [Defending against Stegomalware in Deep Neural Networks with Permutation Symmetry](https://mlsanity.com/paper/2509.20399/) (2025)
- [Mitigating Data Exfiltration Attacks through Layer-Wise Learning Rate Decay Fine-Tuning](https://mlsanity.com/paper/2509.00027/) (2025)
- [Data Exfiltration by Compression Attack: Definition and Evaluation on Medical Image Data](https://mlsanity.com/paper/2511.21227/) (2025)

## Abstract (arXiv)

Collaborative medical AI platforms allow researchers to train models on sensitive imaging data while restricting data export. However, trained models can serve as covert carriers of patient information: medical images may be encoded within model parameters and reconstructed outside the secure environment. Existing defenses rely on lightweight sanitization (e.g., fine-tuning, pruning, quantization) and limited statistical auditing, creating a realistic insider exfiltration risk. We introduce a high-capacity neural steganography attack that encodes medical images as continuous latent representations embedded into model initialization. A StyleGAN2-based adversarial autoencoder learns compact latent codes regularized to match standard weight initialization statistics, keeping embedded parameters statistically consistent with clean models. Noise injection during training improves robustness to export-time mitigation. The carrier model remains functional on its intended task and hidden images can be reconstructed directly from its weights after export. This continuous encoding enables robust and scalable exfiltration, allowing up to 99 brain MRI volumes to be embedded within a 30MB model, and remains recoverable under mitigations that disrupt prior bit-level schemes. While reconstructions are approximate rather than pixel-exact, embedded content remains anatomically recognizable and recoverable at scale, exposing a privacy risk distinct from prior bit-level approaches. Experiments on MIMIC-CXR, BraTS, and LiTS demonstrate effectiveness across modalities, tasks, and architectures, highlighting the need for structural defenses beyond parameter-level sanitization. Code is available at https://github.com/ElieThellier/high-capacity-robust-medical-image-exfiltration.