  Data hiding with deep neural networks (DNNs) has experienced impressive
successes in recent years. A prevailing scheme is to train an autoencoder,
consisting of an encoding network to embed (or transform) secret messages in
(or into) a carrier, and a decoding network to extract the hidden messages.
This scheme may suffer from several limitations regarding practicability,
security, and embedding capacity. In this work, we describe a different
computational framework to hide images in deep probabilistic models.
Specifically, we use a DNN to model the probability density of cover images,
and hide a secret image in one particular location of the learned distribution.
As an instantiation, we adopt a SinGAN, a pyramid of generative adversarial
networks (GANs), to learn the patch distribution of one cover image. We hide
the secret image by fitting a deterministic mapping from a fixed set of noise
maps (generated by an embedding key) to the secret image during patch
distribution learning. The stego SinGAN, behaving as the original SinGAN, is
publicly communicated; only the receiver with the embedding key is able to
extract the secret image. We demonstrate the feasibility of our SinGAN approach
in terms of extraction accuracy and model security. Moreover, we show the
flexibility of the proposed method in terms of hiding multiple images for
different receivers and obfuscating the secret image.
