List of Papers Browse by Subject Areas Author List
Abstract
Collaborative medical AI platforms allow researchers to train models on sensitive imaging data while restricting data export. However, trained models can serve as covert carriers of patient information: medical images may be encoded within model parameters and reconstructed outside the secure environment. Existing defenses rely on lightweight sanitization (e.g., fine-tuning, pruning, quantization) and limited statistical auditing, creating a realistic insider exfiltration risk.
We introduce a high-capacity neural steganography attack that encodes medical images as continuous latent representations embedded into model initialization. A StyleGAN2-based adversarial autoencoder learns compact latent codes regularized to match standard weight initialization statistics, keeping embedded parameters statistically aligned with clean models. Noise injection during training improves robustness to export-time mitigation. The carrier model remains functional on its intended task and hidden images can be reconstructed directly from the model weights after export.
This continuous encoding enables robust and scalable exfiltration, allowing up to 99 brain MRI volumes to be embedded within a 30MB model, and remains recoverable under mitigations that disrupt prior bit-level schemes. While reconstructions are approximate rather than lossless, embedded content remains anatomically recognizable and recoverable at scale, exposing a privacy risk distinct from prior bit-level approaches. Experiments on MIMIC-CXR, BraTS, and LiTS demonstrate effectiveness across modalities, tasks, and architectures, highlighting the need for structural defenses beyond parameter-level sanitization.
Links to Paper and Supplementary Materials
Main Paper (Open Access Version): https://papers.miccai.org/miccai-2026/paper/3616_paper.pdf
SharedIt Link: Not yet available
SpringerLink (DOI): Not yet available
Supplementary Material: Not Submitted
Link to the Code Repository
N/A
Link to the Dataset(s)
MIMIC-CXR dataset: https://physionet.org/content/mimic-cxr-jpg/2.1.0/
BraTS 2021 dataset: https://www.synapse.org/Synapse:syn25829067/wiki/610863
LiTS dataset: https://competitions.codalab.org/competitions/17094
FLARE 2021 dataset: http://flare.grand-challenge.org/
BraTS-Reg 2022 dataset: https://bratsreg.github.io/
BibTex
@InProceedings{TheEli_HighCapacity_MICCAI2026,
author = { Thellier, Elie AND Li, Huiyu AND Ayache, Nicholas AND Delingette, Hervé},
title = { { High-Capacity Robust Medical Image Exfiltration via Neural Network Weight Replacement } },
booktitle = {Medical Image Computing and Computer Assisted Intervention -- MICCAI 2026},
year = {2026},
publisher = {Springer Nature Switzerland},
volume = {LNCS 16896},
month = {September},
page = {pending}
}
Reviews
Review #1
- Please describe the contribution of the paper
This paper proposes a novel data exfiltration method that embeds continuous latent codes into a model prior to standard training. The proposed method successfully reconstructs target data from the trained model with high stealthiness and without compromising utility. The work highlights critical data privacy concerns, which are particularly significant in the medical field.
- Please list the major strengths of the paper: you should highlight a novel formulation, an original way to use data, demonstration of clinical feasibility, a novel application, a particularly strong evaluation, or anything else that is a strong aspect of this work. Please provide details, for instance, if a method is novel, explain what aspect is novel and why this is interesting.
- The paper introduces a novel training data extraction method based on stealthy latent code embedding.
- The experiments are well-constructed and effectively validate the proposed methodology.
- The method causes minimal utility degradation even at 100% attack capacity, successfully storing up to 99 MRI volumes.
- Please list the major weaknesses of the paper. Please provide details: for instance, if you state that a formulation, way of using data, demonstration of clinical feasibility, or application is not novel, then you must provide specific references to prior work.
- Despite strong quantitative performance, the qualitative results do not appear to represent an exact extraction of the target data. For instance, in the BraTS dataset, the structural features of the reconstructed brains differ significantly from the originals. What evidence ensures that these are reconstructed target data points rather than purely synthetic images?
- The method embeds latent codes as part of the model initialization, and the model is subsequently trained without freezing these embedded parameters. Given this configuration, can the embedded parameters reliably preserve the stored data when subjected to Differential Privacy Stochastic Gradient Descent (DP-SGD)?
- Please rate the clarity and organization of this paper
Good
- Please comment on the reproducibility of the paper. Please be aware that providing code and data is a plus, but not a requirement for acceptance.
The submission does not mention open access to source code or data, but provides a clear and detailed description of the algorithm to ensure reproducibility.
- Based on your review and your understanding of the MICCAI Scientific Code of Ethics, do you believe this submission may involve a potential ethics concern or violation?
N/A
- Optional: If you have any additional comments to share with the authors, please provide them here. Please also refer to our Reviewer’s guide on what makes a good review and pay specific attention to the different assessment criteria for the different paper categories: https://conferences.miccai.org/2026/en/REVIEWER-GUIDELINES.html
N/A
- Rate the paper on a scale of 1-6, 6 being the strongest (6-4: accept; 3-1: reject). Please use the entire range of the distribution. Spreading the score helps create a distribution for decision-making.
(5) Accept — should be accepted, independent of rebuttal
- Please justify your recommendation. What were the major factors that led you to your overall score for this paper?
The arguments presented in the paper are convincing, and the experiments are well-designed to demonstrate the effectiveness of the proposed method. Despite the minor weaknesses noted above, the paper provides a sufficient warning to the community regarding data exfiltration threats. Based on these considerations, my decision leans toward accept.
- Reviewer confidence
Confident but not absolutely certain (3)
- [Post rebuttal] After reading the authors’ rebuttal, please state your final opinion of the paper.
Accept
- [Post rebuttal] Please justify your final decision from above.
This paper makes a timely contribution to the MICCAI community by addressing an important issue regarding deep learning in the medical domain. Although Reviewer #3 raised some concerns about the experimental evidence, I believe this is largely due to space constraints, as Reviewer #2 also noted. Overall, I recommend acceptance and hope the authors will consider extending this work into a journal version.
Review #2
- Please describe the contribution of the paper
This paper proposes a novel attack of exporting protected data via encoding data into a network which is exported. The threat model assumes an adversary with internal system access.
- Please list the major strengths of the paper: you should highlight a novel formulation, an original way to use data, demonstration of clinical feasibility, a novel application, a particularly strong evaluation, or anything else that is a strong aspect of this work. Please provide details, for instance, if a method is novel, explain what aspect is novel and why this is interesting.
Overall, I think this paper is a strong submission and has high relevance for the MICCAI community. It once more demonstrates that exporting models without principled defenses does not provide any protection of data and information leakage. The evaluation along four axes is thorough and provides a robust overview of the situation.
- Please list the major weaknesses of the paper. Please provide details: for instance, if you state that a formulation, way of using data, demonstration of clinical feasibility, or application is not novel, then you must provide specific references to prior work.
There are only minor points I miss in the paper, but many are also probably due to the page limit restrictions. First, I think it would make the paper more accessible to discuss the threat model and its applicability as well as the implications of this paper in more detail. Moreover, I would have loved to see a more in-depth discussion which not only lays out mitigation strategies, but also principled approaches such as Differential Privacy.
- Please rate the clarity and organization of this paper
Good
- Please comment on the reproducibility of the paper. Please be aware that providing code and data is a plus, but not a requirement for acceptance.
The submission does not mention open access to source code or data, but provides a clear and detailed description of the algorithm to ensure reproducibility.
- Based on your review and your understanding of the MICCAI Scientific Code of Ethics, do you believe this submission may involve a potential ethics concern or violation?
N/A
- Optional: If you have any additional comments to share with the authors, please provide them here. Please also refer to our Reviewer’s guide on what makes a good review and pay specific attention to the different assessment criteria for the different paper categories: https://conferences.miccai.org/2026/en/REVIEWER-GUIDELINES.html
N/A
- Rate the paper on a scale of 1-6, 6 being the strongest (6-4: accept; 3-1: reject). Please use the entire range of the distribution. Spreading the score helps create a distribution for decision-making.
(5) Accept — should be accepted, independent of rebuttal
- Please justify your recommendation. What were the major factors that led you to your overall score for this paper?
An important and highly relevant study for the MICCAI community.
- Reviewer confidence
Very confident (4)
- [Post rebuttal] After reading the authors’ rebuttal, please state your final opinion of the paper.
Accept
- [Post rebuttal] Please justify your final decision from above.
While I still think the paper should be accepted, I’m actually disappointed that the authors are so hand-wavy about the DP comment that was made by all reviewers. The privacy-utility trade-off depends on the privacy budget and can be modulated as desired. The author’s rebuttal argument is, in my opinion, insufficient at best. So while I was convinced the paper should be accepted, the rebuttal really made me consider voting to reject now.
Review #3
- Please describe the contribution of the paper
The paper proposes a neural steganography attack that encodes medical images into a standard medical model’s weights via a StyleGAN2-based adversarial autoencoder. Image latents (512-d) replace selected conv/FC tensors at initialization. Moment-matching loss aligns latents with Kaiming statistics, and training-time noise injection aims to survive sanitization. On MIMIC-CXR, BraTS, and LiTS, the method reportedly embeds up to 1,641 slice-level latents in a 30MB model while preserving task utility and degrading under fine-tuning, pruning, and quantization.
- Please list the major strengths of the paper: you should highlight a novel formulation, an original way to use data, demonstration of clinical feasibility, a novel application, a particularly strong evaluation, or anything else that is a strong aspect of this work. Please provide details, for instance, if a method is novel, explain what aspect is novel and why this is interesting.
1.Continuous latent encoding is a principled improvement over bit-level steganography. Bit-flip fragility under perturbation is a real limitation of prior schemes, and Fig. 3 shows the expected advantage against DEC. 2.Moment-matching to Kaiming statistics is a sensible stealth mechanism. Table 2 confirms JSD rises from 0.02 to 0.18 when the loss is removed. 3.Evaluation spans three datasets, two tasks, two architectures, and six mitigation strategies.
- Please list the major weaknesses of the paper. Please provide details: for instance, if you state that a formulation, way of using data, demonstration of clinical feasibility, or application is not novel, then you must provide specific references to prior work.
1.Reconstruction fidelity is too poor to support the privacy-attack claim. Table 1 reports SSIM 64.4 and LPIPS 0.32 on MIMIC-CXR, SSIM 53.2 and LPIPS 0.35 on LiTS. LPIPS above 0.3 means perceptually distant reconstructions. The paper never shows that these outputs preserve identity, anatomy, or PHI-relevant content. Without this, the attack is not demonstrated to leak anything meaningful. 2.Stealthiness evaluation contradicts the stated threat model. Sec. 5 admits defenders lack trusted benign references, yet the stealth claim rests entirely on JSD against benign. 3.No evaluation against the defenses the paper itself identifies as relevant. Not testing them makes “current defenses are insufficient” unsupported. 4.DEC comparison is asymmetric. DEC is evaluated at 67/15 image capacity while the proposed method is at 1,641.A matched-capacity comparison is missing and would likely narrow the robustness gap substantially.
- Please rate the clarity and organization of this paper
Satisfactory
- Please comment on the reproducibility of the paper. Please be aware that providing code and data is a plus, but not a requirement for acceptance.
The submission does not provide sufficient information for reproducibility.
- Based on your review and your understanding of the MICCAI Scientific Code of Ethics, do you believe this submission may involve a potential ethics concern or violation?
N/A
- Optional: If you have any additional comments to share with the authors, please provide them here. Please also refer to our Reviewer’s guide on what makes a good review and pay specific attention to the different assessment criteria for the different paper categories: https://conferences.miccai.org/2026/en/REVIEWER-GUIDELINES.html
1.Sec. 2.2 “prioritizing larger high-variance tensors” is not a reproducible selection rule. Specify the algorithm. 2.Define “Foreground only” in Fig. 2(b). 3.Table 2 w/o Layer Selection is nearly identical to Full on post-mitigation SSIM. Justify retaining this component. 4.Provide a sensitivity study on lambda_noise, lambda_skew, lambda_kurt. 5.Report identification/re-identification metrics (slice-level retrieval accuracy) rather than just SSIM/LPIPS, since these determine actual privacy consequence.
- Rate the paper on a scale of 1-6, 6 being the strongest (6-4: accept; 3-1: reject). Please use the entire range of the distribution. Spreading the score helps create a distribution for decision-making.
(2) Reject — should be rejected, independent of rebuttal
- Please justify your recommendation. What were the major factors that led you to your overall score for this paper?
The central claim of the paper is a high-capacity, robust and stealthy medical image exfiltration attack. All properties are inadequately supported. Reconstruction fidelity at the advertised capacity is too low to demonstrate privacy leakage. Stealthiness uses a metric the stated threat model says defenders cannot compute. The paper names permutation-based defenses as the relevant countermeasure and does not test them. Combined with misleading capacity framing and asymmetric baseline comparison, this does not meet the bar for a MICCAI paper.
- Reviewer confidence
Confident but not absolutely certain (3)
- [Post rebuttal] After reading the authors’ rebuttal, please state your final opinion of the paper.
Reject
- [Post rebuttal] Please justify your final decision from above.
I thank the authors for the detailed response. The authors’ intent are clarified in the response, but it does not fully resolve my concerns. The privacy-attack claim still needs evidence that the reconstructions leak meaningful information such as identity, anatomy, pathology, or PHI-relevant content; visual examples and the reported SSIM/LPIPS are not enough. The stealthiness evaluation also still relies on benign references, which contradicts the stated threat model. Relevant defenses such as DP-SGD and structural defenses are acknowledged but not tested, so the defense claim should be narrowed. The DEC comparison also remains asymmetric because matching payload alone does not replace a matched-capacity or matched-budget comparison. Overall, the rebuttal reframes the claim but does not provide the missing evidence.
Author Feedback
We thank the reviewers for their constructive feedback and for acknowledging the novelty and relevance of the proposed attack. We agree that several aspects require clarification, particularly reconstruction fidelity, defenses, and evaluation scope.
Our work shows that continuous latent encoding enables high-capacity and mitigation-resilient extraction of semantically meaningful medical image content. The goal is not exact memorization but robust scalable exfiltration under realistic export conditions.
1.Reconstruction fidelity and privacy relevance R3 questions whether imperfect quantitative metrics demonstrate meaningful reconstruction. R1 suggests outputs may be synthetic rather than memorized.
Our method does not produce pixel-perfect reconstructions, especially under domain shift. However, reconstructed images are decoded from latent vectors directly linked to training samples rather than unconstrained synthetic samples, and degradation is caused by perturbations during optimization and mitigation.
The reconstructed images (Fig. 4) remain anatomically recognizable across modalities after mitigation, including tumor regions (BraTS), lung anatomy (MIMIC-CXR), and liver morphology (LiTS). Global SSIM underestimates preservation of clinically relevant regions because large uniform backgrounds dominate many medical images. Foreground-only SSIM (Fig. 2b), masking low-intensity regions, reaches 88% indicating strong anatomical preservation. Our claim is therefore not exact reconstruction, but semantic leakage of training data information at high capacity and robustness. Prior privacy work shows that partial leakage (e.g., membership/property inference) is considered sensitive, as approximate reconstructions may still reveal anatomical structure, pathology, or acquisition details.
Reconstruction quality also reflects a trade-off between fidelity, robustness, utility, and capacity. Table 2 shows SSIM >85% is achievable by freezing latent parameters, but at utility cost. Reducing noise injection improves fidelity but weakens robustness. Retrieval/re-identification metrics would further characterize leakage, but are a downstream analysis beyond our focus on exfiltration.
2.Defenses and comparison fairness Reviewers note missing DP-SGD and structural defenses and R3 questions DEC comparison fairness.
We acknowledge DP-SGD as a principled mitigation that may reduce robustness since we rely on stable latent preservation during optimization. However, it introduces a strong utility-privacy trade-off sensitive to privacy budget and tuning, and can degrade utility in benign settings. Systematic evaluation is needed in future work. Permutation-based defenses [29,30] are recent structural defenses that emerged after our implementation phase and are set for future work. We do not claim all defenses fail; rather, lightweight parameter-level sanitization is insufficient against continuous latent encoding.
For DEC, we match by payload rather than parameter percentage since its bit-level encoding is substantially less capacity-efficient. Matching percentages would result in unrealistic comparisons (1-6 images for DEC vs >1,600 at 10% capacity). Fig. 2 shows our method remains stable under increasing payload. The robustness gap stems from intrinsic fragility of DEC’s bit-level steganography under perturbation rather than differences in capacity.
3.Threat model and clarifications R3 questions JSD usage and reproducibility clarifications.
JSD against benign references is used as an auxiliary, stronger-than-threat-model analysis. Demonstrating low divergence under this worst-case evaluation protocol provides a strong upper-bound assessment of the stealthiness claim.
Layer selection strategy follows [15]: ranking tensors by expected Kaiming variance and inserting payload sequentially into higher-variance tensors that better tolerate perturbations. Lambda parameters were empirically chosen to balance convergence, stealth, and robustness.
Meta-Review
Meta-review #1
- Your recommendation
Invite for Rebuttal
- Please justify your decision. In case you deviate from the reviewers’ recommendations, explain in detail the reasons why. In case of an invitation for rebuttal, clarify which points are important to address in the rebuttal.
While all the three reviewers agree that the paper proposes a reasonably novel and relevant training data extraction attack, Reviewer #3 has raised some valid concerns about the reconstruction fidelity (especially the quantitative metrics), fair comparison against baselines, and robustness against defenses. These issues must be clarified in the rebuttal.
- After you have reviewed the rebuttal and updated reviews, please provide your recommendation based on all reviews and the authors’ rebuttal.
Accept
- Please justify your recommendation.
The paper proposes a reasonably novel attack. The rebuttal has clarified the issue of reconstruction fidelity, which partially addresses the concern. The issue of fair comparison against baselines (e.g., DEC) has also been clarified in the rebuttal. The response regarding DP-SGD defense is unsatisfactory and is a key limitation of the paper. Overall, the paper can be accepted, but the limitations must be clearly highlighted in the final version.
Meta-review #2
- After you have reviewed the rebuttal and updated reviews, please provide your recommendation based on all reviews and the authors’ rebuttal.
Accept
- Please justify your recommendation.
The paper proposes an interesting training data extraction attack while motivating the development of more effective defenses. There are concerns related to utility-capacity trade-off, reconstruction quality, and tested defense. Overall the paper has merit and reasonably good contribution to be presented at MICCAI.
Meta-review #3
- After you have reviewed the rebuttal and updated reviews, please provide your recommendation based on all reviews and the authors’ rebuttal.
Accept
- Please justify your recommendation.
The paper introduces a highly novel and timely threat model to medical data privacy: leveraging neural network weight replacement via a StyleGAN2-based adversarial autoencoder to covertly exfiltrate sensitive medical images. Reviewers #1 and #2 strongly recognize the clinical significance and urgency of exposing this vulnerability, noting the impressive payload capacity (99 brain MRI volumes) achieved without compromising the primary medical task’s functionality. While Reviewers #2 and #3 raised valid and critical concerns regarding the authors’ evasive rebuttal on Differential Privacy (DP-SGD) baselines, the missing evaluation on clinical content leakage, and a reliance on benign references, the conceptual contribution of revealing this sophisticated exfiltration vector is considered to outweigh these empirical gaps. While the authors’ handling of privacy baselines was suboptimal, the conceptual contribution of revealing this sophisticated exfiltration vector is highly valuable to the community and exposes critical limitations of existing parameter-level defenses.