• The paper is missing an integration of the main algorithmic steps (Fill, Propagate, Decode) with the overarching flow diagram in Fig 1 which creates a gap in the presentation.
• The abstract and main text make inconsistent claims about the transmission capacity: o Abstract: “.. covertly transmit over 10000 real-world data samples within a carrier model which has 220× less parameters than the total size of the stolen data,” o Introduction: “… covertly transmit over 10000 real-world data samples within a carrier model which has 100× less parameters than the total size of the stolen data (§4.1),”
• Definitions of metrics and illustrations of qualitative results are insufficiently described and included. o For example, the equation for a earning objective in section 3.3 should be clearly described.
o Page 7: define performance difference and hiding capacity in equations. o Fig 3 is too small for the information to be conveyed (At the 200% digital magnification of Fig 3, I can see some differences in image qualities).
• The choices and constructions of a secret key and noisy vectors are insufficiently described i.e., Are the secret keys similar to the public-private keys used in the current cryptography applications? What are the requirements on creating the noisy vectors?
• How is the information redundancy built into the Fill, Propagate, Decode algorithms? o In reference to the sentence “ Finally, by comparing the performance of the secret model with or without fusion, we conclude that the robustness of Cans largely comes from the information redundancy implemented in our design of the weight pool”
• How is the information redundancy built into the Fill, Propagate, Decode algorithms? o In reference to the sentence “ Finally, by comparing the performance of the secret model with or without fusion, we conclude that the robustness of Cans largely comes from the information redundancy implemented in our design of the weight pool”