Model details — full reference

§1Identity

§2Architecture

This section is the precise spec for the deployed carrier — autohide/.../1024bit_noamp_keepckpt/idea097_design001, the same checkpoint that powers the public imagehide-demo. Variable / module names in this section refer to autohide/.../idea097_design001/code/inn_model.py (verified against train_args.txt: --num_blocks 8 --subnet_type light --secret_len 1024 --no-amp). The simpler "uniform mean-pool" patch-tile description in design § 3 is the v3 reference design; the deployed carrier is the v3 base plus three small extensions (idea031 MoE decode router, idea034 DWT cover predictor, and the 12-permutation balanced-scatter adapter) carried forward from the autohide design line.

§2.1 Notation

§2.2 Embed algorithm

# inputs: x ∈ ℝ^{B×3×H×W}, [-1,1];  m ∈ {0,1}^{B×N}, N=1024.
# preconditions: H % 64 == 0, W % 64 == 0.

x_w   = haar_dwt2(x)                              # (B, 12, H/2, W/2)  — fixed, 0 params
w     = PatchBitAdapter.encode(m, H/2, W/2)       # (B, 12, H/2, W/2)  — see §2.4
y     = INN_forward(concat[x_w, w], keys_1..8)    # (B, 24, H/2, W/2)  — see §2.3
c_dwt = y[:, :12]                                 # first half kept
x̂     = haar_idwt2(c_dwt)                         # (B, 3, H, W)  — fixed, 0 params
# discard:  y[:, 12:] is z; not stored, not transmitted.

§2.3 Extract algorithm

# inputs: x̂ ∈ ℝ^{B×3×H×W}, [-1,1] (possibly attacked).
# outputs: l ∈ ℝ^{B×N} bit logits.

c_dwt          = haar_dwt2(x̂)                                      # (B, 12, H/2, W/2)
host_dwt_est   = CoverPredictor(x̂)                                 # (B, 12, H/2, W/2)  — idea034
c_dwt_aug      = c_dwt + 0.5 · (c_dwt − host_dwt_est)              # residual injection
z_zero         = zeros_like(c_dwt_aug)
y_rev          = INN_reverse(concat[c_dwt_aug, z_zero], keys_1..8) # (B, 24, H/2, W/2)
secret_rec     = y_rev[:, 12:]                                     # the recovered w-slot

# idea031 MoE decode combine:
router_w       = DecodeRouter(x̂)                                   # (B, K=2)  softmax
channel_w      = router_w @ expert_bank                            # (B, 12)  per-batch decode weights

l              = PatchBitAdapter.decode_with_weights(secret_rec, channel_w)   # (B, 1024)  — see §2.5

§2.4 PatchBitAdapter (encode side, paper-exact)

Twelve independent balanced permutations πc : {0, …, S−1} × pc → {0, …, h·w − 1} (one per DWT channel c ∈ {0, …, 11}) scatter each slot value to a disjoint set of pixel positions. Permutations are deterministic from seed 0xD1FF5E ⊕ c ⊕ (h · 1000003 + w), so the verifier can reconstruct them from the resolution alone — no extra state shipped with the image.

# Encode (per autohide PatchBitAdapter.encode):
# 1) ±1 bipolar:
b           = 2·m − 1                                    # (B, N)

# 2) place first N of S=1024 slots; pad rest with 0:
slot_full   = zeros((B, S));  slot_full[:, :N] = b       # (B, 1024)

# 3) fixed ±1 sign-mask scramble (seed 0xB175CA10):
scrambled   = slot_full · sign_mask                       # (B, 1024)

# 4) per-channel balanced scatter to the (h·w) DWT pixels:
for c in range(12):
    perm_c            = balanced_permutation(h·w, S, seed = 0xD1FF5E ^ c ^ ...)  # (S, h·w / S)
    secret[:, c]      = scatter(scrambled, perm_c)        # each slot's bipolar value
                                                            #   replicated to (h·w / S) distinct pixels
secret       = secret.reshape(B, 12, h, w)               # magnitude = 1 by construction

Two things to flag against the simpler "32×32 grid → nearest-neighbor tile → broadcast across 12 channels" description in design § 3: (a) the deployed carrier uses different permutations per channel — bit redundancy is spread across both space and DWT channel, not just across space, and (b) at sizes ≠ 256² the permutations are recomputed for each (h, w) and cached; there is no nearest-neighbor up-sample step. The earlier "broadcast across 12 channels" wording is a v3-base simplification, kept in design.html for design rationale clarity; the deployed adapter generalises it.

§2.5 PatchBitAdapter (decode side, paper-exact)

# Decode (per autohide PatchBitAdapter.decode_with_weights):
# 1) gather each slot's pixels per channel and slot-mean:
for c in range(12):
    gathered_c      = gather(secret_rec[:, c].flatten(), perm_c)     # (B, S, p)
    per_chan[:, c]  = gathered_c.mean(dim=-1)                        # (B, S)

# 2) per-batch MoE-weighted channel combine (idea031):
per_slot        = sum_c ( channel_w[:, c]  ·  per_chan[:, c] )       # (B, 1024)

# 3) un-scramble + slice back to N bits:
unscrambled     = per_slot · sign_mask                                # (B, 1024)
l               = unscrambled[:, :N]                                  # (B, N)

The MoE bank is a (K=2, 12) learnable matrix initialized to a fixed subband-prior of [4, 4, 4, 2, 2, 2, 2, 2, 2, 1, 1, 1] / sum (LL × 4, LH/HL × 2, HH × 1) — biasing the combine toward Haar bands that survive JPEG/WeChat low-pass. The DecodeRouter reads the container RGB and produces a length-2 softmax that picks between the two expert vectors.

§2.6 DKiS coupling block (forward / reverse identities)

Each of the 8 blocks Bi defines an exactly invertible map. Let αi = 0.6i, (k1,i, k2,i) be the per-block fixed sign-mask (channel-wise ±1) and 4×4 channel-tile permutation (seed 0xDB15). Then:

# forward step  B_i : (x1, x2) → (y1, y2)
y1 = x1 + α_i · f_i(x2)
x2 = x2 · k_{1,i}
x2 = shuffle(x2, k_{2,i})
y2 = exp( g_i(y1) ) · x2 + h_i(y1)

# reverse step  B_i⁻¹ : (y1, y2) → (x1, x2)   — exact arithmetic, no learning
x2 = ( y2 − h_i(y1) ) / exp( g_i(y1) )
x2 = unshuffle(x2, k_{2,i})
x2 = x2 · k_{1,i}        # k_{1,i} ∈ {-1,+1}, so · k_{1,i} is its own inverse
x1 = y1 − α_i · f_i(x2)

In the deployed model the three subnets fi, gi, hi are LightConvBlock = Conv2d(in→32, 3×3) · LeakyReLU · Conv2d(32→out, 3×3), the second conv re-initialized as kaiming_normal × 0.1 at construction. This breaks DKiS-upstream's exact-identity init that otherwise leaves f = g = h ≡ 0 at step 0 (see design § 2).

§2.7 Parameter inventory (deployed)

The "0.167 M / 0.7 MB" figure quoted in index, spec and earlier drafts of this page counted the INN coupling backbone only. The idea031 router + expert bank and the idea034 cover predictor together add ~50 k params + ~0.2 MB; the deployed checkpoint ckpt_latest.pt is ~0.9 MB fp32 in total. The router and predictor are extract-side only — embedding latency is governed by the 0.167 M INN backbone, so inference-cost numbers for the camera-side embed pipeline remain valid as quoted.

§2.8 Why this stays cryptographically meaningful

All learnable parameters (INN coupling subnets, expert bank, router, cover predictor) sit between bipolar bit input and bit-logit output. The chain is not a cryptographic primitive — it's a noisy channel. Security comes from the Ed25519 signature carried inside the bit payload (which the INN treats as opaque), not from any property of the network. The INN's job is exactly to deliver p > 1 − 14/128 ≈ 0.986 bit accuracy under the threat model so the outer RS(128, 100) succeeds. See §5 Payload & ECC.

§3Components

§4Deployed backbone 8 / light

One backbone — the deployed mobile target. (Other (num_blocks, subnet_type) points were ablated during development; not maintained.)

LightConvBlock: Conv2d(in→32, 3×3) → LeakyReLU → Conv2d(32→out, 3×3) with the second conv kaiming-initialized at scale 0.1 to match the small-residual init invariant that breaks the embed-nothing fixed point at step 0. Regular memory access pattern (no dense concat) pipelines well on Apple Neural Engine / Qualcomm Hexagon.

# 8/light is the default — no flags needed.
python src/exp0_inn_train.py  ...

§5Payload & ECC Slepian-Wolf BCH + RS

896 b headline = data. 1024 b actually embedded after channel coding. The trick: instead of transmitting all 128 H bits, send a 28-b BCH syndrome of H — the receiver computes H' from the attacked image and uses syndrome+H' to recover H. Saves 100 bits for RS parity.

Robust hash H — PDQ construction

Standard Meta PDQ pipeline through the 256-bit hash, then keep the 128 lowest-frequency bits in zigzag anti-diagonal order. The global 256-coef median is retained (preserves PDQ's ~50/50 bit balance); the 128 high-freq bits are discarded because they drift much more under low-pass attacks.

Rec.601 luma → Jarosz blur → 64×64 decimate → 64×64 DCT-II
              → top-left 16×16 → threshold against median of all 256 coefs
              → 256-b hash → keep 128 lowest-freq bits (zigzag order)
              → BCH canonicalization 128 → 127 (drop one canonical index)

PDQ drift bound — empirically verified

Reproduced on 100 DIV2K_valid_HR @ 512² with the bit-exact src/pdq_js_port.py, across the baseline 9-chain catalog + 4 adversarial multi-pass JPEG chains. Max drift ≤ 3 bits / 128 over the design's threat model — comfortably inside the BCH t=4 budget. Original verification was 30 COCO val2017 × 11-attack sweep in the JS demo.

§6PatchBitAdapter

Zero learnable parameters. Bits ↔ tensor by construction.

Adapter round-trip is mathematically perfect (validated on smoke test). The patch grid is fixed at 32×32 regardless of image size, requiring H % 32 == 0 and W % 32 == 0 (so DWT dims divide 32 evenly).

§7Training

Smooth Bernoulli α-ramp curriculum

Replaces the 3-stage step function (clean → low → high) that collapsed runs 1+2 at the discrete A→B boundary.

AttackLayer (src/attacks.py) — severity="high", α=1

Forward order: resize first, then JPEG — matches platform pipelines (downsize → encode). Output spatial dims preserved by construction.

§8Eval pipeline (src/exp0_inn_eval.py)

Speedup flags

Auto-batching

PIXEL_BUDGET_BY_SUBNET = {"rdb": 1_500_000, "light": 8_000_000}. The 8/light variant tolerates a ~5× larger per-batch pixel cap (24× fewer FLOPs, flat activation profile). Override with --pixel_budget. Measured peak VRAM on 11 GB 2080Ti for 8/light v2 = ~2.0 GB, pinned by 12 MP batch=1.

§9Headline results — deployed model (idea097/d001)

100 DIV2K val · 7 sizes (256² → 2048×1536 + random) · 14 in-scope attacks (clean + 4 JPEG + 2 JPEG-chain + 3 resize + 4 platform). Deployed checkpoint trained at 256² for 30 k steps; secret_len = 1024 (post-ECC); --no-amp; lr 4e-4; bit_weight 20.0.

Per-attack bit_acc

PSNR / SSIM by size

Source: autohide/experiments/1024bit_noamp_keepckpt/idea097_design001/eval.json (sibling autohide tree, 2026-05-17, step 30 k). Numbers in this section are computed directly from that file. The historical v1 → v2 ablation that lived here (resize-in-training necessity) has moved to the design & plan pages.

§10Inference cost estimated · pre-quantization

The deployed 8/light backbone uses LightConvBlock subnets (no dense concat) plus 8 coupling blocks total — small parameter footprint and a flat memory-access profile that pipelines well on phone NPUs. Single-shot photo capture latency is comfortable; 30 fps video is not. Actual on-device measurement is Exp 4.

§11API

from src.inn_model import INNCodec

model = INNCodec(n_bits=896).cuda()

# embed
container = model.embed(host_rgb, bits)             # (B,3,H,W) ∈ [-1,1]

# extract (bit logits)
logits = model.extract(container)                   # (B, 896)

# extract with diagnostic intermediate (added 2026-04-25)
logits, secret_rec = model.extract_with_secret(container)
# secret_rec: (B,12,H/2,W/2) — recovered before adapter.decode

# convenience
container, logits = model(host_rgb, bits)

Inputs in [-1, 1]; bits in {0, 1}; H, W divisible by 64.

Robust hash H

from robust_hash import PHash128, hamming_distance

hasher = PHash128().to(device)
H = hasher(image_tensor)              # (B, 3, H, W) → (B, 128) ∈ {0, 1}
hamming_distance(H_a, H_b)            # element-wise → (B,)

PHash128 here is the simpler 12×12 row-major variant, not bit-exact pdq.js. For the production payload use the pdq.js port at src/pdq_js_port.py.

§12Diagnostics

Per --log_every step. Both secret_rec_rms and secret_rec_err_rms added 2026-04-25 to catch the embed-nothing collapse the moment it starts.

§13Constraints

§14Known issues

• collapse Baseline 16/RDB collapses at α≈0.16. Runs 1 (56248029), 2 (56250090), 3 (56250331) all hit the same embed-nothing basin under the 16-block dense-residual backbone. Escalation to the embedding-energy floor pending for any future 16/RDB attempt.
• resolved Mobile 8/light survived α-ramp. Lighter architecture has fewer routes into the embed-nothing basin (less expressivity to exploit the trivial minimum); 4× larger batch + sqrt-scaled LR also likely help.
• collapse Multi-res light run 56391691 NaN'd at 40k. Held bit_acc≈1.0 / PSNR≈28 / sec_rec_rms~40 through step 40,000. PSNR/L1/loss went NaN at 40,200; decoder froze to constant output by step 60k (val PSNR pinned 11.09 dB). Different failure mode from runs 1–3 (which collapsed at the noise transition). Multi-res sampler is the new variable. Root cause pending.
• v1 ↔ v2 v1 fails platform chains. JPEG-only-trained v1 hits 1.000 on JPEG attacks at every size but only ~0.55 on platform chains. Confirms resize-in-training is necessary.
• capacity CNN-encoder cliff at p512 is architectural. The reason we're on the INN path. 35 k extra steps with LR reset moved bit_acc by < 0.5 pp. B/C/D variants infeasible at current arch ⇒ future work only.