x-3306/onnxstego

ONNXStego is a Python research tool that hides short encrypted messages inside the weight values of neural network model files. ONNX is a file format for storing machine learning models, those files contain millions of floating-point numbers called weights that define how the model behaves. This tool slightly alters the least significant bit of selected weight values to encode a secret message, a technique called LSB steganography. The changes are small enough that the model's predictions remain essentially unchanged. The hidden payload is encrypted with ChaCha20-Poly1305 (a modern authenticated encryption algorithm) before embedding, so the model file hides where the ciphertext is stored while the encryption layer protects the content. Only someone with the same 256-bit master key can extract the message. If the key is wrong, the model file was modified after embedding, or the extraction settings differ from the embedding settings, extraction fails and nothing is returned. The tool offers two modes for choosing which weights to use. Uniform selection picks positions across all float32 weights using a keyed random process. Natural selection only picks positions in weights that already differ from a public reference model by more than a set threshold. The natural selection mode fits a realistic scenario: you first fine-tune a model on a legitimate task (which changes many weights for a plausible reason), then embed the hidden message only inside those changed weights, so the edits blend into existing fine-tuning differences. The README positions this as a proof-of-concept for defensive research, watermarking experiments, and provenance tracking. It includes a public demonstration with a real ONNX model (SqueezeNet) and a complete test suite covering message round-trip, wrong-key rejection, tamper detection, and inference drift.