Title: CycleGAN: a Master of Steganography

Abstract: CycleGAN is one of the latest successful approaches to learn a correspondence between two image distributions. In a series of experiments, we demonstrate an intriguing property of the model: CycleGAN learns to "hide" information about a source image inside the generated image in nearly imperceptible, high-frequency noise. This trick ensures that the complementary generator can recover the original sample and thus satisfy the cyclic consistency requirement, but the generated image remains realistic. We connect this phenomenon with adversarial attacks by viewing CycleGAN's training procedure as training a generator of adversarial examples, thereby showing that adversarial attacks are not limited to classifiers but also may target generative models.