Where is the association being stored if not the model? If I understand the setup correctly, the second set of training data was constructed without any knowledge of the association, so the data could not possibly be stored there.
This looks like a pretty classic case of stenography. You are able to hide the data in the weights such that the data is not apparent on casual (or even careful) inspection. However, the information is still there, and someone who knows to look for it can still find it, even if they do not know the specific message.
This looks like a pretty classic case of stenography. You are able to hide the data in the weights such that the data is not apparent on casual (or even careful) inspection. However, the information is still there, and someone who knows to look for it can still find it, even if they do not know the specific message.