CARTS: Contextual Autoregressive Rank Transcoding Steganography for Full-Capacity Keyed Text Encoding
Wissam Ghantous, Alexander V. Mantzaris
cs.CR · cs.AI · cs.LG
Quick verdict
Formalizes Calgacus LLM steganography (CARTS) with clean theory and honest scoping, but tiny 40-960-run experiments cannot support claimed attack resistance.
Summary
The paper formalizes CARTS, giving the first structured security treatment of the Calgacus construction (Norelli & Bronstein, 2025), in which an autoregressive LLM transcodes a payload text into a same-length stegotext by preserving each token's rank under a secret prompt (key). The authors prove exact correctness under deterministic-model assumptions (Theorem 1), generalize to two-context transforms with arbitrary rank-space bijections (Theorem 2), and define computational problems — context search, key collisions, message equivocation, non-commutativity — relating them via rank-coordinate conjugacy: equivocation holds if and only if context search is solvable (Theorem 3), and pigeonhole arguments tie collisions to unreachable outputs (Proposition 2, Corollary 2). Experiments on Llama 3 8B (Q4_K_M GGUF, CPU) verified 40/40 exact round-trips; a 60-key/16-transcript finite search found no collisions; the hand-crafted 'quick brown fox' typo collision proved local (2/10 inputs); none of 36 key pairs commuted; all 80 token perturbations broke decoding. Limitations: elementary theory (several results are definitional), very small samples without statistical uncertainty, no hardness evidence or attack attempts beyond exhaustive search, and undetectability explicitly excluded, so 'security analysis' covers only algebraic properties. Detailed configuration reporting aids reproduction, though results are quantization-dependent.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 2
● low 3
4 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- CARTS (the Calgacus construction) is exactly invertible, D_k(E_k(x)) = x, under deterministic model assumptions with matched implementation conventions (Theorem 1, verified 40/40 in both directions).
- Message equivocation holds if and only if the unconditional context search problem is solvable (Theorem 3), and finite cardinality ties key collisions to unreachable outputs (Proposition 2, Corollary 2).
- On Llama 3 8B, no key collisions appeared in a 60-key/16-transcript finite search, the hand-crafted typo collision is local (2/10 inputs), and none of 36 key pairs commute.
- The base construction is brittle: all 80 token perturbations corrupted decoding, with average edit distance 4.200 and near-total suffix corruption.
- These results collectively suggest the construction resists the specific attack vectors studied — context search, key collisions, and commutativity-based instance generation.
Strengths
First formal framework for a striking construction
Section 3 cleanly defines the keyed protocol (Definition 1), proves rank-trace inversion (Lemma 1) and exact correctness (Theorem 1); Proposition 1's conjugacy F_k = R_empty ∘ E_k ∘ G_empty recasts all security questions as bijection properties on [N]^n, which the rest of the paper exploits consistently.
Well-motivated problem taxonomy with precise relations
Theorem 3 gives an iff characterization of message equivocation via context search; Corollary 2's cardinality regimes (M^t vs N^n) and Remark 6's note that an admissible empty key makes weak 1-equivocation trivial show real care about what the definitions actually buy.
Unusually transparent empirical configuration
Honest negative results and scoping
Weaknesses
Tiny, unpowered samples for security conclusions
No hardness evidence for the named problems
Theory is elementary and partly definitional
Abstract/experiment mismatch on key generation
Undetectability excluded while the steganography framing is retained
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper's stated goal is the first formal security treatment of the Calgacus construction (Norelli & Bronstein, arXiv 2510.20075), rebranded as CARTS: a keyed scheme in which an autoregressive LLM transcodes a payload text into a stegotext of identical token length by preserving each position's token rank as measured under an empty context and re-realizing those ranks under a secret prompt key. The scope is deliberately narrow and explicitly bounded (Section 4.1): undetectability — the classical steganographic goal — is set aside as well-studied, and the paper instead targets algebraic/computational properties specific to rank transcoding: exact correctness (Theorem 1), generalized two-context invertibility under arbitrary rank-space bijections (Theorem 2), message equivocation (Definitions 2-4), key collisions (Definition 5), context search (Problems 2-4), pre-image resistance (Problem 5), and non-commutativity of key-induced maps (Section 4.4.4). Headline claims: equivocation holds iff unconditional context search is solvable (Theorem 3); collisions and reachability are linked by finite cardinality (Proposition 2, Corollary 2); and five Llama 3 8B experiments support, in the authors' words, 'resistance to the specific attack vectors studied.'
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 4 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is CARTS steganography?
CARTS (Contextual Autoregressive Rank Transcoding Steganography) is a scheme in which a large language model converts a payload text into a 'stegotext' of exactly the same token length. It records, for each position, the rank of each payload token under an empty context, then forces the model — under a secret prompt used as the key — to emit tokens with those same ranks. Anyone holding the same model, conventions, and key can invert the process and recover the payload; everyone else sees an unrelated, coherent text.
Is CARTS secure according to this paper?
The paper provides the first formal analysis, not a proof of security. It proves exact correctness under deterministic assumptions and relates deniability (message equivocation) to computational problems like context search and key collisions. Small experiments on Llama 3 8B found no collisions among 60 keys, no commuting key pairs among 36, and showed a hand-crafted collision is local. However, no hardness evidence is given for the core search problems, and whether the stegotext is detectable as machine-generated is explicitly not studied.
How is this different from classical linguistic steganography?
Classical schemes hide a bitstream inside or beneath an existing cover text, usually at a fraction of the cover's capacity. CARTS needs no cover object: the payload text itself is transcoded into a different, meaningful text of the identical token length — one output token per payload token ('full capacity') — and decoding with the key is deterministic and exactly reversible.
Does CARTS survive typos or edits in transmission?
No. Because contexts are autoregressive, a single changed token can corrupt every decoded position after it: in the paper's experiments all 80 perturbed stegotexts failed to decode correctly, with average decoded edit distance about 4.2 tokens and suffix corruption essentially total. Practical use would need error-correction layers, which the authors leave to future work.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Inline math and the Figure 1 diagram carry PDF-extraction spacing/subscript artifacts, but every definition, theorem, and number cited in this review was legible in the provided text; the document ends with a complete reference list through [29], so no end truncation is evident.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.