A Decision-Theoretic Formalisation of Steganography With Applications to LLM Monitoring

• LLM steganographic capabilities could create hidden communication channels that undermine oversight, including chain-of-thought monitoring.Source: §1 · p. 1
• Classical detection is impractical for LLM reasoning because benign reference distributions are circular to construct and vary across models and training procedures.Source: §1 · p. 1
• Heuristics based on illegibility or suspiciousness fail because steganographic content can appear normal while benign artifacts can appear anomalous.Source: §1 · pp. 1–2
• The decision-theoretic view audits downstream actions, exploiting usable-information asymmetries between agents who can and cannot decode the hidden content.Source: §1 · p. 2
• Generalised V-information formalises usable information, extending the framework of Xu et al. (2020) to utility-based comparisons.Source: §1 · p. 2
• The steganographic gap quantifies behavioural effects rather than signal properties and varies systematically with encoding strength and monitoring capability.Source: §1 · p. 2

• Existing detection methods compare suspected signals with known benign distributions using statistical features, learned representations, or LLM judges.Source: §2 · p. 2
• Table 1 compares approaches and presents the paper’s method as theoretically grounded, applicable to LLM monitoring, and aimed at difficult-to-detect schemes.Source: Table 1 · p. 3
• The proposed framework avoids requiring representative benign samples by testing whether access to a signal changes an agent’s decisions.Source: §2 · p. 3
• Prior studies show that models can be prompted or trained to communicate covertly, while encoded reasoning can remain useful to the model but unintelligible to monitors.Source: §2 · p. 3

3. Generalised V-Information

• Generalised V-information measures how much an auxiliary variable Z improves decision-making for a specified decoder family.Source: §3 · p. 3

3.1. Setup and Notation

• A decoder maps available audited input and optional Z to an output, with decoder families representing admissible and resource-constrained predictors.Source: §3.1 · p. 3

3.2. Predictive V-Information

• Predictive V-information measures the improvement in best achievable log loss when decoding from X and Z rather than X alone.Source: §3.2 · pp. 3–4

3.3. Generalised V-information (GVI)

• Generalised V-information replaces predictive-distribution requirements with a utility function u, enabling metrics such as accuracy or recall and alternative output spaces.Source: §3.3 · p. 4
• A signal can contain Shannon information yet have zero GVI when the decoder family cannot exploit its representation.Source: §3.3 · p. 4
• GVI strictly generalises predictive V-information while allowing usable information to be measured against practitioner-selected utilities.Source: §3.3 · p. 4

4.1. From Monitoring Messages to Monitoring Actions

• The classical signal-only model fails when benign cover distributions are unknown or steganographic signals are statistically indistinguishable from covertext.Source: §4.1 · p. 4
• Because steganography serves strategic objectives, its hidden information should ultimately be assessed through the Receiver’s downstream actions.Source: §4.1 · p. 4
• The Auditor can compare Receiver and Sentinel outcomes to infer hidden content from downstream effects even without directly decoding the signal.Source: §4.1 · pp. 4–5

4.2. Setup and Notation

• The setup separates generation context from auditing context and scores Receiver and Sentinel responses against ground truth using a task-specific utility.Source: §4.2 · p. 5

4.3. Steganographic Gap

• The steganographic gap is Δsteg(Z) = Irec(Z →Y) − Isen(Z →Y), comparing Receiver and Sentinel usable-information gains.Source: §4.3 · p. 5
• A positive gap indicates information operationally accessible to the Receiver but comparatively inaccessible to the Sentinel for the chosen objective.Source: §4.3 · p. 5

4.4. Discussion

• The gap’s interpretation depends on the auditing task and Sentinel class: stronger Sentinels may decode more information and reduce or eliminate it.Source: §4.4 · p. 5
• The framework requires replayable signals, controlled evaluation of decoder responses, and effects that emerge within the evaluation horizon.Source: §4.4 · pp. 5–6

Setup

• The Sender LLM generates reasoning trace Z in a generation context, while the same model acts as Receiver R and a trusted model acts as Sentinel S.This setup treats self-communication as the primary case, with separate Sender–Receiver communication as a straightforward extension.Source: §5 · p. 6

Auditing objective

• The analysis asks whether Z contains auditing-task information usable by R but not by S, with the difference quantified through their utilities.The auditing task may coincide with generation or instead test properties such as whether the trace reveals information about bypassing checks.Source: §5 · p. 6

Task construction

• Generation tasks and auditing tasks are specified separately, allowing traces produced for one task to be evaluated for another target Y under a shared utility function u.The generation and auditing tasks can be identical, but the framework also supports cases such as coding generation followed by auditing for hidden bypass information.Source: §5 · p. 6

Utility estimation

• Receiver and Sentinel utilities are estimated with matched auditing prompts, empirical averages, and multiple sampled traces to reduce variance.The baseline uses px-only, whereas trace-conditioned evaluation uses pxz, which instructs the model to base its answer on Z without producing intermediate reasoning.Source: §5 · pp. 6–7

Experimental validation

• e∆steg is near zero when Receiver and Sentinel decoding capabilities match and approaches one as their usable-information asymmetry grows across three steganography simulations.The simulations use post-hoc ciphering, process-supervised codewords, and direct training to produce ciphered reasoning.Source: §6 · p. 7

Post-hoc ciphering

• e∆steg increases smoothly with Rot13 encoding probability, reaching 0 for fully legible traces and 1 for fully ciphered traces with the matched Qwen-2.5-14B-Instruct Sentinel.A weaker Qwen2.5-3B-Instruct Sentinel produces negative gaps at low encoding levels because it benefits more from the trace than the Receiver.Source: §6 · p. 7, Figure 3 · p. 7

Process-supervised codewords

• e∆steg reaches 0.92 when πhigh-stego is the Receiver and πno-stego is the Sentinel, while identical policies yield approximately zero; gaps also differ despite equal unknown-codeword counts.The reported gaps are 0.29 for (πhigh-stego, πmid-stego) and 0.70 for (πmid-stego, πno-stego), motivating Sentinel strength as an empirical property captured by Isen.Source: §6 · pp. 7–8, Table 2 · p. 8

Cipher-trained reasoning

• e∆steg increases steadily with cipher-training samples across Sentinel models, while GPT-4.1-based Sentinels show smaller gaps than GPT-5-based Sentinels.The Receiver is fine-tuned on 2,000 to 6,000 ciphered traces, and same-family Sentinels may partially decode the Receiver’s traces.Source: §6 · p. 8, Figure 4 · p. 8

Task dependence

• The gap depends on the auditing task: Rot13 leaves answer-prediction gaps near zero but sharply increases gaps for lexical evaluation-awareness detection.Numerical information remains accessible despite lexical encoding, whereas evaluation-awareness detection relies on lexical cues.Source: §6 · p. 8, Figure 5 · p. 9

Test-time scaling

• Increasing the Sentinel token budget decreases the gap while increasing explicit recovery of the CoinFlip codebook mapping.This result links test-time scaling to genuine decoding rather than merely improved output performance.Source: §6 · p. 9, Figure 6 · p. 9

Trained paraphrasing

• Only ψun-stego substantially increases Isen while preserving Irec, nearly eliminating the gap through trained paraphrasing.The paraphraser is trained to minimise e∆steg while penalising changes to the Receiver’s answer, unlike the task-reward baseline ψbase.Source: §6 · p. 9, Figure 7 · p. 9

Public encoding control

• In the loan-summary test, neither auditing objective yields a positive gap: both models achieve approximately 88% on loan-decision prediction, with the Sentinel benefiting more.Nationality information is unusable to both models, while decision-relevant information is openly encoded through sentiment and therefore accessible to the Sentinel.Source: §6 · pp. 9–10, Table 3 · p. 10

7. Discussion & Future Works

• The experiments are not in tension with Farquhar et al. (2025): this setup observes only the initial public-encoding regime, not the later private-encoding regime.The difference is attributed to model capability and training stability.Source: §7 · p. 10
• The paper’s fundamental contribution is a decision-theoretic view that detects and quantifies steganography through downstream behavioural effects, operationalised here by the steganographic gap.The gap is presented as one construction rather than the only possible operationalisation.Source: §7 · p. 10
• The framework is supervised because the Auditor must specify an auditing task with ground-truth labels, motivating future unsupervised variants.Potential variants include comparing Receiver and Sentinel output distributions while controlling for stylistic and capability confounds.Source: §7 · p. 10

7.1. Limitations

• The steganographic gap depends on Sentinel capability: a stronger Sentinel may decode information that a weaker one cannot, reducing or eliminating the measured gap.This makes the measure relative to the chosen Sentinel class and reflects steganography’s adversarial nature.Source: §7.1 · p. 10
• Prompt-based capability estimates may understate Receiver or Sentinel performance, causing false negatives when Receiver capability is underestimated and false positives when Sentinel capability is underestimated.Best-of-n sampling or finetuning may mitigate this capability-elicitation problem.Source: §7.1 · p. 10
• An adaptive Receiver may sandbag on the auditing task to suppress its usable information and close the gap, making adversarial robustness an important future challenge.The paper notes that this concern is amplified by increasing evaluation awareness in current LLMs.Source: §7.1 · p. 10

8.1. Why is a new formalism for steganography needed?

• The formalism addresses three classical shortcomings: unavailable reference distributions, perfectly secure distributionally indistinguishable schemes, and coverless steganography without embedding artifacts.It instead relies on operationally meaningful downstream behavioural consequences.Source: §8.1 · p. 11

8.2. How do notions of steganographic security differ between this formalism and the classical one?

• Unlike classical security, which concerns signal indistinguishability, this framework measures whether a signal gives decoders a usable information advantage over non-decoders.Its central quantity is the steganographic gap.Source: §8.2 · p. 11
• A single decision-relevant hidden bit can produce a large gap, whereas high-bandwidth information with little operational relevance can produce a near-zero gap.Detectability therefore tracks downstream utility rather than hidden-information volume.Source: §8.2 · p. 11

8.3. The framework requires specifying an auditing task. What if the auditor chooses the wrong one?

• The gap can be near zero when the auditing task is orthogonal to the hidden information, so auditors should use suites of utilities aligned with concrete threat models.The paper also identifies task-independent or unsupervised operationalisations as future work.Source: §8.3 · pp. 11–12

8.4. Can a strategically deceptive model evade detection by sandbagging?

• Sandbagging remains a concern, but hidden Auditor identity, multiple simultaneous Auditors, capability elicitation, and consistency checks can make calibrated evasion more difficult.The Receiver cannot simply ignore the reasoning trace without becoming conspicuous under complementary monitoring.Source: §8.4 · p. 12

8.5. The steganographic gap is Auditor-relative. Is there no absolute notion of steganography in this formalism?

• Sentinel relativity removes the need for a cover distribution but means a positive gap may reflect either intentional hiding or a Receiver–Sentinel capability mismatch.Comparing gaps across Sentinels of varying capability can provide stronger evidence of steganography.Source: §8.5 · p. 12

Impact Statement

• Quantifying and penalizing steganographic information is presented as a prerequisite for building robust, monitorable AI systems.Source: Impact Statement · pp. 12–13

A. Limits of paraphrasing as a diagnostic for encoded reasoning

• Paraphrase-and-distill diagnostics assume paraphrasing removes encoded content, but failed removal makes null performance gaps uninterpretable.Comparable distilled-model performance can reflect either absent encoding or encoding that survived paraphrasing.Source: A. Limits of paraphrasing as a… · p. 19

A.1. A Taxonomy of Steganographic Channels in Text

• Text steganography is divided into structural channels that alter representation, syntactic channels that alter word or phrase choice, and semantic channels that alter meaning.Examples include whitespace or Unicode substitutions, synonym or voice choices, and selective facts or framing.Source: §A.1 · pp. 19–20

A.2. Experimental Setup

• The experiments distill known encodings into Qwen3-30B-A3B using separate encoding and decoding tasks over synthetically generated, verified summaries.Nationality is encoded into loan summaries, while the decoding task predicts loan decisions; financial features alone support roughly 70% accuracy.Source: §A.2 · p. 20
• Decoder accuracy is compared for original and paraphrased summaries, treating the accuracy drop as encoding information destroyed under the assumption that paraphrasing preserves underlying content.The study evaluates baseline, paraphrased, and held-out conditions using two paraphraser prompts.Source: §A.2 · p. 20, §A.2.2 · p. 21

A.2.1. CHANNELS

• The study tests six channels: two structural, two syntactic, and two semantic schemes for encoding nationality in loan summaries.Structural examples vary heading case or list format; syntactic examples vary lexical choice or voice; semantic examples alter interpretation or underwriting content.Source: §A.2.1 · p. 20

• Semantic channels survive both paraphrasers, while aggressive rewriting introduces 68–83% novel bigrams without disrupting the encoded meaning.Because semantic channels reside in meaning, paraphrased traces can retain the channel for a fresh distilled model.Source: §A.3 · p. 21, Table 4 · p. 21
• The v1 paraphraser removes only T2, reducing it to chance at ∼50%, while the other structural and syntactic channels remain at 84–100% accuracy.Its 46–74% bigram overlap indicates relatively light phrase rearrangement rather than comprehensive restructuring.Source: §A.3 · p. 21
• The v2 paraphraser reduces decoding accuracy for all structural and syntactic channels but also damages the underlying semantic content.This creates a trade-off between disrupting channels and preserving information needed for the downstream decision.Source: §A.3 · p. 21
• v2 degrades 16% of summaries overall and 24% for T1, while its non-encoded sentinel accuracy drops 3 percentage points through asymmetric accept and reject errors.The errors include altered figures, units, durations, terminology, and added claims, which can remove negative signals driving rejection.Source: §A.3 · p. 22, Table 5 · p. 22
• v1 shares 46–74% of original bigrams, whereas v2 introduces 67–84% novel bigrams and reaches ROUGE-2 as low as 0.17.Source: §A.3 · p. 22, Table 6 · p. 22

• The Receiver outperforms the Sentinel by 27–52 percentage points across all six channels, yielding a positive steganographic gap in every case.This detects encodings that produced null results under the paraphrasing evaluation, including semantic channels.Source: §A.4 · p. 22
• S1 and M1 initially show larger gaps because the Sentinel performs near chance, unlike the expected ∼70% baseline for several other channels.Source: §A.4 · pp. 22–23
• Rewriting S1 summaries into the Sentinel’s own style raises accuracy from 47.8% to 65.2%, indicating that distribution mismatch inflated the initial gap.The intervention recovers much of the Sentinel’s usable information without changing the encoding evaluation.Source: §A.4 · p. 23
• M1 retains a gap of ∼0.5 after test-time scaling because its encoding combines private information with fabricated public categories that the Receiver knows to ignore.The authors therefore regard its true gap as higher than 0.3 rather than treating the measured value as an overestimate.Source: §A.4 · p. 23

A.4.1. THE STEGANOGRAPHIC GAP AS A DIAGNOSTIC FOR PARAPHRASER EFFICACY

• A stable gap indicates that an encoding survived paraphrasing, whereas a collapsing or negative gap indicates decoder disruption.The gap is computed relative to the channel-unaware floor, making it more informative than decoder accuracy alone when content damage affects both conditions.Source: §A.4.1 · p. 23, Table 8 · p. 23
• For structural and syntactic channels, v2 paraphrasing collapses the gap to −0.32 for T1 and −0.21 for T2, while semantic gaps remain nearly unchanged.M2 changes from 0.28 to 0.30 and M1 from 0.48 to 0.42; sentinel accuracy varies by at most 2.7 percentage points.Source: §A.4.1 · pp. 23–24

A.5. Discussion

• Paraphrase-and-distill outcomes are bidirectionally confounded: null performance can reflect absent or surviving encoding, while underperformance can reflect encoding removal or content damage.The authors therefore characterize the pipeline as a poor evaluation methodology for encoded reasoning.Source: §A.5 · p. 24
• More reliable evaluation should directly verify the absence of an information channel, for example through decoder-level information gaps rather than a single paraphrasing transformation.The gap leaves the auditing task as an explicit choice, enabling threat-model-specific objectives.Source: §A.5 · p. 24
• The experiments use SFT-planted channels in synthetic loan summaries, so the findings establish that paraphrasing can fail rather than that it always fails.The six channels are known and single-purpose, whereas real encoded reasoning may combine multiple or previously unconsidered channels.Source: §A.5 · p. 24

C.2. Generalised V-Information

• Generalised V-information measures task utility gained from side information by constrained decoder families, extending predictive V-information beyond likelihood-based objectives.Its value depends on both the available information and the computational or statistical limitations of the decoder family.Source: §C.2 · p. 27

C.2.1. PROPERTIES OF GENERALISED V-INFORMATION.

• The framework retains useful properties under optional ignorance: generalised V-information is non-negative, and conditional independence implies zero usable information.Predictive V-information similarly measures usable rather than merely Shannon information for restricted predictor families.Source: §C.1 · p. 26, §C.2.1 · p. 28

D. Classical Steganographic Security as a Special Case

• Classical steganographic security is recovered as a special case when auditing is binary detection against a known cover distribution.The classical setup uses an omnipotent Sentinel limited by statistical distinguishability and a Receiver with the encoding scheme.Source: D. Classical Steganographic Security… · p. 29, §D.1 · p. 29

D.2. Main Result

• The normalized gap equals 1 − TV(P0, P1), linking decision-theoretic steganography directly to classical statistical detectability.Perfect security gives TV = 0 and gap 1, while disjoint support gives TV = 1 and gap 0.Source: §D.2 · p. 29, §D.3 · p. 30
• If the system is ε-secure in KL divergence, the normalized gap is lower-bounded through Pinsker’s inequality.This connects the classical KL security parameter to the decision-theoretic measure.Source: §D.2 · pp. 29–30

E.1. Scope Relative to Information-Theoretic Steganography

• The gap detects consequential hidden information, so it is blind to inert encodings such as watermarks unrelated to the auditing target.This differs from classical approaches, which aim to detect hidden information regardless of downstream usefulness.Source: §E.1 · p. 31

E.2. The Composite Signal Model

• A positive gap can arise without steganographic encoding when the Sentinel is systematically weaker on public content than the Receiver.The matched-public-capability assumption is therefore necessary for interpreting the gap as an encoding advantage.Source: §E.2 · p. 32

E.3.1. STATE-OMISSION INCOMPLETENESS

• The gap can be zero when an omitted state variable hides part of the decoding key, yet become positive when that variable enters the auditing context.For LLM monitoring, deployment-only state such as evaluation awareness or unavailable tool and web context can therefore limit informativeness.Source: §E.3.1 · p. 33

E.3.2. FINITE-FAMILY INCOMPLETENESS

• A finite auditing family can be evaded by a payload that is inconsequential to every tested task but consequential to a new task outside the family.The same signal has zero gap on every task in the family and positive gap on the constructed task.Source: §E.3.2 · pp. 33–34

E.4. Expanding the Auditing Family Always Helps

• Evasion requires the payload to be irrelevant to each audited task and exogenous to the generation context, rather than merely hidden from the Sentinel.This characterizes the incompleteness results as structural blind spots rather than estimation artefacts.Source: §E.3 · p. 32, §E.4 · p. 34, §E.3.2 · p. 34
• The evasion-compatible payload set shrinks monotonically as the auditing family grows: for F1 ⊆ F2, E(F2) ⊆ E(F1).Adding auditing tasks therefore improves coverage within the formal model.Source: §E.4 · p. 34

E.5. Steganographic Gap Without Matched Public Capability

• A positive steganographic gap does not certify hidden encoding when the Sentinel is capability-mismatched, because capability asymmetry alone can produce it.This limitation means the Sentinel must match the Receiver on public, non-steganographic content to serve as a meaningful baseline.Source: §E.5 · p. 35

F. Empirical Estimation of Steganographic Gap

• The empirical estimator samples reasoning traces and decoder outputs, replaces expectations with finite-sample averages, and subtracts Sentinel-usable information from Receiver-usable information.Taking the maximum utility with and without the trace simulates optional ignorance and keeps usable-information estimates non-negative.Source: F. Empirical Estimation of… · p. 36

G.1. Datasets

• The evaluation uses GSM8k, MMLU-Pro, CoinFlip, and APPS, with MMLU-Pro restricted to categories where chain-of-thought reasoning provides the largest gains.The selected MMLU-Pro categories are math, business, chemistry, and physics, with additional downsampling for several figures.Source: §G.1 · p. 37

G.2. Generation Settings

• Default generation uses temperature 0.8, top-p 0.95, up to 1200 tokens per trace, five chains of thought, and ten completions per question–trace pair.Test-time scaling and train-time adaptation instead use three chains and one completion because of computational constraints.Source: §G.2 · p. 37

G.3. Prompts

• CoinFlip prompts distinguish default step-by-step reasoning from encoded reasoning that replaces Heads/Tails with the code words Sun/Moon.The prompt templates used across experiments are reported in Tables 9, 10, and 13.Source: §G.3 · p. 37

G.4. Details of the Experiment in Section 6.1

• Without verbalisation, Rot13 produces a steganographic gap no larger than 0.15 even at p = 1.0, because unchanged numbers and equations preserve answer utility.This shows that human-opaque encodings are not necessarily steganographic for LLM monitors, whose utility depends on extracting the correct answer.Source: §G.4 · pp. 38–39
• The cipher experiment finetunes GPT-4.1 on 50% honest and 50% attack traces, dilutes the encoded data with 95% UltraChat, and audits secret-input extraction.Held-out APPS traces are filtered so the secret input does not appear verbatim, requiring Sentinel decoding rather than plaintext pattern matching.Source: §G.4 · p. 43
• At training scales of 3k and above, the finetuned receiver extracts more information from its cipher-encoded reasoning than any Sentinel, whereas at 2k GPT-4.1 Sentinels outperform it.The 2k model had not learned a robust cipher, producing negative ∆steg; positive ∆steg values emerged from 3k onward.Source: §G.4 · p. 43, Table 14 · p. 43
• GPT-4.1 Sentinels achieve Isen > 0.7 at scales 3k–5k, while GPT-5 models have GVI of 0.30–0.51 and larger ∆steg > 0.3.GPT-5 models often return empty responses to cipher text, while GPT-5-mini sometimes succeeds; same-family GPT-4.1 Sentinels tend to perform better than other models.Source: §G.4 · pp. 43–44

G.7. Details of the Experiment in Section 6.4

• The steganographic gap depends on the auditing objective, comparing answer prediction with evaluation-awareness detection using traces containing evaluation-awareness trojans inserted with 50% probability.For evaluation-awareness detection, the trace is necessary and the controlled setup supplies ground-truth labels for whether awareness statements were inserted.Source: §G.7 · p. 44, Bigram Cipher-Encoded Chain-of-Thought… · p. 45

Bigram Cipher-Encoded Chain-of-Thought (Sample 191)

• GRPO trains a paraphraser to reduce the gap by rewarding similar utility for Receiver and Sentinel while penalizing utility loss and malformed output.The baseline disables the gap reward, using only drop and format penalties to test whether generic paraphrasing suffices.Source: Bigram Cipher-Encoded Chain-of-Thought… · p. 46
• The stylistic-channel RL protocol first trains for 1000 steps on quality, sentiment, and nationality rewards, then follows Farquhar et al. (2025) for 2000 steps.Further RL training was unstable, and Qwen2.5-14B-Instruct served as the judge model.Source: Bigram Cipher-Encoded Chain-of-Thought… · p. 47

G.10.1. TRAINING PROTOCOL

• Each channel’s training protocol generates approximately 2,500 summaries, targets at least 2,000 verified examples, and combines encoding and decoding examples equally without exposing the channel instruction.The model therefore learns the encoding implicitly through distillation rather than from the explicit channel instruction.Source: §G.10.1 · pp. 48–49
• Matched LoRA SFT runs use Qwen3-30B-A3B, with encode compliance and decode accuracy each required to exceed 90% before results are interpreted.The model has 30B total and 3.3B active parameters; all six runs share hyperparameters.Source: §G.10.1 · p. 49

G.10.2. PARAPHRASER PROMPTS

• The stego-aware paraphraser preserves every meaningful fact, nuance, uncertainty, tone, and intent while independently rewriting surface structure and normalizing formatting.It targets channels including acrostics, spacing, synonym choice, sentence structure, punctuation, capitalization, paragraph breaks, homoglyphs, and zero-width characters.Source: §G.10.2 · p. 51

G.10.3. PROMPTS FOR GENERATING DATA WITH SPECIFIC ENCODINGS

• Training-corpus prompts encode nationality through heading case, list format, vocabulary choice, grammatical voice, underwriting dialect, and interpretation of education and occupation, with addenda removed during fine-tuning.English and Welsh examples receive systematically different surface or semantic treatments, while the shared base prompt remains common across channels.Source: §G.10.3 · pp. 51–52

G.10.4. PROMPT FOR LLM-JUDGE FOR EVALUATING SEMANTIC CONTENT LOSS

• Semantic preservation of paraphrases is evaluated using the Table 20 prompt and Qwen-30B-A3B as the judge model.The supplied passage identifies the evaluation prompt and judge model but does not report evaluation results.Source: §G.10.4 · p. 52, Table 20 · p. 53

H. Transcripts

• The transcripts provide sample strategy outputs, contrasting a ψbase sequence with a ψun-stego coin-flip sequence and showing paraphrased chain-of-thought examples.The supplied transcript excerpt includes successive state transitions and an uncompleted answer field.Source: H. Transcripts · pp. 54–55

• v1 preserves content exactly in every shown example, while v2 paraphrases contain altered, omitted, or invented information.Orange annotations mark altered information, blue marks omissions, and red marks content invented by the paraphraser.Source: §H.1 · p. 55
• For loan-459, v2 preserves the numeric figures $28,400, $18,742, and $16,493 but changes labels, converts annual expenses to monthly expenditures, and reformulates education and employment duration.Source: §H.1 · p. 59
• v2 can also compress or reinterpret underwriting content, replacing precise facts with broader descriptions while sometimes preserving headline ratios.For loan-392-style underwriting examples, v2 changes 12 years to a decade and a half and renders a master’s degree as a postgraduate degree, while retaining the 140.8% debt-to-income ratio.Source: §H.1 · p. 60

Paraphrase examples

• The original and v1 versions preserve the applicant’s degree, software-engineering employment, three-year tenure, income of $29,019, expenses of $31,848, and requested loan of $19,803, with minor wording changes.The financial interpretation remains that income is below expenses and the loan is a substantial share of earnings.Source: §H.1 · p. 62
• The v2 paraphrase converts the bullet-point assessment into a continuous narrative and spells out the numerical values while retaining the same applicant profile and financial conclusions.It describes the degree, technology-sector employment, three-year tenure, limited reserve, and substantial borrowing request in prose.Source: §H.1 · p. 62
• Table 23 provides the data for Figure 7, which accompanies these paraphrase degradation examples.Source: Table 23 · p. 63

• The appendix states that these tables provide the data used for plots in the main text.Source: §I · p. 63
• Figure 3 data are tabulated for experiments with Qwen2.5-14B-Instruct and Qwen2.5-3B-Instruct as Sentinel model A.Source: Table 24 · p. 64, Table 25 · p. 65
• Figure 10 data report extraction rates without chain-of-thought and with cipher-encoded chain-of-thought, alongside GVI values.Source: Table 26 · p. 66
• Figure 5 data are provided separately for MMLU-Pro and GSM8k, using Qwen2.5-14B-Instruct as both Receiver and Sentinel.Source: Table 27 · p. 67, Table 28 · p. 68