{"id":"ab8105b8-b28f-4053-9488-45238958c788","arxiv_id":"2506.16023","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"A reversible GAN embeds hidden data into the generated numeric fields of blockchain transactions, recovering it by inverting the generator.","lead":"This paper presents a reversible GAN that generates realistic blockchain transaction amounts while concealing extra hidden data in the generator's input noise, so receivers can recover the data by inverting the network. If it holds up, it roughly doubles to triples the capacity of blockchain covert channels relative to several baselines.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Decoding equations (7) and (9) omit the bias terms of the fully connected layers, so the paper's stated inverse does not invert the generator as written.","rationale":"The reader's weakest assumption concerns the invertibility and conditioning of the weight matrices W1 and W2. That is a legitimate numerical concern, and the paper indeed never reports ranks or condition numbers. However, an even more immediate algebraic issue sits in the same decoding steps: the inverse formulas printed in Section II.E do not account for the bias terms that standard fully connected layers introduce, and step (2) appears to apply the logistic function where the logit function is required. If the implemented layers include biases, the receiver's backcalculation is wrong even with perfect arithmetic and perfectly conditioned matrices. The paper's reported successful decoding implies either bias-free layers, a different treatment of biases, or a typo in the equations, but the text does not say which. Because no code or trained weights are released, a reader cannot disambiguate. This is a load-bearing gap in the central claim, and it supports the conditional verdict rather than full acceptance. I do not claim fraud or intentional omission; the issue may be a simple missing implementation detail. The concrete test above would settle whether the printed algorithm is self-consistent or whether the paper needs a correction. In the meantime, the conditionality of the reader's verdict is appropriate.","tokens_in":27449,"tokens_out":9696,"duration_ms":109957,"concrete_test":"Reimplement the printed decoding path: train R-GAN with PyTorch Linear(bias=True) on the Bitcoin amount dataset, then run Section II.E verbatim, interpreting 'Logistic' as the logistic function. If the recovered noise bits do not match the embedded data, the stated inverse is internally inconsistent. Then rerun with two corrections: use logit for step (2) and subtract b2 and b1 in steps (3) and (5). If the corrected version succeeds, the paper requires a correction; if it fails, the central claim is unsupported by the described algorithm.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim requires the receiver to invert the generator exactly. The generator described in Section II.C is two fully connected layers followed by LeakyReLU and Sigmoid. In the standard PyTorch Linear layer used in the paper's setup, the computation is z^(1) = W1*x + b1, then a = W2*z^(1) + b2, then y = sigmoid(a). Decoding step (3) sets z^(1) = W2^{-1}*x^(2), and step (5) sets x = W1^{-1}*x^(1), with no subtraction of b2 or b1. With nonzero biases, this is not the inverse: z^(1) should be W2^{-1}(x^(2) - b2) and x should be W1^{-1}(x^(1) - b1). The paper never states that the Linear layers are bias-free, and Fig. 4 labels them simply as 'Linear'. Separately, step (2) calls Logistic 'the logistic function', but inverting sigmoid requires the logit function; applying the logistic function to the normalized amount does not recover the pre-activation. Exact arithmetic with nonzero biases therefore fails, independent of conditioning or precision. The reported successful round trips imply the implementation must deviate from the printed equations, but without code or an explicit bias=False statement the decoding procedure is not reproducible as written. This is the most load-bearing soft spot because it sits at the exact point where covert data is recovered.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a generic blockchain-based steganography framework (GBSF) in which the sender generates required transaction fields (e.g., Bitcoin amount, fees) using a GAN whose generator is made reversible, and embeds additional covert data into the generator's input noise. The receiver decodes the data by inverting the generator. The authors present two schemes, R-GAN and CCR-GAN, the latter adding a counter-intuitive data preprocessing (CIDP) step and a custom ClipSigmoid activation to reduce rounding error and stabilize training. They also propose T2C, a magnitude-reduction mechanism to trade capacity for concealment. Experiments on real Bitcoin and Ethereum amount/fee datasets report per-field capacities of 11 and 24 bits for R-GAN and CCR-GAN on Bitcoin amounts, up to 40-41 bits on Ethereum amounts, and concealment metrics based on the CTR steganalysis model. The central claims are that the proposed schemes improve channel capacity over existing blockchain steganography baselines while maintaining acceptable concealment, and that capacity is ultimately limited by IEEE 754 floating-point precision to about 40 bits per field.","tokens_in":27692,"tokens_out":6858,"duration_ms":79243,"significance":"If the reversibility mechanism is correct, the paper addresses a genuinely under-explored problem: generating required transaction fields while simultaneously embedding covert data, rather than only encoding into existing fields. The empirical evaluation is direct and useful: capacities are measured by round-trip decoding through the actual trained models, and the scaling experiments across Bitcoin and Ethereum amount/fee fields provide a concrete, falsifiable statement about when precision limits capacity. The T2C trade-off is a practical contribution, and the comparison with prior amount-embedding baselines is informative. However, the central decoding procedure as printed is not the mathematical inverse of the described generator, and the proof of the main capacity-scaling theorem is incomplete. These are load-bearing issues because the claimed 11/24/40-bit capacities depend on exact inversion and on Theorem 1's predictions. With a corrected and reproducible decoding specification and a more rigorous theorem, the work would be a solid contribution to blockchain steganography.","major_comments":[{"comment":"The decoding procedure as printed does not invert the generator. The fully connected layers in PyTorch compute z = W x + b, but steps (3) and (5) use only W2^{-1} and W1^{-1} without subtracting the bias vectors b2 and b1. Moreover, step (2) applies the logistic (sigmoid) function to the normalized amount, whereas inverting the generator's final sigmoid requires the logit function. Unless the Linear layers are explicitly bias-free (the paper never states this, and Fig. 4 labels them only as 'Linear') and Eq. (6) is intended as the inverse sigmoid, exact arithmetic decoding fails regardless of rounding or precision error. Since the receiver's recovered bits are the central measured quantity, this is load-bearing. The paper should state explicitly that all linear layers are bias-free, or add the bias-subtraction steps, and replace Eq. (6) with the logit transform; alternatively, the authors should provide code confirming the exact implemented inverse.","section":"II.E, Eqs. (6)-(9)"},{"comment":"The scheme requires the square weight matrices W1 and W2 to be invertible, but the paper only sets M=H=N and notes that W^{-1} exists if the matrix is full-rank. Standard GAN training with random initialization and gradient descent does not guarantee full rank, nor does it control the condition number. If either matrix is singular or ill-conditioned, the decoded noise is garbage or the error is amplified, which would invalidate the measured m values for the receiver. Please report condition numbers or singular value distributions for the trained weight matrices, or add an explicit invertibility/orthogonality regularization to the generator, and verify that the inverse used in decoding is the true inverse of the trained forward layer.","section":"II.C and II.E"},{"comment":"The proof of Theorem 1 covers only the special case where Q = max(X) is an exact power of ten (Q = 10^m), y has a finite decimal expansion, and the rounding operator [.] behaves as rounding down (y_{m+1} <= 4). In the actual datasets Q is an arbitrary integer (e.g., 2,874,993,345,277 for the Bitcoin amount dataset), rounding is to the nearest integer, and the conclusion NPID(y, \\hat{y}) = m+1 does not follow from the stated assumptions for general Q. Since Theorem 1 is used to justify CIDP and to predict the 10^17 saturation observed in Section V.C, this is not a purely cosmetic gap. The theorem should be restated and proved for arbitrary integer Q and the actual rounding mode, or its predictions should be supported by direct empirical validation across the fields used in the paper.","section":"III.A, Theorem 1 proof"},{"comment":"ClipSigmoid as defined in Eq. (19) has a flat segment where it is not invertible. The paper asserts that this does not affect reversibility because the sender can intentionally train the generator to avoid the zero-segment, but no mechanism or experiment demonstrates that the flat segment is never entered for the adopted values of m and the tested datasets. The receiver's decoding equations contain no rule for handling outputs at the ClipSigmoid threshold. If a generated amount corresponds to the flat segment, the receiver cannot recover the sender's pre-activation, and the verification loop in Algorithm 1 would be validating against an inverse that is not the true inverse of the generator. Please provide a more precise argument or experiments showing that the flat segment is avoided for the reported configurations, or modify ClipSigmoid to be bijective.","section":"III.B and II.E"}],"minor_comments":[{"comment":"The text of the figures contains garbled glyph sequences such as '/uni00000016/uni00000017/...', making the figures illegible in the submitted version; they should be regenerated with proper fonts.","section":"Figs. 3(a) and 9"},{"comment":"The variable name 'Logistic' is used for the function that should invert the sigmoid; please clarify that this is the logit (inverse sigmoid) transformation, or use a different symbol to avoid ambiguity.","section":"II.E, Eq. (6)"},{"comment":"The comment above Algorithm 3 states 'Algorithm 2 describes the process of revovering magnitude', but the algorithm being described is Algorithm 3; there is also a typo 'revovering'.","section":"IV, Algorithm 3"},{"comment":"There are several typos: 'The Ethernet fee' should be 'Ethereum fee', 'Futhermore' should be 'Furthermore', and 'revovering' appears again.","section":"V.C"},{"comment":"Table IV does not state which m values are used for the Ethereum amount row after the paper discards CCR-GAN and selects a reduced magnitude of 10^3; please make the mapping to Table III explicit.","section":"V.F, Table IV"},{"comment":"The quantitative trade-off 'for every 10-fold reduction in dataset magnitude, the capacity is reduced by 2-3 bits and concealment is enhanced by 3%-4%' is stated without a dedicated experiment or a direct pointer to the supporting data in Table III; please provide the evidence or clarify how the numbers were obtained.","section":"V.D, Answer to RQ5"}],"recommendation":"major_revision","confidential_remarks":"The paper does not include source code or trained models, and the printed decoding equations differ from what would be needed to reproduce the reported round-trips. This makes independent verification difficult. The issues identified appear fixable: if the implementation actually uses bias-free linear layers and the logit transform, a precise statement and code would resolve the main reproducibility concern; the theorem can be strengthened by removing the power-of-ten assumption. I do not see evidence of intentional misreporting, but the manuscript in its current form is not self-contained enough for the central capacity claims to be accepted as stated."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the idea is real, the capacity numbers are believable if the implementation works, but the decoding equations in Section II.E don't invert the generator. That's a load-bearing bug, not a nit.\n\nWhat's actually new: R-GAN treats a GAN generator as a reversible encoder, with a verification loop that resamples noise until the bits survive rounding to an integer on-chain. That's a clever way to get guaranteed decodability, and I haven't seen it in the prior blockchain-steganography literature. The CIDP and ClipSigmoid additions are a reasonable response to the rounding/convergence tradeoff, and the T2C knob for trading capacity against concealment is useful. The authors also did the right empirical checks: round-trip decoding, cross-chain scaling (Bitcoin fee, Ethereum amount/fee), and the float64 saturation at ~10^17 magnitude. Those results look internally consistent.\n\nSoft spots, in rough order of severity:\n\n1. Section II.E is not the inverse of the generator. Step (2) applies the logistic function to the normalized amount, but the generator's last activation is Sigmoid; to invert you need the logit. Steps (7) and (9) multiply by W2^{-1} and W1^{-1} without subtracting the layer biases, and the paper never states that the Linear layers are bias-free. The reported round-trip successes therefore cannot come from the printed algorithm; they must come from an implementation that differs from the text. Without code — none is released — the method is not reproducible as written. This is the most serious issue.\n\n2. Theorem 1's proof handles only the round-down case and ignores carries from rounding up, so the claimed ten-fold/NPID relation isn't fully derived. The empirical trend may still hold, but the theorem needs a proper proof or a corrected statement.\n\n3. The 'outperforms state-of-the-art' claim is too broad: in Table V, STCBC embeds ~27 bits vs CCR-GAN's 24, so capacity is not a win; the concealment advantage is real and is the right basis for comparison.\n\n4. A secondary technical gap: invertibility is assumed (M=H=N, full-rank) but no rank or condition monitoring is reported. That's worth an ablation, especially since this scheme lives or dies by inversion accuracy.\n\nBottom line: the paper is worth a serious referee — the core idea is novel and the capacity boost would matter to the covert-channel community. But the current text needs major revision before it can be trusted. I'd send it out, with a request for corrected decoding equations, code/data, and a fixed theorem.","headline":"Novel reversible-GAN steganography with plausible capacity numbers, but the printed decoding equations don't invert the generator as written.","tokens_in":28314,"tokens_out":7759,"would_cite":false,"duration_ms":80362,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims a reversible GAN can embed 11–24 bits of covert data per Bitcoin transaction amount and up to about 40 bits per numeric field under IEEE 754 precision, with the receiver recovering the data by inverting the generator.","keywords":["blockchain steganography","covert channel","reversible generative adversarial network","transaction amount embedding","capacity expansion","IEEE 754 precision","steganalysis"],"falsifier":"Train the R-GAN exactly as described on Bitcoin output amounts, then compute the condition number of W1 and W2 from the trained generator and run the encoding/decoding loop on 10,000 random noise vectors. If any trained run yields a singular or severely ill-conditioned matrix, or if the recovered covert-data bits disagree with the sent bits at a rate higher than the reported 11-bit (R-GAN) or 24-bit (CCR-GAN) error rate, the central claim fails.","tokens_in":27172,"feed_emoji":"🔐","tokens_out":5718,"duration_ms":57357,"temperature":0.7,"pith_summary":"This paper tries to turn the required fields of a blockchain transaction—fields the sender must fill anyway, like the output amount and the fee—into a covert channel. The sender trains a generative adversarial network whose generator is deliberately invertible, encodes extra covert data into the generator's input noise, and publishes the generated field; the receiver recovers the noise by backcalculating the generator. The central experimental claim is that this works on real Bitcoin data: 11 bits per transaction amount with the basic design, 24 bits with an improved design that reduces rounding error, both with generation times under three seconds. The paper also claims a hard ceiling: under IEEE 754 double precision, about 40 bits per numeric field, because floating-point error dominates once dataset magnitude reaches $10^{17}$. A reader should care because this raises channel capacity without touching the fields where existing steganography already hides data.","feed_headline":"A reversible GAN packs 24 covert bits into Bitcoin amounts","feed_subtitle":"The receiver inverts the generator to recover the data; IEEE 754 precision sets the ceiling near 40 bits per field.","key_machinery":"The load-bearing object is the reversible generator: two fully connected layers, equal width M=H=N, with LeakyReLU followed by Sigmoid (or ClipSigmoid). Decoding is the exact inversion chain X̂ = $W1^{{-1}}$($LeakyReLU^{{-1}}$($W2^{{-1}}$(Logistic(Ŷ)))), so invertibility of W1 and W2 is assumed. The argument that capacity can be tuned is carried by the NPID measure—the count of consecutive identical leading digits between the sender's normalized value and the receiver's rounded value—and by the theorem that raising the dataset's maximum value by a factor of ten increases NPID by one.","core_discovery":"The central claim is that a GAN generator made of two fully connected layers with piecewise-linear and monotone activations is a reversible function, so the sender can put covert data into the generator's noise and the receiver can recover it by computing $W1^{{-1}}$, the inverse LeakyReLU, $W2^{{-1}}$, and the inverse logistic on the observed rounded field. Rounding to integer amounts creates the limiting error; the paper's Theorem 1 says each tenfold increase in the difference between the dataset's maximum and minimum adds one recoverable digit, which motivates keeping extreme amounts in the training set. To make that work, ClipSigmoid clamps tiny Sigmoid outputs to $10^{-20}$ so gradients vanish instead of exploding. The net experimental result is that R-GAN reaches 11 bits and CCR-GAN 24 bits per Bitcoin amount, with the Bitcoin fee, Ethereum amount, and Ethereum fee also usable, and with capacity saturating near 40 bits when the rounding error no longer dominates.","pith_inferences":["Because decodability rests on inverting W1 and W2, a natural testable extension is to regularize the generator to keep its weight matrices well-conditioned; the paper does not verify conditioning after training.","The verification loop in the encoder is a rejection sampler whose expected runtime grows roughly exponentially with m; the reported 'under 3 seconds' figure is tied to the tested bit counts and would grow sharply if m were raised, unless error-correcting codes replace bit-by-bit verification.","The 40-bit ceiling suggests the true carrier is the field's numeric range, not the neural network; any generator that maps noise to the same distribution would hit the same rounding and precision limits.","The paper assumes both parties share the same trained model; a deployment would need a retraining and sync schedule, and that schedule itself could leak side information to an observer."],"forward_implications":["Existing blockchain covert channels that use the address or signature as the embedding field can gain capacity by also using the amount or fee field, since the sender controls these fields anyway.","The capacity ceiling is architectural: with float64 and IEEE 754, no amount of dataset preprocessing pushes a single numeric field beyond about 40 bits.","The scheme transfers to other numeric fields and blockchains, with measured capacities of 2–4 bits for Bitcoin fee, roughly 40 bits for Ethereum amount, and 21–25 bits for Ethereum fee.","T2C gives the communicating parties a tunable knob: shrinking the dataset magnitude by a factor of ten trades 2–3 bits of capacity for 3–4% better concealment.","Concealment is probabilistic, not perfect: a steganalysis classifier trained to recognize generated fields detects them with accuracy between 0.577 and 0.968 depending on field and dataset."],"supporting_citations":[{"why":"Supplies the required-field-generation baseline and the CTR steganalysis model used to measure concealment.","marker":"[15]"},{"why":"Foundational GAN framework that the reversible generator extends.","marker":"[16]"},{"why":"Defines IEEE 754 standard, which sets the computational precision barrier of about 40 bits per field.","marker":"[26]"},{"why":"Justifies sampling the generator's input noise from a uniform distribution because encrypted covert data looks random.","marker":"[31]"},{"why":"CCMBBT baseline used for the Bitcoin amount capacity and concealment comparison.","marker":"[38]"},{"why":"STCBC baseline used for the Bitcoin amount capacity and concealment comparison.","marker":"[39]"},{"why":"AMASC baseline used for the Bitcoin amount capacity and concealment comparison.","marker":"[40]"}],"fun_headline_variants":["Reversible GAN hides 24 bits in Bitcoin amounts","Backcalculating GAN boosts blockchain steganography to 24 bits","CCR-GAN: Reversible GAN for covert data in blockchain fields","Reverse GAN encodes covert data in Bitcoin transactions","24-bit steganography via reversible GAN on blockchain"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The decoding scheme assumes the generator's two square weight matrices remain full-rank and numerically stable after training; the paper sets their dimensions equal but never checks that the learned matrices are actually invertible.","fun_headline_variants_meta":{"raw":{"variants":["Reversible GAN hides 24 bits in Bitcoin amounts","Backcalculating GAN boosts blockchain steganography to 24 bits","CCR-GAN: Reversible GAN for covert data in blockchain fields","Reverse GAN encodes covert data in Bitcoin transactions","24-bit steganography via reversible GAN on blockchain"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000173,"raw_usage":{"total_tokens":1337,"prompt_tokens":1065,"completion_tokens":272,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":681,"completion_tokens_details":{"reasoning_tokens":186}},"tokens_in":681,"tokens_out":272,"duration_ms":3157,"temperature":1.0,"reasoning_tokens":186,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T23:45:26.497911+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train the R-GAN exactly as described on Bitcoin output amounts, then compute the condition number of W1 and W2 from the trained generator and run the encoding/decoding loop on 10,000 random noise vectors. If any trained run yields a singular or severely ill-conditioned matrix, or if the recovered covert-data bits disagree with the sent bits at a rate higher than the reported 11-bit (R-GAN) or 24-bit (CCR-GAN) error rate, the central claim fails.","supporting_citations":[{"cited_title":"Practical blockchain-based steganographic com- munication via adversarial ai: A case study in bitcoin,","cited_arxiv_id":null,"evidence_quote":"Supplies the required-field-generation baseline and the CTR steganalysis model used to measure concealment."},{"cited_title":"Generative adversarial networks: An overview,","cited_arxiv_id":null,"evidence_quote":"Foundational GAN framework that the reversible generator extends."},{"cited_title":"Single-precision floating-point adder based on ieee 754 standard through verilog,","cited_arxiv_id":null,"evidence_quote":"Defines IEEE 754 standard, which sets the computational precision barrier of about 40 bits per field."},{"cited_title":"Katz and Y","cited_arxiv_id":null,"evidence_quote":"Justifies sampling the generator's input noise from a uniform distribution because encrypted covert data looks random."},{"cited_title":"A novel covert communication method based on bitcoin 17 transaction,","cited_arxiv_id":null,"evidence_quote":"CCMBBT baseline used for the Bitcoin amount capacity and concealment comparison."},{"cited_title":"A blockchain-based secure covert communication method via shamir threshold and stc mapping,","cited_arxiv_id":null,"evidence_quote":"STCBC baseline used for the Bitcoin amount capacity and concealment comparison."},{"cited_title":"Amount-based covert communication over blockchain,","cited_arxiv_id":null,"evidence_quote":"AMASC baseline used for the Bitcoin amount capacity and concealment comparison."}],"review_version":1}