{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2026:SIVTGXMHLFOPZYKWRQACEV2LVG","short_pith_number":"pith:SIVTGXMH","schema_version":"1.0","canonical_sha256":"922b335d87595cfce1568c0022574ba9b8c4943fdb38dfee4921b9e50629c33d","source":{"kind":"arxiv","id":"2601.22818","version":2},"attestation_state":"computed","paper":{"title":"Hide and Seek in Embedding Space: Geometry-based Steganography and Detection in Large Language Models","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Charles Westphal, Fernando E. Rosas, Keivan Navaie","submitted_at":"2026-01-30T10:43:43Z","abstract_excerpt":"Fine-tuned LLMs can covertly encode prompt secrets into outputs via steganographic channels. Prior work demonstrated this threat but relied on trivially recoverable encodings. We formalize payload recoverability via classifier accuracy and show previous schemes achieve 100\\% recoverability. In response, we introduce low-recoverability steganography, replacing arbitrary mappings with embedding-space-derived ones. For Llama-8B (LoRA) and Ministral-8B (LoRA) trained on TrojanStego prompts, exact secret recovery rises from 17$\\rightarrow$30\\% (+78\\%) and 24$\\rightarrow$43\\% (+80\\%) respectively, w"},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"2601.22818","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-01-30T10:43:43Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"b22c25ec6b13de6ff7dcf46cf595d13c6e923e3fadf8b22654dba3542763f4ce","abstract_canon_sha256":"ac101199487c17c55ab11288cff72ed7c927c4ca87f73396eb0303d18d22c281"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-20T01:18:26.608471Z","signature_b64":"Lh5YMfK0lqh7MDURoGdH/BpV2D1CSCgMHkRfydCsi/O4n4tlaAwtMdYt6IbZuezhO6JkeT2fO/sWjs+kHyl4DA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"922b335d87595cfce1568c0022574ba9b8c4943fdb38dfee4921b9e50629c33d","last_reissued_at":"2026-07-20T01:18:26.607462Z","signature_status":"signed_v1","first_computed_at":"2026-07-20T01:18:26.607462Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"Hide and Seek in Embedding Space: Geometry-based Steganography and Detection in Large Language Models","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Charles Westphal, Fernando E. Rosas, Keivan Navaie","submitted_at":"2026-01-30T10:43:43Z","abstract_excerpt":"Fine-tuned LLMs can covertly encode prompt secrets into outputs via steganographic channels. Prior work demonstrated this threat but relied on trivially recoverable encodings. We formalize payload recoverability via classifier accuracy and show previous schemes achieve 100\\% recoverability. In response, we introduce low-recoverability steganography, replacing arbitrary mappings with embedding-space-derived ones. For Llama-8B (LoRA) and Ministral-8B (LoRA) trained on TrojanStego prompts, exact secret recovery rises from 17$\\rightarrow$30\\% (+78\\%) and 24$\\rightarrow$43\\% (+80\\%) respectively, w"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2601.22818","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2601.22818/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"2601.22818","created_at":"2026-07-20T01:18:26.607937+00:00"},{"alias_kind":"arxiv_version","alias_value":"2601.22818v2","created_at":"2026-07-20T01:18:26.607937+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2601.22818","created_at":"2026-07-20T01:18:26.607937+00:00"},{"alias_kind":"pith_short_12","alias_value":"SIVTGXMHLFOP","created_at":"2026-07-20T01:18:26.607937+00:00"},{"alias_kind":"pith_short_16","alias_value":"SIVTGXMHLFOPZYKW","created_at":"2026-07-20T01:18:26.607937+00:00"},{"alias_kind":"pith_short_8","alias_value":"SIVTGXMH","created_at":"2026-07-20T01:18:26.607937+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":2,"internal_anchor_count":2,"sample":[{"citing_arxiv_id":"2606.09411","citing_title":"Now You (Still) See Me: Detecting Evasive Steganographic Payloads in LLMs","ref_index":23,"is_internal_anchor":true},{"citing_arxiv_id":"2606.03771","citing_title":"$\\pi$Creds: Privately Inferred Credentials","ref_index":51,"is_internal_anchor":true}]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/SIVTGXMHLFOPZYKWRQACEV2LVG","json":"https://pith.science/pith/SIVTGXMHLFOPZYKWRQACEV2LVG.json","graph_json":"https://pith.science/api/pith-number/SIVTGXMHLFOPZYKWRQACEV2LVG/graph.json","events_json":"https://pith.science/api/pith-number/SIVTGXMHLFOPZYKWRQACEV2LVG/events.json","paper":"https://pith.science/paper/SIVTGXMH"},"agent_actions":{"view_html":"https://pith.science/pith/SIVTGXMHLFOPZYKWRQACEV2LVG","download_json":"https://pith.science/pith/SIVTGXMHLFOPZYKWRQACEV2LVG.json","view_paper":"https://pith.science/paper/SIVTGXMH","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=2601.22818&json=true","fetch_graph":"https://pith.science/api/pith-number/SIVTGXMHLFOPZYKWRQACEV2LVG/graph.json","fetch_events":"https://pith.science/api/pith-number/SIVTGXMHLFOPZYKWRQACEV2LVG/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/SIVTGXMHLFOPZYKWRQACEV2LVG/action/timestamp_anchor","attest_storage":"https://pith.science/pith/SIVTGXMHLFOPZYKWRQACEV2LVG/action/storage_attestation","attest_author":"https://pith.science/pith/SIVTGXMHLFOPZYKWRQACEV2LVG/action/author_attestation","sign_citation":"https://pith.science/pith/SIVTGXMHLFOPZYKWRQACEV2LVG/action/citation_signature","submit_replication":"https://pith.science/pith/SIVTGXMHLFOPZYKWRQACEV2LVG/action/replication_record"}},"created_at":"2026-07-20T01:18:26.607937+00:00","updated_at":"2026-07-20T01:18:26.607937+00:00"}