Headline contributions
AEGIS is the first system in this comparison to survive an active-tamperer attack at all. Combining AES-256-GCM, a from-scratch Reed–Solomon code over GF(256), and a self-synchronizing word-level channel, it recovers the byte-exact secret in 8 of 12 attack cases (67%): substitution, swap, and sentence injection at both 5% and 10%, plus insertion and truncation at 5%. All seven reproduced baselines (AC-2/6, ADG, Discop, OD-KL/OD-TV, LLM-Stega) collapse to 0% recovery the moment any edit is applied. That gap (Table IV, Fig. 2 left) is really the paper’s central empirical claim.
Zero wrong emissions, guaranteed by construction rather than observed by luck. Every decode is gated by AES-GCM tag verification — a corrupted candidate passes only with probability ≈2⁻¹²⁸ — so the four unrecovered cases come back as an explicit refusal (⊥), never a silently wrong secret. This is validated as a unit test before any attack runs at all: Table II shows 3,000/3,000 correct decodes at and under the certified RS budget, and 0/3,000 wrong answers even one symbol past it.
Entropy-aware contrastive sampling for the stealth mode, targeting an optimized distribution under an explicit KL budget δ = C·H(P). At C = 0.01 on GPT-2-XL, ACS-RS-OD reaches AUC 0.792 — the same range the paper benchmarks it against for AC-6 (0.712) and LLM-Stega (0.726) — while posting the best semantic similarity in the entire comparison (0.424) at roughly a fifth of their perplexity, and, unlike either of them, still recovering 67% of messages exactly after attack instead of 0%.
A shared evaluation harness that makes the field’s numbers comparable for the first time. Eight baselines reproduced under identical conditions — same 9,000 prompts, same warden, same seed — rather than compared against each paper’s own reported figures. The paper shows this matters: Discop’s published 4.76 bpw becomes 1.25 bpw under this harness, and ADG’s published perplexity of 709.8 becomes 270.8. More to the point, it’s the only evaluation in this space that reports post-attack recovery and a wrong-emission count at all — the related-work discussion notes none of the stealth-focused prior methods report either.
Supporting contributions
The synchronization mechanism, not just the error-correcting code, is the real engineering novelty. Reed–Solomon assumes a byte channel with known symbol boundaries; a channel that can insert or delete whole words breaks that assumption. The per-word keyed-hash embedding inside a CRC-gated frame with periodic sync markers is what turns an unknown-position edit into a recoverable, known-position erasure — without it, RS has nothing to operate on.
Reframing stealth vs. robustness as a selectable design point instead of a forced trade-off — one key, one AEAD front end, two modes sharing both. The paper’s closing argument, that concealment and verifiable integrity don’t have to be mutually exclusive as long as the system can refuse instead of guess, is essentially this framing stated as a thesis-level claim.
A GPU-free operating point for the robust mode. AEGIS also runs on a pure-Python word n-gram backbone (~1 bit/token, no GPU), at 557 ms to hide and 70 ms to reveal on a laptop CPU. The GPU is only needed to reach the headline stealth/capacity numbers — not for AEGIS to function.
