# RESULT — 083 stego-capacity (DEFENSIVE covert-channel capacity characterization)

**Tier: T3-exploratory. DONE + SELF-HARVESTED in-session.** Extends BLOCK K (safety applications, from
082). Box GPU phys0 (CVD=0) tmux `c100_083`, **21,344 Stage-A carrier-sweep decodes + 384 round-trip
payloads, det_ok=True, 227.7 s**. Rule-free (exact greedy-decode string match + chrF + cosine + nn-cos
+ norm), analysis local, ran per frozen `PREREG_LITE.md`; no deviations. Src: `stego_run.py`
(byte-identical to the script executed on box, md5 `d97d08d0…`; invoked via wrapper `run_083.sh`).

## Framing (defensive, per 025 lesson)
We **quantify the side-channel capacity of a SONAR z-vector**: for a *latent channel* (z' transmitted
directly), how many payload bits can be hidden in `z' = z + δ` that evade BOTH proposed monitors —
(a) a **cosine gate** `cos(z,z') ≥ τ` (τ=0.95, the 082 operating point) AND (b) a **decode-parse
monitor** requiring greedy `decode(z') == decode(z)` (the sentence reads the same) — AND are recoverable
from z'. Then: is such a payload **detectable** by a defender's cheap orthogonal check (manifold nn-cos,
norm)? The deliverable is the **capacity-vs-detectability tradeoff** that tells a defender which auxiliary
monitor to add. Neutral characterization of a representation's covert channel, not a channel for misuse.

## ★ Headline — cosine+decode monitors leave a ~100-bit hole; a manifold/norm check closes it
Against the two named monitors **only**, a single SONAR latent hides **~103 bits/sentence**
(joint-cosine-budget estimate, non-radial) **+ ~3.6 bits** in the cosine-free magnitude carrier, and
**96.1 % of such payloads pass both gates and are recovered at BER = 0.0**. This is an order of magnitude
above the prereg guess (~10 bits) — the decode-inert, cosine-cheap subspace is large and the
representation's own re-encode noise floor is tiny, so each carrier direction holds ~4–7 bits.
**But the capacity is NOT detection-free:** every carrier family is caught by one cheap orthogonal
monitor. Directional payloads (which hold ~100 of the bits) push z off-manifold — a nearest-neighbour
cosine monitor (max cos to a reference bank) separates max-payload from clean at **AUC 0.92–0.94**.
The magnitude/radial carrier is manifold-invisible (**nn AUC 0.50**, cos ≡ 1) but a **norm monitor
catches it at AUC 0.998**. So the defensive statement is sharp: **latent-cosine + decode-parse monitoring
is insufficient (≈100-bit covert channel); pairing it with a manifold-distance check + a norm check
detects the payload.** This is the concrete "orthogonal check the cosine gate lacks" that 082 flagged.

## Capacity (τ=0.95, γ=4 SNR margin; median ‖z‖=0.204, cosine-ball radius R=0.0645)
| carrier family | dims | median inert_frac | median cos_frac | bits/carrier (med) | family Σ bits (per-carrier) |
|---|:--:|:--:|:--:|:--:|:--:|
| **NULL_ORTHO** (sample null-space, 037) | 8 | 0.300 | 0.300 | 6.79 | 54.2 |
| **NULL_INSUP** (low-variance PCA, 037) | 8 | 0.275 | 0.300 | 6.23 | 50.2 |
| **RAND** (random dirs) | 8 | 0.300 | 0.300 | 5.91 | 47.9 |
| **MAG** (radial, 036) | 1 | 0.200 | *cos-free* | 3.58 | 3.6 |
| *TOP* (decode-relevant **control**) | 4 | **0.205** | 0.300 | 4.97 | 19.5 |

- **C_percarrier (optimistic upper bound**, each carrier at its own min(decode,cos) limit): **152.3 bits** non-radial.
- **C_jointbudget (realistic**, orthonormal carriers uniformly down-scaled so Σaᵢ² ≤ R²; scale 0.237): **103.2 bits** non-radial + **3.6** radial ≈ **107 bits/sentence**.
- Carriers were **orthonormalised (QR)** across families so capacity is not double-counted; Stage-B round-trip therefore has zero cross-talk → **BER 0.0**.
- **NULL families are the largest non-radial carriers** (P2), but only marginally over RAND — the whole decode-inert-and-cosine-cheap subspace is broadly usable, not just the 037 near-null dims.

## Round-trip (empirical demonstration)
384 payloads (32 test sentences × 12 random payloads) built at the derived joint-budget levels over the
24 non-radial carriers: **gate_pass 0.961** (exact-decode 0.961 × cos≥τ 1.000), **BER 0.000** — the ~103
payload bits are recovered perfectly by projecting z' onto the carriers. The 3.9 % gate failures are
sentences that flip one decode token at the maximal derived level (inert range calibrated at a 90 %
exact-match threshold, so a minority flips at the edge).

## Detectability AUC (max payload vs clean, per family)
| family | manifold nn-cos AUC | norm AUC | reading |
|---|:--:|:--:|---|
| NULL_ORTHO | **0.932** | 0.681 | off-manifold → caught by nn monitor |
| NULL_INSUP | **0.923** | 0.674 | off-manifold → caught by nn monitor |
| RAND | **0.937** | 0.681 | off-manifold → caught by nn monitor |
| MAG (radial) | 0.500 | **0.998** | manifold-invisible, but norm-detectable |
| TOP (control) | 0.932 | 0.724 | — |

## Gates / controls
- **G_identity** PASS: zero-payload (frac=0) rows decode EXACTLY (exact=1), cos=1.0.
- **G_decode_monitor** (positive control, P4) PASS: **TOP (decode-relevant) is the least decode-inert
  family** (inert_frac 0.205 < NULL 0.30) and its inert range is **below the cosine budget** (frac ≈0.30),
  so a payload pushed to the cosine limit along top-PC directions DOES change the decode → the decode
  monitor certifiably bites where the payload is decode-relevant. (Gap is modest — decode is fairly
  scale/rotation-robust at small magnitude, consistent with 036/037 — but the ordering is correct.)
- **G_norm** (lesson 3) PASS/flag: radial payload norm-detectable (AUC 0.998); directional carriers shift
  ‖z'‖ only modestly (AUC ~0.68) — the norm monitor alone does NOT catch directional payloads (nn does).
- **G_roundtrip** PASS: BER 0.000, gate_pass 0.961.
- **G_det** PASS: greedy decode deterministic (det_ok=True).

## Predictions → outcomes → Brier (frozen in PREREG_LITE)
| id | statement | P | outcome |
|----|-----------|---|---------|
| P1 | MAG inert ≥±25% AND cos-free AND norm-AUC≥0.9 | 0.80 | **FALSE** (inert only ±20% under strict exact-match [036's ±30% was judge-based]; cos-free ✓, norm-AUC 0.998 ✓ — the ±25% clause misses) |
| P2 | NULL carriers largest non-radial capacity, ≥1 bit/dim | 0.60 | **TRUE** (NULL_ORTHO 54 > RAND 48; ~4–7 bits/dim) |
| P3 | total capacity 4–40 bits (order ~10) | 0.50 | **FALSE** (103 bits — an order of magnitude above; the monitors leave a far larger hole than guessed) |
| P4 | TOP payload changes decode within cosine budget (decode monitor certified) | 0.85 | **TRUE** (TOP least inert 0.205 < budget 0.30) |
| P5 | payload detectable, manifold/norm AUC≥0.70 | 0.60 | **TRUE** (directional nn 0.92–0.94; radial norm 0.998 — not detection-free) |
| P6 | round-trip BER < 0.01 | 0.90 | **TRUE** (0.000) |

**Mean Brier = 0.2071** (4/6). **The two misses are the science:** (P3) the covert capacity against
cosine+decode monitors is ~10× larger than intuited — a single sentence latent is a ~100-bit side
channel if only those two monitors are deployed; (P1) under a *strict exact-decode* criterion the
magnitude carrier is inert only to ±20 %, tighter than 036's judge-based ±30 %.

## Caveats / limitations
- **Latent channel only** (z' transmitted losslessly). In a *text* channel the payload does not survive
  by construction — an identical decode re-encodes to the clean z, destroying the payload; that channel's
  capacity through this mechanism is ~0. This row bounds the latent side-channel, which is the row's question.
- **Capacity is a modelling estimate** (levels = decode-inert-and-cosine-range / γ·noise-floor); the
  *demonstrated* number is the round-trip: 96 % of ~103-bit payloads pass both gates at BER 0. The γ=4
  choice sets the SNR margin; a smaller γ raises the estimate, a larger γ lowers it.
- **SAE-residual carrier (042/043) approximated by the PCA null/low-variance subspace** — the trained w40
  SAE weights were not loaded (noted; the null/residual proxy is a conservative stand-in and behaves like
  042's "structured residual": high capacity, off-manifold-detectable).
- **`auc_spanE` in capacity.json is DEGENERATE** (compared payload span-energy to a constant 1.0, not the
  true held-out-clean span-energy) — **disregard it**; the valid detectors are `auc_nn` and `auc_norm`,
  both scored against the real clean distributions.
- Templated English SVO/spatial stimuli, one embedder (SONAR), greedy decode, 300-sentence reference bank
  (nn-cos monitor uses this bank; a real defender's bank would differ). Worst-case per-carrier envelope.

## Bottom line
For this autoencoder, a defender monitoring **only** latent-cosine (τ=0.95) + decode-parse leaves a
**~100-bit-per-sentence covert channel**: a payload placed in the decode-inert, cosine-cheap subspace
(near-null PCA dims, sample null space, and even generic random directions) decodes to the identical
sentence, stays within the cosine budget, and reads back at BER 0 in 96 % of cases. The magnitude/radial
carrier adds ~4 bits at **zero** cosine cost. **The channel is not detection-free:** the directional
payload is off-manifold (nn-cos monitor AUC 0.92–0.94) and the radial payload is norm-anomalous (AUC
0.998). **Defensive conclusion:** cosine + decode monitoring must be paired with a **manifold-distance
(nn-cos-to-bank) check and a norm check** to close the side channel — the concrete orthogonal monitor
082 said the cosine gate was missing. **Follow-up worth funding? Y (narrow):** (1) load the real w40 SAE
and test the SAE-residual carrier specifically (does dictionary structure raise or lower detectability?);
(2) natural (non-templated) sentences — does the ~100-bit capacity and the nn-cos AUC hold off-manifold?;
(3) an *adaptive* payload that minimises off-manifold nn-cos deviation (project onto the data manifold's
tangent) — the true worst-case for a manifold monitor, to size the residual undetectable capacity.

## Provenance / hygiene
Repo: PREREG_LITE.md (frozen), src/{stego_run.py,run_083.sh}, out/{capacity,carriers,meta,sweep,
stageB}.json + run.log + DONE. Box GPU phys0 claimed@35 MiB, released@exit (back to 35 MiB); no foreign
process touched; tmux `c100_083` self-exited (never kill-server). night8 venv, `unset CONDA_PREFIX`,
HF_HOME=/workspace/hfcache, BLAS=8. Single experiment in flight (one-at-a-time honoured). Local commit,
no push. T3-exploratory. *Note: trailing `run.log` shell-parse errors are cosmetic — they occurred AFTER
the python run finished + wrote all sentinels/JSONs (an in-flight scp of the renamed wrapper corrupted
bash's read of the wrapper's trailing lines); results are unaffected, det_ok=True, DONE written by python.*