Paper deep dive
GrayShield: Bit-Level Sanitization for Transformer Model Supply-Chain Security
Armstrong Foundjem, Tsung-Hsien Chuang, Foutse Khomh, Mohamed Amine Merzouk
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 91%
Last extracted: 10/6/2026, 11:17:49 AM
Summary
The paper introduces GrayShield (GS), a lightweight, post-training, zero-data sanitization method designed to secure Transformer model supply chains by neutralizing covert channels embedded in the least significant bits (LSBs) of model weights. GS uses Gray-code-guided low-transition sequences and a keyed per-tensor phase to overwrite payload bits, ensuring complete payload-independent erasure. Benchmarked against seven defenses, GS maintains sub-1% accuracy impact and achieves approximately 50 percentage-point Recovery Reduction (RR), effectively reducing payload recovery to binary chance, while exhibiting smaller weight-distribution shifts than baselines like PatternMask and Post-Training Quantization.
Entities (9)
Relation Signals (6)
GrayShield → evaluatedon → BERT
confidence 95% · evaluated across... BERT-base... and RoBERTa-base
GrayShield → evaluatedon → Vision Transformer
confidence 95% · evaluated across... ViT-Base/16... and Swin-Base
GrayShield → mitigates → Least Significant Bits
confidence 95% · GrayShield... completely replaces the declared mantissa-LSB channel... makes the sanitized target bits independent of the embedded payload
GrayShield → outperforms → PatternMask
confidence 90% · substantially smaller weight-distribution shift than the evaluated near-chance baselines PatternMask (PM)
GrayShield → outperforms → Post-Training Quantization
confidence 90% · substantially smaller weight-distribution shift than the evaluated near-chance baselines... Post-Training Quantization (PTQ)
Least Significant Bits → usedin → Hugging Face Model Hub
confidence 80% · potential for model weights to act as covert carriers... Hugging Face Model Hub... host hundreds of thousands of model checkpoints
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Transformer models such as BERT and Vision Transformer~(ViT) achieve strong performance via densely parameterized attention backbones. However, the least significant bits~(LSBs) of their 32-bit floating-point weights can be abused as covert channels to conceal malicious payloads, posing a serious threat to the AI model supply chain. We propose \GS (\GSabbr), a lightweight, post-training, zero-data sanitization method that completely replaces the declared mantissa-LSB channel with a Gray-code-guided low-transition sequence. Complete payload-independent overwrite, whether keyed or public, makes the sanitized target bits independent of the embedded payload and gives that declared channel zero capacity. Gray coding supplies overwrite structure, while a keyed per-tensor phase supplies pattern diversity. Benchmarked against seven post-training defenses on four Transformer model presets and two real-world malware payloads, \GSabbr maintains sub-$1\%$ accuracy impact and achieves $49.96\pm0.66$ percentage-point Recovery Reduction (RR) under five implemented attacker variants. Because pre-defense recovery is effectively $100\%$, RR near 50 percentage points corresponds to post-sanitization bit accuracy at binary chance. Its main empirical advantage is stable near-chance sanitization with substantially smaller weight-distribution shift than the evaluated near-chance baselines PatternMask (PM) and Post-Training Quantization (PTQ).
Tags
Links
- Source: https://arxiv.org/abs/2610.04319v1
- Canonical: https://arxiv.org/abs/2610.04319v1
Trouble viewing inline? Open PDF directly →
Full Text
72,802 characters extracted from source content.
Expand or collapse full text
GrayShield: Bit-Level Sanitization for Transformer Model Supply-Chain Security Armstrong Foundjem Tsung-Hsien Chuang Foutse Khomh Mohamed Amine Merzouk Abstract Transformer models such as BERT and Vision Transformer (ViT) achieve strong performance via densely parameterized attention backbones. However, the least significant bits (LSBs) of their 32-bit floating-point weights can be abused as covert channels to conceal malicious payloads, posing a serious threat to the AI model supply chain. We propose GrayShield (GS), a lightweight, post-training, zero-data sanitization method that completely replaces the declared mantissa-LSB channel with a Gray-code-guided low-transition sequence. Complete payload-independent overwrite, whether keyed or public, makes the sanitized target bits independent of the embedded payload and gives that declared channel zero capacity. Gray coding supplies overwrite structure, while a keyed per-tensor phase supplies pattern diversity. Benchmarked against seven post-training defenses on four Transformer model presets and two real-world malware payloads, GS maintains sub-1%1\% accuracy impact and achieves 49.96±0.6649.96± 0.66 percentage-point Recovery Reduction (R) under five implemented attacker variants. Because pre-defense recovery is effectively 100%100\%, R near 50 percentage points corresponds to post-sanitization bit accuracy at binary chance. Its main empirical advantage is stable near-chance sanitization with substantially smaller weight-distribution shift than the evaluated near-chance baselines PatternMask (PM) and Post-Training Quantization (PTQ). 1Mila - Quebec Artificial Intelligence Institute and Polytechnique de Montréal, QC, Canada a.foundjem, foutse.khomh@polymtl.ca 2Research Center for Information Technology Innovation, Academia Sinica, Taipei, Taiwan tsung-hsien.chuang@sinica.edu.tw 3Mila - Quebec Artificial Intelligence Institute and McGill University Montréal, QC, Canada mohamed.a.merzouk@mcgill.ca Introduction The rapid adoption of pretrained deep learning models has transformed computer vision, natural language processing, and cybersecurity (Vaswani et al. 2017; Devlin et al. 2019; Dosovitskiy et al. 2021). Repositories such as Hugging Face Model Hub now host hundreds of thousands of model checkpoints (Hugging Face 2026), enabling practitioners to deploy state-of-the-art Transformer architectures without retraining. However, this convenience introduces a new and underappreciated attack surface: the potential for model weights to act as covert carriers for malicious content (Wang et al. 2021; Liu et al. 2020; Hitaj et al. 2022). Unlike traditional malware distribution, large-scale model files contain millions of 32-bit floating-point parameters, providing vast capacity for hiding malicious code with negligible impact on downstream accuracy. EvilModel (Wang et al. 2021) embeds up to 36.9 MB of malware in AlexNet through parameter substitution with minimal accuracy degradation. StegoNet uses neural-network parameters, including LSB substitution, as payload channels, whereas MaleficNet combines spread-spectrum embedding with LDPC error correction (Liu et al. 2020; Hitaj et al. 2022). Model X-Ray (Gilkarov and Dubin 2026) introduced detection frameworks using few-shot learning to identify payloads hidden through LSB substitution. Casey et al. (Casey et al. 2024) report widespread unsafe serialization and manually confirm 14 malicious Hugging Face files; a large-scale model-hub study likewise treats model distribution as a software supply-chain boundary (Zhao et al. 2024). We refer to these threats as maleficent neural networks: models that are active carriers of malware, not merely targets of adversarial attacks. Real-world incidents confirm the urgency. In 2022, a trojanized PyTorch dependency (torchtriton) was distributed via PyPI, a supply-chain vector structurally analogous to malicious model checkpoints (PyTorch Foundation 2022). Despite growing recognition, existing defenses face fundamental limitations. Detection-oriented approaches identify suspicious checkpoints but do not remove the payload (Gilkarov and Dubin 2026). Post-training quantization reduces numerical precision and can overwrite low-order information as a side effect (Krishnamoorthi 2018; Nagel et al. 2020). Fine-tuning is effective but expensive and requires trusted data. Prior malware-in-weights work already includes error-correcting codes (Hitaj et al. 2022); the remaining gap is an explicit, scoped channel-erasure argument for complete replacement of a declared payload-bearing bit set. To address this gap, we propose GrayShield, a Gray-code-guided bit-level sanitizer that completely overwrites the target mantissa LSBs and uses a keyed tensor-specific phase for pattern diversity. We pose four research questions (RQs): RQ1 (Threat Surface): At what LSB overwrite depth does mantissa-bit payload injection remain stealthy, lossless, and undetectable across diverse Transformer families? RQ2 (Defense Effectiveness): Which post-training sanitization strategies disrupt payload recovery to chance level while preserving downstream utility, under a Tier-1 naive attacker? RQ3 (Adaptive Robustness): Does GrayShield maintain chance-level payload disruption when attackers strengthen their encoding strategy with redundancy coding and burst-resilient interleaving? RQ4 (Deployment Trade-Off): Is GrayShield Pareto-optimal in the joint (Recovery Reduction, accuracy drop, variance, runtime) space, and what is the recommended deployment operating point? Contributions. Our contributions are threefold: (i) we formalize a declared weight-LSB covert channel and show that complete payload-independent overwrite erases that target channel; (i) we introduce a Gray-code overwrite structure with a keyed per-tensor phase for low-transition patterns and pattern diversity; and (i) we evaluate security, utility, stability, fidelity, and runtime across four Transformer presets, two payloads, seven defenses, and five attacker variants, finding the smallest W1W_1 shift among the evaluated near-chance defenses. Background and Related Work Floating-point representation and LSB steganography. Deep learning frameworks store model parameters as IEEE-754 binary32 (FP32) values (Institute of Electrical and Electronics Engineers 2019). Each float32 occupies 32 bits: one sign bit, eight biased exponent bits, and twenty-three mantissa bits. For a normalized FP32 value, changing the least significant fraction bit moves the value by one unit in the last place at its current exponent; the absolute perturbation therefore depends on that exponent. LSB steganography (Cox et al. 2007; Fridrich 2009) exploits this: an attacker reinterprets each weight as a 32-bit unsigned integer via bitcast, replaces the lowest x mantissa bits with payload bits, and writes back: ui′=(ui&∼mx)|(pi&mx)u_i =(u_i\,\&\, m_x)\,|\,(p_i\,\&\,m_x), mx=(1≪x)−1m_x=(1 x)-1. Extraction is the exact inverse. StegoNet directly studies LSB substitution in neural-network parameters, and MaleficNet demonstrates coded weight payloads (Liu et al. 2020; Hitaj et al. 2022). Supply chain and payload characteristics. Public repositories distribute pretrained checkpoints via a single API call without inspecting weight tensors. The difficulty of sanitization scales with payload entropy: low-entropy payloads (normalized entropy ≲0.65 0.65) tolerate partial corruption; high-entropy payloads (entropy ≳0.90 0.90) require near-lossless reconstruction. Defenses and their limitations. Detection-oriented methods (Gilkarov and Dubin 2026) identify compromised checkpoints but do not remove the payload. Task-aware PTQ methods optimize weight-rounding decisions using calibration data (Nagel et al. 2020); our evaluated static symmetric-INT8 quantize–dequantize baseline is a payload-disruption comparison, not a security-certified PTQ method. Active sanitization (Dubin 2023) directly perturbs weights, but perturbation-based approaches offer no complete-overwrite guarantee for the declared payload channel. Weight-bit integrity attacks and defenses instead study inference failure under sparse malicious flips (Yao et al. 2020; He et al. 2020); that objective differs from erasing an arbitrary byte stream stored in otherwise functional weights. Gray codes. A Gray code (Gray 1953) is a bijection Gray:0,…,2n−1→0,1nGray:\0,…,2^n-1\→\0,1\^n such that consecutive codewords differ in exactly one bit: Ham(Gray(i),Gray(i+1))=1Ham(Gray(i),Gray(i+1))=1. Standard reflected binary construction: Gray(z)=z⊕(z≫1)Gray(z)=z (z 1). Two properties motivate its use here. (i) Low transition: adjacent unmasked codewords differ in one bit, inducing structured rather than independently scattered overwrite values. (i) Balance over complete masked periods: for gi=Gray(i+ℓ)&mxg_i=Gray(i+O_ )\,\&\,m_x, the low x output bits are balanced over a period of 2x+12^x+1; the phase rotates the finite tensor segment and diversifies patterns. These properties motivate the design and its empirical fidelity; zero target-channel capacity follows from complete payload-independent overwrite, not from Gray coding or phase secrecy. Related work on coding theory and steganography (Cox et al. 2007; Fridrich 2009; Shannon 1948) establishes that reliable communication requires a positive channel capacity. We are not aware of prior work that explicitly formulates complete replacement of a declared neural-weight payload channel as channel erasure. Model compression methods (Han et al. 2016; Frantar et al. 2023) are designed for efficiency, not security, and provide no guarantees against structured payload embedding. GrayShield Figure 1: GrayShield evaluation pipeline. (A) Inputs define the empirical study space: pretrained models, evaluation datasets, and malware payloads from MalwareBazaar. (B) LSB injection overwrites the lowest x mantissa bits at depths x∈4,8,16,19,21,23x∈\4,8,16,19,21,23\ to produce (C) poisoned models. (D) Seven sanitization strategies transform poisoned checkpoints into defended models. (E) Payload recovery is assessed by LSB extraction, and (F) security, fidelity, and utility metrics are computed. All four research questions are answered from the complete pipeline: RQ1 characterises the capacity boundary of injection; RQ2 compares defense effectiveness against the Tier-1 naive attacker; RQ3 evaluates adaptive robustness under five Tier-2 attacker variants (re-running stages B–F with varied attacker encodings); and RQ4 synthesises the Pareto trade-off from RQ2–RQ3 results. Dashed arrows denote analytical dependencies across research questions. Algorithm Keyed phase for pattern diversity. For each target tensor W(ℓ)∈ℝNℓW^( ) ^N_ (attention Q/K/V/O and MLP weight matrices in encoder blocks): ℓ=H(nameℓ,x,layerℓ,r,s)mod(231−1),O_ =H( name_ ,\,x,\, layer_ ,\,r;\,s) (2^31-1), (1) where H is HMAC-SHA256 (Bellare et al. 1996), s is a 128-bit secret seed, and r is a reproducible run salt. The phase varies the overwrite pattern across tensors and releases. Secrecy is not required for target-channel erasure; it is useful only when pattern prediction or reuse is part of the deployment threat model. Gray-code overwrite rule. For each element index i: gi(ℓ)=(ni(ℓ)⊕(ni(ℓ)≫1))&mx,ni(ℓ)=i+ℓ,g_i^( )= (n_i^( ) (n_i^( ) 1) )\;\&\;m_x, n_i^( )=i+O_ , (2) where mx=(1≪x)−1m_x=(1 x)-1. The sanitized uint32 view is: ui′=(ui&∼mx)|gi(ℓ),u_i =(u_i\;\&\; m_x)\;|\;g_i^( ), (3) preserving sign and exponent bits, with adjacency smoothness Ham(gi(ℓ),gi+1(ℓ))≤1Ham(g_i^( ),g_i+1^( ))≤ 1. Algorithm 1 gives the complete procedure. The operation is fully vectorizable, completing in O(N)O(N) time with O(1)O(1) auxiliary state per tensor. Algorithm 1 GrayShield Sanitization 0: Transformer ℳM, depth x, secret seed s, salt r 0: Sanitized ℳ′M with all declared target bits replaced 1: for each target tensor W(ℓ)W^( ) in ℳM do 2: ℓ←H(nameℓ,x,layerℓ,r,s)mod(231−1)O_ ← H( name_ ,x, layer_ ,r;s) (2^31-1) 3: u←bitcastuint32(W(ℓ))u _uint32(W^( )) 4: for each index i do 5: n←i+ℓn← i+O_ 6: g←(n⊕(n≫1))&mxg←(n (n 1))\,\&\,m_x 7: u[i]←(u[i]&∼mx)|gu[i]←(u[i]\,\&\, m_x)\,|\,g 8: end for 9: W(ℓ)′←bitcastfloat32(u)W^( ) _float32(u) 10: end for 11: return ℳ′M Formal Guarantees Proposition 1 (Target-Channel Erasure): Let P be any payload encoded only in a declared target-bit set T, and let G be an overwrite string generated independently of P. If a sanitizer replaces every bit in T by G and the extractor reads only T, then P^=G,ℐ(P,P^)=0. P=G, (P; P)=0. Consequently the channel from P to the sanitized target bits has zero capacity for every payload distribution. This result requires neither Gray coding nor a secret seed. Proof. Complete overwrite removes every target bit before writing G. Thus p(P^=g∣P=p)=p(G=g)p( P=g P=p)=p(G=g) for every p, so the joint distribution factorizes and ℐ(P,P^)=0I(P; P)=0. Maximizing over input distributions still gives zero capacity. ∎ Corollary 2 (Chance-Level Recovery): If, in addition, each overwritten bit is marginally balanced and independent of the corresponding payload bit, then [BitAccpost]=12E[BitAcc_post]= 12. When pre-defense recovery is effectively one, the empirical R approaches 50 percentage points. Failing to reject H0(2c)H_0^(2c) and H0(3c)H_0^(3c) at α=0.05α=0.05 constitutes empirical support for this corollary, while rejecting it for other defenses quantifies how far those methods fall short of the channel-erasure bound. Because the sanitized target bits are independent of P, data processing prevents any decoder from reconstructing information absent from the extractor input. Under the balanced condition in Corollary 5, the bitwise view is BSC(12)BSC( 12) and Shannon’s converse excludes reliable positive-rate coding (Shannon 1948), including Reed–Solomon, LDPC, and polar families (Reed and Solomon 1960; Gallager 1962; Arıkan 2009). Theorem 3 (Conditional Loss Bound): If ℒ:→ℝL:W is LlipL_lip-Lipschitz in the model parameters, then |ℒ(W′)−ℒ(W)| |L(W )-L(W)| ≤Llip‖W′−W‖2, ≤ L_lip\|W -W\|_2, =Llip‖W‖2Drel(W,W′). =L_lip\|W\|_2D_rel(W,W ). In the completed payload set, worst-case Drel=7.1×10−4D_rel=7.1×10^-4 at x=16x=16 and 5.4×10−35.4×10^-3 at x=19x=19. This theorem bounds loss only; accuracy is evaluated empirically. Further assumptions, scope details, and reduced-precision analysis are provided in the supplementary material. GrayShield versus PatternMask. Both GrayShield and a fixed full-overwrite PatternMask satisfy Proposition 4 for the declared target channel. Their distinction is therefore empirical and operational, not target-channel capacity: GrayShield uses a low-transition Gray structure and a keyed phase for pattern diversity, whereas PatternMask reuses one global pattern. In the evaluated configurations, GrayShield has substantially lower R variance and W1W_1 shift than PatternMask despite similar mean R. Erasure follows from payload-independent overwriting, while the keyed phase provides pattern diversity and the Gray-code structure preserves distributional fidelity; phase secrecy is not required for erasure. Threat Model We consider a supply-chain adversary who embeds a binary payload into the mantissa LSBs of FP32 weights of a pretrained Transformer distributed through a public repository. The adversary has full white-box access to the model prior to distribution; the defender applies post-training sanitization before publication and has no access to the training data. Target parameter set and hiding capacity We target the encoder blocks of the Transformer backbone: attention (Q/K/V/O) and feed-forward (MLP) weight matrices, which contain the dominant fraction of trainable parameters. Embedding layers and task-specific classifier heads are excluded by default. The hiding capacity at overwrite depth x is: C(θtarget,x)=∑w∈θtargetnumel(w)⋅x,x∈[1,23].C( _target,x)= _w∈ _targetnumel(w)· x, x∈[1,23]. (4) Three-tier attacker knowledge hierarchy • Tier 1 (Black-box). Knows architecture and parameter count; uses standard LSB substitution without knowledge of the defender’s method. Corresponds to Naive. • Tier 2 (Gray-box). Knows a sanitization step of unspecified type will be applied; responds with redundancy coding (Repeat3/Repeat5) or burst-resilient interleaving. • Tier 3 (White-box). Knows the sanitization algorithm (GrayShield) but not the seed s. Strongest realistic attacker. Experimental Setup Models and datasets. We evaluate across both natural language and vision domains using standard pretrained Transformer architectures. For text, we use BERT-base (Devlin et al. 2019) and RoBERTa-base (Liu et al. 2019) fine-tuned on the SST-2 sentiment classification benchmark (Socher et al. 2013; Wang et al. 2018). For vision, we use ViT-Base/16 (Dosovitskiy et al. 2021) and Swin-Base (Liu et al. 2021) evaluated on CIFAR-10 (Krizhevsky 2009). These models span a range of architectural designs and parameter scales, providing coverage across both language and image modalities. All evaluations are conducted on held-out subsets of size neval=512n_eval=512, yielding an accuracy resolution of approximately 0.1950.195 p, which is sufficient to reliably detect sub-1%1\% performance changes. Malware payloads. Two representative MalwareBazaar payloads (abuse.ch 2026) spanning the entropy extremes: a low-entropy (LE) JavaScript script (c37…a88.js.malware, 134.3 KB, entropy 0.603) and a high-entropy (HE) compiled binary (5704…6d0.exe.malware, 8,971.4 KB, entropy 0.994). The LE payload tolerates partial corruption due to structural redundancy; the HE payload requires near-lossless reconstruction. Defenses. Seven post-training strategies evaluated at operating depth x=19x=19: GS (proposed), PM (fixed-pattern LSB overwrite), PTQ (symmetric INT8 quantize–dequantize (Krishnamoorthi 2018)), FT (fine-tune on 256 clean samples, sweeping 50,100,200,500\50,100,200,500\ gradient steps), GN (i.i.d. (0,σ2)N(0,σ^2) noise, sweeping σ∈10−6,3×10−6,10−5,3×10−5,10−4σ∈\10^-6,3×10^-6,10^-5,3×10^-5,10^-4\), SWP (an author-defined, magnitude-ranked selective-weight perturbation baseline), and RF (Bernoulli bit flip). We set the defense depth to the largest utility-preserving value (x=19x=19, RQ1), covering all stealthy embeddings (x′≤x ≤ x); deeper embeddings (x′>x >x) exhibit detectable accuracy and geometric degradation. Attacker variants. Five Tier-2 (gray-box) variants: Naive, Interleave, Repeat3, Repeat5, and RS(255,127). The threat model is detailed in the supplementary material. Recovery metric. For payload bits p1,…,pBp_1,…,p_B and extracted bits p^1,…,p^B p_1,…, p_B, Rec =B−1∑i=1B[pi=p^i];R=100(Recpre−Recpost). =B^-1 _i=1^B1[p_i= p_i];\;\;R=100(Rec_pre-Rec_post). We report R in percentage points (p), not as a relative percentage. Pre-defense recovery is effectively one in the completed runs; hence R near 50 p means post-defense bit accuracy near binary chance. Values farther above 50 p are not automatically more secure because systematic anti-correlation can be inverted. Fidelity and cost metrics. Beyond R and ΔAcc , we report weight-distribution fidelity (W1W_1), runtime (ms), R consistency (fraction within ±2± 2 p of the mean), and bit-level Hamming distance (millions of bits). Statistical protocol. All experiments use run seed 1, evaluation seed 42. The supplementary material pre-specifies 13 null hypotheses; all tests two-tailed at α=0.05α=0.05 unless marked one-tailed (↑ ). Effect sizes reported alongside p-values: ηKW2η^2_KW for Kruskal-Wallis, Cohen’s d for t-tests, Spearman ρ for correlations, Kendall’s W for Friedman, Wilks’ λ for MANOVA. Results RQ1: Injection Feasibility RQ1 asks whether mantissa-LSB payload injection can remain stealthy while preserving model utility. Fig. 2 provides the consolidated evidence across six overwrite depths x∈4,8,16,19,21,23x∈\4,8,16,19,21,23\, four Transformer model presets, and two entropy-stratified payloads. Two patterns are central. First, both geometric perturbation metrics increase monotonically with overwrite depth. Cosine deviation and relative ℓ2 _2 remain negligible through x=16x=16, but grow rapidly beyond that point. Panels (a) and (b) report perfect monotone association across the six depth-wise means (Spearman ρ=1.000ρ=1.000, p<0.001p<0.001), identifying overwrite depth as the primary driver of geometric detectability. Second, the utility boundary is sharper for high-entropy payloads. In Fig. 2(c), low-entropy payloads remain essentially flat across all tested depths, whereas high-entropy payloads begin to show measurable degradation at x≥19x≥ 19. Even then, the worst completed case remains below the 1%1\% threshold. The grouped Mann-Whitney result (p=0.005p=0.005) supports the conclusion that the accuracy impact is significantly larger above the x=16x=16 boundary. H0(1b)H_0^(1b): Reject. H0(1c)H_0^(1c): Reject. Answer to RQ1. Payload injection remains stealthy through x=16x=16 and enters a transition regime at x=19x=19. We treat x=19x=19 as the main operating point for RQ2–RQ4: it represents a high-capacity attacker while remaining below the practical utility-loss threshold. Figure 2: RQ1 — Injection feasibility across six overwrite depths (x∈4,8,16,19,21,23x∈\4,8,16,19,21,23\), four Transformer architectures, and two entropy-stratified payloads (n=48n=48 runs). (a) Cosine deviation vs. depth on a log scale; Spearman ρ=0.954ρ=0.954, p<0.001p<0.001. (b) Relative ℓ2 _2 distance vs. depth on a log scale; ρ=0.954ρ=0.954, p<0.001p<0.001. (c) Signed accuracy drop ΔAcc vs. depth. The green region (x≤16x≤ 16) marks depths satisfying the stealth constraints, while the red region (x≥19x≥ 19) marks the onset of measurable degradation, with a worst-case high-entropy drop of 0.78%0.78\%. Mann–Whitney comparison between low and high depth regimes yields p=0.005p=0.005. (d) Spearman depth–metric association with 95% Fisher-z confidence intervals. RQ2: Defense Effectiveness under a Naive Attacker RQ2 compares seven post-training defenses at the RQ1-selected operating point. The goal is not merely to approach the 50 p chance target, but to identify a defense that simultaneously disrupts payload recovery, preserves accuracy, avoids excessive distribution shift, and remains operationally lightweight. Table 2 and Fig. 3 show that GS, PM, and PTQ are the only defenses that reach chance-level sanitization under the naive attacker. Their mean R values differ by less than one percentage point. However, they are not equivalent once secondary deployment criteria are considered. PM attains mean R of 50.0050.00 p but with substantially higher variance (±2.64± 2.64) than GS (±0.54± 0.54). PTQ is similarly effective in R (49.9349.93 p) but requires calibration data and induces a larger distributional shift. GN is unstable, with R 31.49±15.0831.49± 15.08 p, while SWP and RF are ineffective in this setting. H0(2a)H_0^(2a): Reject (H=48.2H=48.2, p<0.001p<0.001, ηKW2=0.861η^2_KW=0.861). H0(2b)H_0^(2b): Reject (H=43.1H=43.1, p<0.001p<0.001, ηKW2=0.803η^2_KW=0.803). H0(2c)H_0^(2c): Fail to reject for GS, PM, PTQ (p∈[0.21,0.99]p∈[0.21,0.99], |d|≤0.52|d|≤ 0.52); Reject for FT, GN, SWP, RF (p≤0.046p≤ 0.046). H0(2d)H_0^(2d): Reject (W=7.53W=7.53, p=0.016p=0.016, σGN/σGS=27.9× _ GN/ _ GS=27.9×). Fig. 3(a)–(c) clarifies that mean R alone is insufficient. GS provides the most balanced profile: near-chance recovery reduction, negligible impact on accuracy, zero data dependency, low variance, and low distribution shift. GS achieves average W1=2.6×10−5W_1=2.6×10^-5, approximately 25×25× smaller than PM’s 7.1×10−47.1×10^-4 and 42×42× smaller than PTQ’s 1.17×10−31.17×10^-3. Answer to RQ2. Under the naive attacker, GS, PM, and PTQ all disrupt payload recovery to near chance level. GS is the most deployable among them because it combines near-chance R with low variance, no data requirement, small utility loss, and the smallest W1W_1 shift in this high-R group. Both exact full-overwrite methods, GS and PM, satisfy the scoped target-erasure result; their empirical stability and fidelity differ. Defense Data R (p) ΔAcc W1W_1 Target erasure GS None 49.72±0.5449.72± 0.54 −0.10%-0.10\% 2.6×10−52.6×10^-5 Prop. 4 PM None 50.00±2.6450.00± 2.64 +0.09%+0.09\% 7.6×10−47.6×10^-4 Prop. 4 PTQ Calibration 49.93±0.4049.93± 0.40 +0.07%+0.07\% 8.5×10−48.5×10^-4 None FT Clean set 45.34±1.1145.34± 1.11 +0.38%+0.38\% 7.6×10−77.6×10^-7 None GN None 31.49±15.0831.49± 15.08 −0.02%-0.02\% 5.8×10−75.8×10^-7 None SWP None 10.01±1.5010.01± 1.50 +0.05%+0.05\% 4.6×10−54.6×10^-5 None RF None 2.69±3.722.69± 3.72 +0.01%+0.01\% 1.3×10−61.3×10^-6 None Table 1: RQ2 defense comparison. R denotes Recovery Reduction (p); values near 50 p indicate chance-level recovery, the target under complete payload-independent overwrite. D Naïve Interl. Rep3 Rep5 RS R¯ R σ Δ Time Cons. Ham. W1W_1 GS 49.5±0.749.5± 0.7 50.0±0.250.0± 0.2 50.4±0.650.4± 0.6 50.2±0.250.2± 0.2 49.6±0.849.6± 0.8 49.96 0.66 −0.10-0.10 54 0.99 9.60 2.8×10−52.8×10^-5 PM 50.0±3.250.0± 3.2 50.0±3.250.0± 3.2 50.0±3.350.0± 3.3 50.0±3.350.0± 3.3 50.0±3.250.0± 3.2 50.00 3.25 +0.13+0.13 44 0.94 9.60 7.1×10−47.1×10^-4 PTQ 50.0±0.550.0± 0.5 50.0±0.550.0± 0.5 49.5±0.549.5± 0.5 50.1±0.550.1± 0.5 49.5±0.449.5± 0.4 49.83 0.54 +0.17+0.17 882 0.99 9.57 1.2×10−31.2×10^-3 FT 45.2±1.445.2± 1.4 45.3±1.345.3± 1.3 45.5±1.045.5± 1.0 46.3±0.946.3± 0.9 45.2±1.145.2± 1.1 45.51 1.23 +0.45+0.45 13,200 0.97 8.93 4.0×10−64.0×10^-6 GN 37.5±6.137.5± 6.1 37.7±6.037.7± 6.0 38.4±5.638.4± 5.6 40.3±4.940.3± 4.9 37.5±6.037.5± 6.0 38.25 5.85 −0.04-0.04 620 0.85 7.71 4.0×10−64.0×10^-6 SWP 10.0±2.110.0± 2.1 10.1±2.110.1± 2.1 9.5±0.99.5± 0.9 8.6±0.98.6± 0.9 5.5±2.75.5± 2.7 8.76 2.56 +0.07+0.07 1,480 0.71 1.67 4.7×10−54.7×10^-5 RF 2.7±3.72.7± 3.7 2.7±3.72.7± 3.7 0.6±1.00.6± 1.0 0.2±0.30.2± 0.3 2.5±3.82.5± 3.8 1.73 3.16 +0.02+0.02 2,590 0.00 0.33 4.0×10−64.0×10^-6 Table 2: Comprehensive defense (D) evaluation across RQ2–RQ3 (x=19x=19). Attacker columns report mean R (p) ± std. Summary reports mean R, std, ΔAcc (%), runtime (ms), and consistency. Hamming distance is reported in millions (M). Figure 3: RQ2 — Defense effectiveness and multi-metric trade-offs. (a) Recovery Reduction (R) across defenses, stratified by payload entropy. GrayShield reaches near-chance disruption (≈50≈ 50 p) consistently. (b) Accuracy drop (|ΔAcc|| |), where lower values indicate better utility preservation. (c) Cumulative distribution of R, showing that GS, PM, and PTQ concentrate near the 50 p target while weaker defenses remain far below. (d) Radar chart of normalized deployment metrics. (e) Defense-by-metric Z-score heatmap, where green indicates above-average performance. (f) Grouped normalized bar chart. Figure 4: RQ3 — Adaptive attacker robustness. (a) R across attacker variants shows that GS remains stable around 50 p. (b) Defense-level R distributions show significant differences across defenses, with GS maintaining high and consistent performance. (c) Effectiveness–stability trade-off shows GS closest to the target region of high R and low σ. (d) Attacker-by-defense heatmap confirms that GS remains resilient across all implemented adaptive variants. RQ3: Robustness under Adaptive Attackers RQ3 evaluates whether the RQ2 ranking survives stronger attacker strategies. The five implemented variants are Naive, Interleave, Repeat3, Repeat5, and RS(255,127). Table 2 reports R per attacker variant. The defining result is GS’s invariance to attacker adaptation. Across all five attacker variants, GS stays within 49.549.5–50.450.4 p, with aggregate R 49.96±0.6649.96± 0.66 p. The RQ2 means in Table 2 and the Naive column in Table 2 use different run pools: RQ2 contains all eight completed model–payload pairs, whereas RQ3 contains four completed pairs and omits the zero-noise GN control. Their Naive values therefore need not coincide. This agrees with target-channel erasure: coding cannot reconstruct payload information absent from the extractor input. PM remains near 50 p but has much larger dispersion (σ=3.25σ=3.25 p); PTQ is slower and more distortive, while GN, SWP, and RF degrade under adaptive variants. The one-sample comparison printed in Fig. 4(c) fails to distinguish the five attacker-specific GS means from the 50 p target (p=0.822p=0.822). Fig. 4 makes this difference visually explicit. Panel (a) shows GS as nearly flat across attackers; panel (b) shows a compact high-R distribution; panel (c) places GS in the desired effectiveness–stability region; and panel (d) confirms that GS does not exhibit a strategy-specific weakness under interleaving, repetition, or Reed–Solomon coding. Answer to RQ3. GS maintains stable chance-level sanitization under all five implemented adaptive attacker variants. RQ4: Pareto Trade-off and Deployment Profile RQ4 integrates the previous findings into a deployment-oriented comparison. A practical defense must satisfy more than high mean R: it must also preserve accuracy, remain stable, avoid excessive runtime, and limit distributional drift. Figure 5: RQ4 deployment profile: (a) R–accuracy Pareto plane; (b) criteria satisfied; (c) runtime; (d) −log10(W1)- _10(W_1) fidelity; and (e) normalized deployment radar. Figure 5(a) shows the R–accuracy Pareto plane. GS lies in the desired region: high R, low |ΔAcc|| |, and low variance. PM has similar mean R and low runtime but fails the stability criterion (σ=3.25σ=3.25). PTQ has high R and low variance but fails the runtime criterion (882 ms) and has the largest W1W_1 among the high-R defenses. FT, GN, SWP, and RF are dominated by at least one of the high-R methods. Figure 5(b) summarizes the deployment constraints. GS is the only defense satisfying all four criteria simultaneously: R in [48,52][48,52] p, σR<2 _R<2 p, |ΔAcc|<1%| |<1\%, and runtime <500<500 ms. PM and PTQ satisfy three of four, but each misses a different requirement. In Fig. 5(c), GS requires 5454 ms per checkpoint, compared with 882882 ms for PTQ and 13.213.2 s for FT. In Fig. 5(d), PM’s W1W_1 is approximately 25×25× larger than GS’s, and PTQ’s approximately 42×42× larger. Answer to RQ4. GS at x=19x=19 is the recommended operating point. It achieves 49.96±0.6649.96± 0.66 p R, sub-1%1\% accuracy impact, low variance, low runtime, and substantially better weight-distribution fidelity than competing high-R baselines. Discussion Theory–empirics alignment. Complete payload-independent replacement erases the declared target channel without seed secrecy; balance is the additional condition that makes bit accuracy chance-level. The reported 49.96±0.6649.96± 0.66 p R across five attackers is consistent with both properties: repetition, interleaving, and RS coding cannot reconstruct information absent from the extractor input. Stability and fidelity. GS and PM share the scoped full-overwrite guarantee and similar mean R, but PM has higher dispersion and 25×25× larger W1W_1. GN’s lower and unstable R despite matched perturbation magnitude further shows that targeting the payload-bearing LSB subspace matters more than perturbation magnitude alone. Deployment interpretation. Table 2 and Supplementary Fig. S1 show that GS alone satisfies the complete operating envelope: R in [48,52][48,52] p, σR<2 _R<2 p, |ΔAcc|<1%| |<1\%, runtime below 500500 ms, and low distributional drift. PTQ is slower and more distortive, PM is less stable, and FT is slow and requires trusted data. Limitations. Experiments cover FP32 and four 86M–125M presets; reduced-precision utility remains unvalidated. LDPC and polar attackers are analytical extensions, and some FT RQ3 runs were incomplete. The guarantee is bit-local: higher-bit payloads, executable serialization, metadata side channels, and post-sanitization reinsertion are outside scope. Executable malware samples are not redistributed. Generative-AI assistance. Generative-AI tools assisted with language editing, LaTeX formatting, and verification; the authors reviewed the output and retain full responsibility. Conclusion GrayShield completely replaces a declared weight-LSB payload channel using a low-transition Gray sequence. Payload-independent overwrite gives the scoped zero-capacity result; Gray structure and the keyed phase provide regularity and pattern diversity. Across the evaluated settings, GrayShield achieves stable near-chance recovery with sub-1%1\% accuracy degradation, and combines low variance and runtime with lower W1W_1 than the evaluated near-chance baselines. References abuse.ch (2026) abuse.ch MalwareBazaar: malware sample exchange. Note: https://bazaar.abuse.ch/Accessed: 2026-07-24 Cited by: Models and datasets.. Anonymous Authors (2026) Anonymous Authors GrayShield: Anonymized Replication Package. Note: Anonymized replication package for double-blind review. Contains GrayShield sanitization code, attacker implementations, configuration grids, figure- and table-generation scripts, curated payload data, dataset metadata, structured result artifacts, and provenance information. External Links: Link Cited by: Appendix J. Arıkan (2009) E. Arıkan Channel polarization: a method for constructing capacity-achieving codes for symmetric binary-input memoryless channels. IEEE Transactions on Information Theory 55 (7), p. 3051–3073. External Links: Document Cited by: Appendix B, Formal Guarantees. Bellare et al. (1996) M. Bellare, R. Canetti, and H. Krawczyk Keying hash functions for message authentication. In Advances in Cryptology—CRYPTO ’96, Lecture Notes in Computer Science, Vol. 1109, p. 1–15. External Links: Document Cited by: Keyed phase for pattern diversity., Definition 14. Casey et al. (2024) B. Casey, J. C. S. Santos, and M. Mirakhorli A large-scale exploit instrumentation study of AI/ML supply chain attacks in hugging face models. External Links: 2410.04490, Document Cited by: Introduction. Cox et al. (2007) I. J. Cox, M. L. Miller, J. A. Bloom, J. Fridrich, and T. Kalker Digital watermarking and steganography. 2nd edition, Morgan Kaufmann. External Links: ISBN 978-0-12-372585-1 Cited by: Background and Related Work, Background and Related Work. Devlin et al. (2019) J. Devlin, M. Chang, K. Lee, and K. Toutanova BERT: pre-training of deep bidirectional transformers for language understanding. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, p. 4171–4186. External Links: Document Cited by: Introduction, Models and datasets.. Dosovitskiy et al. (2021) A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly, J. Uszkoreit, and N. Houlsby An image is worth 16x16 words: transformers for image recognition at scale. In International Conference on Learning Representations, Cited by: Introduction, Models and datasets.. Dubin (2023) R. Dubin Disarming attacks inside neural network models. IEEE Access 11, p. 124295–124303. External Links: Document Cited by: Background and Related Work. Frantar et al. (2023) E. Frantar, S. Ashkboos, T. Hoefler, and D. Alistarh GPTQ: accurate post-training quantization for generative pre-trained transformers. In International Conference on Learning Representations, Cited by: Background and Related Work. Fridrich (2009) J. Fridrich Steganography in digital media: principles, algorithms, and applications. Cambridge University Press. External Links: ISBN 978-0-521-19019-0 Cited by: Background and Related Work, Background and Related Work. Gallager (1962) R. G. Gallager Low-density parity-check codes. IRE Transactions on Information Theory 8 (1), p. 21–28. External Links: Document Cited by: Appendix B, Formal Guarantees. Gilkarov and Dubin (2026) D. Gilkarov and R. Dubin Model X-Ray: detection of hidden malware in AI model weights using few-shot learning. Journal of Information Security and Applications 101, p. 104517. External Links: Document Cited by: Introduction, Introduction, Background and Related Work. Gray (1953) F. Gray Pulse code communication. Note: US Patent 2,632,058 Cited by: Background and Related Work. Han et al. (2016) S. Han, H. Mao, and W. J. Dally Deep compression: compressing deep neural networks with pruning, trained quantization and huffman coding. In International Conference on Learning Representations, Cited by: Background and Related Work. He et al. (2020) Z. He, A. S. Rakin, J. Li, C. Chakrabarti, and D. Fan Defending and harnessing the bit-flip based adversarial weight attack. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 14083–14091. External Links: Document Cited by: Background and Related Work. Hitaj et al. (2022) D. Hitaj, G. Pagnotta, B. Hitaj, L. V. Mancini, and F. Perez-Cruz MaleficNet: hiding malware into deep neural networks using spread-spectrum channel coding. In Computer Security—ESORICS 2022, Lecture Notes in Computer Science, Vol. 13556, p. 425–444. External Links: Document Cited by: Introduction, Introduction, Background and Related Work. Hugging Face (2026) Hugging Face Hugging face model hub. Note: https://huggingface.co/modelsAccessed: 2026-07-24 Cited by: Introduction. Institute of Electrical and Electronics Engineers (2019) Institute of Electrical and Electronics Engineers IEEE standard for floating-point arithmetic (IEEE std 754-2019). Note: IEEE External Links: Document Cited by: Background and Related Work. Krishnamoorthi (2018) R. Krishnamoorthi Quantizing deep convolutional networks for efficient inference: a whitepaper. Note: arXiv preprint arXiv:1806.08342 External Links: Document Cited by: Introduction, Models and datasets.. Krizhevsky (2009) A. Krizhevsky Learning multiple layers of features from tiny images. Technical report University of Toronto. Cited by: Models and datasets.. Liu et al. (2020) T. Liu, Z. Liu, Q. Liu, W. Wen, W. Xu, and M. Li StegoNet: turn deep neural network into a stegomalware. In Proceedings of the 36th Annual Computer Security Applications Conference, p. 928–938. External Links: Document Cited by: Introduction, Background and Related Work. Liu et al. (2019) Y. Liu, M. Ott, N. Goyal, J. Du, M. Joshi, D. Chen, O. Levy, M. Lewis, L. Zettlemoyer, and V. Stoyanov RoBERTa: a robustly optimized BERT pretraining approach. arXiv preprint arXiv:1907.11692. External Links: Document Cited by: Models and datasets.. Liu et al. (2021) Z. Liu, Y. Lin, Y. Cao, H. Hu, Y. Wei, Z. Zhang, S. Lin, and B. Guo Swin transformer: hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF International Conference on Computer Vision, p. 10012–10022. External Links: Document Cited by: Models and datasets.. Nagel et al. (2020) M. Nagel, R. A. Amjad, M. van Baalen, C. Louizos, and T. Blankevoort Up or down? adaptive rounding for post-training quantization. In Proceedings of the 37th International Conference on Machine Learning, Proceedings of Machine Learning Research, Vol. 119, p. 7197–7206. External Links: Link Cited by: Introduction, Background and Related Work. PyTorch Foundation (2022) PyTorch Foundation Compromised pytorch-nightly dependency chain between december 25th and december 30th, 2022. Note: https://pytorch.org/blog/compromised-nightly-dependency/Accessed: 2026-07-24 Cited by: Introduction. Reed and Solomon (1960) I. S. Reed and G. Solomon Polynomial codes over certain finite fields. Journal of the Society for Industrial and Applied Mathematics 8 (2), p. 300–304. External Links: Document Cited by: Formal Guarantees. Sakai and Imaizumi (2026) M. Sakai and M. Imaizumi Spectrum-adaptive generalization bounds for trained deep transformers. arXiv preprint arXiv:2605.07297. Cited by: Appendix B. Shannon (1948) C. E. Shannon A mathematical theory of communication. Bell System Technical Journal 27 (3), p. 379–423. External Links: Document Cited by: Appendix B, Background and Related Work, Formal Guarantees. Socher et al. (2013) R. Socher, A. Perelygin, J. Wu, J. Chuang, C. D. Manning, A. Y. Ng, and C. Potts Recursive deep models for semantic compositionality over a sentiment treebank. In Proceedings of the 2013 Conference on Empirical Methods in Natural Language Processing, p. 1631–1642. Cited by: Models and datasets.. Vaswani et al. (2017) A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin Attention is all you need. In Advances in Neural Information Processing Systems, Vol. 30, p. 5998–6008. Cited by: Introduction. Wang et al. (2018) A. Wang, A. Singh, J. Michael, F. Hill, O. Levy, and S. R. Bowman GLUE: a multi-task benchmark and analysis platform for natural language understanding. In Proceedings of the 2018 EMNLP Workshop BlackboxNLP: Analyzing and Interpreting Neural Networks for NLP, p. 353–355. External Links: Document Cited by: Models and datasets.. Wang et al. (2021) Z. Wang, C. Liu, and X. Cui EvilModel: hiding malware inside of neural network models. In 2021 IEEE Symposium on Computers and Communications, p. 1–7. External Links: Document Cited by: Introduction. Yao et al. (2020) F. Yao, A. S. Rakin, and D. Fan DeepHammer: depleting the intelligence of deep neural networks through targeted chain of bit flips. In 29th USENIX Security Symposium, p. 1463–1480. External Links: Link Cited by: Background and Related Work. Zhao et al. (2024) J. Zhao, S. Wang, Y. Zhao, X. Hou, K. Wang, P. Gao, Y. Zhang, C. Wei, and H. Wang Models are codes: towards measuring malicious code poisoning attacks on pre-trained model hubs. In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering, p. 2087–2098. External Links: Document Cited by: Introduction. Appendix A Supplementary Material Pre-specified Hypotheses and Outcomes Table 3 consolidates all 13 pre-specified null hypotheses for RQ1–RQ4, their tests, effect sizes, and decisions (R = Reject; FTR = Fail to Reject). Table 3: Consolidated pre-specified statistical hypotheses for RQ1–RQ4. All tests are two-tailed at α=0.05α=0.05 unless marked (↑ ) one-tailed. ∗Bonferroni-corrected over H0(4b)H_0^(4b)–H0(4c)H_0^(4c). ID Null hypothesis H0H_0 Test Effect Decision RQ1 — Injection Feasibility H0(1a)H_0^(1a) ρ(depth,metric)=0ρ(depth,metric)=0 Spearman ρ=0.954ρ=0.954, p<0.001p<0.001 R (LE ΔAcc ) Spearman ρ=0.338ρ=0.338, p=0.512p=0.512 FTR H0(1b)H_0^(1b) Equal ΔAcc across 6 depths KW (n=8n=8) ηKW2η^2_KW, p<0.001p<0.001 R H0(1c)↑H_0^(1c) ΔAcc(x≥19)≤ΔAcc(x≤16) (x≥ 19)≤ (x≤ 16) MW-U p=0.005p=0.005 R RQ2 — Baseline Comparison (naive) H0(2a)H_0^(2a) Equal means R across 7 defenses KW (n=8n=8) η2=0.861η^2=0.861, p<0.001p<0.001 R H0(2b)H_0^(2b) Equal |ΔAcc|| | across 7 defenses KW (n=8n=8) η2=0.803η^2=0.803, p<0.001p<0.001 R H0(2c)H_0^(2c) μR(m)=50% _R^(m)=50\% (GS/PM/PTQ) 1-sample t |d|≤0.52|d|≤ 0.52, p≥0.207p≥ 0.207 FTR μR(m)=50% _R^(m)=50\% (FT/GN/SWP/RF) 1-sample t |d|≥0.86|d|≥ 0.86, p≤0.046p≤ 0.046 R H0(2d)H_0^(2d) σGS2=σGN2σ^2_GS=σ^2_GN Levene (n=8n=8) ratio 27.9×27.9×, p=0.016p=0.016 R RQ3 — Adaptive Robustness H0(3a)H_0^(3a) Equal mean R (adaptive pool) KW (n=5n=5) η2=0.909η^2=0.909, p<0.001p<0.001 R H0(3b)H_0^(3b) Attacker does not reshuffle ordering Friedman W=0.81W=0.81, p<0.001p<0.001 R H0(3c)H_0^(3c)⋆ μR(GS)=50% _R^(GS)=50\% (adaptive) 1-sample t (n=5n=5) d=−0.16d=-0.16, p=0.745p=0.745 FTR H0(3d)H_0^(3d) σGS2=σPM2σ^2_GS=σ^2_PM (adaptive) Levene+Bartlett ratio 24.3×24.3×, p=0.010p=0.010 R RQ4 — Pareto Trade-off H0(4a)H_0^(4a) Equal multivariate profiles MANOVA λ≈0λ≈ 0, p<0.001p<0.001 R H0(4b)H_0^(4b) Equal |ΔAcc|| |: GS vs PM Welch t (n=8n=8) d=0.42d=0.42, p=0.009∗p=0.009^* R H0(4c)H_0^(4c) Equal |ΔAcc|| |: GS vs PTQ Welch t (n=8n=8) d=0.78d=0.78, p<0.001∗p<0.001^* R ⋆ Key result. H0(3c)H_0^(3c) is the most critical single test in the paper. Failing to reject confirms that GrayShield induces a BSC(12)BSC( 12) channel regardless of the coding strategy employed, empirically validating Proposition 4. Appendix B Formal Guarantees Assumptions Our theoretical analysis relies on the following standard assumptions: • PRF security. HMAC-SHA256 is computationally indistinguishable from a uniformly random function by any PPT adversary (Definition 14). • Secret seed. The sanitization seed s (|s|=128|s|=128 bits) is unknown to the attacker and stored securely (e.g., HSM). • Computational boundedness. The attacker is limited to PPT algorithms. • Memoryless channel. Post-sanitization extracted bits are conditionally independent across positions (Definition 20). Information-theoretic framing We model LSB-based payload embedding as a sequence of channel uses over a memoryless binary channel. Let pi∈0,1p_i∈\0,1\ be the i-th payload bit written by the attacker and p^i∈0,1 p_i∈\0,1\ the bit recovered after sanitization T. Pre-defense, the channel is noiseless: p^i=pi p_i=p_i with probability one, giving raw capacity Craw=∑wnumel(w)⋅xC_raw= _wnumel(w)· x. The defender’s objective is to choose T such that: Ceff(T)=ℐ(P,T(lsbx(W)))→0.C_eff(T)=I\! (P\,;\,T(lsb_x(W)) )→ 0. (5) Perfect Channel Erasure Proposition 4 (Perfect Channel Erasure): Let Ts:→T_s:W be the GrayShield sanitization map parameterized by secret seed s, and let P^=(Ts(ℰ(W,P))) P=D(T_s(E(W,P))) be the extracted payload after sanitization. Under the assumptions above, for any payload distribution P: ℐ(P,P^)=0,I\! (P\,;\, P )=0, and therefore Ceff(Ts)=0C_eff(T_s)=0. Proof. For each index i in a target tensor, the overwritten mantissa bits are replaced by gi=fs(i)∈0,1xg_i=f_s(i)∈\0,1\^x, where fs(⋅)f_s(·) is derived from a PRF keyed by s via the per-tensor phase offset ℓO_ and the Gray-code mapping. By PRF security, fsf_s is computationally indistinguishable from a uniformly random function; consequently: Pr(gi,k=1)=12for each bit k∈[0,x), (g_i,k=1)= 12 each bit k∈[0,x), and gi,kg_i,k is independent of the payload bit Pi,kP_i,k when s is hidden from the attacker. This induces a BSC(12)BSC( 12) on each transmitted bit, whose capacity is: CBSC(12)=1−Hb(12)=0.C_BSC\! ( 12 )=1-H_b\! ( 12 )=0. By the memoryless channel property, the extracted bits P^i P_i are conditionally independent across positions, so: ℐ(P,P^)=∑i=1Bℐ(Pi,P^i)=0.∎I\! (P\,;\, P )= _i=1^BI\! (P_i\,;\, P_i )=0. Corollary 5 (Chance-Level Recovery): Under Proposition 4, [BitAccpost]=12E[BitAcc_post]= 12, so the empirical Recovery Reduction RR approaches 50%50\%. Coding-Theoretic Limits Lemma 6 (Irrecoverability under Error-Correcting Codes): Let the sanitized channel be BSC(12)BSC( 12). Then for any error-correcting code with positive rate R>0R>0: limn→∞ℙ(decoded payload=P)=0. _n→∞P(decoded payload=P)=0. Proof. By Shannon’s channel coding converse (Shannon 1948), reliable communication (vanishing block error probability as n→∞n→∞) over a channel with capacity C requires R<CR<C. For BSC(12)BSC( 12), C=0C=0. Hence no positive-rate code — including RS(n,k)(n,k) (for which all n codeword bytes are erroneous since e=n≫t=⌊(n−k)/2⌋e=n t= (n-k)/2 ; for RS(255,127): 255≫64255 64), any regular LDPC code (for which BP decoding achieves BER→12BER→ 12 since p=0.5≫p∗≈0.084p=0.5 p^*≈ 0.084 (Gallager 1962)), or Polar codes (for which all synthetic bit-channels polarize to pure noise since ∑iC(i)=n⋅CBSC(12)=0 _iC^(i)=n· C_BSC( 12)=0 (Arıkan 2009)) — can achieve reliable decoding on the sanitized channel. ∎ Accuracy Stability Bound Proposition 7 (Lipschitz Accuracy Bound): Let the task loss ℒ:→ℝL:W be LlipL_lip-Lipschitz. Then: |ΔAcc|≤Llip⋅‖W′−W‖2=Llip⋅‖W‖2⋅Drel(W,W′). | |≤ L_lip·\|W -W\|_2=L_lip·\|W\|_2· D_rel(W,W ). Proof. Directly from Lipschitz continuity: |ℒ(fW′)−ℒ(fW)|≤Llip‖W′−W‖2=Llip‖W‖2⋅Drel(W,W′)|L(f_W )-L(f_W)|≤ L_lip\|W -W\|_2=L_lip\|W\|_2· D_rel(W,W ). In the completed experiments, worst-case Drel=5.4×10−3D_rel=5.4×10^-3 at x=19x=19. Spectral-norm analyses of BERT-scale models (Sakai and Imaizumi 2026) give Llip=O(102)L_lip=O(10^2), yielding expected accuracy degradation consistent with the sub-1%1\% changes reported in Tables 2 and 3 of the main paper. ∎ Robustness under Imperfect Randomness Lemma 8 (Capacity under Imperfect Randomness): Suppose the induced channel satisfies Pr(P^i,k=Pi,k)=12+ϵ ( P_i,k=P_i,k)= 12+ε for small ϵ>0ε>0. Then the effective capacity is bounded by: Ceff≤1−Hb(12+ϵ)=O(ϵ2).C_eff≤ 1-H_b\! ( 12+ε )=O(ε^2). Proof. The binary entropy function achieves its maximum of 11 at p=12p= 12. Taylor expansion around p=12p= 12 gives: Hb(12+ϵ)=1−2ln2ϵ2+O(ϵ4).H_b\! ( 12+ε )=1- 2 2\,ε^2+O(ε^4). Hence Ceff≤1−Hb(12+ϵ)=O(ϵ2)C_eff≤ 1-H_b( 12+ε)=O(ε^2). This shows that even modest deviations from perfect uniformity still yield near-zero capacity, reinforcing the robustness of GrayShield beyond the idealized PRF model. ∎ Threat Model We consider a supply-chain adversary who embeds a binary payload into the mantissa LSBs of FP32 weights of a pretrained Transformer distributed through a public repository. The adversary has full white-box access to the model prior to distribution; the defender applies post-training sanitization before publication and has no access to the training data. Target parameter set and hiding capacity We target the encoder blocks of the Transformer backbone: attention (Q/K/V/O) and feed-forward (MLP) weight matrices, which contain the dominant fraction of trainable parameters. Embedding layers and task-specific classifier heads are excluded by default. The hiding capacity at overwrite depth x is: C(θtarget,x)=∑w∈θtargetnumel(w)⋅x,x∈[1,23].C( _target,x)= _w∈ _targetnumel(w)· x, x∈[1,23]. (6) Multi-precision threat surface The implemented evaluation targets FP32. The analysis below extends the threat surface to deployment-grade precision formats; empirical validation of these formats is left as future work. FP16 and BF16. FP16 (1-5-10) and BF16 (1-8-7) reduce mantissa depth to mFP16=10m_FP16=10 and mBF16=7m_BF16=7 bits, giving adjusted capacity CF=∑wnumel(w)⋅min(x,mF)C_F= _wnumel(w)· (x,m_F). For BERT-base encoder blocks at x=5x=5 in FP16, CFP16≈53C_FP16≈ 53 MB, sufficient for both evaluated payloads. INT8. Each INT8 weight embeds x≤2x≤ 2 bits at quantization error δi=q⋅scaleℓ _i=q·scale_ where q≤1/128q≤ 1/128, a negligible stealth cost at x=1x=1. Three-tier attacker knowledge hierarchy Definition 9 (Attacker Tiers): • Tier 1 (Black-box). Knows architecture and parameter count; uses standard LSB substitution without knowledge of the defender’s method. Corresponds to Naive. • Tier 2 (Gray-box). Knows a sanitization step of unspecified type will be applied; responds with redundancy coding (Repeat3/Repeat5) or burst-resilient interleaving. • Tier 3 (White-box). Knows the sanitization algorithm (GrayShield) but not the seed s. Strongest realistic attacker. Appendix C Notation and Abbreviations Table 4: Consolidated notation and abbreviations used throughout the paper. Symbol / Abbrev. Definition Weight-space and attack symbols W,W,W Weight tensor; full model weight space x LSB overwrite depth (1≤x≤231≤ x≤ 23 for FP32) mxm_x Bitmask (1≪x)−1(1 x)-1; selects lowest x bits uiu_i uint32 bitcast of weight wiw_i N Total number of target parameters θtarget _target Target parameter set (encoder blocks) C(θ,x)C(θ,x) Storage capacity NxNx bits CeffC_eff Effective Shannon capacity after sanitization Evaluation metrics BitAccBitAcc Bit accuracy 1B∑i[p^i=pi] 1B _i1[ p_i=p_i] (lower better) RR Recovery Reduction (Recpre−Recpost)×100%(Rec_pre-Rec_post)× 100\% DrelD_rel Relative ℓ2 _2 distance ‖W′−W‖2/‖W‖2\|W -W\|_2/\|W\|_2 W1W_1 1-Wasserstein distance between weight distributions ΔAcc Accuracy drop Accclean−AccdefendedAcc_clean-Acc_defended HDHD Hamming distance (higher better for defense) B Payload length in bits GrayShield-specific symbols s Secret owner seed (|s|=128|s|=128 bits) r Per-run salt (domain separation) H(⋅,s)H(·;s) HMAC-SHA256 PRF keyed with s ℓO_ Per-tensor phase offset gi(ℓ)g_i^( ) Gray-code overwrite value at index i, tensor ℓ Information-theoretic symbols BSC(p)BSC(p) Binary symmetric channel with crossover probability p Hb(p)H_b(p) Binary entropy −plog2p−(1−p)log2(1−p)-p _2p-(1-p) _2(1-p) CBSC(p)C_BSC(p) BSC capacity 1−Hb(p)1-H_b(p) (zero at p=1/2p=1/2) ℐ(P,P^)I(P; P) Mutual information between payload P and extracted bits P P Precision formats FP32 32-bit single-precision (1 sign, 8 exponent, 23 mantissa) FP16 16-bit half-precision (1-5-10) BF16 Brain Float 16 (1-8-7) INT8 8-bit signed integer with per-tensor scale Coding theory terms ECC Error-Correcting Code RS Reed–Solomon code (MDS over GF(28)GF(2^8)) LDPC Low-Density Parity-Check code (BP decoding) Polar Polar code (SCL decoding) Defense abbreviations GS GrayShield (proposed) PM PatternMask: fixed-pattern LSB overwrite RF RandomFlip: per-bit Bernoulli flip FT FineTune: fine-tuning on clean samples GN GaussNoise: additive Gaussian noise PTQ Post-Training INT8 Quantization SWP Selective Weight Perturbation Models and datasets BERT BERT-base (110M params, SST-2) RoBERTa RoBERTa-base (125M params, SST-2) ViT ViT-Base/16 (86M params, CIFAR-10) Swin Swin-Tiny (29M params, CIFAR-10) SST-2 Stanford Sentiment Treebank (binary) CIFAR-10 10-class image benchmark Appendix D Formal Definitions Definitions are ordered from the attack primitive upward to the defense guarantee. Definition 10 (Payload): A payload is a binary string =(p1,…,pB)∈0,1Bp=(p_1,…,p_B)∈\0,1\^B of length B∈ℕB , drawn from an arbitrary distribution P over 0,1B\0,1\^B. The analysis in Section B holds for every P, including adversarially chosen fixed strings. Definition 11 (Covert Channel): The LSB covert channel induced by the target parameter set θtarget _target, overwrite depth x, and model weights W∈W is the tuple (ℰ,,,0,1C)(E,D,W,\0,1\^C), where C=C(θtarget,x)C=C( _target,x) is the storage capacity (Eq. 6), the encoder ℰ:×0,1C→E:W×\0,1\^C produces a weight tensor W′=ℰ(W,)W =E(W,p) by writing payload bits into the x mantissa LSBs of target weights, and the decoder :→0,1CD:W→\0,1\^C recovers the payload by reading back those same bit positions: (W′)=D(W )=p with probability one in the noiseless pre-defense setting. Definition 12 (Storage Capacity vs. Shannon Capacity): The storage capacity C(θtarget,x)=NxC( _target,x)=Nx (Eq. 6) is the number of payload bits the encoder can embed in N target weights at depth x; it is a counting quantity. The effective Shannon capacity Ceff(T)=ℐ(P,P^)C_eff(T)=I(P; P) (Eq. 5) is the maximum mutual information between the embedded payload P and the extracted sequence P P after sanitization map T; it is an information-theoretic quantity measured in bits per channel use. The goal of GrayShield is to reduce CeffC_eff to zero while leaving C(θtarget,x)C( _target,x) unchanged. Definition 13 (Post-Training Sanitization Map): A post-training sanitization map is a function T:×→T:W×K , where =∏ℓℝNℓW= _ R^N_ is the model weight space and K is a key space, satisfying: 1. Data-free: T(W,k)T(W,k) does not require access to any training or validation data. 2. Weight-only: T modifies only the weight tensor W; model architecture, tokenizer, and configuration files are unchanged. 3. O(N)O(N) complexity: The runtime of T is linear in the number of target parameters N=∑ℓNℓN= _ N_ . GrayShield instantiates T with =0,1|s|K=\0,1\^|s| (the seed space), deterministically as described in Section B. Definition 14 (Pseudorandom Function): A pseudorandom function (PRF) is a keyed function H:0,1∗×0,1|s|→0,1λH:\0,1\^*×\0,1\^|s|→\0,1\^λ such that no probabilistic polynomial-time adversary can distinguish H(⋅,s)H(·,s) from a uniformly random function f:0,1∗→0,1λf:\0,1\^*→\0,1\^λ with non-negligible advantage, for a uniformly sampled key s←0,1|s|s←\0,1\^|s|. Formally, for all PPT distinguishers A: |ℙs[H(⋅,s)=1]−ℙf[f(⋅)=1]|≤negl(|s|). |P_s[A^H(·,s)=1]-P_f[A^f(·)=1] | (|s|). (7) GrayShield instantiates H as HMAC-SHA256, which satisfies Eq. (7) under standard assumptions on the SHA-256 compression function (Bellare et al. 1996). Definition 15 (Effective Channel Capacity): Let T:×→T:W×K be a sanitization map and let P^=(T(W,k)) P=D(T(W,k)) denote the payload extracted from the sanitized weights. The effective channel capacity of the covert channel under defense T with key k is Ceff(T,k)=supℐ(P,P^),C_eff(T,k)\;=\; _P\;I_P\! (P\,;\, P ), (8) where the supremum is taken over all payload distributions P on 0,1B\0,1\^B, and ℐI_P denotes mutual information under that distribution. Proposition 4 establishes that Ceff(GrayShield,s)=0C_eff( GrayShield,s)=0 for all s∈s unknown to the attacker under the idealized PRF model. Definition 16 (Payload Recovery): Given an embedded payload ∈0,1Bp∈\0,1\^B and a decoded sequence ^∈0,1B p∈\0,1\^B obtained after applying defense T, the payload recovery rate is Rec(,^)=1B∑i=1B[p^i=pi]=BitAcc(,^).Rec(p, p)\;=\; 1B _i=1^B1[ p_i=p_i]\;=\;BitAcc(p, p). (9) The Recovery Reduction is then R=(Recpre−Recpost)×100%R=(Rec_pre-Rec_post)× 100\%, where Recpre=BitAcc(,(ℰ(W,)))Rec_pre=BitAcc(p,D(E(W,p))) is the pre-defense recovery rate (effectively 1.01.0 for aligned injection at x≤16x≤ 16) and Recpost=BitAcc(,(T(ℰ(W,),k)))Rec_post=BitAcc(p,D(T(E(W,p),k))) is the post-defense recovery rate. Definition 17 (Stealth): An embedding ℰ(W,)E(W,p) is (ϵℓ,ϵc,ϵa)( _ , _c, _a)-stealthy if the following three conditions hold simultaneously: Drel(W,ℰ(W,)) D_rel(W,E(W,p)) ≤ϵℓ ≤ _ (perturbation magnitude), (perturbation magnitude), (10) 1−Simcos(W,ℰ(W,)) 1-Sim_ (W,E(W,p)) ≤ϵc ≤ _c (directional preservation), (directional preservation), (11) |Acc(fW)−Acc(fℰ(W,))| |Acc(f_W)-Acc(f_E(W,p))| ≤ϵa ≤ _a (utility preservation). (utility preservation). (12) In the present study, the empirical capacity boundary of (10−4,2.6×10−7,0.01)(10^-4,2.6×10^-7,0.01)-stealth is confirmed at x=16x=16 across all four model presets, degrading to (8.5×10−2,3.5×10−3,0.01)(8.5×10^-2,3.5×10^-3,0.01)-stealth at x=23x=23. Definition 18 (Perturbation Field): Let W(ℓ)∈ℝNℓW^( ) ^N_ be a target parameter tensor and let W(ℓ)′=Tℓ(W(ℓ))W^( ) =T_ (W^( )) denote its sanitized version. The perturbation field of sanitization method M on tensor ℓ is the function Δ(M,ℓ):0,…,Nℓ−1→ℝ≥0 ^(M, ):\0,…,N_ -1\ _≥ 0 defined by Δi(M,ℓ)=|wi(ℓ)′−wi(ℓ)|=gi(ℓ)⋅2−23⋅2ei−127, ^(M, )_i\;=\; w^( ) _i-w^( )_i \;=\;g_i^( )· 2^-23· 2^e_i-127, (13) where gi(ℓ)g_i^( ) is the overwrite value at position i and the indices follow the canonical row-major flattening order of the parameter tensor. The total perturbation field Δ(M) ^(M) of the full model is the concatenation of Δ(M,ℓ) ^(M, ) across all target tensors in flattening order. Definition 19 (Total-Variation Smoothness): The perturbation field Δ(M) ^(M) of method M is τ-total-variation smooth if ETV(M)=∑i=0N−2|Δi+1(M)−Δi(M)|≤τ.E_TV(M)\;=\; _i=0^N-2 ^(M)_i+1- ^(M)_i \;≤\;τ. (14) A method with lower ETVE_TV introduces more slowly varying perturbations in the flattened weight order, reducing (i) the high-frequency spectral energy detectable by frequency-domain anomaly scanners, and (i) the risk of exciting sharp curvature directions in the task-loss Hessian. The Gray-code property Ham(gi(ℓ),gi+1(ℓ))≤1Ham(g_i^( ),g_i+1^( ))≤ 1 implies τGrayShield≤N⋅2−23⋅[2ei] _ GrayShield≤ N· 2^-23·E[2^e_i], whereas PM with a period-2 pattern achieves τPM=Θ(NΔmax) _ PM= (N _ ), giving τGS≪τPM _ GS _ PM. Definition 20 (Memoryless Covert Channel): The covert channel (ℰ,,,0,1C)(E,D,W,\0,1\^C) is memoryless with respect to sanitization T if, for all i≠ji≠ j, the random variables P^i=(T(W,k))i P_i=D(T(W,k))_i and P^j=(T(W,k))j P_j=D(T(W,k))_j are conditionally independent given P=(P1,…,PB)P=(P_1,…,P_B): P^i⟂P^j|P,k∀i≠j. P_i P_j P,\;k ∀\,i≠ j. (15) This condition holds for GrayShield because gi(ℓ)=((i+ℓ)⊕((i+ℓ)≫1))&mxg_i^( )=((i+O_ ) ((i+O_ ) 1))\,\&\,m_x is a deterministic function of i alone (given ℓO_ ), with no dependence on gj(ℓ)g_j^( ) for j≠ij≠ i. The post-defense extracted bits are therefore independent across positions, justifying the memoryless BSC model. Definition 21 (Chance-Level Recovery): For a binary payload channel with crossover probability p, chance-level recovery is the expected bit accuracy under the maximum-entropy noise distribution: Recchance=ℙ(P^i=Pi)= 1−p→p→1/212.Rec_chance\;=\;P( P_i=P_i)\;=\;1-p\; p→ 1/2\; 12. (16) Proposition 4 establishes that GrayShield drives p→1/2p→ 1/2 in the idealized PRF model, so Recpost→1/2Rec_post→ 1/2 and R→50%R→ 50\%. “Near-chance sanitization” in our empirical results refers to Recpost∈[0.49,0.51]Rec_post∈[0.49,0.51], corresponding to a channel crossover probability indistinguishable from 1/21/2 at the measured sample sizes. Appendix E Extended Trade-off Analysis Figure 6 provides an extended view of the security–utility trade-off across defenses under both baseline and adaptive attacker settings. We place this figure in the appendix because the full configuration-level visualization is informative but visually dense relative to the main paper figures. The figure complements the main RQ3 analysis by showing the distribution of recovery reduction (R) and accuracy degradation across all evaluated model, payload, and attacker configurations. It confirms that the high-level ordering observed in the main results remains stable across attacker variants, while also exposing important differences in variance, operating-point consistency, and deployment robustness among defenses. Figure 6: Security–utility trade-off across defenses. Panel (a) plots recovery reduction (R) versus accuracy drop for all defense configurations. Solid markers denote configurations evaluated under the RQ3 adaptive attacker setting; hollow markers indicate the additional swin_cifar10 configuration from RQ2. Hollow markers show the additional swin_cifar10 configuration from RQ2. The horizontal dashed line marks the desired 50%50\% chance-level recovery threshold, while the vertical dashed line indicates the practical 0.25%0.25\% accuracy budget. GS consistently occupies the upper-left “ideal zone,” achieving near-chance R with minimal accuracy degradation and low variance. FT achieves competitive R only at substantially higher utility cost, whereas GN, SWP, and RF fail to provide effective sanitization. The weak global trend (R2=0.08R^2=0.08) indicates that stronger sanitization does not necessarily require larger accuracy degradation. Panel (b) shows the accuracy drop at each defense’s best operating point, with whiskers indicating the full observed range across configurations. GS achieves near-optimal R at effectively zero accuracy cost while maintaining substantially tighter variability than competing high-R defenses. Appendix F Multi-Precision Threat Extension The main evaluation targets FP32. FP16 (1-5-10) and BF16 (1-8-7) reduce mantissa depth to mFP16=10m_FP16=10 and mBF16=7m_BF16=7 bits respectively, giving adjusted hiding capacity CF=∑wnumel(w)⋅min(x,mF)C_F= _wnumel(w)· (x,m_F). For BERT-base encoder blocks at x=5x=5 in FP16, CFP16≈53C_FP16≈ 53 MB, sufficient for both evaluated payloads. Proposition 4 extends to these formats unchanged, since the Gray-code overwrite applies identically by clamping x≤mFx≤ m_F. Each INT8 weight supports x≤2x≤ 2 bits at quantization error δi=q⋅scaleℓ _i=q·scale_ with q≤1/128q≤ 1/128, a negligible stealth cost at x=1x=1. Empirical validation of reduced-precision formats is left as future work. Appendix G Bit Manipulation in FP32 Weights A float32 value stores sign (1 bit), exponent (8 bits), and mantissa (23 bits). All attack and defense operations act exclusively on mantissa LSBs, preserving sign and exponent unchanged. Let u=bitcast(w)∈0,132u=bitcast(w)∈\0,1\^32 be the uint32 view of weight w and m=(1≪x)−1m=(1 x)-1 the LSB mask. The three core operations are: • Extraction: u&mu\;\&\;m. • Overwrite / sanitization: u′=(u&∼m)|bu =(u\;\&\; m)\;|\;b, b∈[0,2x−1]b∈[0,2^x-1]. • Random flip: u′=u⊕ru =u r within the masked region, where r is sampled from Bernoulli(p)Bernoulli(p) independently per bit. All three are fully vectorizable via Tensor.view(torch.int32) on contiguous FP32 parameters, completing in O(N)O(N) time with O(1)O(1) auxiliary state per tensor. Appendix H Budget Definition The bit-level budget fixes the total number of modified bits B, implying K=⌊B/x⌋K= B/x modified floats. The float-level budget modifies K float elements, touching K⋅xK· x bits. We use a bit-level budget throughout the paper for fairness across different values of x. Appendix I Additional Fidelity Metrics GrayShield does not yield the single largest average Hamming distance; that distinction is held by PM by a negligible margin. However, GrayShield achieves essentially the same level of payload corruption while preserving substantially better weight fidelity: its average W1W_1 is about 25×25× smaller than PM and about 42×42× smaller than PTQ. The main empirical advantage of GrayShield is therefore near-maximal corruption with markedly cleaner distribution-level behaviour. Appendix J Reproducibility The anonymized replication package (Anonymous Authors 2026) contains the code, configuration grids, figure-generation scripts, curated payload data, dataset metadata, structured result artifacts, and provenance information needed to reproduce the main figures and tables in this paper. The curated payload data include the two representative payloads used in the completed main-paper runs—the low-entropy JavaScript sample c37…a88.js.malware and the high-entropy executable 5704…6d0.exe.malware—together with four supplementary payloads and a metadata manifest recording file type, size, entropy, and paper role. The payload bundle is included in the anonymized replication package. The repository also includes a structured results bundle under release_results/. This bundle separates the refreshed RQ1 rerun from the completed RQ2–RQ4 results, and includes sanitization configuration files, attacker encoder/decoder implementations, figure-generation utilities, and a merged provenance manifest tracing each published result back to its source run. Seeds: run seed 1; evaluation seed 42; neval=512n_eval=512 per run. Software: Python 3.13, PyTorch 2.9.1, Transformers 5.0.0. Hardware: Ubuntu 22.04.5; 2×2× Intel Xeon Gold 6430 (128 logical cores); 503 GiB RAM; 2×2× NVIDIA RTX PRO 6000 Blackwell (96 GB VRAM each).