Calgacus Mlx

calgacus-mlx

LLM Steganography: Hide a meaningful text inside another plausible text of comparable length.

MLX implementation of the [Calgacus protocol](https://arxiv.org/abs/2510.20075) (Norelli & Bronstein, 2025) for LLM-based text steganography. Given a secret message, calgacus produces a stegotext that reads like ordinary prose, but encodes the secret losslessly via rank-driven selection from a language model's next-token distribution at each position. A receiver with the same model and the same key recovers the original message exactly.

This is a Python CLI that runs locally on Apple Silicon via [MLX](https://github.com/ml-explore/mlx).

Demo

Generate a `keyfile.toml` that bundles the model, cover prompt, and protocol settings that sender and receiver share. See [Keyfile format](#keyfile-format) for more details.

uv run calgacus init -o keyfile.toml

model = "mlx-community/SmolLM3-3B-Base-8bit"
cover_prompt = "The spaghetti was delicious and the breadsticks were a fantastic side dish, but the salad was stale."
secret_prefix = "The following is an important covert message. Please read it carefully."
trailer = "graceful"

With the following `secret.txt`:

The plan has changed. We must meet Tuesday night. Come to my office at midnight and bring the money.

encode to `stegotext.txt`:

uv run calgacus encode \
    -k keyfile.toml \
    -s secret.txt \
    -o stegotext.txt

The `stegotext.txt` it produces:

The plate had no dressing, which left tiny bits and large chunks that didn't go very well. The salad Zac finished was a bit better, but still not great.

Anyone with the same `keyfile.toml` can recover it:

uv run calgacus decode \
    -k keyfile.toml \
    -s stegotext.txt

The plan has changed. We must meet Tuesday night. Come to my office at midnight and bring the money.

The recovered text matches the original byte-for-byte. The stegotext gives no surface indication that it carries a hidden payl