REVIEW 4 major objections 5 minor 1 cited by
CryptoX : Compositional Reasoning Evaluation of Large Language Models
T0 review · 4 major / 5 minor · reviewed 2026-08-08 · deepseek-v4-flash
Pith's one-line read A benchmark that encodes prompts reveals that most LLMs are weak at compositional reasoning, with open-source models trailing closed-source ones by a large margin.
desk verdict A usable stress-test benchmark whose central 'compositional reasoning' claim is undercut by its own case studies; worth refereeing, but only after the authors reposition the claim. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The engine of the method is instruction encryption: a codebook (base Morse, emoji Morse, or emoji shuffle) randomly replaces a chosen number of words in a prompt, and the encoding rules are explicitly included in the prompt. Instruction transformation then adds further projection steps from the decoded answer to the required output, such as mapping A–D to 1–4 or appending the first character of the option text. Performance is summarized as an area-under-curve (AUC) score computed as the number of encoded words ranges from 0 to 10, which the paper argues is more sensitive than a single accuracy value. On the mechanism side, logit lens and neuron activation analysis identify which layers track decoded words versus answer options, and reasoning-stage analysis labels layer bands as shallow (decomposition), intermediate (subtask solving), and deep (summarization).
What would settle it
The paper's own Appendix G case studies show models producing correct answers even when they fail to decode the question or skip the decoding step outright. A direct test of the central mechanism would measure, per item, whether final-answer accuracy tracks decoding accuracy (for example, ROUGE or BLEU against the true plaintext question); if many items are answered correctly despite failed decoding, the benchmark is measuring something other than decode-then-reason compositionality.
Extended reading notes
Core claim
CryptoBench quantifies compositional reasoning by forcing a model to perform two coupled subtasks in one run: decode a cipher-transformed question using rules stated in the prompt, then answer the original question under an additional output transformation (for example, convert the chosen option letter to its alphabet position). The authors report that no tested model handles this well at high encoding levels, that the gap between open-source and closed-source models is large — o1 reaches 83.7% average accuracy while the smallest open-source models fall to near zero — and that model size, instruction tuning, and architecture all shift performance. Their mechanistic experiments indicate that models decompose the problem, decode in early-to-middle layers, solve the base task, and summarize subtask answers in later layers, and that neuron activation for encoding rules precedes the logit-lens rise of decoded words. The paper's conclusion is that compositional reasoning is a measurable ability distinct from the skills tapped by vanilla benchmarks, and that CryptoBench's area-under-curve score over encoding levels is a more discriminating metric than single accuracy numbers.
Load-bearing premise
The load-bearing premise is that a model's accuracy on prompts that must be decoded before answering is a valid measure of compositional reasoning as a distinct ability, separate from instruction following, resilience to input perturbations, or memorization of benchmark answers; if that premise gives way, the scores blend unrelated capabilities.
Editorial extensions
If this is right
- Standard benchmarks such as MMLU can be stress-tested by re-encoding prompts with a fresh codebook, yielding a difficulty curve instead of a single accuracy point.
- Model rankings change under CryptoBench relative to vanilla accuracy, so a model's advertised reasoning skill on familiar benchmarks does not reliably predict its performance when prompts are superficially transformed.
- The strong drop in accuracy as encoded-word count rises implies that improving compositional reasoning—not just base-task skill—could be a lever for better generalization.
- The observed layer-level ordering (decode, then reason, then summarize) suggests that architectures or inference procedures that enforce explicit decomposition may improve CR performance.
- AUC over encoding levels gives benchmark designers a graded metric that keeps some discrimination even when models saturate the vanilla task.
Reading between the lines
- Editorial inference: Appendix G's cases where a model answers correctly despite failed or skipped decoding suggest that CryptoBench scores may partly reflect memorized or shortcut answers, so the benchmark's construct validity as a pure measure of compositional reasoning remains an open question.
- Editorial inference: The framework is codebook-agnostic, so an immediate extension would be to test whether a model's ranking under emoji shuffle transfers to structurally different ciphers (for example, Huffman coding or RSA-style encryption), which would show whether the measured ability is generic compositionality or specific familiarity with the cipher format.
- Editorial inference: The multi-turn versus single-turn ablation implies that decomposing a task into separate prompts is easier than composing the same subtasks in one context; a natural application is to use that gap as a diagnostic for how much context-composition overhead a model carries.
- Editorial inference: The logit-lens finding that decoded-word probability peaks before answer-option probability suggests a testable intervention: explicitly forcing a model to output the plaintext question before answering should raise accuracy if the mechanism is causal, and should leave accuracy unchanged if decoding is epiphenomenal.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes CryptoX, a framework that transforms existing benchmarks (MATH, MMLU, MBPP, BBH, Needle) by encrypting 5 or 10 words in each prompt using fixed codebooks and by adding answer-projection rules (numeric and alpha transformations). It constructs CryptoBench with 21 sub-datasets and roughly 7K cases, evaluates 20+ open- and closed-source LLMs, and reports that accuracy declines as more words are encoded, that closed-source models outperform open-source models, and that an AUC score provides a better ranking than average accuracy. The paper also presents logit-lens, neuron-activation, and reasoning-stage analyses on smaller open models to argue that models decode encoded words before solving the original problem.
Significance. If the benchmark measures a distinct compositional-reasoning ability, it would be a useful tool: it is grounded in established datasets, ships code, and the monotone accuracy decline with encoding level is a crisp and reproducible empirical finding. The paper is also transparent in providing detailed case studies in the appendix. However, the construct-validity premise is not established, and the paper's own appendix contradicts the central claim that the benchmark forces models to decode before answering. The evaluation of math answers relies on an unvalidated LLM-as-judge, and the mechanistic analyses are limited to small, low-scoring models. These issues make the headline conclusion ('most LLMs have weak compositional reasoning abilities') premature, although the benchmark itself may be salvageable with additional controls and more modest claims.
major comments (4)
- [Section 3.1, Appendix G (Figures 35-37)] Section 3.1 states that 'CryptoBench forces models to conduct compositional reasoning, requiring them to decode the question before answering it,' but the paper's own case studies contradict this. In Figure 35, Qwen2.5-72B-Instruct answers correctly despite mistranslating the encoded question, and on the Crypto-MMLU single-stage task it 'skipped the translation step entirely and directly answered the question.' Figure 37 reports correct answers despite incorrect decoding in both conditions. Consequently, item-level scores do not require the intended decode-then-answer chain, and the central claim that CryptoBench quantifies compositional reasoning is unsupported. Please either redesign items so that correct answers require decoding (e.g., encode all content words and the answer options, or require the decoded question to be echoed in the response), or reframe the benchmark as measuring robustness to input corruption and explicitly state that construct-validity evidence is still needed.
- [Algorithm 1, Table 1] With only 5 or 10 words encoded in prompts that are hundreds to thousands of characters long (e.g., Crypto-BBH average length ranges from 1585.3 to 3517.24 characters; Crypto-MMLU from 627.97 to 1333.6), most of the question and all answer options remain in plaintext. This leaves ample residual cues for models to answer correctly, especially for public benchmarks like MMLU that are likely present in pretraining corpora. The case studies in Appendix G are consistent with this alternative explanation: the model often answers correctly without decoding or after failed decoding. To support the compositional-reasoning interpretation, please add control conditions in which all content words are encoded (or a random-permutation control) and show that performance still tracks the number of encoded words; otherwise, the observed decline may reflect token-level perturbation sensitivity or partial-prompt pattern matching rather than compositional reasoning.
- [Section 3, 'Evaluation Metrics'] Scores for Crypto-Math and Crypto-HighResolution are obtained with an LLM-as-judge (Doubao-Pro-256K) without reporting any validation, inter-judge agreement, comparison against exact match, or human ratings. Since mathematical answers are a significant part of the reported results, please provide evidence that the judge is reliable (e.g., agreement rates on a sample, or a comparison with exact-match with tolerance), or report exact-match numbers with clearly stated normalization rules for mathematical expressions.
- [Section 4, Appendices D-F] The logit-lens and neuron-activation analyses are run only on Qwen2.5-3B/7B, Llama-3.1-8B, and similar small models, which are among the lowest-performing models in Table 2 (e.g., Qwen2.5-7B-Instruct has AUC 1.24). The paper draws general conclusions that 'LLMs' summarize subtask answers and that 'the layers of LLMs' exhibit a hierarchical pattern of subtask execution, but the highest-scoring models (o1, o3-mini, Gemini-2.0-Flash-Thinking) are not analyzed. Please restrict the mechanistic claims to the studied models or extend the analysis to at least one high-performing model before making claims about LLM compositional reasoning in general.
minor comments (5)
- [Appendix G.2] The paper uses the term 'overfitting' to describe correct answers despite decoding errors, but the evidence is equally consistent with memorization of public MMLU questions or with the model simply ignoring the encoding. Please clarify the terminology and discuss the possibility of benchmark contamination explicitly.
- [Section 3, 'LLMs'] The sampling parameters are given as wide ranges ('temperature T = 0.7 to 1.0 and top p = 0.75 to 1.0') without per-model values. Please report the exact settings and number of runs for each model, especially because temperature affects the variance reported in Table 5.
- [Throughout] There are several typos and heading errors: 'Compostional Reasoning' (Section 5.1), 'Performane' (Appendix C.2), 'Thr Effect' (Appendix C.5), 'Instrcut' (Figure 6), 'nueron' (Section 4.2), and 'chararcter' (Figure 2).
- [Table 2] Table 2 is visually dense and uses color coding (green/blue/orange) that may not render reliably in print or for color-blind readers; consider splitting the 0/5/10 columns into separate rows or adding explicit numeric highlighting.
- [Appendix C.8] The Spearman correlations with Chatbot Arena (0.61, 0.57, 0.19) are reported without the number of models or p-values; please add these statistics to make the correlation comparison interpretable.
Circularity Check
No significant circularity: CryptoBench is an empirical benchmark and the CR conclusions rest on measured scores with independent mechanistic evidence; Appendix G raises construct-validity concerns but no derivation reduces to its inputs.
full rationale
The paper's central claim is an empirical evaluation result: CryptoBench scores are measured accuracies and AUC over tasks built from external datasets (MATH, MMLU, BBH, MBPP, Needle) by instruction encryption and transformation. No parameter is fitted and then renamed as a prediction; the AUC in Eq. (2) is an explicit aggregation of measured performance, not a hidden definition of compositional reasoning. The conceptual definition of CR in the introduction is independent of the benchmark score, and the mechanistic analyses (logit lens, neuron activation, reasoning stage) provide additional, though limited, evidence. Self-citations in the references are not load-bearing, and no uniqueness theorem is imported. The main weakness is construct validity, not circularity: Section 3.1 asserts that CryptoBench 'forces models to conduct compositional reasoning, requiring them to decode the question before answering it,' but Appendix G (Figures 35-37) documents cases where models answer correctly despite decoding errors or skip decoding entirely, and Algorithm 1 encodes only 5 or 10 words in long prompts, leaving much of the question and all options in plaintext. These observations undermine the inference from scores to CR ability, but they do not make the conclusion equivalent to the inputs by construction. The benchmark is self-contained as a measurement instrument; therefore the circularity score is 0.
Assumptions & free parameters
free parameters (5)
- Encoding levels (0, 5, 10 words) =
0, 5, 10
- Encoding codebooks =
base Morse, emoji Morse, emoji shuffle
- Answer transformation rules =
numeric (A->1), alpha (first character)
- Number of needles in Needle benchmark =
3
- Sampling temperature and top_p =
temperature 0.7-1.0, top_p 0.75-1.0
assumptions (3)
- domain assumption Decoding encoded words and applying answer transformations is a valid measure of compositional reasoning.
- domain assumption The LLM-as-judge (Doubao-Pro-256K) provides correct evaluations of math answers.
- domain assumption Logit lens probabilities and neuron activation counts reflect the model's internal reasoning stages.
Cite this review
Pith. "Pith review of CryptoX : Compositional Reasoning Evaluation of Large Language Models." pith.science (2026). https://pith.science/paper/U2YGPS47
@misc{pith2026250207813,
author = {Pith},
title = {Pith review of: CryptoX : Compositional Reasoning Evaluation of Large Language Models},
year = {2026},
howpublished = {\url{https://pith.science/paper/U2YGPS47}},
note = {Machine review of arXiv:2502.07813}
}
read the original abstract
The compositional reasoning capacity has long been regarded as critical to the generalization and intelligence emergence of large language models LLMs. However, despite numerous reasoning-related benchmarks, the compositional reasoning capacity of LLMs is rarely studied or quantified in the existing benchmarks. In this paper, we introduce CryptoX, an evaluation framework that, for the first time, combines existing benchmarks and cryptographic, to quantify the compositional reasoning capacity of LLMs. Building upon CryptoX, we construct CryptoBench, which integrates these principles into several benchmarks for systematic evaluation. We conduct detailed experiments on widely used open-source and closed-source LLMs using CryptoBench, revealing a huge gap between open-source and closed-source LLMs. We further conduct thorough mechanical interpretability experiments to reveal the inner mechanism of LLMs' compositional reasoning, involving subproblem decomposition, subproblem inference, and summarizing subproblem conclusions. Through analysis based on CryptoBench, we highlight the value of independently studying compositional reasoning and emphasize the need to enhance the compositional reasoning capabilities of LLMs.
Figures
Figures from the paper (35 more)
Forward citations
Cited by 1 Pith paper
-
KORGym: A Dynamic Game Platform for LLM Reasoning Evaluation
KORGym introduces a 51-game, text and visual, multi-turn benchmark with a normalized scoring scheme, and uses it to compare 19 LLMs and 8 VLMs on six reasoning dimensions.
Reference graph
Works this paper leans on
- [3]
-
[4]
0 5 10 15 20 25 30 Layer 3000 4000 5000 6000 7000 8000 9000 10000Highly activated neurons Meta-Llama-3.1-8B_Plot of Vocabs and Encodeds by Layer Index Vocabs Encodeds (a) The result of Neuron Activation on Llama-3.1-8B 0 5 10 15 20 25 30 35 Layer 0 1000 2000 3000 4000 5000 6000 7000Highly activated neurons Qwen2.5-3B_Plot of Vocabs and Encodeds by Layer I...
work page 2000
-
[5]
A. Ghandeharioun, A. Caciularu, A. Pearce, L. Dixon, and M. Geva. Patchscope: A unify- ing framework for inspecting hidden representations of language models. arXiv preprint arXiv:2401.06102,
-
[6]
URL https://github.com/gkamradt/LLMTes t_NeedleInAHaystack/tree/main. J. Gui, Y. Liu, J. Cheng, X. Gu, X. Liu, H. Wang, Y. Dong, J. Tang, and M. Huang. Log- icgame: Benchmarking rule-based reasoning abilities of large language models. arXiv preprint arXiv:2408.15778,
-
[7]
S. Han, H. Schoelkopf, Y. Zhao, Z. Qi, M. Riddell, W. Zhou, J. Coady, D. Peng, Y. Qiao, L. Benson, et al. Folio: Natural language reasoning with first-order logic. arXiv preprint arXiv:2209.00840,
-
[8]
17 D. Hendrycks, C. Burns, S. Basart, A. Zou, M. Mazeika, D. Song, and J. Steinhardt. Measuring Massive Multitask Language Understanding. arXiv e-prints, art. arXiv:2009.03300, Sept. 2020a. doi: 10.48550/arXiv.2009.03300. D. Hendrycks, C. Burns, S. Basart, A. Zou, M. Mazeika, D. Song, and J. Steinhardt. Measuring Massive Multitask Language Understanding. ...
-
[11]
doi: 10.18653/v1/2023.emnlp-main.299
Association for Computational Linguistics. doi: 10.18653/v1/2023.emnlp-main.299. URL https: //aclanthology.org/2023.emnlp-main.299/. Jamba Team, B. Lenz, A. Arazi, A. Bergman, A. Manevich, B. Peleg, B. Aviram, C. Almagor, C. Fridman, D. Padnos, D. Gissin, D. Jannai, D. Muhlgay, D. Zimberg, E. M. Gerber, E. Dolev, E. Krakovsky, E. Safahi, E. Schwartz, G. C...
arXiv 2023
-
[12]
doi: 10.48550/arXiv.2408.12570. Z. Li, G. Jiang, H. Xie, L. Song, D. Lian, and Y. Wei. Understanding and Patching Compositional Reasoning in LLMs. arXiv e-prints, art. arXiv:2402.14328, Feb
Show all 35 references
- [13]
-
[15]
K. Ma, X. Du, Y. Wang, H. Zhang, Z. Wen, X. Qu, J. Yang, J. Liu, M. Liu, X. Yue, et al. Kor-bench: Benchmarking language models on knowledge-orthogonal reasoning tasks. arXiv preprint arXiv:2410.06526,
-
[16]
Masry, D
A. Masry, D. X. Long, J. Q. Tan, S. Joty, and E. Hoque. Chartqa: A benchmark for question answering about charts with visual and logical reasoning. arXiv preprint arXiv:2203.10244,
-
[18]
URL https://www.lesswrong.com/po sts/AcKRB8wDpdaN6v6ru/interpreting-gpt-the-logit-lens . Y. Onoe, M. J. Zhang, E. Choi, and G. Durrett. Creak: A dataset for commonsense reasoning over entity knowledge. arXiv preprint arXiv:2109.01653,
- [19]
- [20]
-
[21]
In Domain_Words, Words denotes the number of words encoded in the given question
The performance of different architectural models. In Domain_Words, Words denotes the number of words encoded in the given question. 30 C.6. The Decoding Capacity of LLMs Content C.6 below shows the performance of different models in decoding. C.6.1. ROUGE-1 Score The statisti...
2004
-
[22]
doi: 10.18653 /v1/2020.emnlp-main.185
Association for Computational Linguistics. doi: 10.18653 /v1/2020.emnlp-main.185. URL https://aclanthology.org/2020.emnlp-main.185/. O. Press, M. Zhang, S. Min, L. Schmidt, N. A. Smith, and M. Lewis. Measuring and narrowing the compositionality gap in language models. arXiv pr...
2020 arXiv
-
[23]
Sakarvadia, A
M. Sakarvadia, A. Ajith, A. Khan, D. Grzenda, N. Hudson, A. Bauer, K. Chard, and I. Foster. Memory injections: Correcting multi-hop reasoning failures during inference in transformer- based language models. arXiv preprint arXiv:2309.05605,
-
[24]
Singh, N
S. Singh, N. Wen, Y. Hou, P . Alipoormolabashi, T.-L. Wu, X. Ma, and N. Peng. Com2sense: A commonsense reasoning benchmark with complementary sentences. arXiv preprint arXiv:2106.00969,
-
[25]
Suzgun, N
M. Suzgun, N. Scales, N. Schärli, S. Gehrmann, Y. Tay, H. W. Chung, A. Chowdhery, Q. V . Le, E. H. Chi, D. Zhou, , and J. Wei. Challenging big-bench tasks and whether chain-of-thought can solve them. arXiv preprint arXiv:2210.09261,
-
[26]
B. Wang, X. Yue, Y. Su, and H. Sun. Grokked transformers are implicit reasoners: A mechanistic journey to the edge of generalization. arXiv preprint arXiv:2405.15071,
-
[27]
W. Wu, Y. Wang, G. Xiao, H. Peng, and Y. Fu. Retrieval head mechanistically explains long- context factuality. ArXiv, abs/2404.15574,
-
[28]
URL https://api.semanticscholar.or g/CorpusID:269330144. A. Yang, B. Yang, B. Zhang, B. Hui, B. Zheng, B. Yu, C. Li, D. Liu, F. Huang, H. Wei, et al. Qwen2. 5 technical report. arXiv preprint arXiv:2412.15115, 2024a. J. Yang, J. Yang, K. Jin, Y. Miao, L. Zhang, L. Yang, Z. Cui...
-
[29]
Zhang, C
S. Zhang, C. Gao, W. Zhu, J. Chen, X. Huang, X. Han, J. Feng, C. Deng, and S. Huang. Getting More from Less: Large Language Models are Good Spontaneous Multilingual Learners. arXiv e-prints, art. arXiv:2405.13816, May
- [30]
-
[32]
In Domain_Words, Words denotes the number of words encoded in the given question
The decoding performance of different models. In Domain_Words, Words denotes the number of words encoded in the given question. 31 C.6.2. BLEU Score The statistical results of decoding accuracy using BLEU(1-gram)[Papineni et al., 2002] are shown below. (a) The result of Crypto...
2002
-
[33]
gold standard
Variance of accuracy and AUC for closed-source models on Crypto-HighResolution. Num stands for Accuracy, which corresponds to solving the question ofNum words being encoded. 0 1 2 3 4 5 6 7 8 9 10 AUC Variance0.0043 0.0055 0.0058 0.0058 0.0066 0.0069 0.0081 0.0094 0.0091 0.011...
2024
-
[36]
WHICH FOOTBALL TEAM WON THE WORLD CUP IN 2018 AND THROUGH WHICH LENS OF CHILDHOOD EYES DID THE SOLDIERS?
Case 3 in the Case Study: The prompts for the Crypto-MMLU-Alpha and Crypto-MMLU datasets are provided in Appendix B. Original Question Which of the following is the best lens through which to investigate the role of child soldiers? Question Options A) Child soldiers are victim...
2018
-
[2002]
E. M. Ponti, G. Glavaš, O. Majewska, Q. Liu, I. Vuli´ c, and A. Korhonen. XCOPA: A multilingual dataset for causal commonsense reasoning. In B. Webber, T. Cohn, Y. He, and Y. Liu, editors, Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (...
2020
-
[2004]
S. Liu, L. Chai, J. Yang, J. Shi, H. Zhu, L. Wang, K. Jin, W. Zhang, H. Zhu, S. Guo, et al. Mdeval: Massively multilingual code debugging. arXiv preprint arXiv:2411.02310,
-
[2017]
Nostalgebraist
doi: 10.14569/IJACSA.2017.081141. Nostalgebraist. interpreting gpt: the logit lens,
2017
-
[2020]
Y. Hou, J. Li, Y. Fei, A. Stolfo, W. Zhou, G. Zeng, A. Bosselut, and M. Sachan. Towards a mechanistic interpretation of multi-step reasoning capabilities of language models. In H. Bouamor, J. Pino, and K. Bali, editors, Proceedings of the 2023 Conference on Empirical Methods i...
2023
-
[2021]
Ho, A.-K
X. Ho, A.-K. D. Nguyen, S. Sugawara, and A. Aizawa. Constructing a multi-hop qa dataset for comprehensive evaluation of reasoning steps. arXiv preprint arXiv:2011.01060,
2011 arXiv
-
[2022]
Dubey, A
A. Dubey, A. Jauhri, A. Pandey, A. Kadian, A. Al-Dahle, A. Letman, A. Mathur, A. Schelten, A. Yang, A. Fan, et al. The llama 3 herd of models. arXiv preprint arXiv:2407.21783,
-
[2023]
Cheng, L
S. Cheng, L. Pan, X. Yin, X. Wang, and W. Y. Wang. Understanding the interplay between para- metric and contextual knowledge for large language models. arXiv preprint arXiv:2410.08414,
-
[2024]
Accessed: 2024-09-21
URL https://www.paperswith code.com/paper/claude-3-5-sonnet-model-card-addendum . Accessed: 2024-09-21. J. Austin, A. Odena, M. Nye, M. Bosma, H. Michalewski, D. Dohan, E. Jiang, C. Cai, M. Terry, Q. Le, et al. Program synthesis with large language models. arXiv preprint arXiv...
2024 arXiv
Reviewed August 8, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.