{"id":"896b0865-f2ba-4491-ac6c-2e94f5e0961e","arxiv_id":"2412.19652","paper_version":5,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"FreStega adjusts language model token probabilities at decoding time, using entropy-based temperature and target-domain token frequency alignment, improving steganalysis resistance and increasing embedding rate by about fifteen percent.","lead":"FreStega is a plug-in that reshapes how a language model chooses words while hiding secret messages, making the hidden text look more like real posts and letting it carry more secret bits. It could make covert text communication harder for automated detectors to spot on social media and similar platforms.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Decoding correctness is never validated: FreStega's spatial adjustment requires Alice and Bob to share exact target-domain and model-generated corpora, but no synchronization protocol or bit-error-rate measurement is reported.","rationale":"The reader's weakest-assumption analysis identifies the same load-bearing issue I would flag: FreStega's spatial adjustment depends on auxiliary corpora (D and M) that must be exactly shared between encoder and decoder, yet the paper neither specifies a synchronization mechanism nor measures bit error rates. This is more fundamental than the suspect KL expansion in Eq. (9), which only motivates the approach, and more concrete than the perplexity increases, which are secondary quality concerns. Without a verified encode/decode round-trip, the reported capacity and imperceptibility numbers do not demonstrate a working steganographic system. The empirical results themselves are substantial and largely consistent, and the method is plausible if the shared-corpus assumption is made explicit and a sync protocol is added. The appropriate verdict is therefore CONDITIONAL, with conditions being: report BER under exact-shared inputs, specify a synchronization/versioning protocol for D and M, and re-run the main experiments with that protocol in place. If the exact-input BER is nonzero, the verdict should be REJECT, since the central claim would fail; if the drift BER is high but exact-input BER is zero, the paper can be accepted after adding the missing protocol and demonstrating its use.","tokens_in":33889,"tokens_out":3949,"duration_ms":370586,"concrete_test":"Implement the full encode/decode cycle for all four steganography baselines (AC, ADG, METEOR, DISCOP) with FreStega on at least Qwen2-7B and Llama3-8B over 1,000 stego texts each. First, with Alice and Bob using identical D and M, report bit error rate (BER) per algorithm/model; correctness requires BER = 0. Second, introduce corpus drift after encoding by (a) regenerating M with a different random seed and (b) adding 10% new texts to D before decoding, then report BER. If BER is nonzero under either drift condition, a concrete synchronization/versioning protocol is needed for the method to be usable; if BER is nonzero even under identical inputs, the construction itself is broken.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central correctness condition, Eq. (3), requires Bob to reconstruct exactly the same reformed distribution that Alice used for encoding. FreStega's spatial adjustment, Eq. (16)-(17), multiplies the sequentially adjusted logits by F(w; D, M), which depends on token frequencies in the target-domain corpus D and the model-generated corpus M. Algorithm 1 lists D and M as inputs, but the formal setup in Section III-A specifies only K, M, H, and IE as shared (Eq. 1-2), and no protocol is given for ensuring that both parties hold byte-identical versions of D and M. Any drift in D (which the paper itself discusses as a dynamic update in Section IV-D1) or any difference in how M is sampled changes F and hence changes the token probabilities used for decoding, causing bit extraction to fail. The paper reports no bit-error rates even under the ideal exact-shared-input setup, so the fundamental round-trip correctness of FreStega is unverified. The capacity and imperceptibility claims all presume successful decoding; without a correctness measurement, the plug-and-play claim rests on an unstated synchronization assumption.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes FreStega, a decoding-time distribution reformation method for generative linguistic steganography. FreStega modifies the language model's next-token distribution in two steps: a sequential adjustment that changes temperature according to instantaneous entropy (Eq. 13) and a spatial adjustment that rescales logits by the ratio of n-gram frequencies in a target-domain corpus D and a model-generated corpus M (Eqs. 16-17). The reformed distribution is then fed unchanged into existing steganographic sampling algorithms such as AC, ADG, METEOR, and DISCOP. Experiments across four LLMs, three datasets, and four baselines report higher MAUVE scores, lower steganalysis F1 scores, increased embedding rates (about 15.41% relative), and no meaningful loss of fluency or generation speed.","tokens_in":34060,"tokens_out":12045,"duration_ms":110161,"significance":"If the claims hold, FreStega addresses a real and timely gap: distribution-preserving steganography can be secure with respect to an LM distribution while still being easily distinguishable from real human text in a target domain. The paper is empirically broad, with a released code/data link, multiple LLMs and datasets, three steganalysis detectors, AIGT detection, compatibility studies, ablations, hyperparameter analyses, and time-efficiency measurements. These are real strengths. The main weakness is that the paper never verifies the round-trip correctness of the scheme: Bob must reconstruct exactly the same reformed distribution as Alice, which requires byte-identical shared copies of D and M, yet no synchronization protocol or bit-error-rate measurement is reported. In addition, the imperceptibility evaluation is partly by construction because the same target corpus is used for alignment and for computing MAUVE/training detectors. These issues are fixable, but they are load-bearing for the central plug-and-play claim.","major_comments":[{"comment":"The correctness condition in Eq. (3) requires Bob to reconstruct exactly the distribution Alice used. In FreStega that distribution depends, through F(w; D, M) in Eqs. (16)-(17), on the target-domain corpus D and the model-generated corpus M. However, the formal Encode/Decode interface in Eqs. (1)-(2) lists only K, M, H, and IE as shared inputs, and Algorithm 1 simply takes D and M as inputs without describing how both parties obtain byte-identical copies. Section IV-D1 even discusses dynamically updating D after preprocessing; any update that is not identically synchronized on Bob's side changes F and makes bit extraction fail. The paper reports no decoding accuracy or bit-error-rate results, even under the ideal exact-sharing assumption. The experiments in Tables I-III compute embedding rates and imperceptibility from the encoding process, but they never run the Decode routine, so the central correctness requirement of a steganographic system is unverified. This is the main blocker for the plug-and-play claim and should be addressed with either a synchronization protocol plus BER measurements or an explicit statement that FreStega assumes a static, pre-shared D and M.","section":"Section III-A, Eq. (3); Algorithm 1"},{"comment":"The Taylor expansion in Eq. (9) is not correct as written. For pS = pM + epsilon, the first-order term in an expansion of D_KL(pE || pS) should involve the derivative with respect to epsilon evaluated at epsilon = 0 (a linear functional of epsilon), not the expression 'epsilon * grad D_KL(pS || pM)' with respect to the arguments shown. The two KL divergences have different reference distributions, and D_KL(pS || pM) is minimized at epsilon = 0, so the displayed first-order term has the wrong argument and sign structure. The qualitative conclusion that aligning pM toward pE can reduce D_KL(pE || pS) may still be plausible, but this equation does not demonstrate it. Please replace Eq. (9) with a correct expansion or remove the formal claim and argue the point directly.","section":"Section III-B, Eq. (9)"},{"comment":"The imperceptibility evaluation is partly circular. Section IV-A2 states that the entire target-domain corpus is used for spatial alignment, and Section IV-B3 computes MAUVE against the same corpus and trains the steganalysis detectors on the same corpus. Because FreStega explicitly matches token-frequency statistics to that corpus, the large MAUVE and F1 improvements in Tables I-III are expected by construction. The data-quantity experiments in Section IV-H are a step in the right direction, but they still evaluate against the same target corpus. To support the claim of improved practical imperceptibility, the paper should report results with disjoint alignment and evaluation sets (for example, align on 100-500 samples and evaluate MAUVE/detector F1 on a held-out portion of the human corpus), or at minimum quantify how much of the reported gain depends on the evaluation corpus being identical to the alignment corpus.","section":"Section IV-A2, Section IV-B3, Section IV-C1"},{"comment":"Table III appears to contain column-order errors for the LLAMA2 Shakespeare block. The row 'ADG[4] w/o' reads ER 8.76 / MAU 0.27, and the row 'METEOR[5] w/' reads ER 21.99 / MAU 0.21, whereas all neighboring rows in the same block have ER values well below 1 and MAU values around 8-25. If, as it appears, the ER and MAU columns are interchanged in these two rows, then the corrected METEOR w/ embedding rate is 0.21, which is below the baseline METEOR w/o value of 0.28. That would contradict the statement in Section IV-C3 that FreStega 'consistently and reliably increases the embedding rate across all scenarios.' Please verify the table and either correct the entries or qualify the capacity claim to acknowledge the exception.","section":"Table III and Section IV-C3"},{"comment":"The paper should clarify what happens to the provable-security guarantees of the base schemes when FreStega is applied. ADG, METEOR, and DISCOP are described as provably secure with respect to the original language-model distribution pM. FreStega deliberately replaces pM with a reformed distribution, so the resulting stego channel is not distribution-preserving with respect to pM. The paper does not discuss this trade-off or evaluate an adversary who knows M and can compare stego text against pM. Since the method is advertised as plug-and-play with provably secure baselines, the authors should state explicitly which distribution the base algorithm is secure with respect to after reformation and discuss the implications for a model-aware adversary.","section":"Section II and Section III-C"}],"minor_comments":[{"comment":"The text after Eq. (13) says the temperature adjustment range is bounded within '[0, 0.01 * log2(...)]', but T_Pt is defined as 1 + theta * log2(1 + c * E_t), so the range is [1, 1 + 0.01 * log2(...)]. Please correct the lower endpoint.","section":"Section III-D, Eq. (13)"},{"comment":"The n-gram order n is never specified in the experiments or in Algorithm 1. Since F(w; D, M) depends on the choice of n, and since Bob needs the same F for decoding, please state the default n used in Tables I-III and in the hyperparameter analyses.","section":"Section III-E, Eq. (17)"},{"comment":"The symbol M is overloaded: in Eqs. (1)-(3) M denotes the language model, while Algorithm 1 uses M for the model-generated corpus. This is confusing in a paper whose correctness depends on both objects. Please use distinct symbols for the LM and the corpus, e.g., LM and Corr_M.","section":"Notation throughout"},{"comment":"The abstract reports a 15.41% capacity increase, while Section IV-C3 reports per-dataset relative increases of 20.65%, 10.07%, and 15.94%. Please state how 15.41% is computed (e.g., unweighted average over the three datasets or over all configurations) so the headline number is reproducible.","section":"Section IV-C3 and Abstract"},{"comment":"Table XI contains the typo 'Traninable params' (should be 'Trainable params'), and in Table XIII the label 'w.' should be 'w/' for consistency with the other tables. These are minor but should be fixed in the final version.","section":"Tables and typos"},{"comment":"The proof of Lemma 1 in the appendix appears to contain a minor sign issue: the displayed bound for log(1 + (q-p)/p) is written with an inequality that does not match the derivation in the surrounding text. Please check the algebra and ensure the stated inequality follows from the given cases.","section":"Appendix VI-A, Eq. (24)"}],"recommendation":"major_revision","confidential_remarks":"The paper has strong empirical breadth and a plausible practical contribution, but the missing decode-accuracy validation is the main risk. I would be willing to support publication after the authors add a bit-error-rate experiment under the exact shared-corpus assumption, propose a synchronization protocol or clearly constrain the threat model, correct Eq. (9), and fix the apparent column errors in Table III. The relationship to the authors' earlier FreMax work [23] should also be made more explicit in the main text, since FreStega is positioned as a substantial extension."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"FreStega has a real empirical result, and one serious blind spot. What's new: entropy-based temperature scheduling at each decoding step plus token-frequency alignment to a target corpus, applied as a plug-in to existing steganography samplers. The experiments are broad—four LLMs, three datasets, four stego algorithms—and the direction of the numbers is consistent: steganalysis F1 drops, MAUVE rises, embedding rate rises roughly 15%, and diversity improves without large PPL damage. Code and data are promised. That is a decent contribution to the subfield.\n\nThe blind spot is decoding correctness. The paper defines correctness in Eq. (3), but never measures bit-error rate, even in the ideal case where Alice and Bob share identical corpora. More importantly, no protocol ensures they do. The formal setup shares K, M, H, and IE, but Algorithm 1 needs both a target-domain corpus D and a model-generated corpus M; those are not the same object, and no synchronization mechanism is given. The paper even discusses updating D dynamically. Any drift changes the reformed distribution, so Bob extracts different bits. The stress-test note has this right. It is not a reason to desk-reject: the method should decode if the shared-corpus assumption is made explicit and honored. But the paper must state that assumption and support it with BER experiments, and ideally a mismatch analysis.\n\nTwo smaller issues. The Taylor expansion in Eq. (9) is not sound as written; the gradient term should be with respect to the reform direction, and the notation mixes pS and pM. It is only motivation, but it should be fixed. And the MAUVE improvement is partly by construction, since the spatial adjustment matches token frequencies in the same corpus MAUVE compares against. The steganalysis F1 results are stronger evidence because they come from learned detectors. Hyperparameters are tuned with grid search on the test domains; the paper is reasonably honest about this, but the fixed c=0.1, alpha=0.1 still feel dataset-associated. PPL rises in some cases, especially ChatGLM, so the 'no quality degradation' claim is overstated.\n\nBottom line: the central empirical claim probably holds, but the correctness condition is unverified. This deserves a serious referee and a major revision more than a desk decision. I'd send it out, with instructions to demand BER experiments and a synchronization protocol.","headline":"Real empirical gains in decoding-time stego distribution reformation, but the paper never verifies that Bob can decode after the reform—that missing correctness check is the thing a referee must push on.","tokens_in":34604,"tokens_out":4634,"would_cite":true,"duration_ms":48440,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"FreStega reshapes a language model's token probabilities at decoding time so stego text mimics target-domain covers, cutting steganalysis F1 and raising embedding capacity by about 15.41%.","keywords":["FreStega","generative text steganography","distribution reformation","steganalysis","embedding capacity","target-domain alignment","decoding-time adjustment","language model distribution sharpening"],"falsifier":"Encode a known bitstring with one snapshot of the target-domain corpus $D$, then decode the same stegotext after adding 100 new sentences to $D$ while keeping the key, model, prompt, and $M$ fixed. If the recovered bits differ from the original message, the paper's correctness requirement (Equation 3) fails under corpus drift, which is exactly the real-world condition the method is meant to address.","tokens_in":33604,"feed_emoji":"🕵️","tokens_out":7271,"duration_ms":60193,"temperature":0.7,"pith_summary":"Generative text steganography hides secret bits in the tokens a language model chooses, and current algorithms aim to make the embedding process statistically indistinguishable from ordinary random sampling from that model. FreStega argues this is the wrong target in practice: language-model distributions drift from real human text in a given domain and are too sharply peaked, so the resulting secret-bearing text is easy for trained detectors to flag and carries little payload. The paper proposes a plug-and-play distribution-reformation module that runs at decoding time, before any existing steganography sampler, and reshapes the model's next-token probabilities in two ways: an entropy-driven temperature adjustment that softens overconfidence, and a corpus-guided rescaling that pushes token probabilities toward their frequencies in target-domain covers. The claim is that with FreStega attached, existing algorithms (ADG, METEOR, DISCOP, arithmetic coding) produce stego text that resists steganalysis, avoids AI-generated-text detectors, and embeds about 15.41% more bits per token, with no meaningful loss of fluency.","feed_headline":"Token-odds tweak boosts hidden-text payloads by 15 percent","feed_subtitle":"A decoder-side plug-in re-weights token odds to match real cover text, cutting detector F1 and lifting embedding rate.","key_machinery":"The load-bearing object is the distribution-reformation function applied to logits before the steganography algorithm samples. Sequential reform uses the entropy of the current predicted distribution to set a temperature: $E_t = -\\sum_k p(w_k|x_{0:t-1})\\log p(w_k|x_{0:t-1})$ and $TP_t = 1 + \\theta \\log_2(1+cE_t)$, with logits divided by $TP_t$. Spatial reform computes a static n-gram frequency ratio $F(w;D,M) = \\log(2 + [f(w;D)/f(w;M)]^\\alpha)$ and multiplies the sequentially reformed logits by it, where $D$ is the target-domain corpus and $M$ is a corpus generated by the same language model. The combined reformed distribution $p_{RF}(w_k|x_{0:t-1})$ is what the unmodified steganographic sampler uses, so the method is a plug-in that changes only the channel distribution, not the embedding algorithm. This two-step reformation is what carries the entire argument: it raises conditional entropy, which increases capacity, while bending the marginal token distribution toward the target domain, which increases imperceptibility.","core_discovery":"The central claim is that imperceptibility and capacity in generative linguistic steganography are properties not of the steganography algorithm alone but of the distribution fed to it, so the language model's raw distribution should be reconstructed before sampling. FreStega does this with two adjustments to the logits at each autoregressive step: sequential adjustment sets a per-token temperature $TP_t = 1 + \\theta \\log_2(1 + c E_t)$ based on instantaneous entropy $E_t$, counteracting LLM distribution sharpening and raising entropy; spatial adjustment multiplies each token's logits by $F(w;D,M) = \\log(2 + [f(w;D)/f(w;M)]^\\alpha)$, the log ratio of token frequency in the target-domain corpus $D$ to frequency in the model-generated corpus $M$, boosting the tokens real covers would use. The reformed distribution $p_{RF}$ is then handed to the unchanged steganography sampler. Across four LLMs and three datasets, the paper reports that the reform reduces steganalysis F1 scores relative to unmodified baselines, raises MAUVE alignment with human covers, increases diversity, and increases embedding rate by 15.41% on average, while perplexity stays roughly flat.","pith_inferences":["Because both Alice and Bob need identical frequency tables for $D$ and $M$, the target-domain corpus effectively becomes part of the shared secret; an active adversary who can cause one side to update its corpus could break extraction, and the paper does not specify a synchronization protocol.","Applying FreStega changes the distribution that the steganography sampler guarantees to match, so the provable-security statements of ADG, METEOR, and DISCOP now apply to the reformed distribution rather than the raw language model; a separate proof or a refined security definition would be needed.","The spatial alignment signal is a token-frequency marginal, and the same plug-in geometry could be tested on other marginals such as sentiment, topic, or style tokens, which the paper itself notes as possible.","A natural extension is to treat the shared corpus as a steganographic key whose diversity contributes to the overall security budget, since a larger or more specific corpus gives better cover alignment but also a larger synchronization burden."],"forward_implications":["Attaching FreStega to ADG, METEOR, DISCOP, or arithmetic coding changes only the sampling distribution; no retraining or modification of the embedding algorithm is needed.","Stego text becomes harder for steganalysis classifiers (TS-CSW, TS-RNN, R-BiLSTM-C) and for Fast-DetectGPT to separate from human cover text in IMDB, Shakespeare, and XHS domains.","Embedding rate rises relative to the unmodified baseline in every reported configuration, by about 10–21% depending on dataset and about 15.41% on average, because the entropy-driven temperature softens the LLM's too-peaked distribution.","Only around 100 target-domain samples are sufficient for spatial alignment, and the sequential adjustment works even with no target-domain text at all.","The method composes with prompt-based generation and LoRA fine-tuning rather than competing with them."],"supporting_citations":[{"why":"Defines METEOR, the provably secure one-step arithmetic-coding baseline that FreStega is plugged into and evaluated against.","marker":"[5]"},{"why":"Defines DISCOP, the distribution-copy baseline whose sharpened distributions and detection rates motivate the reformation.","marker":"[6]"},{"why":"Defines ADG, the balanced-grouping distribution-preserving algorithm used as a baseline and integration target.","marker":"[4]"},{"why":"The authors' earlier FreMax work provided the preliminary spatial-adjustment idea that FreStega extends.","marker":"[23]"},{"why":"Documents the distributional distortion in neural language-model token predictions, which is the bias FreStega's spatial alignment corrects.","marker":"[30]"},{"why":"Identifies the low-entropy and low-capacity problem of LLM-based steganography that sequential adjustment targets.","marker":"[22]"},{"why":"Supplies the MAUVE divergence metric used to measure stego-text alignment with the target-domain human corpus.","marker":"[53]"}],"fun_headline_variants":["Token tweak hides more data and defeats detectors","Re-weighting token odds improves stego stealth and payload","15% more hidden data via smarter token sampling","Plug-in improves stego imperceptibility and capacity","Token-frequency fix boosts stego realism and rate"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"Bob must be able to reproduce, bit-for-bit, the same reformed distribution Alice used, which means both sides must share the same target-domain corpus $D$ and the same model-generated corpus $M$ and must never let either drift; the paper assumes this sharing but does not provide or test a synchronization protocol.","fun_headline_variants_meta":{"raw":{"variants":["Token tweak hides more data and defeats detectors","Re-weighting token odds improves stego stealth and payload","15% more hidden data via smarter token sampling","Plug-in improves stego imperceptibility and capacity","Token-frequency fix boosts stego realism and rate"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000266,"raw_usage":{"total_tokens":1663,"prompt_tokens":1053,"completion_tokens":610,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":669,"completion_tokens_details":{"reasoning_tokens":536}},"tokens_in":669,"tokens_out":610,"duration_ms":6735,"temperature":1.0,"reasoning_tokens":536,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T00:00:40.741787+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Encode a known bitstring with one snapshot of the target-domain corpus $D$, then decode the same stegotext after adding 100 new sentences to $D$ while keeping the key, model, prompt, and $M$ fixed. If the recovered bits differ from the original message, the paper's correctness requirement (Equation 3) fails under corpus drift, which is exactly the real-world condition the method is meant to address.","supporting_citations":[{"cited_title":"Meteor: Cryptographically secure steganography for realistic distributions,","cited_arxiv_id":null,"evidence_quote":"Defines METEOR, the provably secure one-step arithmetic-coding baseline that FreStega is plugged into and evaluated against."},{"cited_title":"Discop: Provably secure steganography in practice based on “distribution copies","cited_arxiv_id":null,"evidence_quote":"Defines DISCOP, the distribution-copy baseline whose sharpened distributions and detection rates motivate the reformation."},{"cited_title":"Provably secure generative linguistic steganography,","cited_arxiv_id":null,"evidence_quote":"Defines ADG, the balanced-grouping distribution-preserving algorithm used as a baseline and integration target."},{"cited_title":"Fremax: A simple method towards truly secure generative linguistic steganography,","cited_arxiv_id":null,"evidence_quote":"The authors' earlier FreMax work provided the preliminary spatial-adjustment idea that FreStega extends."},{"cited_title":"Evaluating distributional distortion in neural language modeling,","cited_arxiv_id":null,"evidence_quote":"Documents the distributional distortion in neural language-model token predictions, which is the bias FreStega's spatial alignment corrects."},{"cited_title":"Co-stega: Collaborative linguistic steganography for the low capacity challenge in social media,","cited_arxiv_id":null,"evidence_quote":"Identifies the low-entropy and low-capacity problem of LLM-based steganography that sequential adjustment targets."},{"cited_title":"Mauve: Measuring the gap between neural text and human text using divergence frontiers,","cited_arxiv_id":null,"evidence_quote":"Supplies the MAUVE divergence metric used to measure stego-text alignment with the target-domain human corpus."}],"review_version":1}