Pith. sign in

REVIEW 5 major objections 6 minor 1 cited by

A Plug-and-Play Method for Improving Imperceptibility and Capacity in Practical Generative Text Steganography

T0 review · 5 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read FreStega reshapes a language model's token probabilities at decoding time so stego text mimics target-domain covers, cutting steganalysis F1 and raising embedding capacity by about 15.41%.

desk verdict Real empirical gains in decoding-time stego distribution reformation, but the paper never verifies that Bob can decode after the reform—that missing correctness check is the thing a referee must push on. read the letter →

arxiv 2412.19652 v5 pith:3QO2K7JL submitted 2024-12-27 cs.CR

Kaiyi Pang This is my paper · ORCID
classification cs.CR
keywords FreStegagenerativetextsteganographydistributionreformationsteganalysisembeddingcapacitytarget-domainalignmentdecoding-timeadjustmentlanguagemodelsharpening
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Generative text steganography hides secret bits in the tokens a language model chooses, and current algorithms aim to make the embedding process statistically indistinguishable from ordinary random sampling from that model. FreStega argues this is the wrong target in practice: language-model distributions drift from real human text in a given domain and are too sharply peaked, so the resulting secret-bearing text is easy for trained detectors to flag and carries little payload. The paper proposes a plug-and-play distribution-reformation module that runs at decoding time, before any existing steganography sampler, and reshapes the model's next-token probabilities in two ways: an entropy-driven temperature adjustment that softens overconfidence, and a corpus-guided rescaling that pushes token probabilities toward their frequencies in target-domain covers. The claim is that with FreStega attached, existing algorithms (ADG, METEOR, DISCOP, arithmetic coding) produce stego text that resists steganalysis, avoids AI-generated-text detectors, and embeds about 15.41% more bits per token, with no meaningful loss of fluency.

What carries the argument

The load-bearing object is the distribution-reformation function applied to logits before the steganography algorithm samples. Sequential reform uses the entropy of the current predicted distribution to set a temperature: $E_t = -\sum_k p(w_k|x_{0:t-1})\log p(w_k|x_{0:t-1})$ and $TP_t = 1 + \theta \log_2(1+cE_t)$, with logits divided by $TP_t$. Spatial reform computes a static n-gram frequency ratio $F(w;D,M) = \log(2 + [f(w;D)/f(w;M)]^\alpha)$ and multiplies the sequentially reformed logits by it, where $D$ is the target-domain corpus and $M$ is a corpus generated by the same language model. The combined reformed distribution $p_{RF}(w_k|x_{0:t-1})$ is what the unmodified steganographic sampler uses, so the method is a plug-in that changes only the channel distribution, not the embedding algorithm. This two-step reformation is what carries the entire argument: it raises conditional entropy, which increases capacity, while bending the marginal token distribution toward the target domain, which increases imperceptibility.

What would settle it

Encode a known bitstring with one snapshot of the target-domain corpus $D$, then decode the same stegotext after adding 100 new sentences to $D$ while keeping the key, model, prompt, and $M$ fixed. If the recovered bits differ from the original message, the paper's correctness requirement (Equation 3) fails under corpus drift, which is exactly the real-world condition the method is meant to address.

Watch

Extended reading notes

Core claim

The central claim is that imperceptibility and capacity in generative linguistic steganography are properties not of the steganography algorithm alone but of the distribution fed to it, so the language model's raw distribution should be reconstructed before sampling. FreStega does this with two adjustments to the logits at each autoregressive step: sequential adjustment sets a per-token temperature $TP_t = 1 + \theta \log_2(1 + c E_t)$ based on instantaneous entropy $E_t$, counteracting LLM distribution sharpening and raising entropy; spatial adjustment multiplies each token's logits by $F(w;D,M) = \log(2 + [f(w;D)/f(w;M)]^\alpha)$, the log ratio of token frequency in the target-domain corpus $D$ to frequency in the model-generated corpus $M$, boosting the tokens real covers would use. The reformed distribution $p_{RF}$ is then handed to the unchanged steganography sampler. Across four LLMs and three datasets, the paper reports that the reform reduces steganalysis F1 scores relative to unmodified baselines, raises MAUVE alignment with human covers, increases diversity, and increases embedding rate by 15.41% on average, while perplexity stays roughly flat.

Load-bearing premise

Bob must be able to reproduce, bit-for-bit, the same reformed distribution Alice used, which means both sides must share the same target-domain corpus $D$ and the same model-generated corpus $M$ and must never let either drift; the paper assumes this sharing but does not provide or test a synchronization protocol.

Editorial extensions

If this is right

  • Attaching FreStega to ADG, METEOR, DISCOP, or arithmetic coding changes only the sampling distribution; no retraining or modification of the embedding algorithm is needed.
  • Stego text becomes harder for steganalysis classifiers (TS-CSW, TS-RNN, R-BiLSTM-C) and for Fast-DetectGPT to separate from human cover text in IMDB, Shakespeare, and XHS domains.
  • Embedding rate rises relative to the unmodified baseline in every reported configuration, by about 10–21% depending on dataset and about 15.41% on average, because the entropy-driven temperature softens the LLM's too-peaked distribution.
  • Only around 100 target-domain samples are sufficient for spatial alignment, and the sequential adjustment works even with no target-domain text at all.
  • The method composes with prompt-based generation and LoRA fine-tuning rather than competing with them.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because both Alice and Bob need identical frequency tables for $D$ and $M$, the target-domain corpus effectively becomes part of the shared secret; an active adversary who can cause one side to update its corpus could break extraction, and the paper does not specify a synchronization protocol.
  • Applying FreStega changes the distribution that the steganography sampler guarantees to match, so the provable-security statements of ADG, METEOR, and DISCOP now apply to the reformed distribution rather than the raw language model; a separate proof or a refined security definition would be needed.
  • The spatial alignment signal is a token-frequency marginal, and the same plug-in geometry could be tested on other marginals such as sentiment, topic, or style tokens, which the paper itself notes as possible.
  • A natural extension is to treat the shared corpus as a steganographic key whose diversity contributes to the overall security budget, since a larger or more specific corpus gives better cover alignment but also a larger synchronization burden.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes FreStega, a decoding-time distribution reformation method for generative linguistic steganography. FreStega modifies the language model's next-token distribution in two steps: a sequential adjustment that changes temperature according to instantaneous entropy (Eq. 13) and a spatial adjustment that rescales logits by the ratio of n-gram frequencies in a target-domain corpus D and a model-generated corpus M (Eqs. 16-17). The reformed distribution is then fed unchanged into existing steganographic sampling algorithms such as AC, ADG, METEOR, and DISCOP. Experiments across four LLMs, three datasets, and four baselines report higher MAUVE scores, lower steganalysis F1 scores, increased embedding rates (about 15.41% relative), and no meaningful loss of fluency or generation speed.

Significance. If the claims hold, FreStega addresses a real and timely gap: distribution-preserving steganography can be secure with respect to an LM distribution while still being easily distinguishable from real human text in a target domain. The paper is empirically broad, with a released code/data link, multiple LLMs and datasets, three steganalysis detectors, AIGT detection, compatibility studies, ablations, hyperparameter analyses, and time-efficiency measurements. These are real strengths. The main weakness is that the paper never verifies the round-trip correctness of the scheme: Bob must reconstruct exactly the same reformed distribution as Alice, which requires byte-identical shared copies of D and M, yet no synchronization protocol or bit-error-rate measurement is reported. In addition, the imperceptibility evaluation is partly by construction because the same target corpus is used for alignment and for computing MAUVE/training detectors. These issues are fixable, but they are load-bearing for the central plug-and-play claim.

major comments (5)
  1. [Section III-A, Eq. (3); Algorithm 1] The correctness condition in Eq. (3) requires Bob to reconstruct exactly the distribution Alice used. In FreStega that distribution depends, through F(w; D, M) in Eqs. (16)-(17), on the target-domain corpus D and the model-generated corpus M. However, the formal Encode/Decode interface in Eqs. (1)-(2) lists only K, M, H, and IE as shared inputs, and Algorithm 1 simply takes D and M as inputs without describing how both parties obtain byte-identical copies. Section IV-D1 even discusses dynamically updating D after preprocessing; any update that is not identically synchronized on Bob's side changes F and makes bit extraction fail. The paper reports no decoding accuracy or bit-error-rate results, even under the ideal exact-sharing assumption. The experiments in Tables I-III compute embedding rates and imperceptibility from the encoding process, but they never run the Decode routine, so the central correctness requirement of a steganographic system is unverified. This is the main blocker for the plug-and-play claim and should be addressed with either a synchronization protocol plus BER measurements or an explicit statement that FreStega assumes a static, pre-shared D and M.
  2. [Section III-B, Eq. (9)] The Taylor expansion in Eq. (9) is not correct as written. For pS = pM + epsilon, the first-order term in an expansion of D_KL(pE || pS) should involve the derivative with respect to epsilon evaluated at epsilon = 0 (a linear functional of epsilon), not the expression 'epsilon * grad D_KL(pS || pM)' with respect to the arguments shown. The two KL divergences have different reference distributions, and D_KL(pS || pM) is minimized at epsilon = 0, so the displayed first-order term has the wrong argument and sign structure. The qualitative conclusion that aligning pM toward pE can reduce D_KL(pE || pS) may still be plausible, but this equation does not demonstrate it. Please replace Eq. (9) with a correct expansion or remove the formal claim and argue the point directly.
  3. [Section IV-A2, Section IV-B3, Section IV-C1] The imperceptibility evaluation is partly circular. Section IV-A2 states that the entire target-domain corpus is used for spatial alignment, and Section IV-B3 computes MAUVE against the same corpus and trains the steganalysis detectors on the same corpus. Because FreStega explicitly matches token-frequency statistics to that corpus, the large MAUVE and F1 improvements in Tables I-III are expected by construction. The data-quantity experiments in Section IV-H are a step in the right direction, but they still evaluate against the same target corpus. To support the claim of improved practical imperceptibility, the paper should report results with disjoint alignment and evaluation sets (for example, align on 100-500 samples and evaluate MAUVE/detector F1 on a held-out portion of the human corpus), or at minimum quantify how much of the reported gain depends on the evaluation corpus being identical to the alignment corpus.
  4. [Table III and Section IV-C3] Table III appears to contain column-order errors for the LLAMA2 Shakespeare block. The row 'ADG[4] w/o' reads ER 8.76 / MAU 0.27, and the row 'METEOR[5] w/' reads ER 21.99 / MAU 0.21, whereas all neighboring rows in the same block have ER values well below 1 and MAU values around 8-25. If, as it appears, the ER and MAU columns are interchanged in these two rows, then the corrected METEOR w/ embedding rate is 0.21, which is below the baseline METEOR w/o value of 0.28. That would contradict the statement in Section IV-C3 that FreStega 'consistently and reliably increases the embedding rate across all scenarios.' Please verify the table and either correct the entries or qualify the capacity claim to acknowledge the exception.
  5. [Section II and Section III-C] The paper should clarify what happens to the provable-security guarantees of the base schemes when FreStega is applied. ADG, METEOR, and DISCOP are described as provably secure with respect to the original language-model distribution pM. FreStega deliberately replaces pM with a reformed distribution, so the resulting stego channel is not distribution-preserving with respect to pM. The paper does not discuss this trade-off or evaluate an adversary who knows M and can compare stego text against pM. Since the method is advertised as plug-and-play with provably secure baselines, the authors should state explicitly which distribution the base algorithm is secure with respect to after reformation and discuss the implications for a model-aware adversary.
minor comments (6)
  1. [Section III-D, Eq. (13)] The text after Eq. (13) says the temperature adjustment range is bounded within '[0, 0.01 * log2(...)]', but T_Pt is defined as 1 + theta * log2(1 + c * E_t), so the range is [1, 1 + 0.01 * log2(...)]. Please correct the lower endpoint.
  2. [Section III-E, Eq. (17)] The n-gram order n is never specified in the experiments or in Algorithm 1. Since F(w; D, M) depends on the choice of n, and since Bob needs the same F for decoding, please state the default n used in Tables I-III and in the hyperparameter analyses.
  3. [Notation throughout] The symbol M is overloaded: in Eqs. (1)-(3) M denotes the language model, while Algorithm 1 uses M for the model-generated corpus. This is confusing in a paper whose correctness depends on both objects. Please use distinct symbols for the LM and the corpus, e.g., LM and Corr_M.
  4. [Section IV-C3 and Abstract] The abstract reports a 15.41% capacity increase, while Section IV-C3 reports per-dataset relative increases of 20.65%, 10.07%, and 15.94%. Please state how 15.41% is computed (e.g., unweighted average over the three datasets or over all configurations) so the headline number is reproducible.
  5. [Tables and typos] Table XI contains the typo 'Traninable params' (should be 'Trainable params'), and in Table XIII the label 'w.' should be 'w/' for consistency with the other tables. These are minor but should be fixed in the final version.
  6. [Appendix VI-A, Eq. (24)] The proof of Lemma 1 in the appendix appears to contain a minor sign issue: the displayed bound for log(1 + (q-p)/p) is written with an inequality that does not match the derivation in the surrounding text. Please check the algebra and ensure the stated inequality follows from the given cases.

Circularity Check

1 steps flagged · score 4.0 of 10

MAUVE and steganalysis-F1 gains are partially in-sample because the target corpus used for spatial alignment is the same corpus used as the evaluation reference; otherwise the derivation is self-contained.

  1. fitted input called prediction [Section III-E (Eq. 16-17), Section IV-B3 (Eq. 20-21), Section IV-A2]
    "LRFs (wk|x0:t−1) = F (wk; D, M ) · LRFt (·), where F (w; D, M ) = log(2 + [ f (w; D)/f (w; M ) ]α). ... In the main experiment, we used the entire target domain for alignment ... We employ the MAUVE [53] metric to evaluate how closely the probability distribution of the generated stegotext aligns with that of the target domain human text ... MAUVE(Dstego, Dcover) = AUC(C(Dstego, Dcover))."

    The spatial adjustment takes the target-domain corpus D as an input and explicitly reshapes token probabilities toward D's token frequencies (Eq. 16-17). The headline imperceptibility metric, MAUVE, is computed between the generated stegotext and Dcover, and in the main experiment Dcover is the same entire target domain D used for alignment. The reported MAUVE improvement is therefore partly the objective of the adjustment measured against its own input corpus, rather than an independent out-of-sample evaluation. The steganalysis F1 detectors are also trained and tested on the same D, so their improvement is in-sample as well.

full rationale

FreStega's core derivation is not circular: the sequential adjustment is a fixed entropy-dependent temperature function, and the spatial adjustment is a token-frequency ratio applied at decoding time; neither is derived from the reported metrics. The capacity gain follows from the deliberate temperature increase but is still measured through actual steganographic embedding rates, and the quality preservation is an independent PPL/diversity check. The main circularity concern is evaluation: the target corpus D is an input to the spatial adjustment and is also the reference for MAUVE and the training corpus for the steganalysis detectors in the main experiment, so the imperceptibility measurements on D are partially in-sample. This does not fully determine the results because MAUVE operates in an embedding space and learned detectors could exploit other features, and the Fast-DetectGPT results provide an external check. No load-bearing self-citation or uniqueness theorem is involved. The absence of bit-error-rate validation under the shared-corpus assumption is a correctness risk, not a circularity.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The method relies on three empirically grounded assumptions about language model bias and corpus statistics, plus a mathematically questionable approximation used for motivation. The only tuned quantities are the hyperparameters theta, c, alpha, and the hidden n-gram order. No new physical or conceptual entities are introduced.

free parameters (4)
  • theta (sequential scaling factor) = 0.01
    Fixed by hand as the scaling factor in the temperature adjustment function TP_t = 1 + theta * log2(1 + c * E_t). No sensitivity analysis is provided for theta in the main text.
  • c (sequential adjustment intensity) = 0.1
    Empirically set in Section IV-G and Figure 10. The paper says 'we empirically set c = 0.1 to improve embedding capacity while maintaining imperceptibility.' This is a tuning choice made on the same datasets used for evaluation.
  • alpha (spatial alignment intensity) = 0.1
    Empirically set in Section IV-G and Figure 9. The paper says 'Empirically, alpha = 0.1 generally works well.' Grid search is suggested but not used for the main results.
  • n-gram order in spatial adjustment = 1 (implied)
    Algorithm 1 counts token frequencies, implying unigram statistics, but Eq. (17) refers to 'static n-gram frequency of sequence w'. The order n is never specified explicitly in the main text, leaving an ambiguity that affects the implemented frequency model.
assumptions (4)
  • domain assumption The token frequency distribution of the target corpus approximates the true distribution of the target environment.
    Invoked in Section III-A and III-E: 'The distribution of IE serves as an approximation of the broader distribution of E, a foundational assumption in statistical language processing.'
  • domain assumption Language model predictive distributions overestimate frequent tokens and underestimate rare tokens, producing a systematic bias relative to human text.
    Used to justify spatial adjustment, with references to [30,31]. This is an empirical claim about LM behavior, not a theorem, and the method relies on it being true for the tested models.
  • domain assumption Applying a distribution-preserving steganography algorithm to the reformed distribution preserves the stego sampling distribution equal to that reformed distribution, maintaining the security definition with respect to the reformed model.
    The paper assumes that stego algorithms like METEOR and DISCOP, when given the adjusted distribution PRF, sample exactly according to PRF. This is true by the definition of those algorithms, but the security guarantee is then with respect to the reformed distribution, not the original model distribution.
  • ad hoc to paper The Taylor expansion in Eq. (9) accurately approximates D_KL(pE||pS) near pM.
    The expansion as written appears to mix gradients of D_KL(pS||pM) into an expansion of D_KL(pE||pS). The paper uses the expansion purely as motivation, but the mathematical inconsistency is not flagged.

how reviews work

0 comments
Cite this review

Pith. "Pith review of A Plug-and-Play Method for Improving Imperceptibility and Capacity in Practical Generative Text Steganography." pith.science (2026). https://pith.science/paper/3QO2K7JL

@misc{pith2026241219652,
  author       = {Pith},
  title        = {Pith review of: A Plug-and-Play Method for Improving Imperceptibility and Capacity in Practical Generative Text Steganography},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3QO2K7JL}},
  note         = {Machine review of arXiv:2412.19652}
}
read the original abstract

Linguistic steganography embeds secret information into seemingly innocuous text to safeguard privacy under surveillance. Generative linguistic steganography leverages the probability distributions of language models (LMs) and applies steganographic algorithms during generation, and has attracted increasing attention with the rise of large language models (LLMs). To strengthen security, prior work has focused on distribution-preserving steganographic algorithms that minimize the gap between stego sampling and random sampling from the model. However, their reliance on model distributions, which often deviate from real-world cover texts, leads to limited imperceptibility when facing steganalysis detectors in practical settings. Moreover, LLM distributions tend to be more deterministic, reducing entropy and thus lowering embedding capacity. In this paper, we propose a plug-and-play method that reconstructs the distributions of language models used for generative linguistic steganography. FreStega dynamically adjusts token probabilities from the language model at each step of autoregressive stego text generation, leveraging both sequential and spatial dimensions. Extensive experiments on four LLMs, three benchmark datasets, and four distribution-preserving steganographic baselines demonstrate that, by reforming the distribution, FreStega improves the imperceptibility of stego text in realistic scenarios and increases steganographic capacity by 15.41\%, without degrading the quality of the generated stegotext.

Figures

Figures reproduced from arXiv: 2412.19652 by the authors.

Figure 1
Figure 1. Generative Linguistic Steganography Framework: Alice and Bob [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Word frequency distribution comparison between text generated by state-of-the-art distribution-preserving algorithms (METEOR [5], ADG [4], [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. F1 classification scores of state-of-the-art steganography methods (ADG [4], METEOR [5], DISCOP [6]) against classic steganalysis classifiers (TS-CSW [17], TS-RNN [18], and R-BiLSTM-C [19]) on the IMDB [16] and SHAKESPEARE [20] in real-world scenarios. The gap is mainly caused by the mismatch between the distribution used for steganography and the real-world cover text distribution. This issue is especially evident … view at source ↗
Figures from the paper (9 more)
Figure 4
Figure 4. Figure 4: Overview of FreStega: We first adjust the temperature at each time [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Average Amortized Time per Inference using QWEN2 0.1 0.3 0.5 0.7 0.9 top P 0.0 0.2 0.4 0.6 0.8 1.0 MAUVE 0.0 0.1 0.2 0.3 0.4 0.5 top K=10 0.1 0.3 0.5 0.7 0.9 top P 0.0 0.2 0.4 0.6 0.8 1.0 0.0 0.2 0.4 0.6 0.8 top K=100 0.1 0.3 0.5 0.7 0.9 top P 0.0 0.2 0.4 0.6 0.8 1.0 0…
Figure 6
Figure 6. Figure 6 [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]
Figure 7
Figure 7. Figure 7: Top-p and Top-k performance on MAUVE and Embedding Rate (ER) using Qwen-METEOR TABLE VII PREPROCESSING TIME AND MEMORY USAGE REQUIRED DURING TARGET DOMAIN DATASET UPDATES Dataset New data points New Tokens Total Processing Memory Overhead Time (ms) (MB) XHS 25 7634 0.1…
Figure 9
Figure 9. Figure 9: Hyperparameter analysis of α (c=0.1). We tested the F1 scores of classifiers on three datasets (XHS, SHAKESPEARE, IMDB) using three classic steganalysis methods (TS-CSW [17], TS-RNN [18], TS-r-bilistm-c [19]). The corresponding colored horizontal lines indicate the F1 …
Figure 10
Figure 10. Figure 10: Hyperparameter analysis of c (α=0.1). We tested the F1 scores of classifiers on three datasets (XHS, SHAKESPEARE, IMDB) using three classic steganalysis methods (TS-CSW [17], TS-RNN [18], TS-r-bilistm-c [19]). The corresponding colored horizontal lines indicate the F1…
Figure 11
Figure 11. Figure 11: Heatmaps showing MAUVE scores under different (α, c) settings for RandomSampling, METEOR, DISCOP, and AC on XHS. model, which is particularly effective when the target corpus, such as XHS, exhibits high diversity. V. CONCLUSION We propose a plug-and-play probability d…
Figure 12
Figure 12. Figure 12: The effect of the number of target domain texts used for alignment on Q [PITH_FULL_IMAGE:figures/full_fig_p016_12.png]
Figure 13
Figure 13. Figure 13: The effect of the number of target domain texts used for alignment on C [PITH_FULL_IMAGE:figures/full_fig_p016_13.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Relatively-Secure LLM-Based Steganography via Constrained Markov Decision Processes

    cs.IT 2025-02 conditional novelty 6.0 of 10

    The optimal modification of a two-state LLM-like token distribution for maximum steganographic capacity under a divergence budget is a deterministic, piecewise water-filling policy.

Reference graph

Works this paper leans on

58 extracted references · 47 canonical work pages · cited by 1 Pith paper

  1. [4]

    Provably secure generative linguistic steganography,

    S. Zhang, Z. Yang, J. Yang, and Y . Huang, “Provably secure generative linguistic steganography,” inFindings of the Association for Computational Linguistics: ACL- IJCNLP 2021, 2021, pp. 3046–3055

    work page 2021

  2. [5]

    Meteor: Cryptographically secure steganography for realistic distributions,

    G. Kaptchuk, T. M. Jois, M. Green, and A. D. Rubin, “Meteor: Cryptographically secure steganography for realistic distributions,” in Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security , ser. CCS ’21. New York, NY , USA: Association for Computing Machinery, 2021, p. 1529–1548

    work page 2021

  3. [1]

    Tor: The secondgeneration onion router,

    P. Syverson, R. Dingledine, and N. Mathewson, “Tor: The secondgeneration onion router,” in Usenix Security. USENIX Association Berkeley, CA, 2004, pp. 303– 320

    work page 2004

  4. [2]

    Provably secure robust image steganography,

    Z. Yang, K. Chen, K. Zeng, W. Zhang, and N. Yu, “Provably secure robust image steganography,” IEEE Transactions on Multimedia , 2023

    work page 2023

  5. [3]

    Audio steganography using bit modification,

    K. Gopalan, “Audio steganography using bit modification,” in 2003 International Conference on Multimedia and Expo. ICME’03. Proceedings (Cat. No. 03TH8698), vol. 1. IEEE, 2003, pp. I–629

    work page 2003

  6. [6]

    Discop: Provably secure steganography in practice based on “distribution copies

    J. Ding, K. Chen, Y . Wang, N. Zhao, W. Zhang, and N. Yu, “Discop: Provably secure steganography in practice based on “distribution copies”,” in 2023 IEEE Symposium on Security and Privacy (SP) . IEEE Computer Society, 2023, pp. 2238–2255

    work page 2023

  7. [7]

    A linguistic steganography based on word indexing compression and candidate selection,

    L. Xiang, W. Wu, X. Li, and C. Yang, “A linguistic steganography based on word indexing compression and candidate selection,” Multimedia Tools and Applications, vol. 77, pp. 28 969–28 989, 2018

    work page 2018

  8. [8]

    Neural linguistic steganography,

    Z. Ziegler, Y . Deng, and A. M. Rush, “Neural linguistic steganography,” in Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), 2019, pp. 1210–1215

    2019

Show all 58 references
  1. [9]

    Linguistic steganalysis toward social network,

    J. Yang, Z. Yang, J. Zou, H. Tu, and Y . Huang, “Linguistic steganalysis toward social network,” IEEE Transactions on Information Forensics and Security, vol. 18, pp. 859–871, 2022

    2022

  2. [10]

    Linguistic steganalysis in few- shot scenario,

    H. Wang, Z. Yang, J. Yang, C. Chen, and Y . Huang, “Linguistic steganalysis in few- shot scenario,” IEEE Transactions on Information Forensics and Security , 2023

    2023

  3. [11]

    Adaptive domain-invariant feature extraction for cross-domain linguistic steganalysis,

    Y . Xue, J. Wu, R. Ji, P. Zhong, J. Wen, and W. Peng, “Adaptive domain-invariant feature extraction for cross-domain linguistic steganalysis,” IEEE Transactions on Information Forensics and Security , 2023

    2023

  4. [12]

    Qwen technical report,

    J. Bai, S. Bai, and Y . C. et. al, “Qwen technical report,” arXiv preprint arXiv:2309.16609, 2023

    2023 arXiv

  5. [13]

    Mistral 7b,

    A. Q. Jiang, A. Sablayrolles, A. Mensch, C. Bamford, D. S. Chaplot, D. d. l. Casas, F. Bressand, G. Lengyel, G. Lample, L. Saulnier, et al., “Mistral 7b,” arXiv preprint arXiv:2310.06825, 2023

    2023 arXiv

  6. [14]

    Llama 2: Open foundation and fine-tuned chat models,

    H. Touvron, L. Martin, K. Stone, P. Albert, A. Almahairi, Y . Babaei, N. Bashlykov, S. Batra, P. Bhargava, S. Bhosale, et al., “Llama 2: Open foundation and fine-tuned chat models,” arXiv preprint arXiv:2307.09288 , 2023

    2023 arXiv

  7. [15]

    The llama 3 herd of models,

    A. Dubey, A. Jauhri, A. Pandey, A. Kadian, A. Al-Dahle, A. Letman, A. Mathur, A. Schelten, A. Yang, A. Fan, et al., “The llama 3 herd of models,” arXiv preprint arXiv:2407.21783, 2024

    2024 arXiv

  8. [16]

    Learning word vectors for sentiment analysis,

    A. L. Maas, R. E. Daly, P. T. Pham, D. Huang, A. Ng, and C. Potts, “Learning word vectors for sentiment analysis,” in Annual Meeting of the Association for Computational Linguistics, 2011

    2011

  9. [17]

    Ts-csw: Text steganalysis and hidden capacity estimation based on convolutional sliding windows,

    Z. Yang, Y . Huang, and Y . Zhang, “Ts-csw: Text steganalysis and hidden capacity estimation based on convolutional sliding windows,” Multimedia Tools and Appli- cations, vol. 79, pp. 18 293–18 316, 2020

    2020

  10. [18]

    Ts-rnn: text steganalysis based on recurrent neural networks,

    Z. Yang, K. Wang, J. Li, Y . Huang, and Y .-J. Zhang, “Ts-rnn: text steganalysis based on recurrent neural networks,” IEEE Signal Processing Letters, vol. 26, no. 12, pp. 1743–1747, 2019

    2019

  11. [20]

    Shakespere dataset

    ayaan04. Shakespere dataset. Huggingface. [Online]. Available: https://hf .com/ datasets/ayaan04/shakespeare-text

  12. [21]

    Training a helpful and harmless assistant with reinforcement learning from human feedback,

    Y . Bai, A. Jones, K. Ndousse, A. Askell, A. Chen, N. DasSarma, D. Drain, S. Fort, D. Ganguli, T. Henighan, et al. , “Training a helpful and harmless assistant with reinforcement learning from human feedback,” arXiv preprint arXiv:2204.05862 , 2022

    2022 arXiv

  13. [22]

    Co-stega: Collaborative linguistic steganography for the low capacity challenge in social media,

    G. Liao, J. Yang, K. Pang, and Y . Huang, “Co-stega: Collaborative linguistic steganography for the low capacity challenge in social media,” in Proceedings of the 2024 ACM Workshop on Information Hiding and Multimedia Security , 2024, pp. 7–12

    2024

  14. [23]

    Fremax: A simple method towards truly secure generative linguistic steganography,

    K. Pang, M. Bai, J. Yang, H. Wang, M. Jiang, and Y . Huang, “Fremax: A simple method towards truly secure generative linguistic steganography,” in ICASSP 2024- 2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2024, pp. 4755–4759

    2024

  15. [24]

    Near-imperceptible neural linguistic steganography via self-adjusting arithmetic coding,

    J. Shen, H. Ji, and J. Han, “Near-imperceptible neural linguistic steganography via self-adjusting arithmetic coding,” in Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), 2020, pp. 303–313

    2020

  16. [25]

    N. J. Hopper, Toward a theory of Steganography . Carnegie Mellon University, 2004

    2004

  17. [26]

    Generating steganographic text with LSTMs,

    T. Fang, M. Jaggi, and K. Argyraki, “Generating steganographic text with LSTMs,” in Proceedings of ACL 2017, Student Research Workshop , A. Ettinger, S. Gella, M. Labeau, C. O. Alm, M. Carpuat, and M. Dredze, Eds. Vancouver, Canada: Association for Computational Linguistics, J...

    2017

  18. [27]

    Rnn-stega: Linguistic steganography based on recurrent neural networks,

    Z. Yang, X. Guo, Z. Chen, Y . Huang, and Y .-J. Zhang, “Rnn-stega: Linguistic steganography based on recurrent neural networks,” IEEE Transactions on Infor- mation Forensics and Security , 2018

    2018

  19. [28]

    Towards near-imperceptible steganographic text,

    F. Dai and Z. Cai, “Towards near-imperceptible steganographic text,” in Proceed- ings of the 57th Annual Meeting of the Association for Computational Linguistics . Florence, Italy: Association for Computational Linguistics, July 2019, pp. 4303– 4308

    2019

  20. [29]

    An effective linguistic steganal- ysis framework based on hierarchical mutual learning,

    Y . Xue, L. Kong, W. Peng, P. Zhong, and J. Wen, “An effective linguistic steganal- ysis framework based on hierarchical mutual learning,” Information Sciences, vol. 586, pp. 140–154, 2022

    2022

  21. [30]

    Evaluating distributional distortion in neural language modeling,

    B. LeBrun, A. Sordoni, and T. J. O’Donnell, “Evaluating distributional distortion in neural language modeling,” in International Conference on Learning Represen- tations, 2022

    2022

  22. [31]

    Tailoring language generation models under total variation distance,

    H. Ji, P. Ke, Z. Hu, R. Zhang, and M. Huang, “Tailoring language generation models under total variation distance,” in The Eleventh International Conference on Learning Representations , 2023

    2023

  23. [32]

    Mixce: Training autoregressive language models by mixing forward and reverse cross- entropies,

    S. Zhang, S. Wu, O. Irsoy, S. Lu, M. Bansal, M. Dredze, and D. Rosenberg, “Mixce: Training autoregressive language models by mixing forward and reverse cross- entropies,” in The 61st Annual Meeting Of The Association For Computational Linguistics, 2023

    2023

  24. [33]

    Predict the next word: <humans exhibit uncertainty in this task and language models >,

    E. Ilia and W. Aziz, “Predict the next word: <humans exhibit uncertainty in this task and language models >,” in Proceedings of the 18th Conference of the European Chapter of the Association for Computational Linguistics (Volume 2: Short Papers). St. Julian’s, Malta: Associati...

    2024

  25. [34]

    Manning and H

    C. Manning and H. Schutze, Foundations of statistical natural language processing. MIT press, 1999

    1999

  26. [35]

    Mention flags (MF): Constraining transformer-based text generators,

    Y . Wang, I. Wood, S. Wan, M. Dras, and M. Johnson, “Mention flags (MF): Constraining transformer-based text generators,” in Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International 16 25 50 100300500700100013001500 len...

    2021

  27. [36]

    Director: Generator-classifiers for supervised language modeling,

    K. Arora, K. Shuster, S. Sukhbaatar, and J. Weston, “Director: Generator-classifiers for supervised language modeling,” in Proceedings of the 2nd Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics and the 12th International Joint Conference...

    2022

  28. [37]

    Discup: Discriminator cooperative unlikelihood prompt- tuning for controllable text generation,

    H. Zhang and D. Song, “Discup: Discriminator cooperative unlikelihood prompt- tuning for controllable text generation,” in Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing . Association for Computa- tional Linguistics, 2022, pp. 3392–3406

    2022

  29. [38]

    Prefix-tuning: Optimizing continuous prompts for gen- eration,

    X. L. Li and P. Liang, “Prefix-tuning: Optimizing continuous prompts for gen- eration,” in Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing, 2021, pp. 4582–4597

    2021

  30. [39]

    Autoprompt: Eliciting knowledge from language models with automatically generated prompts,

    T. Shin, Y . Razeghi, R. L. Logan IV , E. Wallace, and S. Singh, “Autoprompt: Eliciting knowledge from language models with automatically generated prompts,” in Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP). Association for Comp...

    2020

  31. [40]

    Controlled text generation with natural language instructions,

    W. Zhou, Y . E. Jiang, E. Wilcox, R. Cotterell, and M. Sachan, “Controlled text generation with natural language instructions,” in International Conference on Machine Learning. PMLR, 2023, pp. 42 602–42 613

    2023

  32. [41]

    LoRA: Low-rank adaptation of large language models,

    E. J. Hu, Y . Shen, P. Wallis, Z. Allen-Zhu, Y . Li, S. Wang, L. Wang, and W. Chen, “LoRA: Low-rank adaptation of large language models,” in International Conference on Learning Representations , 2022

    2022

  33. [42]

    Training language models to follow instructions with human feed- back,

    O. L. et al., “Training language models to follow instructions with human feed- back,” in Proceedings of the 36th International Conference on Neural Information Processing Systems, 2024

    2024

  34. [43]

    Learning how to ask: Querying lms with mixtures of soft prompts,

    G. Qin and J. Eisner, “Learning how to ask: Querying lms with mixtures of soft prompts,” in Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (NAACL-HLT), 2021

    2021

  35. [44]

    Rewards-in- context: Multi-objective alignment of foundation models with dynamic preference adjustment,

    R. Yang, X. Pan, F. Luo, S. Qiu, H. Zhong, D. Yu, and J. Chen, “Rewards-in- context: Multi-objective alignment of foundation models with dynamic preference adjustment,” in Proceedings of the 41st International Conference on Machine Learning, ser. Proceedings of Machine Learnin...

    2024

  36. [45]

    Panacea: Pareto alignment via preference adaptation for llms,

    Y . Zhong, C. Ma, X. Zhang, Z. Yang, Q. Zhang, S. Qi, and Y . Yang, “Panacea: Pareto alignment via preference adaptation for llms,” Advances in Neural Informa- tion Processing Systems , vol. 36, 2024

    2024

  37. [46]

    Plug and play language models: A simple approach to controlled text generation,

    S. Dathathri, A. Madotto, J. Lan, J. Hung, E. Frank, P. Molino, J. Yosinski, and R. Liu, “Plug and play language models: A simple approach to controlled text generation,” in International Conference on Learning Representations , 2019

    2019

  38. [47]

    Gedi: Generative discriminator guided sequence generation,

    B. Krause, A. D. Gotmare, B. McCann, N. S. Keskar, S. R. Joty, R. Socher, and N. Rajani, “Gedi: Generative discriminator guided sequence generation,” in Conference on Empirical Methods in Natural Language Processing , 2020

    2020

  39. [48]

    FUDGE: controlled text generation with future discrimi- nators,

    K. Yang and D. Klein, “FUDGE: controlled text generation with future discrimi- nators,” in Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, NAACL-HLT 2021, Online, June 6-11, 2021 . ...

    2021

  40. [49]

    Minimizing distortion in steganography via adaptive language model tuning,

    C. Chen, J. Yang, Y . Gao, H. Wang, and Y . Huang, “Minimizing distortion in steganography via adaptive language model tuning,” in International Conference on Neural Information Processing . Springer, 2023, pp. 571–584

    2023

  41. [50]

    A mathematical theory of communication,

    C. E. Shannon, “A mathematical theory of communication,” The Bell system technical journal, vol. 27, no. 3, pp. 379–423, 1948

    1948

  42. [51]

    Coig-cqia: Quality is all you need for chinese instruction fine-tuning,

    Y . B. et al., “Coig-cqia: Quality is all you need for chinese instruction fine-tuning,” CoRR, vol. abs/2403.18058, 2024

    2024 arXiv

  43. [52]

    Glm: General language model pretraining with autoregressive blank infilling,

    Z. Du, Y . Qian, X. Liu, M. Ding, J. Qiu, Z. Yang, and J. Tang, “Glm: General language model pretraining with autoregressive blank infilling,” in Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 2022, pp. 320–335

    2022

  44. [53]

    Mauve: Measuring the gap between neural text and human text using divergence frontiers,

    K. Pillutla, S. Swayamdipta, R. Zellers, J. Thickstun, S. Welleck, Y . Choi, and Z. Harchaoui, “Mauve: Measuring the gap between neural text and human text using divergence frontiers,” Advances in Neural Information Processing Systems , vol. 34, pp. 4816–4828, 2021

    2021

  45. [54]

    A hybrid r-bilstm-c neural network based text steganalysis,

    Y . Niu, J. Wen, P. Zhong, and Y . Xue, “A hybrid r-bilstm-c neural network based text steganalysis,” IEEE Signal Processing Letters, vol. 26, no. 12, pp. 1907–1911, 2019

    1907

  46. [55]

    Pre-train, prompt, and predict: A systematic survey of prompting methods in natural language processing,

    P. Liu, W. Yuan, J. Fu, Z. Jiang, H. Hayashi, and G. Neubig, “Pre-train, prompt, and predict: A systematic survey of prompting methods in natural language processing,” ACM Computing Surveys , vol. 55, no. 9, jan 2023

    2023

  47. [56]

    Fast-detectgpt: Efficient zero- shot detection of machine-generated text via conditional probability curvature,

    G. Bao, Y . Zhao, Z. Teng, L. Yang, and Y . Zhang, “Fast-detectgpt: Efficient zero- shot detection of machine-generated text via conditional probability curvature,” in ICLR, 2024

    2024

  48. [57]

    Zero-shot generative linguistic steganog- raphy,

    K. Lin, Y . Luo, Z. Zhang, and L. Ping, “Zero-shot generative linguistic steganog- raphy,” in Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics , K. Duh, H. Gomez, and S. Bethard, Eds. Association for Computationa...

    2024

  49. [58]

    Random search for hyper-parameter optimization,

    J. Bergstra and Y . Bengio, “Random search for hyper-parameter optimization,” Journal of Machine Learning Research , vol. 13, no. 10, pp. 281–305, 2012

    2012

  50. [59]

    Practical bayesian optimization of machine learning algorithms,

    J. Snoek, H. Larochelle, and R. P. Adams, “Practical bayesian optimization of machine learning algorithms,” Advances in neural information processing systems , vol. 25, 2012. 17 VI. A PPENDIX A. KL divergence of the non-distribution-preserving algorithm If the noise introduced...

    2012

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.