Pith. sign in

REVIEW 3 major objections 4 minor 48 references

Addressing Tokenization Inconsistency in Steganography and Watermarking Based on Large Language Models

T0 review · 3 major / 4 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that inconsistent tokens are infrequent and temporary, and that removing candidate tokens that fail a one-step detokenize-retokenize check guarantees 100-percent steganographic extraction and more reliable watermark detecti

desk verdict Useful empirical study of tokenization inconsistency with two practical fixes, but the steganography guarantee has a proof gap in the fallback branch. read the letter →

arxiv 2508.20718 v1 pith:LRII3UMY submitted 2025-08-28 cs.CL

Ruiyi Yan , Yugo Murawaki This is my paper
classification cs.CL
keywords tokenizationinconsistencysteganographywatermarkingLLM-generatedtextcandidatetokenfilteringdetokenize-retokenizepost-hocrollbacksubwordtokenizers
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

LLM-based steganography and watermarking both assume the sender's token list survives transmission, but detokenization and then retokenization of the transmitted text often changes token boundaries. This paper argues that the resulting tokenization inconsistency comes from tokens that are rare in candidate pools and often only temporarily inconsistent, and that both properties can be exploited. For steganography, checking every candidate token with a one-step detokenize-retokenize comparison and deleting the mismatches is claimed to be sufficient to eliminate inconsistency, giving 100% correct extraction with better fluency, imperceptibility, and anti-steganalysis than prior disambiguation methods. For watermarking, a post-hoc rollback that waits through a short observation period and resamples only if inconsistency persists improves watermark strength, resilience to editing and paraphrase attacks, and perplexity. If correct, tokenizer mismatches in LLM-based covert channels and watermarks are fully removable at little cost, without the quadratic overhead of earlier disambiguation algorithms.

What carries the argument

The load-bearing device is Algorithm 1, a one-step consistency oracle: detokenize the candidate-extended history to text, retokenize that text, and compare the two token lists; inequality marks the candidate as a candidate-level inconsistent token. The paper couples this with a necessary-condition relation (no candidate-level IT output means no TI in the final output) and, in watermarking, an observation window q that converts temporariness into a rollback trigger. The infrequency of inconsistent tokens is what makes both methods cheap: filtering deletes only a small fraction of the candidate pool, so KL divergence from the original model stays small, and rollbacks are rare.

What would settle it

Take any stegotext produced by the stepwise verification method and retokenize it with a tokenizer that differs in one setting, such as keeping special tokens instead of skipping them or using a different normalization flag. If the retokenized sequence contains a token Alice's per-step check had accepted, the sufficiency claim fails and extraction will not be 100 percent. Repeating this full-text retokenization across tokenizer versions or settings and counting mismatches would settle the claim.

Watch

Extended reading notes

Core claim

Working token by token, the paper defines a candidate-level inconsistent token as any vocabulary item that, appended to the generated history, fails the check tokenize(detokenize(list)) = list. It argues by contradiction that outputting such a token is necessary for any final tokenization inconsistency to occur, so a candidate pool from which they have all been removed cannot produce an inconsistency at the receiver. The method applies this filter before steganographic encoding at both sender and receiver, guaranteeing identical token sequences and therefore 100% extraction. For watermarking, where per-token filtering is unnecessary, the paper exploits temporariness: most candidate-level inc

Load-bearing premise

The guarantee rests on the assumption that the sender's quick single-step detokenize-retokenize check, run with default tokenizer settings and special tokens skipped, produces exactly the same token list the receiver will get from the full transmitted text.

Editorial extensions

If this is right

  • Any LLM-based steganography pipeline that uses the same tokenizer as the receiver can be made TI-free by appending the stepwise filter; the 100%-extraction guarantee no longer depends on prefix-based disambiguation heuristics.
  • Because filtering is O(k) per step rather than O(k^2), higher-capacity top-k pools become practical, and arithmetic or Huffman coding can be run on the cleaned pools without synchronization loss.
  • Watermark detectors see higher watermark strength after rollback because inconsistent tokens distort token-level scores at positions where the watermark scheme's context or token assumption is violated.
  • Quality gains follow partly because retokenized inconsistent tokens carry very low model probabilities, so suppressing them removes high-perplexity tokens from the transmitted text.
  • The methods transfer across logit-based watermarks and sampling-based watermarks, so TI elimination is orthogonal to the specific watermarking scheme.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The sufficiency guarantee is only as strong as the tokenizer configuration; pinning the tokenizer version and special-token handling between sender and receiver is an implicit deployment requirement the paper does not state.
  • The same candidate-level check could be run on the tokenizer's vocabulary offline to identify and prune tokens that can never be emitted safely, potentially eliminating the per-step verification cost.
  • The observation-window idea transfers to any autoregressive system that must be reconstructible, such as extractive QA or instruction-data generation, where a rollback on persistent detokenization mismatch would enforce consistency.
  • Measuring the candidate-level inconsistency rate may serve as a cheap diagnostic of tokenizer-induced fragility, with whole-word-style tokenizers likely producing more candidate-level ITs.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper studies tokenization inconsistency (TI) between sender Alice and receiver Bob in LLM-based steganography and watermarking. It first empirically characterizes inconsistent tokens as infrequent and temporary, based on token-level and candidate-level measurements across Llama-2-7b, Swallow-7b, and Qwen2.5-7b in English, Japanese, and Chinese. It then proposes two methods: a stepwise verification method for steganography that filters candidate-level inconsistent tokens at each generation step, claiming 100% correct extraction; and a post-hoc rollback method for watermarking that rolls back generation when a stable TI is detected after a q-token observation period. Experiments compare against disambiguation baselines in steganography and TI-unaware watermarking schemes, reporting improvements in fluency, imperceptibility, anti-steganalysis capacity, and watermark detectability/robustness.

Significance. If the central guarantee holds, the stepwise verification method is a useful contribution: it attacks TI directly instead of bypassing the tokenizer, has linear complexity, and the reported KL-divergence reductions indicate smaller distribution distortion than prior disambiguation methods. The empirical characterization of inconsistent tokens across three languages/models is also a useful reference. The paper releases code, which supports reproducibility. However, the headline 100%-extraction guarantee is not rigorously established for the algorithm as written because of an unverified fallback branch, and the watermarking improvements, while plausible, are numerically small and not supported by significance tests or error bars in several cells. These issues are fixable but they affect the two main claims of the paper.

major comments (3)
  1. [Section 3.1, Algorithm 2 (Appendix C.1)] The 100%-extraction guarantee rests on Proposition 2: if no candidate-level IT is ever output, no final TI can occur. Algorithm 2, however, explicitly has a fallback branch (Lines 5–6) that, when the filtered candidate pool is empty, adds the highest-probability token from V\hat c(t) and labels it 'not an SIT' without running the Algorithm 1 consistency check. Nothing ensures this token is not a candidate-level IT. If it is, the antecedent of Proposition 2 is violated and the proof no longer applies. Appendix C.1 dismisses this as an error scenario of 'very small probability', but no probability bound or empirical count is provided. The algorithm should either verify tokens outside the original pool until a candidate-level-IT-free token is found, or the guarantee should be explicitly restricted to generations that never hit the fallback branch, with evidence about how often that occurs.
  2. [Section 4.2, Tables 8, 14, 15] The claim that the post-hoc rollback method 'enhances detectability and robustness' is not statistically supported. No error bars, confidence intervals, or significance tests are reported, despite 500 samples per cell. Several cells show the proposed method performing worse than the TI-unaware original: e.g., Table 8 Unigram unattacked AUROC drops from 0.998 to 0.995; Table 14 LeftHash attacked (epsilon=0.2) watermark strength drops from 5.18 to 5.13. The aggregate improvement percentages in the steganography experiments similarly average over cells where the method loses. The reader cannot tell whether the reported improvements are systematic or noise. Report per-cell variability and significance tests, or soften the claims accordingly.
  3. [Section 3.2 and Algorithm 4 (Appendix C.2)] The prose description says that after a stable TI is detected, 'the candidate pool is resampled, excluding that candidate-level IT'. Algorithm 4 does not implement this exclusion: Line 14 simply deletes the latest (q+1) historical tokens and generation resumes with no bookkeeping of the offending token. As written, the same candidate-level IT can be sampled again immediately, potentially causing repeated rollbacks or an infinite loop. The algorithm needs an explicit exclusion mechanism or a state variable that prevents the inconsistent token from being regenerated at the rolled-back position.
minor comments (4)
  1. [Section 1] Typo: 'they comprise robustness' should be 'they compromise robustness'. Also 'Inconsistent tokens have not been systematically investigated in view of the detokenization-retokenization pipeline' is vague; consider clarifying that prior disambiguation methods bypass the tokenizer rather than addressing TI directly.
  2. [Appendix D.1] The guarantee depends on Bob using exactly the same tokenizer version, special-token handling, and normalization as Alice. This is reasonable within the paper's threat model, but it should be stated explicitly in the Limitations section, since the single-step check with skip_special_tokens=True may not reproduce Bob's retokenization in all deployment scenarios.
  3. [Appendix F, Table 19] The table contains typographical artifacts such as '1 .36%' and '60 .03%'. Also, the choice of q is empirical and per-model; a sentence clarifying that q is a tuned parameter rather than a derived constant would help readers assess sensitivity.
  4. [Section 4.1.2] The extraction error rates for the proposed method are not reported in the main tables; the paper states all methods achieve 100% extraction, but no empirical extraction-accuracy numbers are given for the stepwise verification method itself. Either report them or explicitly state that the 100% claim is a proof-based guarantee subject to the Algorithm 2 issue above.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the stepwise verification guarantee is constructive and defined by the same tokenizer check that defines TI; self-citations are baseline comparisons only.

full rationale

The derivation chain is self-contained. Section 3's guarantee ("the absence of candidate-level ITs is a sufficient condition for the final absence of inconsistent tokens") is a direct consequence of Proposition 2, which is proved from the operational definition of a candidate-level IT in Algorithm 1: a token that makes tokenize(detokenize(H_i)) differ from H_i. Filtering these tokens at every step is constructive, not a fit or a renamed target; Bob applies the same filter before decoding, so equality of the two token streams is enforced rather than assumed. The empirical investigation of infrequency and temporariness is used to motivate efficiency (why filtering is cheap) and to set the observation period q (Table 19), but q is a tuned hyperparameter, not a predicted quantity. Self-citations (Nozaki & Murawaki 2022; Yan et al. 2023, 2024a/b) appear only as baseline comparisons or as disambiguation methods not adopted; none is load-bearing for the paper's central correctness claim. The one genuine gap is the empty-pool fallback in Algorithm 2 (Appendix C.1, lines 5-6): the fallback adds an unverified token to the "inconsistency-free" pool, so the proof that no candidate-level IT is ever output does not cover the algorithm as written. This is a proof-completeness/correctness problem, not a circular reduction, so it does not raise the circularity score.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The central method has few invented entities; the main data-dependent knob is q. The key load-bearing input is the assumption that the sender-side tokenizer check faithfully represents the receiver's tokenization, and the fallback behavior for empty pools.

free parameters (2)
  • q (observation period for post-hoc rollback) = 2 (Llama-2-7b), 10 (Swallow-7b, Qwen2.5-7b)
    Chosen from the temporary-inconsistency recovery rates in Appendix F/Table 19; it tunes how long an inconsistency must persist before rollback and directly affects watermarking gains.
  • candidate pool truncation size for inconsistency measurement = 64
    Only top-64 tokens per pool are checked for candidate-level inconsistencies (Section 2), so infrequency statistics and method behavior are conditional on this threshold.
assumptions (4)
  • domain assumption The detokenization-retokenization pipeline with default tokenizer parameters plus skip_special_tokens=True exactly models what Bob computes on the transmitted text.
    Algorithm 1 and Appendix D.1; if receiver-side tokenization differs, filtered tokens can still be inconsistent.
  • domain assumption Outputting a candidate-level IT is a necessary condition for any eventual TI.
    Proposition 2 in Appendix B; relies on tokenizer determinism and no external text edits between Alice and Bob.
  • ad hoc to paper When the filtered candidate pool is empty, a non-SIT token outside the pool always exists and can be added without reintroducing TI.
    Algorithm 2 line 6 and Algorithm 3 line 7; the paper does not quantify how often this fallback fires or prove safety.
  • domain assumption The rollback operation in watermarking terminates and preserves watermark detectability.
    Algorithm 4 deletes the latest q+1 tokens and resamples; no termination or convergence analysis is given.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Addressing Tokenization Inconsistency in Steganography and Watermarking Based on Large Language Models." pith.science (2026). https://pith.science/paper/LRII3UMY

@misc{pith2026250820718,
  author       = {Pith},
  title        = {Pith review of: Addressing Tokenization Inconsistency in Steganography and Watermarking Based on Large Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LRII3UMY}},
  note         = {Machine review of arXiv:2508.20718}
}
read the original abstract

Large language models have significantly enhanced the capacities and efficiency of text generation. On the one hand, they have improved the quality of text-based steganography. On the other hand, they have also underscored the importance of watermarking as a safeguard against malicious misuse. In this study, we focus on tokenization inconsistency (TI) between Alice and Bob in steganography and watermarking, where TI can undermine robustness. Our investigation reveals that the problematic tokens responsible for TI exhibit two key characteristics: infrequency and temporariness. Based on these findings, we propose two tailored solutions for TI elimination: a stepwise verification method for steganography and a post-hoc rollback method for watermarking. Experiments show that (1) compared to traditional disambiguation methods in steganography, directly addressing TI leads to improvements in fluency, imperceptibility, and anti-steganalysis capacity; (2) for watermarking, addressing TI enhances detectability and robustness against attacks.

Figures

Figures reproduced from arXiv: 2508.20718 by the authors.

Figure 1
Figure 1. An example of tokenization inconsistency (TI) in LLM-based steganography or LLM-based watermarking. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. An example where a candidate-level IT causes TI which recovers back to consistency during token [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Overview and procedures of LM-based steganography with our stepwise consistency-verification approach. [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Mechanisms of the post-hoc rollback method. [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: Average embedding capacities (bits per token, [PITH_FULL_IMAGE:figures/full_fig_p017_5.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

48 extracted references · 19 canonical work pages

  1. [1]

    Aaronson and H

    S. Aaronson and H. Kirchner. 2023. Watermarking of large language models. Watermarking gpt outputs https://www.youtube.com/watch?v=2Kx9jbSMZqA. Technical report, openai

    work page 2023

  2. [2]

    Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. 2023. Gpt-4 technical report. arXiv preprint arXiv:2303.08774

    arXiv 2023

  3. [3]

    Anthropic. 2024. The claude 3 model family: Opus, sonnet, haiku. https://www-cdn.anthropic.com/de8ba9b01c9ab7cbabf5c33b80b7bbc618857627/Model_Card_Claude_3.pdf

    work page 2024

  4. [4]

    Stevie Bergman, Gavin Abercrombie, Shannon Spruit, Dirk Hovy, Emily Dinan, Y-Lan Boureau, and Verena Rieser

    A. Stevie Bergman, Gavin Abercrombie, Shannon Spruit, Dirk Hovy, Emily Dinan, Y-Lan Boureau, and Verena Rieser. 2022. https://doi.org/10.18653/v1/2022.sigdial-1.4 Guiding the release of safer E 2 E conversational AI through value sensitive design . In Proceedings of the 23rd Annual Meeting of the Special Interest Group on Discourse and Dialogue, pages 39-...

    work page doi:10.18653/v1/2022.sigdial-1.4 2022

  5. [5]

    Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, Sandhini Agarwal, Ariel Herbert-Voss, Gretchen Krueger, Tom Henighan, Rewon Child, Aditya Ramesh, Daniel Ziegler, Jeffrey Wu, Clemens Winter, Chris Hesse, Mark Chen, Eric Sigler, Mateusz Litwin, Scott Gr...

    2020

  6. [6]

    Miranda Christ, Sam Gunn, and Or Zamir. 2024. https://proceedings.mlr.press/v247/christ24a.html Undetectable watermarks for language models . In Proceedings of Thirty Seventh Conference on Learning Theory, volume 247 of Proceedings of Machine Learning Research, pages 1125--1139. PMLR

    work page 2024

  7. [7]

    Falcon Dai and Zheng Cai. 2019. https://doi.org/10.18653/v1/P19-1422 Towards near-imperceptible steganographic text . In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, pages 4303--4308, Florence, Italy. Association for Computational Linguistics

    doi:10.18653/v1/p19-1422 2019

  8. [8]

    distribution copies

    Jinyang Ding, Kejiang Chen, Yaofei Wang, Na Zhao, Weiming Zhang, and Nenghai Yu. 2023. https://doi.org/10.1109/SP46215.2023.10179287 Discop: Provably secure steganography in practice based on "distribution copies" . In 2023 IEEE Symposium on Security and Privacy (SP), pages 2238--2255

    arXiv 2023

Show all 48 references
  1. [9]

    Fedotov, P

    A.A. Fedotov, P. Harremoes, and F. Topsoe. 2003. https://doi.org/10.1109/TIT.2003.811927 Refinements of pinsker's inequality . IEEE Transactions on Information Theory, 49(6):1491--1498

    2003

  2. [10]

    Pierre Fernandez, Antoine Chaffin, Karim Tit, Vivien Chappelier, and Teddy Furon. 2023. https://doi.org/10.1109/WIFS58808.2023.10374576 Three bricks to consolidate watermarks for large language models . In 2023 IEEE International Workshop on Information Forensics and Security ...

    2023

  3. [11]

    Jiayi Fu, Xuandong Zhao, Ruihan Yang, Yuansen Zhang, Jiangjie Chen, and Yanghua Xiao. 2024. https://doi.org/10.18653/v1/2024.acl-long.315 G umbel S oft: Diversified language model watermarking via the G umbel M ax-trick . In Proceedings of the 62nd Annual Meeting of the Associ...

    2024 doi

  4. [12]

    Kazuki Fujii, Taishi Nakamura, Mengsay Loem, Hiroki Iida, Masanari Ohi, Kakeru Hattori, Hirai Shota, Sakae Mizuki, Rio Yokota, and Naoaki Okazaki. 2024. Continual pre-training for cross-lingual llm adaptation: Enhancing japanese language capabilities. In Proceedings of the Fir...

    2024

  5. [13]

    Jonas Geiping, Alex Stein, Manli Shu, Khalid Saifullah, Yuxin Wen, and Tom Goldstein. 2024. https://openreview.net/forum?id=Y5inHAjMu0 Coercing LLM s to do and reveal (almost) anything . In ICLR 2024 Workshop on Secure and Trustworthy Large Language Models

    2024

  6. [14]

    Te Sun Han. 2005. https://doi.org/10.1109/TIT.2004.840860 Folklore in source coding: information-spectrum approach . IEEE Trans. Inf. Theor., 51(2):747–753

    2005

  7. [15]

    Kingma and Jimmy Ba

    Diederik P. Kingma and Jimmy Ba. 2017. https://arxiv.org/abs/1412.6980 Adam: A method for stochastic optimization . Preprint, arXiv:1412.6980

    2017 arXiv

  8. [16]

    John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. 2023. https://proceedings.mlr.press/v202/kirchenbauer23a.html A watermark for large language models . In Proceedings of the 40th International Conference on Machine Learning, volume 202 o...

    2023

  9. [17]

    John Kirchenbauer, Jonas Geiping, Yuxin Wen, Manli Shu, Khalid Saifullah, Kezhi Kong, Kasun Fernando, Aniruddha Saha, Micah Goldblum, and Tom Goldstein. 2024. https://openreview.net/forum?id=DEJIDCmWOz On the reliability of watermarks for large language models . In The Twelfth...

    2024

  10. [18]

    Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang. 2024. https://openreview.net/forum?id=FpaCL1MO2C Robust distortion-free watermarks for language models . Transactions on Machine Learning Research

    2024

  11. [19]

    T Kudo. 2018. Sentencepiece: A simple and language independent subword tokenizer and detokenizer for neural text processing. arXiv preprint arXiv:1808.06226

    2018 arXiv

  12. [20]

    Sander Land and Max Bartolo. 2024. https://doi.org/10.18653/v1/2024.emnlp-main.649 Fishing for magikarp: Automatically detecting under-trained tokens in large language models . In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 116...

    2024 doi

  13. [21]

    Yuxi Li, Yi Liu, Gelei Deng, Ying Zhang, Wenjia Song, Ling Shi, Kailong Wang, Yuekang Li, Yang Liu, and Haoyu Wang. 2024. https://doi.org/10.1145/3660799 Glitch tokens in large language models: Categorization taxonomy and effective detection . Proc. ACM Softw. Eng., 1(FSE)

    2024 doi

  14. [22]

    Aiwei Liu, Leyi Pan, Yijian Lu, Jingjing Li, Xuming Hu, Xi Zhang, Lijie Wen, Irwin King, Hui Xiong, and Philip Yu. 2024. https://doi.org/10.1145/3691626 A survey of text watermarking in the era of large language models . ACM Comput. Surv., 57(2)

    2024 doi

  15. [23]

    Yijian Lu, Aiwei Liu, Dianzhi Yu, Jingjing Li, and Irwin King. 2024. An entropy-based text watermarking detection method. arXiv preprint arXiv:2403.13485

    2024 arXiv

  16. [24]

    Yisroel Mirsky, Ambra Demontis, Jaidip Kotak, Ram Shankar, Deng Gelei, Liu Yang, Xiangyu Zhang, Maura Pintor, Wenke Lee, Yuval Elovici, and Battista Biggio. 2023. https://doi.org/10.1016/j.cose.2022.103006 The threat of offensive ai to organizations . Computers & Security, 124:103006

    2023

  17. [25]

    Jumon Nozaki and Yugo Murawaki. 2022. https://doi.org/10.18653/v1/2022.aacl-short.15 Addressing segmentation ambiguity in neural linguistic steganography . In Proceedings of the 2nd Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics and the...

    2022 doi

  18. [26]

    Naoaki Okazaki, Kakeru Hattori, Hirai Shota, Hiroki Iida, Masanari Ohi, Kazuki Fujii, Taishi Nakamura, Mengsay Loem, Rio Yokota, and Sakae Mizuki. 2024. Building a large japanese web corpus for large language models. In Proceedings of the First Conference on Language Modeling,...

    2024

  19. [27]

    Yuang Qi, Kejiang Chen, Kai Zeng, Weiming Zhang, and Nenghai Yu. 2025. https://doi.org/10.1109/TDSC.2024.3519322 Provably secure disambiguating neural linguistic steganography . IEEE Transactions on Dependable and Secure Computing, 22(3):2430--2442

    2025

  20. [28]

    Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J. Liu. 2020. http://jmlr.org/papers/v21/20-074.html Exploring the limits of transfer learning with a unified text-to-text transformer . Journal of Machine Lea...

    2020

  21. [29]

    Rico Sennrich. 2015. Neural machine translation of rare words with subword units. arXiv preprint arXiv:1508.07909

    2015 arXiv

  22. [30]

    Jiaming Shen, Heng Ji, and Jiawei Han. 2020. https://doi.org/10.18653/v1/2020.emnlp-main.22 Near-imperceptible neural linguistic steganography via self-adjusting arithmetic coding . In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNL...

    2020 doi

  23. [31]

    Kaiser Sun, Peng Qi, Yuhao Zhang, Lan Liu, William Wang, and Zhiheng Huang. 2023. https://doi.org/10.18653/v1/2023.findings-emnlp.887 Tokenization consistency matters for generative models on extractive NLP tasks . In Findings of the Association for Computational Linguistics: ...

    2023 doi

  24. [32]

    Gemini Team, Rohan Anil, Sebastian Borgeaud, Jean-Baptiste Alayrac, Jiahui Yu, Radu Soricut, Johan Schalkwyk, Andrew M Dai, Anja Hauth, Katie Millican, et al. 2023. Gemini: a family of highly capable multimodal models. arXiv preprint arXiv:2312.11805

    2023 arXiv

  25. [33]

    Gemini Team, Petko Georgiev, Ving Ian Lei, Ryan Burnell, Libin Bai, Anmol Gulati, Garrett Tanzer, Damien Vincent, Zhufeng Pan, Shibo Wang, et al. 2024. Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context. arXiv preprint arXiv:2403.05530

    2024 arXiv

  26. [34]

    Qwen Team. 2024. https://qwenlm.github.io/blog/qwen2.5/ Qwen2.5: A party of foundation models

    2024

  27. [35]

    Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timoth \'e e Lacroix, Baptiste Rozi \`e re, Naman Goyal, Eric Hambro, Faisal Azhar, et al. 2023. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.13971

    2023 arXiv

  28. [36]

    Dixuan Wang, Yanda Li, Junyuan Jiang, Zepeng Ding, Guochao Jiang, Jiaqing Liang, and Deqing Yang. 2024. https://arxiv.org/abs/2405.17067 Tokenization matters! degrading large language models through challenging their tokenization . Preprint, arXiv:2405.17067

    2024 arXiv

  29. [37]

    Zihui Wu, Haichang Gao, Ping Wang, Shudong Zhang, Zhaoxiang Liu, and Shiguo Lian. 2024. https://arxiv.org/abs/2410.15052 Glitch M iner: Mining glitch tokens in large language models via gradient-based discrete optimization . Preprint, arXiv:2410.15052

    2024

  30. [38]

    Lingyun Xiang, Shuanghui Yang, Yuhang Liu, Qian Li, and Chengzhang Zhu. 2020. https://doi.org/10.3390/math8091558 Novel linguistic steganography based on character-level text generation . Mathematics, 8(9)

    2020 doi

  31. [40]

    Ruiyi Yan, Tian Song, and Yating Yang. 2024 b . https://doi.org/10.1109/SMC54092.2024.10831652 Token F ree: A tokenization-free generative linguistic steganographic approach with enhanced imperceptibility . In 2024 IEEE International Conference on Systems, Man, and Cybernetics...

    2024

  32. [41]

    Ruiyi Yan, Yating Yang, and Tian Song. 2023. https://doi.org/10.1109/LSP.2023.3302749 A secure and disambiguating approach for generative linguistic steganography . IEEE Signal Processing Letters, 30:1047--1051

    2023

  33. [42]

    An Yang, Baosong Yang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Zhou, Chengpeng Li, Chengyuan Li, Dayiheng Liu, Fei Huang, Guanting Dong, Haoran Wei, Huan Lin, Jialong Tang, Jialin Wang, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Ma, Jin Xu, Jingren Zhou, Jinze Bai, Jinzheng...

    2024 arXiv

  34. [43]

    Zhong-Liang Yang, Xiao-Qing Guo, Zi-Ming Chen, Yong-Feng Huang, and Yu-Jin Zhang. 2019. https://doi.org/10.1109/TIFS.2018.2871746 RNN-S tega: Linguistic steganography based on recurrent neural networks . IEEE Transactions on Information Forensics and Security, 14(5):1280--1295

    2019

  35. [44]

    KiYoon Yoo, Wonhyuk Ahn, and Nojun Kwak. 2024. https://doi.org/10.18653/v1/2024.naacl-long.224 Advancing beyond identification: Multi-bit watermark for large language models . In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computatio...

    2024 doi

  36. [45]

    Zhibo Zhang, Wuxia Bai, Yuxi Li, Mark Huasong Meng, Kailong Wang, Ling Shi, Li Li, Jun Wang, and Haoyu Wang. 2024. https://doi.org/10.1145/3691620.3695060 Glitch P rober: Advancing effective detection and mitigation of glitch tokens in large language models . In Proceedings of...

    2024

  37. [46]

    Xuandong Zhao, Prabhanjan Vijendra Ananth, Lei Li, and Yu-Xiang Wang. 2024. https://openreview.net/forum?id=SsmT8aO45L Provable robust watermarking for AI -generated text . In The Twelfth International Conference on Learning Representations

    2024

  38. [47]

    Zachary Ziegler, Yuntian Deng, and Alexander Rush. 2019. https://doi.org/10.18653/v1/D19-1115 Neural linguistic steganography . In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Langu...

    2019 doi

  39. [48]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list...

  40. [49]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.