Text Steganography with Dynamic Codebook and Multimodal Large Language Model

Jianxin Gao; Ruohan Lei; Wanli Peng

REVIEW 2 major objections 1 minor 1 cited by

Text Steganography with Dynamic Codebook and Multimodal Large Language Model

T0 review · 2 major / 1 minor · reviewed 2026-05-10 · grok-4.3

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Dynamic codebooks from multimodal LLMs enable flexible black-box text steganography

desk verdict The paper sketches a dynamic-codebook black-box steganography scheme using multimodal LLMs and reject sampling, but its practicality claims on real social networks rest on untested assumptions about transmission survival and sampling speed. read the letter →

arxiv 2604.20269 v2 pith:B3AIKXUT submitted 2026-04-22 cs.CR cs.AI

Jianxin Gao , Ruohan Lei , Wanli Peng This is my paper · ORCID

classification cs.CRcs.AI

keywords textsteganographydynamiccodebookmultimodallargelanguagemodelblack-boxrejectsamplingsecretmessageembeddingimagecaptioning

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes a black-box text steganography method that constructs a dynamic codebook using shared session configurations and a multimodal large language model. Secret messages are embedded through an encrypted mapping during the generation of image captions, with a reject sampling mechanism to ensure accurate extraction by the receiver. This addresses the exposure risk in white-box methods that share language models and the inflexibility of black-box methods that require fixed codebooks and per-sentence prompts. A reader would care about this because it provides a more secure and practical way to hide information in text shared publicly on social networks.

What carries the argument

The dynamic codebook constructed via shared session configuration and multimodal large language model, together with the encrypted steganographic mapping and reject-sampling feedback optimization for message embedding and extraction.

What would settle it

Running the method to generate and post captions on actual social networks, then attempting extraction from the retrieved posts to check if the secret messages are recovered at high success rates.

Watch

Extended reading notes

Core claim

The authors establish that their method, using a dynamic codebook from multimodal LLM and shared config along with encrypted mapping and reject-sampling optimization, outperforms existing white-box text steganography in embedding capacity and text quality while achieving better practicality and flexibility than black-box paradigms on popular online social networks.

Load-bearing premise

The multimodal LLM reliably produces captions where the hidden mapping survives real social network transmission, and the reject-sampling loop converges quickly for practical use without revealing the steganography.

Editorial extensions

If this is right

Outperforms white-box methods in embedding capacity and text quality.
Achieves better practicality and flexibility than existing black-box methods in social networks.
Secret messages are accurately extracted using the feedback optimization mechanism based on reject sampling.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If multimodal LLMs advance in generating more diverse captions, the steganographic embedding capacity would naturally increase.
The method could potentially apply to other forms of text generation beyond captions, such as dialogue or article summaries.
Social network platforms might develop new detection techniques if such dynamic steganography becomes common.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Desk Editor's Note

read the letter

The main point is that the authors try to fix two common problems in text steganography: white-box methods that expose the model and black-box methods that need a fixed shared codebook plus per-sentence prompts. They do this by building a fresh codebook from shared session data and a multimodal LLM, embedding via an encrypted mapping during caption generation, and cleaning up extraction errors with a reject-sampling loop. That combination is the actual novelty here, and it is presented clearly enough to show how it differs from the cited prior work on both paradigms. The paper also does a reasonable job stating the limitations of earlier approaches and sketching why the new pieces could add flexibility for use on public networks. Credit for that framing is due; it is not just a rehash. The soft spots are in the validation of the main selling point. The abstract states that experiments show gains in capacity, quality, and practicality over existing methods, yet the description supplies no numbers on transmission success after platform upload, average reject-sampling iterations, or platform-specific artifacts such as compression and re-encoding. Because the extraction depends entirely on the LLM output matching the shared mapping, those missing details matter. If the full paper contains only simulated results rather than actual network traces, the claimed edge over fixed-codebook baselines stays unproven. The stress-test concern about reliability after real transmission therefore lands. This work is aimed at people already working on LLM-assisted covert channels or information hiding. A reader who wants concrete ideas for adaptive black-box steganography can extract useful architecture points, but anyone needing deployable performance numbers will come away wanting more data. It deserves peer review because the idea is distinct and the gaps are fixable with targeted experiments rather than fundamental flaws in the approach.

Referee Report

2 major / 1 minor

Summary. The paper proposes a black-box text steganography scheme that constructs a dynamic codebook from a shared session configuration and a multimodal LLM, embeds secret messages via an encrypted steganographic mapping during caption generation, and uses a reject-sampling feedback loop to guarantee extraction. It claims superior embedding capacity and text quality relative to white-box baselines together with improved practicality and flexibility over fixed-codebook black-box methods when deployed on real social-network platforms.

Significance. If the experimental claims are substantiated, the dynamic-codebook plus MLLM approach would address two long-standing limitations in text steganography—model-sharing exposure in white-box settings and per-message prompt/codebook rigidity in black-box settings—potentially enabling more secure and usable covert communication on platforms that apply compression and re-encoding. The reject-sampling mechanism is a concrete engineering contribution that could be reused in other LLM-based steganographic pipelines.

major comments (2)

[Abstract] Abstract: the central claim that the method 'outperforms existing white-box text steganography methods in terms of embedding capacity and text quality' is unsupported by any quantitative metrics, baseline comparisons, error bars, or description of the experimental protocol; without these data the performance advantage cannot be evaluated.
[Abstract] Abstract: the practicality claim—that the scheme achieves 'better practicality and flexibility than the existing black-box paradigm in some popular online social networks'—rests on two unverified load-bearing assumptions: (1) that MLLM-generated captions containing the encrypted dynamic-codebook mapping survive platform transmission artifacts (compression, resizing, re-encoding), and (2) that the reject-sampling loop converges in a small number of iterations without producing detectable query patterns. No iteration counts, transmission-success rates, or platform-specific results are supplied.

minor comments (1)

[Abstract] The abstract introduces the terms 'dynamic codebook' and 'encrypted steganographic mapping' without a concise one-sentence definition; a brief gloss in the abstract would improve readability for readers outside the immediate subfield.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive feedback on our manuscript. We agree that the abstract requires strengthening to better support our claims with concrete evidence. We address each major comment below and will revise the manuscript accordingly.

read point-by-point responses

Referee: [Abstract] Abstract: the central claim that the method 'outperforms existing white-box text steganography methods in terms of embedding capacity and text quality' is unsupported by any quantitative metrics, baseline comparisons, error bars, or description of the experimental protocol; without these data the performance advantage cannot be evaluated.

Authors: We agree that the abstract would benefit from including specific quantitative support to make the performance claim self-contained. The manuscript body reports experimental comparisons against white-box baselines, including embedding capacity in bits per character and text quality via perplexity and human evaluation scores. We will revise the abstract to summarize these key metrics, name the baselines, and briefly note the evaluation protocol, thereby allowing direct assessment of the claimed advantages. revision: yes
Referee: [Abstract] Abstract: the practicality claim—that the scheme achieves 'better practicality and flexibility than the existing black-box paradigm in some popular online social networks'—rests on two unverified load-bearing assumptions: (1) that MLLM-generated captions containing the encrypted dynamic-codebook mapping survive platform transmission artifacts (compression, resizing, re-encoding), and (2) that the reject-sampling loop converges in a small number of iterations without producing detectable query patterns. No iteration counts, transmission-success rates, or platform-specific results are supplied.

Authors: We acknowledge that the current abstract does not supply the requested supporting data on transmission robustness or reject-sampling convergence. The manuscript describes the reject-sampling feedback mechanism but does not report platform-specific success rates or iteration statistics. For the revision we will add experimental results quantifying transmission success under compression and re-encoding on representative social networks together with average iteration counts for the feedback loop, thereby verifying the practicality assumptions. revision: yes

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity; method relies on external MLLM behavior and empirical results

full rationale

The paper describes a black-box text steganography approach that constructs a dynamic codebook from a shared session configuration plus multimodal LLM output, applies an encrypted mapping during caption generation, and uses reject sampling to ensure extraction accuracy. Performance claims (higher embedding capacity, better text quality, improved practicality/flexibility on social networks) are asserted via experimental results rather than any derivation that reduces by construction to fitted parameters, self-defined quantities, or a self-citation chain. No equations or steps in the abstract or method outline exhibit self-definitional loops, fitted-input-as-prediction, uniqueness theorems imported from the authors' prior work, or ansatz smuggling. The approach treats the MLLM and shared config as external inputs, making the central claims independent of internal circular reduction.

Assumptions & free parameters 0 free parameters · 1 assumptions · 2 invented entities

The approach depends on the generative capabilities of existing multimodal LLMs and the assumption that a shared session configuration can be established securely. No new physical constants or particles are introduced; the dynamic codebook and encrypted mapping are procedural constructs.

assumptions (1)

domain assumption Multimodal LLMs can generate coherent, natural captions whose internal structure can be steered to carry hidden bits without obvious artifacts.
Invoked when constructing the dynamic codebook and performing steganographic caption generation.

invented entities (2)

dynamic codebook
purpose: Provide a per-session mapping between secret bits and caption choices without requiring a fixed shared table.
Constructed on the fly from session configuration and MLLM output.
encrypted steganographic mapping
purpose: Translate secret messages into instructions for the caption generator.
Designed specifically for this steganography pipeline.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Text Steganography with Dynamic Codebook and Multimodal Large Language Model." pith.science (2026). https://pith.science/paper/B3AIKXUT

@misc{pith2026260420269,
  author       = {Pith},
  title        = {Pith review of: Text Steganography with Dynamic Codebook and Multimodal Large Language Model},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/B3AIKXUT}},
  note         = {Machine review of arXiv:2604.20269}
}

read the original abstract

With the popularity of the large language models (LLMs), text steganography has achieved remarkable performance. However, existing methods still have some issues: (1) For the white-box paradigm, this steganography behavior is prone to exposure due to sharing the off-the-shelf language model between Alice and Bob. (2) For the black-box paradigm, these methods lack flexibility and practicality since Alice and Bob should share the fixed codebook while sharing a specific extraction prompt for each steganographic sentence. In order to improve the security and practicality, we introduce a black-box text steganography with a dynamic codebook and multimodal large language model. Specifically, we first construct a dynamic codebook via some shared session configuration and a multimodal large language model. Then an encrypted steganographic mapping is designed to embed secret messages during the steganographic text generation. Furthermore, we introduce a feedback optimization mechanism based on reject sampling to ensure accurate extraction of secret messages. Experimental results show that the proposed method outperforms existing white-box text steganography methods in terms of embedding capacity and text quality. Meanwhile, the proposed method has achieved better practicality and flexibility than the existing black-box paradigm in some popular online social networks.

Figures

Figures reproduced from arXiv: 2604.20269 by the authors.

**Figure 2.** Human evaluation on fluency, clarity, and gram [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

A Comprehensive Survey on Linguistic Steganography: Methods, Countermeasures, Evaluation, and Challenges
cs.CR 2026-08 accept novelty 4.0 of 10

This survey systematically reviews 148 linguistic steganographic methods, 60 steganalysis countermeasures, 23 evaluation metrics, and 9 open challenges, identifying five paradigm shifts in the LLM era.

Pith tools

Reviewed May 10, 2026 · model on record in the stance chip above.