Pith. sign in

REVIEW 2 major objections 5 minor 1 cited by

Distributional Information Embedding: A Framework for Multi-bit Watermarking

T0 review · 2 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper establishes an entropy ceiling for reliable multi-bit LLM watermarking and constructs an optimal encoder–decoder scheme that attains it.

desk verdict The finite-length achievability proof in Theorem 5 has a genuine error that a two-symbol counterexample exposes; the asymptotic part is solid but mostly a repackaged steganography bound. read the letter →

arxiv 2501.16558 v2 pith:LB5XO2C3 submitted 2025-01-27 cs.CR cs.ITcs.LGmath.IT

Haiyun He , Yepeng Liu , Ziqiao Wang , Yongyi Mao , Yuheng Bu This is my paper · ORCID
classification cs.CRcs.ITcs.LGmath.IT MSC 94A1794A2994A62
keywords multi-bitwatermarkingdistributionalinformationembeddinglargelanguagemodelswatermarkcapacityentropyratehypothesistestingsidedistortion
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper reframes multi-bit watermarking for LLM-generated text as distributional information embedding, where the host is the token-generation distribution rather than a fixed signal. Its central asymptotic claim is that the maximum watermarking rate with vanishing detection and decoding error is the entropy of the LLM's output distribution, and that allowing a bounded distortion raises this ceiling to the entropy of the best distribution inside the distortion ball. For finite token sequences with non-i.i.d. tokens, it derives the exact minimax message-error probability under a worst-case false-alarm constraint and gives an encoder–decoder pair that attains it. The framework turns watermark design into a rate–distortion problem and gives designers an entropy benchmark against which practical multi-bit schemes can be checked.

What carries the argument

The load-bearing construction is an $(m+1)$-ary hypothesis test between an unwatermarked distribution and $m$ watermarked distributions, combined with a Latin-square matching between token sequences and side-information sequences, meaning a table in which every row and column is a permutation. Asymptotically, the typical sets $A_{\eta,X}^{(T)}$ and $A_{\eta,\zeta}^{(T)}$ both have about $e^{TH(P_X)}$ sequences; a bijection $g$ assigns each pair $(x^T,\zeta^T)$ a message, and the encoder places essentially all probability mass on the matched pair, so that each message is decoded with error that vanishes like $\exp(-\Omega(T^{1/2}))$. In the finite-length regime, the universal minimax error $\beta^*(m,T,\alpha,d) = \min_{P_{X^T}:D(P_{X^T},Q_{X^T})\le d} \sum_{x^T} (P_{X^T}(x^T)-\alpha/m)_+$ acts as the central identity; the optimal scheme realizes it by choosing $P^*_{\zeta^T}(\zeta^T) = \min(P^*_{X^T}(x^T), \alpha/m)$ for the non-redundant side-information symbols, concentrating the remaining mass on a redundant symbol $\tilde{\zeta}^T$, and using the mass-transport formula of the paper to fill the joint distribution while keeping every message's marginal on $X^T$ equal to $P^*_{X^T}$.

What would settle it

Take one token, two symbols $a,b$, with $P_X(a)=0.9$, $P_X(b)=0.1$, false-alarm budget $\alpha=0.5$, and $m=2$ messages. The claimed minimax error is $(0.9-0.25)_+ + (0.1-0.25)_+ = 0.65$. Any bijective decoder must give one message a pair combination whose correctly decoded mass is only $0.1+0.1=0.2$, so that message's error is $0.8 > 0.65$; computing the proposed encoder's output for this instance settles whether the finite-length optimality claim holds.

Watch

Extended reading notes

Core claim

The paper claims that the reliable multi-bit watermarking of an LLM's token stream is limited by information rather than by computational heuristics. In the i.i.d. asymptotic regime, the best achievable rate with vanishing error is $H(P_X)$, the entropy of the output distribution, and the optimal scheme is a deterministic bijection between typical token sequences and typical side-information sequences: each of the $m$ messages is assigned one matched pair, making the watermark detectable at false-alarm level $\alpha$ while errors decay as $\exp(-\Omega(T^{1/2}))$. With an allowed distortion $d$, the rate ceiling becomes the supremum of $H(P_X)$ over distributions within distance $d$ of the model's distribution. In the finite-length non-i.i.d. case, the paper's central identity is $\beta^*(m,T,\alpha,d) = \min_{P_{X^T}:D(P_{X^T},Q_{X^T})\le d} \sum_{x^T} (P_{X^T}(x^T)-\alpha/m)_+$, and it constructs an optimal scheme by transporting probability mass from tokens onto a side-information alphabet with one extra redundant symbol, preserving the message-secrecy constraint and achieving this minimax error.

Load-bearing premise

The finite-length optimality proof assumes that one fixed one-to-one matching between token sequences and side-information sequences can equalize the decoding error across all messages; with more than one message, a common high-probability token paired with a rare side-information symbol for one message can push that message's error above the claimed bound.

Editorial extensions

If this is right

  • A distortion-free watermark in i.i.d. text cannot reliably carry more than $H(P_X)$ bits per token, so low-entropy, repetitive, or highly predictable text has less watermark capacity than diverse text.
  • Allowing bounded distortion raises the rate ceiling to the entropy of the best distribution inside the distortion ball, meaning a designer can trade text quality for watermark capacity in a principled, quantitative way.
  • For finite sequences, the minimal achievable worst-case message error is $\sum_{x^T}(P_{X^T}(x^T)-\alpha/m)_+$; increasing the number of messages $m$ drives this error toward $1$ unless the false-alarm budget $\alpha$ or the sequence length $T$ grows correspondingly.
  • If $m \le \alpha |\mathcal{X}|^T$, there are parameter regimes where the minimax error is zero, so perfectly reliable multi-bit watermarking is possible for short messages with a loose enough false-alarm constraint.
  • The optimal finite-length scheme is a distribution-adaptive transport of probability mass onto a side-information alphabet with one redundant symbol, providing a structured template for implementing multi-bit watermarks with hard false-alarm control.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the i.i.d. rate equals entropy, real auto-regressive LLMs likely have lower watermark capacity than this bound suggests, since conditional token entropy is typically below the marginal entropy used in the asymptotic analysis; estimating a modern model's per-token conditional entropy against the bound would quantify the gap.
  • The stated connection to lossless source coding suggests a testable design: use an entropy coder's decoder as the watermark encoder and its encoder as the decoder, and measure whether the empirical watermark rate approaches $H(P_X)$ on real prompt distributions.
  • The finite-length minimax formula has the form of a threshold rule: the per-message false-alarm budget $\alpha/m$ acts as a mass threshold below which token probabilities are too small to protect, implying that very low-probability text cannot carry many watermark bits.
  • A natural extension the paper does not pursue is adversarial robustness: since decoding relies on the side-information sequence, an attacker who can estimate or manipulate that sequence might erase or overwrite the watermark; testing the scheme under such an attack would clarify whether the guarantees survive outside the model's own generation process.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 5 minor

Summary. The paper introduces a distributional information embedding framework for multi-bit LLM watermarking, in which the encoder actively modifies the token distribution while a decoder uses side information. The asymptotic section claims that the maximum reliable rate is the entropy of the token distribution and increases with distortion; the finite-length section claims a universal minimax j-th error probability of β*(m,T,α,d) = min_{P_XT: D(P_XT,Q_XT)≤d} Σ_xT (P_XT(xT) - α/m)_+, together with an optimal construction in Theorem 5. The asymptotic converse and typical-set arguments are standard and appear sound, and the converse part of Theorem 4 is elegant. However, the finite-length achievability construction in Theorem 5 and Appendix D contains a load-bearing error: the claimed identity for the per-message correct-decoding mass is false, and the proposed joint distribution does not in general preserve the required marginals. Because the finite-length minimax claim rests on this construction, the paper is not currently acceptable in its present form.

Significance. If the asymptotic rate characterization is correct, it gives a clean entropy benchmark for multi-bit LLM watermarking and connects the problem to classical steganography capacity. The converse of Theorem 4 is a useful lower bound and is clearly argued. The paper is transparent about some limitations, such as not modeling the autoregressive generation process. The main weakness is that the finite-length achievability claim, advertised in the abstract and developed in Section IV, is not supported by the submitted proof. This is a central part of the paper's contribution, so the issue is not merely cosmetic. The asymptotic results alone may merit publication, but the finite-length claim needs to be either corrected with a valid construction or substantially revised.

major comments (2)
  1. [Appendix D, Theorem 5] The proof of Theorem 5 contains an invalid identity in the achievability part. It claims that the correct-decoding probability for message j equals Σ_xT (P_XT(xT) ∧ α/m) because the construction sets P_ζT(ζT)=min(P_XT(xT),α/m). But under the Latin-square decoder, message j pairs xT with ζT = γ*_j^{-1}(xT), and the mass of that ζT is min(P_XT(σ_j(xT)), α/m) for the permutation σ_j induced by the decoder, not necessarily min(P_XT(xT), α/m). A concrete failure is: X={a,b}, P_X(a)=0.8, P_X(b)=0.2, α=0.6, m=2, so β*=0.5. Let Z={a,b,t}, P_ζ(a)=0.3, P_ζ(b)=0.2, P_ζ(t)=0.5, and use h(a,a)=1, h(a,b)=2, h(b,a)=2, h(b,b)=1. For message 2, the correct-decoding mass is min(0.8,0.2)+min(0.2,0.3)=0.4, giving β_2=0.6 > β*. Thus the proposed encoder/decoder does not achieve the claimed minimax error, and Theorem 5's achievability collapses as stated.
  2. [Appendix D, Eq. (7)] There is a second, independent problem: the joint distribution defined in Eq. (7) does not in general have the required P_XT marginal, so Assumption 1 and the distortion constraint are not satisfied. In the same example, for message 2 the formula assigns to X=a the diagonal mass min(0.8,0.2)=0.2 plus residual mass 0.6·(0.1+0.5)/0.5 = 0.72, for a total of 0.92, while X=b is assigned 0.2; the total exceeds 1. The denominator β* is not the actual residual mass 1 - Σ_xT min(P_XT(xT), P_ζT(φ_j(xT))), which equals 0.6 here. Hence Eq. (7) is not even a valid probability distribution for the constructed P_ζT, independent of whether the claimed error bound is met.
minor comments (5)
  1. [Section I] The author affiliation line contains a typo: 'Schoolf of EECS' should be 'School of EECS'.
  2. [Supplementary material] The proofs of Theorems 3, 4, and 5 are placed in an external GitHub supplement [25] rather than in the manuscript; a journal submission should include the complete proofs, especially since the finite-length achievability proof is the source of the main technical difficulty.
  3. [Section II] The paper states that the autoregressive structure is ignored, while the abstract advertises the finite-token case as 'non-i.i.d. tokens'; the scope should be stated more precisely in the abstract and introduction, clarifying that Q_XT is treated as a general joint distribution without exploiting sequential autoregressive sampling.
  4. [Definition 2 and Theorem 4] Definition 2 allows D to be any divergence, but Theorem 4 and the finite-length optimization effectively use total variation; the paper should state which distortion measure is assumed in the finite-length results.
  5. [Theorem 5] The notation γ*_j^{-1} is overloaded: it is used for the inverse decoder map on ζ^T and is set to the empty set at the redundant sequence ζ~^T; this should be defined more carefully to avoid ambiguity.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity; the asymptotic capacity result is self-contained, and the finite-length achievability flaw is a correctness issue rather than a circular reduction.

full rationale

The paper's central asymptotic claim, that the maximum watermarking rate with vanishing error is the entropy of the LLM output distribution, is derived from a standard Fano-inequality converse (Appendix A) and an AEP-based achievability construction (Theorem 3, Appendix C). Neither step assumes the entropy conclusion; the converse upper-bounds log m by H(X^T|ζ^T) ≤ H(P_X), and the achievability scheme uses typical sets and a Latin-square decoder to reach that rate. No fitted parameters are renamed as predictions. The finite-length lower bound in Theorem 4 is obtained by fixing an arbitrary decoder and using the false-alarm constraint to derive a decoder-independent expression, which is not circular. The paper does cite its own prior work [24] and its own supplementary material [25] for proofs, and it describes Theorem 5 as an extension of [24, Theorem 2], but these citations are not used as premises that force the conclusion; the construction is stated in the paper itself. The serious issue is in Appendix D's achievability identity: the equality β_j = 1 - Σ_x (P*_XT(x) ∧ α/m) assumes that every x^T is paired under message j with a ζ^T carrying mass α/m, which the stated Latin-square construction does not guarantee. That is a mathematical error in the proof, not an equivalence-by-construction between input and output. Accordingly, no circular step is exhibited, and the correct circularity score is low.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

No free parameters are fitted. The central capacity result is a theorem from entropy, Fano, and AEP. The main unstated load-bearing premise is that the encoder has full non-causal knowledge of the LLM distribution. The finite achievability proof also implicitly assumes a mass-coupling formula preserves marginals, which it does not in general.

assumptions (4)
  • domain assumption Tokens in the asymptotic section are i.i.d. under both hypotheses.
    Section III explicitly assumes X1,...,XT are i.i.d. with distribution P_X. A real LLM is autoregressive, so this is a modeling idealization acknowledged by the authors.
  • domain assumption The encoder knows the full joint distribution Q_X^T and can optimize the joint distribution of (X^T,zeta^T) non-causally.
    Definition 1 and the optimal encoders in Theorems 3 and 5 require global access to Q_X^T. Practical LLM sampling is sequential and causal, and the discussion admits the autoregressive nature is not fully accounted for.
  • domain assumption The decoder has access to the side-information sequence zeta^T generated from shared secret randomness.
    Definition 1 and Example 1 (the green-red list scheme) assume the decoder receives zeta^T. This is a standard watermarking assumption, not a free parameter.
  • standard math The achievability construction relies on the existence of bijective maps h and Latin-square decoders over X^T times Z^T.
    Remark 1 and Theorem 5 invoke these maps. The maps exist, but the coupling formula built on top of them is where the proof fails.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Distributional Information Embedding: A Framework for Multi-bit Watermarking." pith.science (2026). https://pith.science/paper/LB5XO2C3

@misc{pith2026250116558,
  author       = {Pith},
  title        = {Pith review of: Distributional Information Embedding: A Framework for Multi-bit Watermarking},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LB5XO2C3}},
  note         = {Machine review of arXiv:2501.16558}
}
read the original abstract

This paper introduces a novel problem, distributional information embedding, motivated by the practical demands of multi-bit watermarking for large language models (LLMs). Unlike traditional information embedding, which embeds information into a pre-existing host signal, LLM watermarking actively controls the text generation process--adjusting the token distribution--to embed a detectable signal. We develop an information-theoretic framework to analyze this distributional information embedding problem, characterizing the fundamental trade-offs among three critical performance metrics: text quality, detectability, and information rate. In the asymptotic regime, we demonstrate that the maximum achievable rate with vanishing error corresponds to the entropy of the LLM's output distribution and increases with higher allowable distortion. We also characterize the optimal watermarking scheme to achieve this rate. Extending the analysis to the finite-token case with non-i.i.d. tokens, we identify schemes that maximize detection probability while adhering to constraints on false alarm and distortion.

Figures

Figures reproduced from arXiv: 2501.16558 by the authors.

Figure 1
Figure 1. Illustration of multi-bit watermarking as distributional information embedding with side information. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Illustration of the asymptotically optimal watermarking scheme when [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Watermark in the Classroom: A Conformal Framework for Adaptive AI Usage Detection

    stat.AP 2025-07 conditional novelty 6.0 of 10

    Standard, hierarchical, and weighted conformal prediction applied to LLM watermark scores can control false-positive rates when detecting guideline-violating AI edits in simulated classroom essays.

Reference graph

Works this paper leans on

31 extracted references · 21 canonical work pages · cited by 1 Pith paper

  1. [1]

    Llama: Open and efficient foundation language models,

    H. Touvron, T. Lavril, G. Izacard, X. Martinet, M.-A. Lachaux, T. Lacroix, B. Rozi `ere, N. Goyal, E. Hambro, F. Azhar et al. , “Llama: Open and efficient foundation language models,” arXiv preprint arXiv:2302.13971, 2023

    arXiv 2023

  2. [2]

    Mistral 7b,

    A. Q. Jiang, A. Sablayrolles, A. Mensch, C. Bamford, D. S. Chaplot, D. d. l. Casas, F. Bressand, G. Lengyel, G. Lample, L. Saulnier et al. , “Mistral 7b,” arXiv preprint arXiv:2310.06825 , 2023

    arXiv 2023

  3. [3]

    Watermarking of large language models,

    S. Aaronson, “Watermarking of large language models,” https: //simons.berkeley.edu/talks/scott-aaronson-ut-austin-openai-2023-08-17, 2023, accessed: 2023-08

    work page 2023

  4. [4]

    A watermark for large language models,

    J. Kirchenbauer, J. Geiping, Y . Wen, J. Katz, I. Miers, and T. Goldstein, “A watermark for large language models,” in International Conference on Machine Learning . PMLR, 2023, pp. 17 061–17 084

    work page 2023

  5. [5]

    Ro- bust distortion-free watermarks for language models,

    R. Kuditipudi, J. Thickstun, T. Hashimoto, and P. Liang, “Ro- bust distortion-free watermarks for language models,” arXiv preprint arXiv:2307.15593, 2023

    arXiv 2023

  6. [6]

    Provable robust watermark- ing for AI-generated text,

    X. Zhao, P. Ananth, L. Li, and Y .-X. Wang, “Provable robust watermark- ing for AI-generated text,” arXiv preprint arXiv:2306.17439 , 2023

    arXiv 2023

  7. [7]

    Adaptive text watermark for large language models,

    Y . Liu and Y . Bu, “Adaptive text watermark for large language models,” in Forty-first International Conference on Machine Learning , 2024

    work page 2024

  8. [8]

    Robust multi-bit natu- ral language watermarking through invariant features,

    K. Yoo, W. Ahn, J. Jang, and N. Kwak, “Robust multi-bit natu- ral language watermarking through invariant features,” arXiv preprint arXiv:2305.01904, 2023

    arXiv 2023

Show all 31 references
  1. [9]

    Advancing beyond identification: Multi-bit watermark for large language models,

    K. Yoo, W. Ahn, and N. Kwak, “Advancing beyond identification: Multi-bit watermark for large language models,” in Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Pape...

    2024

  2. [10]

    Provably robust multi-bit watermarking for AI-generated text via error correction code,

    W. Qu, D. Yin, Z. He, W. Zou, T. Tao, J. Jia, and J. Zhang, “Provably robust multi-bit watermarking for AI-generated text via error correction code,” arXiv preprint arXiv:2401.16820 , 2024

    2024 arXiv

  3. [11]

    Sok: Watermarking for ai-generated content,

    X. Zhao, S. Gunn, M. Christ, J. Fairoze, A. Fabrega, N. Carlini, S. Garg, S. Hong, M. Nasr, F. Tramer et al., “Sok: Watermarking for ai-generated content,” arXiv preprint arXiv:2411.18479 , 2024

    2024 arXiv

  4. [12]

    Information-theoretic analysis of water- marking,

    P. Moulin and J. A. O’Sullivan, “Information-theoretic analysis of water- marking,” in 2000 IEEE International Conference on Acoustics, Speech, and Signal Processing. Proceedings (Cat. No. 00CH37100), vol. 6. IEEE, 2000, pp. 3630–3633

    2000

  5. [13]

    On random coding error exponents of watermarking sys- tems,

    N. Merhav, “On random coding error exponents of watermarking sys- tems,” IEEE Transactions on Information Theory , vol. 46, no. 2, pp. 420–430, 2000

    2000

  6. [14]

    The role of information theory in watermarking and its application to image watermarking,

    P. Moulin, “The role of information theory in watermarking and its application to image watermarking,” Signal Processing , vol. 81, no. 6, pp. 1121–1139, 2001

    2001

  7. [15]

    Identification in the presence of side information with application to watermarking,

    Y . Steinberg and N. Merhav, “Identification in the presence of side information with application to watermarking,” IEEE Transactions on Information Theory, vol. 47, no. 4, pp. 1410–1422, 2001

    2001

  8. [16]

    The gaussian watermarking game,

    A. S. Cohen and A. Lapidoth, “The gaussian watermarking game,” IEEE transactions on Information Theory, vol. 48, no. 6, pp. 1639–1667, 2002

    2002

  9. [17]

    Quantization index modulation: A class of provably good methods for digital watermarking and information embedding,

    B. Chen and G. W. Wornell, “Quantization index modulation: A class of provably good methods for digital watermarking and information embedding,” IEEE Transactions on Information theory , vol. 47, no. 4, pp. 1423–1443, 2001

    2001

  10. [18]

    The duality between information embedding and source coding with side information and some applications,

    R. J. Barron, B. Chen, and G. W. Wornell, “The duality between information embedding and source coding with side information and some applications,” IEEE Transactions on Information Theory , vol. 49, no. 5, pp. 1159–1180, 2003

    2003

  11. [19]

    Information-theoretic analysis of infor- mation hiding,

    P. Moulin and J. A. O’Sullivan, “Information-theoretic analysis of infor- mation hiding,” IEEE Transactions on information theory , vol. 49, no. 3, pp. 563–593, 2003

    2003

  12. [20]

    Scalar costa scheme for information embedding,

    J. J. Eggers, R. Bauml, R. Tzschoppe, and B. Girod, “Scalar costa scheme for information embedding,” IEEE Transactions on signal processing , vol. 51, no. 4, pp. 1003–1019, 2003

    2003

  13. [21]

    Perfectly secure steganography: Capacity, error exponents, and code constructions,

    Y . Wang and P. Moulin, “Perfectly secure steganography: Capacity, error exponents, and code constructions,” IEEE Transactions on Information Theory, vol. 54, no. 6, pp. 2706–2722, 2008

    2008

  14. [22]

    Capacity of steganographic chan- nels,

    J. J. Harmsen and W. A. Pearlman, “Capacity of steganographic chan- nels,” IEEE Transactions on Information Theory, vol. 55, no. 4, pp. 1775– 1792, 2009

    2009

  15. [23]

    Writing on dirty paper (corresp.),

    M. Costa, “Writing on dirty paper (corresp.),” IEEE transactions on information theory, vol. 29, no. 3, pp. 439–441, 1983

    1983

  16. [24]

    Theoretically grounded framework for llm watermarking: A distribution-adaptive approach,

    H. He, Y . Liu, Z. Wang, Y . Mao, and Y . Bu, “Theoretically grounded framework for llm watermarking: A distribution-adaptive approach,”

  17. [25]

    Supplementary material for “Distributional information embedding: A framework for multi-bit watermarking

    ——, “Supplementary material for “Distributional information embedding: A framework for multi-bit watermarking”,” 2024. [Online]. Available: https://github.com/haiyun-he/PaperAppendices/blob/ main/APWDSIT2025 Multibit WM Appendix.pdf

    2024

  18. [26]

    Optimal watermark embedding and detection strategies under limited detection resources,

    N. Merhav and E. Sabbag, “Optimal watermark embedding and detection strategies under limited detection resources,” IEEE Transactions on Information Theory, vol. 54, no. 1, pp. 255–274, 2008

    2008

  19. [27]

    T. M. Cover and J. A. Thomas, Elements of Information Theory (Wiley Series in Telecommunications and Signal Processing) . USA: Wiley- Interscience, 2006

    2006

  20. [28]

    A. D. Keedwell and J. D ´enes, Latin Squares and Their Applications: Latin Squares and Their Applications . Elsevier, 2015

    2015

  21. [29]

    OD-Stega: LLM-based near-imperceptible steganography via optimized distributions,

    Y .-S. Huang, P. Just, K. Narayanan, and C. Tian, “OD-Stega: LLM-based near-imperceptible steganography via optimized distributions,” 2024. [Online]. Available: https://arxiv.org/abs/2410.04328 APPENDIX A. Proof of Lemma 1 Proof. Let Pe = Pr( ˆM ̸= M ). From the Fano’s inequal...

    2024

  22. [31]

    We then prove that the j-th error probability vanishes to 0 while the worst-case false alarm error is upper bounded by α as T → ∞

    In the following, we first show that the probability of the atypical set decays exponentially with T . We then prove that the j-th error probability vanishes to 0 while the worst-case false alarm error is upper bounded by α as T → ∞. Let η = T − 1 4 and define the set A(T ) η,...

  23. [2025]

    Available: https://arxiv.org/abs/2410.02890

    [Online]. Available: https://arxiv.org/abs/2410.02890

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.