PaperlayerView exact revision on arXiv

Source-linked AI summary

Text Steganography with Dynamic Codebook and Multimodal Large Language Model

Jianxin Gao, Ruohan Lei, Wanli Peng

arXiv:2604.20269v2cs.CRcs.AI

TL;DR

Existing white-box methods risk exposing steganographic behavior, while black-box methods can require fixed codebooks and sentence-specific extraction prompts. DyCo-Stega uses multimodal context to construct a dynamic codebook and combines encrypted mapping with feedback optimization. The authors report strong overall performance and improved practicality and flexibility in online social networks.

  • Problem

    White-box steganography risks exposing behavior through shared language models, while black-box methods can depend on fixed codebooks and sentence-specific extraction prompts.

    Source: §1 · p. 2

  • Method

    DyCo-Stega uses public visual context and a multimodal LLM to construct dynamic codebooks, with encrypted message mapping and feedback optimization for black-box embedding and extraction.

    Source: §1 · p. 2

  • Results

    DyCo-Stega achieves the best overall performance among evaluated methods, with PPL 128.9, SS 0.8940, KLD 3.37, and EC 6.37 bpw.

    Source: §4.3 · p. 6

  • Takeaways & Limitations

    The method offers improved practicality and flexibility than existing black-box methods in some popular online social networks while preserving strong text quality and embedding capacity.

    Source: §1 · p. 2

Abstract

from arXiv · show

With the popularity of the large language models (LLMs), text steganography has achieved remarkable performance. However, existing methods still have some issues: (1) For the white-box paradigm, this steganography behavior is prone to exposure due to sharing the off-the-shelf language model between Alice and Bob. (2) For the black-box paradigm, these methods lack flexibility and practicality since Alice and Bob should share the fixed codebook while sharing a specific extraction prompt for each steganographic sentence. In order to improve the security and practicality, we introduce a black-box text steganography with a dynamic codebook and multimodal large language model. Specifically, we first construct a dynamic codebook via some shared session configuration and a multimodal large language model. Then an encrypted steganographic mapping is designed to embed secret messages during the steganographic text generation. Furthermore, we introduce a feedback optimization mechanism based on reject sampling to ensure accurate extraction of secret messages. Experimental results show that the proposed method outperforms existing white-box text steganography methods in terms of embedding capacity and text quality. Meanwhile, the proposed method has achieved better practicality and flexibility than the existing black-box paradigm in some popular online social networks.

1 Introduction

DyCo-Stega targets exposure risks in white-box text steganography and inflexibility in black-box methods. It combines a dynamic codebook, multimodal LLMs, encrypted mapping, and feedback optimization to improve practicality and performance.

1 Introduction

  • White-box methods risk exposing steganographic behavior because Alice and Bob share an off-the-shelf language model, while black-box methods rely on fixed codebooks and sentence-specific extraction prompts.The cited passage identifies LLM-Stega as a black-box prompt-engineering method but notes its codebook and extraction-prompt requirements.Source: §1 · p. 2
  • DyCo-Stega uses public visual context and an MLLM to construct a dynamic codebook, so extraction need not rely on a fixed shared codebook across communication rounds.The MLLM also serves as a synchronization tool between sender and receiver.Source: §1 · p. 2
  • The proposed framework combines dynamic codebook construction, encrypted message mapping, and feedback optimization to support accurate recovery in a black-box setting.The paper evaluates text quality, embedding capacity, statistical imperceptibility, and resistance to steganalysis.Source: §1 · p. 2
  • The method offers a strong balance between practicality and performance across embedding capacity, statistical imperceptibility, resistance to steganalysis, and robustness in online settings.The supplied passage gives no numerical values for these outcomes.Source: §1 · p. 2

2 Related Work

Prior linguistic steganography spans text editing, generative methods, provable-security approaches, and black-box protocols. DyCo-Stega differs by reconstructing session-specific decoding structure from public multimodal context rather than persistent protocol materials.

2 Related Work

  • White-box work progressed from text editing to generative and provably secure methods, but these approaches generally assume token-probability access and shared local models.The cited examples include RNN/LSTM methods, arithmetic coding, ADG, Discop, minimum-entropy coupling, METEOR, and SparSamp.Source: §2 · p. 2
  • Black-box methods remove logit-access requirements but still commonly depend on fixed lexical inventories, static mappings, or other reusable protocol materials.Examples include in-context learning and LLM-Stega, which uses pre-shared keyword sets, encrypted mappings, and rejection sampling.Source: §2 · p. 2
  • DyCo-Stega uses public image-caption context to reconstruct a session-specific codebook, applying MLLM capabilities to synchronization for covert communication.The cited passage identifies this use of public image-caption context as unaddressed by prior black-box linguistic steganography methods.Source: §2 · p. 2

3 The Proposed Methodology

DyCo-Stega coordinates sender and receiver through shared session configuration and public multimodal context. It constructs a dynamic codebook for encrypted message embedding, then reconstructs that codebook and recovers the message at the receiver.

3.1 Shared Session Configuration

  • Shared session configuration uses MLLM-generated images and reject sampling until the receiver-side MLLM extracts exactly the original seed words.The configuration includes a pre-shared key, ordered seed words, and an anchor sequence; the image, extraction prompt, and iterative feedback support seed recovery.Source: §3.1 · p. 3

3.2 Secret Message Embedding

  • Seed words, a public dictionary, and session parameters support deterministic codebook construction, with dictionary-based expansion and probability shaping favoring seed and high-frequency words.Candidate words are retrieved through dictionary relations, including definitions, entry contexts, and prefixes; the session seed reorders word-probability pairs without changing their probabilities.Source: §3.1 · p. 3, §3.2 · p. 4
  • The secret message maps to a codeword and interval offset, while XOR masking with the session seed protects the offset shared through a side channel.Caption generation uses reject sampling until the caption contains the codeword and anchor sequence without other semantic-pool words.Source: §3.2 · p. 5

3.3 Secret Message Extraction

  • The receiver recovers seed words from the shared image, reconstructs the codebook, unmasks the offset, and converts the resulting index back into the secret message.The codeword identifies the interval; adding the recovered offset to its base boundary yields the message index.Source: §3.3 · p. 5

4 Experiments

The experiments compare DyCo-Stega with black-box and white-box baselines across text quality, embedding capacity, statistical imperceptibility, and detectability. Ablations examine model pairing, probability shaping, OSN transmission, and prompt and temperature effects on recovery.

4.1 Experimental Setup

  • The setup compares DyCo-Stega and LLM-Stega with six white-box baselines, using GPT-2 and Qwen2.5 for white-box methods.The study generates 15,000 stego texts for each black-box method and 10,000 per white-box baseline on each language model.Source: §4.1 · p. 5

4.2 Evaluation Metrics

  • Text quality is measured with PPL and semantic similarity, while embedding capacity is reported in bits per word.The evaluation also includes steganalysis accuracy, embedding-space KLD, image–text CLIP-Score, and human ratings of fluency, clarity, and grammaticality.Source: §4.2 · pp. 5–6

4.3 Main Results

  • DyCo-Stega achieves the best overall benchmark performance, with PPL 128.9, SS 0.8940, KLD 3.37, and EC 6.37 bpw.Compared with LLM-Stega, it has lower PPL and KLD, higher SS and EC, and an Acc closer to 0.5; KLD is measured in sentence-embedding space.Source: Table 1 · p. 6, §4.3 · p. 6
  • Cover and stego captions differ by an average CLIP-Score change of only 0.06, and the black-box methods score higher than white-box baselines on all three human-rated dimensions.DyCo-Stega has the highest clarity score, with fluency and grammaticality comparable to LLM-Stega.Source: §4.3 · p. 6

4.4 Ablation Studies

  • Across recognizers, Gemini achieves 96%–98% S@3 and GPT 92%–94% S@3; Qwen is lower at 64%–68% S@3, though its successful-case AvgR remains comparable to other generators.Source: §4.4 · p. 7
  • The default σ=τ/2 offers the best overall balance, while sharper σ=τ/4 yields PPL 105.7 and SS 0.903 but KLD 30.32.Increasing σ from τ to 2τ lowers SS from 0.894 to 0.814 and raises KLD from 3.37 to 19.73.Source: §4.4 · p. 7
  • All five tested social platforms achieve 100% success under S@3 after image transmission and screenshot capture.S@1 ranges from 97% to 98%, and S@2 from 99% to 100%; test images had been verified as successful before upload.Source: §4.4 · p. 7
  • The full prompt achieves 100% S@3 at T=0 and T=0.7, while the minimally constrained prompt reaches only 40.7% and 48.7%, respectively.For the full prompt, S@3 is 99.3% at T=1.0 and 90.8% at T=2.0; the minimally constrained prompt reaches 30.2% at T=2.0.Source: §4.4 · p. 8

5 Extension to Video

The video-carrier exploration supports extending the method beyond images, while reporting higher cost and lower stability than the image setting. Results vary by video generator and recognizer.

5 Extension to Video

  • 95% S@3 is achieved by Veo videos paired with Gemini 3.1 Pro, the strongest reported video-generator and recognizer pairing.Sora and Seedance also maintain relatively stable performance; Gemini 3.1 Pro is the strongest recognizer overall.Source: §5 · p. 8
  • Seedance often pushes successful seed-word recovery above 500 seconds, whereas Veo is the most efficient across recognizers.GPT 5.3 responds fastest but with lower accuracy; GPT 5.4 Thinking takes longer without significantly improving accuracy.Source: §5 · p. 8, Table 5 · p. 8
  • Video results support feasibility beyond images, but higher cost and lower stability keep images as the main configuration.The study is a lightweight exploration using video-generation and recognition model interfaces.Source: §5 · p. 8

6 Conclusion

DyCo-Stega constructs a session-specific codebook from public visual context and combines it with private-key and seed-based recovery. The conclusion reports broad performance and transmission results, with video explored as a preliminary extension.

6 Conclusion

  • DyCo-Stega reconstructs the dynamic codebook and recovers the offset using the transmitted private key and session seed.Image-generation and caption-generation optimization improve the reliability of seed-word recovery and secret extraction in black-box settings.Source: §6 · p. 8
  • The conclusion reports strong text quality, embedding capacity, statistical imperceptibility, and anti-steganalysis, plus robustness across generators, recognizers, and online social networks.Its video-carrier study is preliminary; future work will investigate audio and more stable multimodal steganography.Source: §6 · p. 8

A Case Studies

  • The case studies show images from Gemini-3 Pro, Qwen Image Max, and GPT4o alongside corresponding stego captions generated by GPT5.1..Source: A Case Studies · p. 10

A.1 Gemini-3 Pro

The case studies pair generated images with stego captions, providing examples across Gemini-3 Pro, Qwen Image Max, and GPT4o.

A.1 Gemini-3 Pro

  • Gemini-3 Pro generated the image shown with a stego caption describing a brush, comb, mirror, soap, and tweezers.The example caption places these objects together beside a round mirror.Source: §A.1 · p. 10, Figure 3 · p. 10

A.2 Qwen Image Max

  • The Qwen Image Max example caption describes a calculator, headphones, keyboard, mug, and scissors.Source: §A.2 · p. 10

A.3 GPT4o

  • The GPT4o example caption describes a red apple, bowl, fork, knife, and warm mug.Source: §A.3 · p. 10

B Details of Seeds Expansion

The appendix makes the seed-expansion implementation reproducible by specifying preprocessing, expansion routes, scoring, and deterministic selection. It notes that Alice and Bob may agree on other deterministic implementations.

B Details of Seeds Expansion

  • The appendix specifies one reproducible seed-expansion realization while allowing Alice and Bob to agree on other deterministic implementations.It details normalization, three expansion routes, scoring, and deterministic selection and ranking to produce the semantic pool.Source: B Details of Seeds Expansion · p. 10

B.1 Normalization and Dictionary Preprocessing

  • Normalization lowercases tokens, removes non-alphabetic characters, and applies WordNet noun lemmatization before matching.Source: §B.1 · p. 10
  • Dictionary definitions, synonyms, and examples are tokenized, normalized, and stripped of stopwords and single-character tokens.Source: §B.1 · p. 10
  • Seed words are retained even if they are stopwords, and missing seeds are inserted into the shared candidate universe with frequency zero.Source: §B.1 · pp. 10–11

B.2 Candidate Generation from the Seed Set

The candidate universe expands ordered image-derived seed words through three deterministic dictionary routes, then normalizes and deduplicates the resulting candidates.

B.2 Candidate Generation from the Seed Set

  • Candidates enter the universe when at least one seed triggers at least one of three dictionary-based matching routes.The resulting candidates are normalized before duplicates are removed.Source: §B.2 · p. 11
  • Reverse-definition matching links a candidate to a seed when the normalized seed appears in the candidate’s definition-token set.Its weight is inversely scaled by definition length using λ_rev(w) = 30.0 log2(|Def(w)| + 4).Source: §B.2 · p. 11
  • Forward-context matching uses seed-entry synonyms, definitions, or examples, prioritizing synonym matches (15.0), then definitions (12.0), then examples (2.5).Prefix matching also admits non-trivial extensions of a seed word.Source: §B.2 · p. 11

B.3 Seed-wise Scoring and Aggregation

This appendix specifies deterministic procedures for scoring and ordering seed-expanded candidates, constructing codebook intervals and keys, generating captions, and analyzing recovery uncertainty.

B.3 Seed-wise Scoring and Aggregation

  • Each candidate–seed score sums weights for active matching routes, with a 2.0 multiplier when reverse-definition evidence is corroborated by forward-context or prefix evidence.The route indicators are binary, and the forward-context weight follows the stated field-priority rule.Source: §B.3 · p. 11
  • Global modifiers distinguish support across multiple seeds from repeated support by one seed, while frequency smoothing mildly favors common words without letting frequency dominate semantic evidence.The hub reward counts distinct supporting seeds.Source: §B.3 · p. 11

B.4 Selection and Ranking

  • The pool excludes seed words, selects the highest-scoring α−K candidates with alphabetical tie-breaking, sorts them by dictionary frequency, and places seeds first.This deterministic construction lets both parties reconstruct the same semantic pool from the public dictionary and shared seeds.Source: §B.4 · pp. 11–12

C Details of Seed-Based Ordering

  • A concrete ordering example assigns each index an HMAC-SHA256 tag keyed by the session seed, then sorts tags to derive a shared permutation without extra communication.The paper describes this as one implementation of a mutually agreed deterministic ordering rule.Source: C Details of Seed-Based Ordering · p. 12, Algorithm · p. 12

D Details of Repeated Sampling

  • Repeated sampling discretizes fractional interval lengths by assigning extra units to the first R words, yielding a partition in which every integer index belongs to exactly one interval.The procedure uses cumulative interval boundaries after discretization.Source: D Details of Repeated Sampling · p. 12

E Details of XOR Masking

  • Each embedded codeword receives a fixed-width private-key fragment; concatenating τ fragments gives the key, which the receiver splits to recover offsets.The XOR operands and each resulting fragment have length b.Source: E Details of XOR Masking · p. 13

F Algorithm of Stego Caption Generation

  • Caption generation verifies that the caption contains the selected codeword and anchor sequence but no other semantic-pool words, revising rejected captions through feedback prompts.The accepted caption is posted on the OSN.Source: F Algorithm of Stego Caption Generation · p. 13

G Mapping Rules for Session Parameters; H.1 Assumptions

  • Session parameters derive from a hash of the pre-shared key and public image-caption features; recovery analysis assumes public construction knowledge and no reliable validation oracle.The session seed determines the codebook permutation and interval partitioning.Source: G Mapping Rules for Session Parameters · pp. 13–14, §H.1 · p. 14

H.2 Ambiguity of Dynamic Codebooks

The discussion counts uncertainty in dynamic-codebook reconstruction when a warden has intercepted the private key but lacks the pre-shared key.

H.2 Ambiguity of Dynamic Codebooks

  • The codebook size α has 64 possible values, while the shaping parameter σ has 16 possible values under the stated parameter mapping.The discussion treats these as remaining parameter ambiguities after b is inferred.Source: §H.2 · p. 14
  • For each candidate pair (α, σ), the unknown session seed leaves α! possible codebook word permutations at the layout level.Accounting for all admissible α values produces multiple candidate branches.Source: §H.2 · p. 14
  • Replacing every α! term with the smallest admissible factorial, 24!, gives a conservative lower bound rather than the exact total candidate count.The bound uses α ∈ {24, . . . , 87}.Source: §H.2 · p. 14

H.3 Ambiguity of Selected Intervals

Even after a codeword identifies an interval, the exact message offset remains uncertain; the section estimates the resulting offset-search space under half-Gaussian shaping.

H.3 Ambiguity of Selected Intervals

  • An observed codeword identifies its dynamic-codebook interval but not the exact offset within it, leaving multiple offset combinations consistent with the caption.The candidate-combination count is considered under a current structural branch and the stated probability model.Source: §H.3 · p. 15
  • Under the paper’s default parameter setting, the representative offset-search-space scale is reported as E[M_X] ≈ 2128.6.Equation (35) characterizes this scale under the half-Gaussian shaping rule.Source: §H.3 · p. 15

H.4 Combined Interpretation

The combined interpretation examines recovery ambiguity even when the private key is intercepted, while the later sections describe the study’s scope and prompt workflow. The authors caution against real-world deployment in safety-critical or adversarial settings.

H.4 Combined Interpretation

  • Intercepting the private key does not reduce recovery to simple inversion: reconstructing the dynamic codebook remains ambiguous, with a large search space in selected intervals.The interpretation combines a conservative structural lower bound with this recovery analysis.Source: §H.4 · p. 15

I Ethical Considerations and Broader Impact

  • The study examines black-box, API-only multimodal steganography and frames its security, deployability, and forensic properties as threat-model questions.The authors say this work may motivate defensive research, including multimodal steganalysis and platform-side auditing.Source: I Ethical Considerations and Broader… · p. 15
  • The authors do not advocate real-world deployment in safety-critical or adversarial settings and call for attack and defense perspectives to be evaluated in parallel.They also call for stronger detection methods, auditing tools, and usage policies for multimodal generation platforms.Source: I Ethical Considerations and Broader… · p. 15

J Seed Words and Prompts We Used

Extraction Prompt

  • The extraction prompt identifies five visible object categories, normalizes them to canonical nouns, sorts them alphabetically, and requests a JSON array.It specifies criteria for ignoring background or unclear objects and normalizing synonyms and variants.Source: Extraction Prompt · p. 17

Image Feedback Prompt Template

  • The image feedback prompt compares target and extracted nouns, then instructs object-level edits to remove or de-emphasize extras and add or emphasize missing targets.It preserves the original scene style, lighting, viewpoint, and background.Source: Image Feedback Prompt Template · p. 17

Embedding Prompt Template

  • The embedding prompt requires a one-sentence caption to include each required word once, preserve the ordered public anchor sequence, and avoid forbidden words.It also constrains caption length and asks for simple, visually supported language.Source: Embedding Prompt Template · p. 18

Related papers

Loading 2604.20269v2…