PaperlayerView exact revision on arXiv

Source-linked AI summary

A Comprehensive Survey on Linguistic Steganography: Methods, Countermeasures, Evaluation, and Challenges

Ruiyi Yan, Chenhui Chu, Zhongliang Yang, Yugo Murawaki

arXiv:2608.29077v1cs.CRcs.CL

TL;DR

Linguistic steganography has advanced rapidly with LLMs, yet a comprehensive account of how these developments reshape the field was missing. This survey organizes the area across methods, countermeasures, metrics, and challenges, identifying five LLM-era paradigm shifts and positioning the field’s practical scope and limitations.

  • Problem

    Previous surveys lacked comprehensive LLM-era coverage and offered coarsegrained, paper-narrow analyses.

  • Method

    The survey systematically reviews modification-based and generative steganographic methods, linguistic steganalysis, evaluation metrics, and challenges.

  • Results

    The survey identifies five LLM-era paradigm shifts, including prompt-only generation, provable security, black-box or asymmetric access, joint optimization, and engineering-aware design.

  • Takeaways & Limitations

    The survey provides a reference and roadmap for practical and responsible linguistic steganography in the LLM era.

  • Takeaways & Limitations

    The survey focuses exclusively on linguistic steganography and synthesizes reported results without reimplementing or re-benchmarking methods under a unified protocol.

Abstract

from arXiv · show

Linguistic steganography hides secret messages in natural language text. Large language models (LLMs) have reshaped the field, but a systematic account of how these scattered advances collectively reshape the field in this new era is still missing. We provide one along four axes: 148 steganographic methods, 60 linguistic steganalysis countermeasures, 23 evaluation metrics, and 9 open challenges, each with taxonomies, reviews, and adoption analyses. Cutting across these axes, we identify five specific paradigm shifts in the LLM era: (1) from covertext modification to prompt-only generation, (2) from heuristic to provable security, (3) from white-box symmetric LMs to black-box or asymmetric access, (4) from security-centric designs to joint optimization, and (5) from text-quality concerns to engineering issues. The survey aims to serve as both a reference and a roadmap for practical and responsible linguistic steganography in the LLM era.

1 Introduction

Linguistic steganography has gained importance with LLM advances, but prior surveys lacked comprehensive LLM-era coverage and fine-grained analysis. This survey addresses that gap by systematically reviewing methods, countermeasures, metrics, challenges, and five resulting paradigm shifts.

  • Textual ubiquity, improved LLM-generated fluency, and lower compression sensitivity have increased interest in linguistic steganography.The survey frames modification and generation as its two primary frameworks.
  • Previous surveys lacked LLM-era coverage and provided coarsegrained, paper-narrow analyses.
  • The survey systematically covers modification and generation methods, steganalysis countermeasures, evaluation metrics, and open challenges.Tables 1 and 2 compare its quantitative comprehensiveness and qualitative depth with existing surveys.
  • Prompt-only generation removes the modification budget as a fundamental capacity bottleneck.
  • Security research is shifting from heuristic approaches toward provable, information-theoretic mechanisms.
  • The field is also moving toward black-box or asymmetric LM access, joint optimization of security, efficiency, and robustness, and engineering-aware designs.Reported engineering concerns include tokenization inconsistency and computational indeterminism.

2 Preliminaries and Background

The survey introduces steganography through the monitored-communication setting and formalizes a system around key generation, embedding, and extraction. It also distinguishes steganography from cryptography and watermarking and reviews two security definitions.

  • Simmons’ Prisoners’ Problem illustrates how Alice and Bob hide messages in innocent-looking cover objects to evade Eve’s detection.
  • A steganographic system is formalized as the algorithmic triple P_D = (KeyGen_D, Embed_D, Extract_D).
  • KeyGen_D generates a shared key, Embed_D combines the key, message, and channel history into steganographic content, and Extract_D recovers the message.
  • The survey distinguishes steganography from cryptography and watermarking as related but separate concepts.
  • Steganographic security is discussed through information-theoretic and complexity-theoretic definitions.

3 Steganography Based on Modification

Before generative language models, text steganography primarily modified existing covertexts while preserving readability and naturalness. These methods include format, lexicon, and rewriting alterations but have low capacity and vulnerability to statistical steganalysis.

  • Modification-based methods embed secrets by altering existing covertexts while preserving readability and naturalness.
  • Format-based methods manipulate spaces, punctuation, or layout, whereas linguistic methods replace words or rewrite sentence structures.
  • Modification-based approaches are generally lightweight but have low embedding capacity and can be detected by statistical steganalysis.

4 Generative Linguistic Steganography

Generative linguistic steganography replaces covertext modification with prompt-based autoregressive generation, enabling flexible embedding while organizing methods around security, efficiency, and robustness.

  • 4.1 Basics and Notions of LM: LM-based generation predicts each next token from the preceding context, converts logits into a probability distribution, and samples the next token.Most methods interact with the postsoftmax next-token distribution rather than model internals.
  • 4.2 Paradigm of LM-based Steganography: Generative methods use a shared prompt rather than a traditional cover carrier, with Alice and Bob coordinating embedding and extraction through language-model generation.The sender embeds a message into generated stegotext, while the receiver extracts it using the same model and prompt.
  • 4.3 Taxonomy of Existing Methods: Methods are categorized by target performance into higher security, efficiency, or robustness, covering imperceptibility, capacity, speed, and extraction consistency.Robustness concerns whether the extracted message remains consistent after active attacks such as substitution, deletion, or insertion.
  • 4.3 Taxonomy of Existing Methods: The field has shifted from heuristic toward provable security, with distribution-preserving generative methods pursuing stronger guarantees against steganalysis.Provably secure approaches aim to preserve the language model’s distribution at each generation step.
  • 4.3 Taxonomy of Existing Methods: Efficiency and complexity have gained emphasis, but jointly achieving distribution preservation, perfect extraction, and low complexity remains an open challenge.SyncPool achieves the combination at superlinear O(N log N) complexity, heavier than linear-time alternatives.

5 Linguistic Steganalysis

Linguistic steganalysis detects stegotexts without extracting their messages, using taxonomies based on representations and neural backbones while increasingly adapting to LLMs.

  • 5 Linguistic Steganalysis: Steganalysis is essential for detecting covert messages because linguistic steganography is dual-use and may support either privacy or malicious communication.Eve monitors messages and blocks exchanges when she detects suspicious content.
  • 5.1 Taxonomy of Existing Methods: Existing methods are organized by use of pretrained representations or models and by backbone type, including RNNs, CNNs, GNNs, and hybrid architectures.The taxonomy focuses on modern neural-network methods and excludes earlier representative methods from its reviewed set.
  • 5.2 Evaluation Metrics: Evaluation also uses text-quality metrics including perplexity, BLEU, ROUGE, METEOR, diversity, human evaluation, and LLM-as-a-judge.Human evaluation and LLM-as-a-judge metrics are increasingly important but remain absent from most existing works.
  • 5.1 Taxonomy of Existing Methods: 19?
  • 5.1 Taxonomy of Existing Methods: LLM-based steganalysis methods have emerged only recently and remain relatively underexplored, motivating attention to LLM-adaptable detectors.The survey separately summarizes methods adaptable to LLMs as a promising direction.
  • 5.1 Taxonomy of Existing Methods: Five commonly adopted detectors for evaluating generative steganography are FCN, CNN, R-BiLSTM-C, TS-RNN, and TS-CSW.These detectors represent frequently used steganalysis choices in the surveyed evaluation literature.

6 Evaluation for Linguistic Steganography

The survey organizes evaluation into security, efficiency, and robustness metrics and finds increasing attention to entropy utilization and error-based robustness assessment.

  • 6 Evaluation for Linguistic Steganography: Evaluation metrics are categorized into security, efficiency, and robustness, following the survey’s taxonomy of generative steganographic methods.The survey also tracks adoption trends across 95 papers on modern generative methods.
  • 6 Evaluation for Linguistic Steganography: Entropy utilization is gaining emphasis because model-agnostic methods need fair cross-model assessment of embedding capacity.The motivation is compatibility with diverse large language models.
  • 6 Evaluation for Linguistic Steganography: Metrics based on error rates are increasingly used as robustness receives greater research attention.This reflects growing concern with performance under conditions that can affect message recovery.
  • 6 Evaluation for Linguistic Steganography: Growing evaluation of efficiency and robustness reflects a shift from security-centric designs toward joint optimization.The survey connects this chronological adoption trend to broader changes in method objectives.

7 Challenges and Future Directions

The survey identifies nine open challenges grouped into engineering realities, impractical assumptions and evaluations, and community and ethical concerns.

  • Engineering realities and issues: Engineering challenges include computational indeterminism, tokenization inconsistency, abrupt termination, and prompt synchronization.
  • Impractical assumptions and evaluations: Impractical assumptions and evaluations involve limited embedding capacity, dependence on white-box LLMs, and unrealistic security evaluations.
  • Community and ethical concerns: Community and ethical challenges include a lack of unified benchmarks and use restrictions imposed by LLM licenses.

8 Conclusion

The survey synthesizes linguistic steganography across methods, steganalysis, and evaluation metrics, identifies five LLM-era paradigm shifts, and groups remaining challenges into three themes.

  • The survey systematically reviews modification-based and generative methods, linguistic steganalysis methods, and evaluation metrics.
  • It identifies five LLM-era paradigm shifts, including provably secure generative methods, robustness-oriented designs, and black-box or asymmetric schemes.
  • The remaining open challenges span engineering realities, impractical assumptions and evaluations, and community and ethical concerns.
  • The survey aims to catalyze practical deployment and responsible use of linguistic steganography.

Limitations

The survey is limited to linguistic steganography and synthesizes reported findings rather than reimplementing or re-benchmarking methods under a unified protocol.

  • The survey focuses exclusively on linguistic steganography and excludes image, audio, video, and cross-modal schemes.
  • It synthesizes results reported by original authors without reimplementing or re-benchmarking methods under a unified protocol.
  • Building a unified benchmark is identified as an open challenge.

Ethical Considerations

The paper distinguishes steganography from cryptography and watermarking, then surveys format-based, lexicon-based, rewriting-based, and generative linguistic steganographic approaches.

  • Conceptual distinctions: Cryptography protects message content, while steganography conceals message existence by embedding it in innocuous carriers.
  • Conceptual distinctions: Watermarking embeds robust marks to prove ownership, authenticity, or traceability through common transformations.
  • Modification-based methods: Format-based methods manipulate spaces, encoding, fonts, or spelling without altering linguistic content, but remain fragile and platform-dependent.
  • Modification-based methods: Lexicon-based methods replace words or word forms while preserving semantics and fluency, using synonyms or masked language models.
  • Modification-based methods: Rewriting-based methods alter syntax or paraphrase sentences while preserving meaning, often achieving strong readability and imperceptibility but low capacity.
  • Generative methods: Generative language models use whole-vocabulary redundancy to achieve higher embedding rates than modification-based approaches.

E Review of Modern Generative Linguistic Steganographic Methods

Modern generative linguistic steganography is reviewed through taxonomies of methodology features, targeted metrics, scenarios, and model requirements. The field increasingly emphasizes multi-objective performance, model flexibility, black-box access, multilingual scope, and provable security.

  • Taxonomy: The taxonomy organizes methods by targeted metrics, scenarios, backbone models, LLM adaptability, training requirements, asymmetry, and black-box access.General methods apply across generation scenarios, while model-agnostic methods avoid dependence on a particular autoregressive architecture.
  • Method trends: Earlier studies mainly focused on security, while newer methods increasingly optimize efficiency, robustness, or multiple objectives.This reflects growing attention to practical performance beyond security alone.
  • Method trends: Since 2024, model-agnostic, LLM-adaptable, and training-free methods have started dominating.These methods support different model backbones without costly retraining or architecture-specific modification.
  • Access assumptions: Asymmetric and black-box methods enable lightweight implementations but remain almost underexplored despite matching practical API-only interactions.Such settings often provide access only to generated text rather than model internals.
  • Method trends: Most recent methods are multilingual in scope because they target general scenarios rather than a single language.Only a few studies specifically address Arabic, Malay, or Chinese poetry.
  • Method families: Provable-security methods preserve the language model’s distribution during generation to reduce statistical distortion.Arithmetic coding maps message bits to successive token intervals, while later methods adjust candidate pools or sampling mechanisms.
  • Evaluation-oriented methods: Entropy utilization normalizes payload by the generator’s information budget, enabling fair cross-model capacity comparisons.Recent work also improves entropy use through distribution-preserving sampling, including in black-box API settings.
  • Evaluation-oriented methods: Message error rate measures the ratio of extraction failures, including errors caused by tokenization inconsistencies, active attacks, or length mismatches.These factors motivate explicit robustness assessment.

I Introduction of Challenges and Future Directions

The survey identifies operational, evaluation, benchmark, access, and licensing challenges for linguistic steganography. It emphasizes that realistic deployment requires addressing robustness, adaptability, capacity, human-facing security, standardization, and use restrictions.

  • Robustness challenges: Computational indeterminism in hosted LLMs undermines extraction robustness for API-only or black-box methods.The next-token distribution may vary for the same prompt and model.
  • Robustness challenges: Tokenization countermeasures cannot currently achieve provable security and high capacity simultaneously.For SyncPool, capacity drops to zero when operation is required over the entire vocabulary.
  • Generation challenges: Abrupt termination after message embedding can produce unnatural stegotexts and extra decoded bits.Current experiments often stop generation immediately when the hidden message is fully embedded.
  • Generation challenges: Prompt synchronization trades flexibility against security because dynamic sharing or updating creates an additional side channel.That auxiliary channel must be secured and authenticated.
  • Capacity challenges: Linguistic steganography has inherently lower embedding capacity than image, audio, or video steganography because linguistic units carry more semantic load.Suggested directions include information retrieval, greater diversity, and diffusion language models.
  • Deployment challenges: Most generative methods remain symmetric and white-box, requiring Alice and Bob to access the same model despite increasing computational and memory demands.This makes black-box and asymmetric designs more relevant to realistic deployment scenarios.
  • Evaluation challenges: Distributional guarantees from KL divergence and perplexity do not ensure imperceptibility in realistic human-facing scenarios.Human evaluation and LLM-as-a-judge metrics are increasingly important but remain absent from most works.
  • Benchmark and ethics challenges: Current works show benchmark inconsistencies across datasets or prompts, language models, steganalysis methods, and other metrics.The survey also identifies LLM licenses such as OpenRAIL and Meta’s Llama licenses as potential restrictions on deceptive uses central to linguistic steganography.
Loading 2608.29077v1…