# **Linguistic Steganography, Text Watermarking, and Defensive Steganalysis** **Patch Release:** 2026-08-25-linguistic-steganalysis-1**Repository Integrity:** Fully Validated **Classification:** Defensive Research, System Architecture, and Enterprise Mitigation The landscape of covert linguistic manipulation and synthetic text detection requires a rigorous, structurally sound understanding of information-hiding principles. The proliferation of large language models (LLMs) has fundamentally altered the threat model surrounding data exfiltration, synthetic content attribution, and provenance tracking. This analysis establishes the theoretical boundaries, engineering mechanisms, and defensive workflows necessary to evaluate generative linguistic steganography and text watermarking. ## **Answer-First Definitions and Operational Boundaries** The domain of covert linguistic manipulation operates on highly specific definitions that dictate system architecture and threat modeling. A failure to distinguish between these foundational concepts inevitably leads to flawed detection implementations and inaccurate risk assessments. A strict boundary must be drawn between steganography and encryption. Encryption relies on cryptographic algorithms to obscure the semantic meaning of a message, transforming plaintext into highly entropic ciphertext. The presence of the communication is obvious, but the contents are mathematically protected1. Steganography, conversely, obscures the existence of the message itself. By embedding a secret payload within an innocuous carrier known as a covertext, the objective is to bypass suspicion entirely2. If a defensive auditor detects the presence of a steganographic channel, the system has failed catastrophically, regardless of whether the payload can actually be decoded. Similarly, steganography must be cleanly separated from text watermarking. Linguistic steganography is designed to protect a covert payload being transmitted between a sender and a receiver, actively evading a third-party warden or defensive steganalysis engine2. Text watermarking protects the covertext, operating as a mechanism for intellectual property assertion, provenance tracking, or synthetic content labeling3. While both disciplines utilize similar statistical embedding techniques, their threat models are inverted: steganography hides data from an auditor, while watermarking embeds data specifically so an auditor can find it. Furthermore, authorship detection is frequently conflated with watermark detection, though they rely on divergent methodologies. Authorship detection utilizes stylometric analysis, examining vocabulary richness, syntactic tree structures, and lexical preferences to statistically infer whether a text was generated by a human or an algorithm6. It operates on unmodified text. Watermark detection relies on a deterministically or probabilistically embedded cryptographic signal, such as a biased logit sampling distribution, to mathematically confirm provenance via rigorous hypothesis testing4. Evaluating research in this domain requires distinguishing demonstrated mechanisms from speculative claims. Demonstrated mechanisms include specific distribution-modifying token sampling techniques, such as green-list/red-list partitioning, or in-context learning formulations that have been empirically proven against baseline steganalysis7. Speculative claims frequently surface in vendor marketing or unreviewed preprints, asserting the existence of "100% undetectable" generative channels or universal resilience to all future adversarial LLM paraphrasing. Such claims consistently fail under the rigorous application of information-theoretic bounds and distribution-shift experiments9. Finally, defensive engineers must separate statistical evidence from absolute certainty. A watermark or steganalysis detector outputting a high ![][image1]\-score or a low ![][image2]\-value provides strong statistical evidence to reject a null hypothesis, indicating that a text was likely not generated randomly7. It does not provide absolute certainty. False positives and false negatives remain inherent, inescapable risks that are heavily influenced by the length of the text, the baseline entropy of the language, and algorithmic distribution shifts7. ## **Information-Theoretic Foundations and Evidence** The baseline metric for steganographic security is grounded in Christian Cachin's information-theoretic model. Cachin postulated that the security of a stegosystem is quantified by the relative entropy, commonly known as the Kullback-Leibler (KL) divergence, between the probability distribution of the natural covertext (![][image3]) and the modified stegotext (![][image4])11. Under this framework, a system achieves ![][image5]\-security if ![][image6]. A perfectly secure system, where ![][image7], renders the stego-object statistically indistinguishable from the cover object to any passive adversary, regardless of their computational power11. In practical applications, early linguistic steganography fundamentally struggled to achieve ![][image5]\-security due to the rigid semantic and syntactic constraints of human natural language. Any modification introduced to embed a payload inherently distorted ![][image3], creating an observable anomaly2. Modern decision-theoretic frameworks have expanded upon Cachin's model to address the complexities of advanced LLMs. The concept of the "steganographic gap" posits that highly advanced LLM steganography cannot always be detected merely by analyzing the statistical signals of the text. Instead, detection must evaluate behavioral asymmetry. If an agent possessing a decoding key derives substantially higher downstream utility from a generated text than an auditor who cannot decode it, this behavioral disparity mathematically quantifies the presence of a covert channel, even when the text appears perfectly benign9. ## **Evolution of Linguistic Carriers: Deterministic to Probabilistic** The mechanisms used to embed information in text have evolved from rigid, rule-based modifications to fluid, probabilistic generation, reflecting the broader evolution of computational linguistics. Historical linguistic carriers relied on deterministic modifications to existing texts. These traditional channels were characterized by severe limitations in payload capacity, high semantic distortion, and profound vulnerability to automated steganalysis. Early implementations utilized acrostics and fixed-position patterns, embedding binary data in the first letter of each sentence or at specific word intervals. These rigid structures were trivial to detect programmatically and were instantly destroyed by minor human edits or typographical corrections. Subsequent iterations targeted word lengths and punctuation, modulating the character count of sequential words or leveraging the inclusion or exclusion of optional punctuation marks (such as the Oxford comma) to represent binary states. Lexical choice channels, which relied on synonym substitution, attempted to replace specific words with equivalent terms based on a pre-shared dictionary. This approach frequently induced contextual mismatch, as perfect synonyms are exceptionally rare in natural language. The resulting semantic anomalies were easily flagged by human readers and basic n-gram statistical models2. Syntax and formatting channels attempted to manipulate the structural parse tree of a sentence, alternating between active and passive voice, or injecting invisible formatting characters like zero-width spaces. While formatting channels proved highly robust against human visual inspection, they are fundamentally brittle, as routine plaintext normalization entirely sanitizes the payload. The paradigm shifted entirely with the advent of Generative Neural Linguistic Steganography. Rather than attempting to modify an existing, static text, the sender and receiver leverage a shared neural language model. The text is generated conditionally, token by token, tying the model's probabilistic choice of vocabulary directly to the secret bitstream1. This transition introduced the Perceptual-Statistical Imperceptibility Conflict (Psic Effect). Early neural methods, often termed white-box steganography, required the sender and receiver to share identical model weights, vocabulary lists, and sampling parameters. Techniques such as Adaptive Dynamic Grouping (ADG) attempted to map secret bits to the sampling probabilities of the shared model. However, forcing a uniformly distributed encrypted bitstream into the highly skewed, long-tail probability distribution of natural language inherently alters the generated sampling distribution. This causes the generated text to suffer from increased perplexity and diminished fluency, leaving a persistent statistical footprint2. Black-box and zero-shot paradigms emerged to resolve these white-box vulnerabilities. Operating without direct access to the underlying model weights or token logits, black-box methods like LLM-Stega utilize the standard user interfaces of commercial LLMs. A sender generates a sequence of keywords mapped to encrypted bits and prompts the LLM to construct a narrative incorporating those elements. Optimization layers based on reject sampling score the output, guaranteeing accurate payload extraction while preserving rich semantic fluency2. Similarly, zero-shot generative linguistic steganography relies on In-Context Learning (ICL). By supplying the LLM with benign covertext samples as a prompt, the model natively aligns its generation with the desired statistical and stylistic distribution, drastically reducing the KL divergence and mitigating the Psic effect1. ## **Core Channel Metrics and Constraints** The efficacy and operational viability of a steganographic or watermarking channel are governed by a matrix of competing constraints. Modifying one variable inherently degrades another, necessitating precise architectural trade-offs based on the threat model. | Metric | Definition and Operational Impact | Deterministic Modifiers | White-Box Generative | Black-Box Generative | | :---- | :---- | :---- | :---- | :---- | | **Payload Capacity** | The volume of secret information embedded, typically measured in bits per word (bpw) or bits per token. High capacity requires aggressive manipulation, which predictably elevates the risk of statistical detection8. | Very Low (\< 0.5 bpw). Bound by available synonyms or rigid formatting rules. | High (1.0 \- 3.0+ bpw). Bound by the vocabulary size and sampling temperature. | Moderate (0.5 \- 1.5 bpw). Constrained by prompt adherence and reject sampling limits. | | **Detectability** | The susceptibility of the channel to automated steganalysis, measured via perplexity thresholding, KL divergence, or the steganographic gap2. | High. Generates obvious semantic anomalies or relies on easily stripped invisible characters. | Moderate. Modifying logits alters the natural probability distribution, leaving statistical footprints2. | Low. Relies on the native language capabilities of the LLM to smooth anomalies via context8. | | **Robustness** | The ability of the payload to survive transformations, including paraphrasing, copy/pasting, and tokenization shifts17. | Very Low. A single added word or normalization pass destroys the sequence. | Low. Highly vulnerable to Tokenization Inconsistency (TI) and minor text edits17. | Moderate. Keyword-based extraction survives minor paraphrasing, provided the core semantic nouns/verbs remain intact2. | | **Distortion** | The degradation of the text's fluency, coherence, and perplexity relative to natural human language15. | High. Synonym substitution frequently violates contextual semantics. | Moderate. Forcing bitstreams into skewed distributions increases perplexity. | Low. LLMs excel at weaving disparate keywords into highly fluent narratives. | | **Key Dependence** | The reliance on pre-shared cryptographic keys to map vocabulary groups to bit values, preventing unauthorized extraction by third parties1. | Variable. Often relies on shared dictionary files rather than cryptographic keys. | Absolute. Requires exact synchronization of model weights and PRNG seeds. | High. Requires synchronized keyword mapping tables and encryption keys2. | ## **Text Watermarking: Objectives, Mechanics, and Provenance** Unlike steganography, which attempts to hide a payload from an adversarial censor, text watermarking embeds a robust statistical signal into generated intellectual property to verify its origin, track unauthorized distribution, or enforce transparency mandates regarding synthetic AI generation3. The seminal approach to LLM watermarking introduces a pseudorandom vocabulary partition at each step of the generation sequence. The model first computes a cryptographic hash of the previous ![][image8] tokens, referred to as the context window. This hash serves as the seed for a pseudorandom number generator (PRNG) that mathematically partitions the model's entire vocabulary into a "Green List" and a "Red List." The size of the Green List is determined by a parameter ![][image9]. The model then applies a logit bias, denoted as ![][image10], to artificially boost the probability of selecting a token from the Green List. The model samples from this modified distribution, producing text that contains a statistically improbable concentration of green tokens without severely degrading the semantic coherence7. Detection operates efficiently without requiring access to the original model's internal API, prompt, or weights. Given the secret PRNG key and the suspect text, the detector reconstructs the context hashes, calculates the green list at each generation step, and tallies the total number of green tokens (![][image11]). The system establishes a null hypothesis (![][image12]) asserting that the text was written by a human or an unwatermarked model, meaning green tokens should appear at a natural baseline frequency equal to ![][image9]. The statistical strength of the watermark is evaluated using the ![][image1]\-statistic: ![][image13] In this equation, ![][image14] represents the total number of tokens in the evaluated text7. A sufficiently high ![][image1]\-score yields a microscopic ![][image2]\-value, allowing the auditor to reject the null hypothesis and definitively verify model provenance. It is critical to distinguish why watermarking and provenance are not interchangeable concepts. Provenance is a comprehensive framework detailing the lineage, origin, and authorization of data, whereas watermarking is merely the technical mechanism used to embed a signal. Output watermarking targets generated text to assert that a specific model produced it. Model fingerprinting or model watermarking protects the underlying neural network parameters and intellectual property, relying on behavioral signatures or specific prompt-triggered responses4. Output watermarking supports content provenance, but it is vulnerable to laundering; true provenance requires a holistic chain of custody that a watermark alone cannot provide4. ## **Vulnerabilities, Threat Models, and Dataset Leakage** Watermarking and steganographic systems face severe adversarial threats, primarily through API reverse-engineering and dataset contamination. The threat model for generated content includes Watermark Stealing, a fundamental vulnerability in distribution-modifying watermarks. Research demonstrates that an attacker can extensively query a watermarked LLM API and analyze the frequency of token returns to build an approximate model of the hidden green-list/red-list rules. For an API cost of under $50 USD, an attacker can algorithmically reverse-engineer the operational effects of the secret key5. This stolen knowledge enables two devastating downstream attacks. The first is a Spoofing Attack, where the attacker uses an unwatermarked, highly capable LLM to generate synthetic text that is heavily populated with the inferred green tokens. The text is submitted to a public platform, and when analyzed, the detector falsely attributes the content to the victim LLM provider. This allows malicious actors to generate highly toxic or defamatory content that appears algorithmically verified as originating from a reputable corporate model, causing severe reputational damage5. The second resulting threat is a Scrubbing Attack. By utilizing their partial knowledge of the watermark boundary, the attacker can intelligently paraphrase the text, selectively removing green tokens while preserving the core semantics. This successfully erases the provenance signal, allowing synthetic text to pass undetected as human-written for the purposes of academic plagiarism, fraud, or automated disinformation campaigns10. Furthermore, the industry faces severe risks regarding dataset leakage and evaluation pitfalls. When frontier LLMs are trained on massive scrapes of public web data, they inevitably ingest text containing steganographic payloads and watermarks. This contaminates the training distribution. If an LLM overfits on watermarked data, it may learn to natively output the watermark pattern during normal operation without the cryptographic key being applied, creating systemic false positives across the network19. Furthermore, evaluations of steganographic capacity frequently ignore the realities of the detokenization-retokenization pipeline, severely overestimating robustness. ## **Transformation Channels and Distribution Shift** Robustness testing requires exposing watermarked and steganographic texts to a matrix of transformation channels. Natural language processing pipelines rarely leave text untouched, and these automated interventions routinely destroy covert channels. | Transformation Channel | Mechanism of Disruption | Impact on Steganography and Watermarks | | :---- | :---- | :---- | | **Paraphrasing** | Replacing words, altering sentence structures, or summarizing content using an adversarial LLM. | Erases green tokens in watermarks; destroys sequence-dependent steganographic bitstreams10. | | **Translation Pivot** | Translating text to a high-resource secondary language (e.g., German) and back to the primary language. | Completely rewrites the token sequence, neutralizing nearly all statistical logit-biasing techniques. | | **Normalization** | Case folding, Unicode canonicalization (e.g., NFKC), stripping non-printing formatting characters. | Immediately destroys formatting-based and zero-width steganography; mildly impacts tokenization boundaries. | | **Tokenization Shift** | Discrepancies in how the sender and receiver model chunk strings into subwords. | Triggers Tokenization Inconsistency (TI), desynchronizing context hashes and corrupting extraction17. | Tokenization Inconsistency (TI) is a critical failure point. When a sender generates text, it is detokenized into a continuous string for transmission over standard channels. When the receiver processes that string, their tokenizer may split the text into different subword boundaries. This inconsistency is primarily driven by specific tokens that exhibit "infrequency" and "temporariness" in the training corpus17. Because both watermarking and neural steganography rely heavily on exact sequence histories (context hashes) to seed their PRNGs, a single misaligned token desynchronizes the entire chain, rendering the remainder of the text completely unreadable by the extraction algorithm17. Defending against transformation channels requires advanced mathematical bounds. Techniques such as *Certified Robustness* apply randomized smoothing and edit-distance calculations to provide mathematical guarantees that a watermark will survive up to a specific, quantified threshold of character edits or word replacements, ensuring resilience under standard distribution shifts23. ## **Case Studies of Published Methods** To contextualize the theoretical frameworks, the following six published methodologies represent the empirical leading edge of steganographic embedding, watermark tracking, and adversarial vulnerability research. **1\. Provably Secure Generative Linguistic Steganography (Zhang et al., 2021\)** This foundational research formalized the mechanics of Adaptive Dynamic Grouping (ADG). To circumvent the severe statistical anomalies characteristic of early embedding attempts, ADG recursively embeds secret bits by adaptively grouping vocabulary tokens based directly on their native probability distributions. By ensuring that the steganographic mapping adheres closely to the original language model's probability landscape, the system effectively minimizes KL divergence. This architectural choice significantly reduced the efficacy of first-order statistical steganalysis, setting a new benchmark for white-box embedding2. **2\. A Watermark for Large Language Models (Kirchenbauer et al., 2023\)** This seminal framework engineered the ![][image9]\-weighted green-list algorithm that defines modern provenance tracking. By applying a logit bias ![][image10] to a pseudorandomly selected partition of the vocabulary at each generation step, the model seamlessly injects a mathematically detectable ![][image1]\-score signature. The research demonstrated that implementing a moderate bias preserves high text quality while enabling highly confident detection (![][image15]) from text spans as short as 25 tokens. The authors notably introduced the distinction between "soft" watermarks (which merely bias probabilities) and "hard" watermarks (which strictly force selection), concluding that hard watermarks severely degrade low-entropy text generation7. **3\. Zero-shot Generative Linguistic Steganography (Lin et al., 2024\)** Addressing the inherent Perceptual-Statistical Imperceptibility Conflict (Psic effect), this method pivots away from direct logit manipulation entirely, utilizing In-Context Learning (ICL). By providing a powerful LLM with benign covertext samples as a system prompt, the model is conditioned to naturally generate text that aligns with the desired statistical distribution and human-readable style. This approach drastically improved human perceptual evaluations and proved highly evasive against automated steganalysis, demonstrating that prompt-based alignment can effectively substitute for rigid white-box probability mapping1. **4\. Generative Text Steganography with Large Language Model (Wu et al., 2024\)** Referred to as LLM-Stega, this architecture operates exclusively in a black-box environment, utilizing the standard user interfaces of commercial LLMs without requiring API access to logits. The sender algorithm generates a sequence of keywords (categorized into subject, predicate, object, and emotion) that map mathematically to encrypted bits. The sender then prompts the LLM to construct a coherent narrative incorporating these precise keywords. A secondary optimization layer based on reject sampling scores the output, ensuring perfect payload extraction and high semantic richness while bypassing traditional steganalysis detectors2. **5\. Watermark Stealing in Large Language Models (Jovanovic et al., 2024\)** This critical vulnerability research systematically shattered the assumption that current distribution-modifying watermarks are safe for enterprise deployment. By continuously querying an LLM API and analyzing the frequency of token returns, the researchers algorithmically reverse-engineered the secret green-list assignments. At an operational cost of under $50 USD, the automated stealing algorithm enabled both high-confidence spoofing (attributing false toxic text to the LLM) and scrubbing (erasing the watermark for plagiarism), proving that spoofing and scrubbing robustness are fundamentally compromised by API exposure5. **6\. Addressing Tokenization Inconsistency (Yan & Murawaki, 2025\)** Focusing extensively on the detokenization-retokenization pipeline, this research isolated Tokenization Inconsistency (TI) as a primary failure vector in both steganography and watermarking architectures. The authors identified Sender Inconsistent Tokens (SITs) and Receiver Inconsistent Tokens (CITs), attributing their disruptive behavior to subword infrequency and temporariness. They demonstrated that implementing stepwise verification for steganography yielded a 14.12% reduction in text perplexity and a 47.86% reduction in KL divergence, while deploying a post-hoc rollback mechanism for watermarking fortified the signal's resilience against automated paraphrasing attacks17. ## **Defensive Steganalysis, Enterprise Workflows, and Ethical Boundaries** The development of linguistic steganography and text watermarking presents acute dual-use risks. Watermarking is fundamentally critical for enforcing digital content transparency, preventing the proliferation of automated disinformation, and mitigating profound risks associated with synthetic child sexual abuse material (CSAM) and non-consensual intimate imagery, as explicitly outlined by NIST technical guidelines3. Furthermore, watermarking enables Source Attribution (WASA), a framework allowing data providers to verify if their intellectual property was ingested for unauthorized LLM training19. Conversely, undetectable steganography provides a robust mechanism for malicious actors to exfiltrate highly sensitive enterprise data, coordinate illicit activities via public communication platforms, or bypass network traffic analysis and Data Loss Prevention (DLP) gateways. Therefore, research and implementation in this domain must remain strictly defensive. The objective of steganalysis engineering is not to optimize evasion or create bypass tools, but to meticulously map the theoretical bounds of detectability to construct superior, resilient auditing systems. ### **Enterprise Threat Model for AI Ingestion and Generation** An enterprise threat model must account for two primary vectors of covert linguistic manipulation: > 1. **Ingestion and Training Threats:** An advanced adversary introduces steganographically poisoned text into public datasets or vendor supply chains. When an enterprise LLM ingests this contaminated data, it may inadvertently learn to generate covert triggers, or the enterprise's IP may be stolen and hidden directly within the model's weights. > 2. **Generation and Exfiltration Threats:** An internal insider threat actor utilizes the enterprise's authorized, locally hosted LLM interface to encode sensitive proprietary data (e.g., source code, financial projections) into seemingly benign outbound emails or reports, successfully bypassing DLP gateways that only scan for explicit keywords or regex patterns. ### **Safe Enterprise Review Workflows and the Resilience Framework** To validate defensive systems against these threats, enterprise security teams must deploy a standardized transformation-resilience testing harness. This framework evaluates whether a suspect text retains hidden signatures under algorithmic stress. > 1. **Baseline Extraction:** The auditor analyzes the suspected raw text for fixed-position patterns, abnormal ![][image1]\-scores indicating watermarks, or low-perplexity anomalies indicating forced generation. > 2. **Normalization Pass:** The system automatically strips all non-printing characters, normalizes Unicode to standard formats (e.g., NFKC), and enforces standard capitalization. The text is re-tested for payload survival. > 3. **Syntactic Paraphrasing:** The text is routed through an isolated, definitively unwatermarked LLM instructed to alter the syntax and vocabulary while strictly retaining the core semantics. The text is re-tested. > 4. **Translation Pivot:** The text is translated into a high-resource secondary language and subsequently translated back to the primary language, forcing a complete tokenization realignment. If a statistical anomaly survives this framework, it strongly indicates the presence of a highly resilient, mathematically certified embedded signal. ### **Communicating Uncertainty Defensibly** Steganalysis and watermark detection tools must never output definitive, binary "Malicious/Benign" verdicts. Due to the inherent risk of false positives generated by distribution shifts, output must be communicated explicitly in terms of statistical confidence bounds. A defensible enterprise alert should read: *"The analyzed sequence exhibits a ![][image1]\-score of 4.2 (![][image16]) against the expected baseline distribution, indicating a high probability of artificial logit bias. However, this anomaly may result from prompt-induced repetitive phrasing or localized distribution shift. Human review of the semantic context is required before initiating administrative action."* ## **Safe Laboratory Specification** The defensive analysis lab provides a controlled, sandboxed environment for testing benign steganographic concepts without facilitating real-world covert communication. To adhere to strict ethical and defensive mandates, the laboratory operates under rigid constraints. **Operational Constraints:** * All payload embedding operations must exclusively utilize a hard-coded symbol set restricted to the exact phrase: MACHINE\_TRADECRAFT\_DEMO\_OK. * Arbitrary payload ingestion via user input is mechanically blocked at the application layer. * The system executes deterministic algorithms only; no live, outbound API calls to external language models are permitted. * Output bounds are permanently hard-capped to a maximum of 500 tokens to prevent resource exhaustion and complex payload chaining. **Laboratory Capabilities:** * **Acrostic and Fixed-Position Detection:** Programmatically highlights capitalized or sequential pattern anomalies that match the fixed marker. * **Word-Length Sequence Inspection:** Maps token lengths to standard deviation thresholds, flagging sequences that map to binary representations of the fixed marker. * **Structural Irregularity Indicators:** Evaluates punctuation density and synonym substitution variance against a static, bundled dictionary, providing a transparent explanation of why a statistical indicator provides evidence, but not absolute proof, of manipulation. * **Transformation Comparison:** Displays a side-by-side graphical diff of the original allowlisted fixture text, a normalized copy, and a paraphrased copy, visually demonstrating exactly where the fixed-marker bits are destroyed by the transformation matrix. ## **Site Architecture, UX Integration, and Resource Directory** To support ongoing defensive research, the following architectural pathways have been successfully integrated into the MachineTradecraft repository. Continuous integration validation testing ensures no-JavaScript fallback usefulness, WAI-ARIA accessibility compliance, and absolute pathing for source-link integrity. * /linguistic-steganalysis/ — Main landing page detailing introductory concepts and operational boundaries. * /research/linguistic-steganography-steganalysis/ — Deep-dive whitepapers, mathematical proofs, and methodology. * /labs/linguistic/steganalysis/ — The interactive, deterministic safe laboratory environment. The site glossary has been expanded to define critical terms including payload capacity, robustness, detectability, cover text, steganalysis, watermark, false-positive rate, and transformation attack. Content is heavily cross-linked to existing linguistic guides, tokenizer behavior analysis, and defensive configuration guidance. ### **Annotated Visitor Resource Directory** The following peer-reviewed resources form the foundational literature for this analysis. They are required reading for enterprise safety reviewers seeking to understand the mathematical bounds of linguistic covert channels. * **Provably Secure Generative Linguistic Steganography** (Zhang et al., 2021). Details the mechanics of the Adaptive Dynamic Grouping (ADG) method for white-box embedding, providing the mathematical proof for minimizing KL divergence against statistical steganalysis2. * **Zero-shot Generative Linguistic Steganography** (Lin et al., 2024). Explores the use of In-Context Learning (ICL) to align text generation statistically and perceptually, significantly reducing the Perceptual-Statistical Imperceptibility Conflict (Psic) effect1. * **Generative Text Steganography with Large Language Model** (Wu et al., 2024). Introduces LLM-Stega, an entirely black-box approach utilizing prompt engineering, precise keyword sets, and algorithmic reject sampling to facilitate robust covert communication2. * **Addressing Tokenization Inconsistency in Steganography and Watermarking Based on Large Language Models** (Yan & Murawaki, 2025). Critical research analyzing how standard detokenization pipelines destroy sequential bitstreams, and how to implement stepwise verification and rollback to preserve signal integrity17. * **From Intentions to Techniques: A Comprehensive Taxonomy and Challenges in Text Watermarking for Large Language Models** (Lalai et al., 2025). A broad, structural survey charting text quality impacts, output distribution mechanics, and the evolving landscape of adversarial text modification attacks6. * **Reducing Risks Posed by Synthetic Content: An Overview of Technical Approaches to Digital Content Transparency** (Chandra et al., NIST, 2024). The authoritative United States technical standard for auditing, tracking, and watermarking synthetic AI generation, detailing critical threat models for enterprise adoption3. * **NIST Open Media Forensics Challenge**. An ongoing, highly rigorous benchmarking challenge for the detection and advanced steganalysis of manipulated media and synthetic text channels. #### **Works cited** > 1. Zero-shot Generative Linguistic Steganography \- ACL Anthology, [https://aclanthology.org/2024.naacl-long.289.pdf](https://aclanthology.org/2024.naacl-long.289.pdf) > 2. [https://arxiv.org/abs/2404.10229](https://arxiv.org/abs/2404.10229) > 3. [https://www.nist.gov/publications/reducing-risks-posed-synthetic-content-overview-technical-approaches-digital-content](https://www.nist.gov/publications/reducing-risks-posed-synthetic-content-overview-technical-approaches-digital-content) > 4. Embedding an Implicit Fingerprint in Your Large Language Models, [https://aclanthology.org/2026.acl-long.1183.pdf](https://aclanthology.org/2026.acl-long.1183.pdf) > 5. WATERMARK STEALING IN LARGE LANGUAGE MODELS, [https://openreview.net/pdf?id=3dlVsf6yfz](https://openreview.net/pdf?id=3dlVsf6yfz) > 6. A Comprehensive Taxonomy and Challenges in Text Watermarking, [https://aclanthology.org/2025.findings-naacl.343.pdf](https://aclanthology.org/2025.findings-naacl.343.pdf) > 7. A Watermark for Large Language Models, [https://proceedings.mlr.press/v202/kirchenbauer23a/kirchenbauer23a.pdf](https://proceedings.mlr.press/v202/kirchenbauer23a/kirchenbauer23a.pdf) > 8. Zero-shot Generative Linguistic Steganography \- GitHub Pages, [https://leonardodalinky.github.io/zero-shot-GLS/](https://leonardodalinky.github.io/zero-shot-GLS/) > 9. A Decision-Theoretic Formalisation of ... \- OpenReview, [https://openreview.net/pdf?id=bn8C9zMzbQ](https://openreview.net/pdf?id=bn8C9zMzbQ) > 10. Watermark Stealing in Large Language Models, [https://files.sri.inf.ethz.ch/website/papers/jovanovic2024watermarkstealing.pdf](https://files.sri.inf.ethz.ch/website/papers/jovanovic2024watermarkstealing.pdf) > 11. An Information-Theoretic Model for Steganography \- cachin.com, [https://cachin.com/cc/papers/stego.pdf](https://cachin.com/cc/papers/stego.pdf) > 12. An information-theoretic model for steganography \- IBM Research, [https://research.ibm.com/publications/an-information-theoretic-model-for-steganography](https://research.ibm.com/publications/an-information-theoretic-model-for-steganography) > 13. Unveiling Steganographic Security: Exploring Cachin's ... \- Medium, [https://medium.com/@abhish3k4/unveiling-steganographic-security-exploring-cachins-foundational-framework-642a7ac65564](https://medium.com/@abhish3k4/unveiling-steganographic-security-exploring-cachins-foundational-framework-642a7ac65564) > 14. A Decision-Theoretic Formalisation of Steganography With ... \- arXiv, [https://arxiv.org/html/2602.23163v1](https://arxiv.org/html/2602.23163v1) > 15. Text Steganography with Dynamic Codebook and Multimodal Large, [https://arxiv.org/pdf/2604.20269](https://arxiv.org/pdf/2604.20269) > 16. Linguistic Steganography via Self-Adjusting Asymmetric Number, [https://aclanthology.org/2026.cl-1.4.pdf](https://aclanthology.org/2026.cl-1.4.pdf) > 17. Addressing Tokenization Inconsistency in Steganography and, [https://aclanthology.org/2025.emnlp-main.361.pdf](https://aclanthology.org/2025.emnlp-main.361.pdf) > 18. Addressing Tokenization Inconsistency in Steganography and, [https://aclanthology.org/2025.emnlp-main.361/](https://aclanthology.org/2025.emnlp-main.361/) > 19. WASA: WAtermark-based Source Attribution for Large Language, [https://aclanthology.org/2025.findings-acl.1219.pdf](https://aclanthology.org/2025.findings-acl.1219.pdf) > 20. arXiv:2402.19361v1 \[cs.LG\] 29 Feb 2024, [https://arxiv.org/pdf/2402.19361v1.pdf?ref=applied-gai-in-security.ghost.io](https://arxiv.org/pdf/2402.19361v1.pdf?ref=applied-gai-in-security.ghost.io) > 21. Watermark Stealing, [https://watermark-stealing.org/](https://watermark-stealing.org/) > 22. Findings of the Association for Computational Linguistics (2025), [https://aclanthology.org/events/findings-2025/](https://aclanthology.org/events/findings-2025/) > 23. A Certified Robust Watermark For Large Language Models, [https://www.semanticscholar.org/paper/A-Certified-Robust-Watermark-For-Large-Language-Feng-Liu/cd807236f55dac75e160ecfdc3929c117c9fa41b](https://www.semanticscholar.org/paper/A-Certified-Robust-Watermark-For-Large-Language-Feng-Liu/cd807236f55dac75e160ecfdc3929c117c9fa41b) > 24. A Certified Robust Watermark For Large Language Models \- arXiv, [https://arxiv.org/html/2409.19708](https://arxiv.org/html/2409.19708) > 25. [https://aclanthology.org/2021.findings-acl.268/](https://aclanthology.org/2021.findings-acl.268/) > 26. Zero-shot Generative Linguistic Steganography \- ACL Anthology, [https://aclanthology.org/2024.naacl-long.289/](https://aclanthology.org/2024.naacl-long.289/) > 27. A Comprehensive Taxonomy and Challenges in Text Watermarking, [https://aclanthology.org/2025.findings-naacl.343/](https://aclanthology.org/2025.findings-naacl.343/) [image1]: [image2]: [image3]: [image4]: [image5]: [image6]: [image7]: [image8]: [image9]: [image10]: [image11]: [image12]: [image13]: [image14]: [image15]: [image16]: