# **Advanced Frameworks in Semantic Steganography: Vocabulary-Class Encoding, Generative Models, and Information-Theoretic Security** ## **Introduction to Linguistic and Semantic Steganographic Communication** The domain of information security has historically bifurcated into two foundational paradigms: cryptography, which seeks to render intercepted information mathematically incomprehensible to unauthorized entities, and steganography, which seeks to conceal the very existence of the communication channel1. While cryptographic protocols establish confidentiality, they inherently broadcast the presence of a secret, thereby inviting targeted surveillance, traffic analysis, or censorship by adversarial networks3. Steganography mitigates this vulnerability by embedding covert payloads within innocuous carrier media, transforming standard digital artifacts into covert communication channels1. Within this discipline, Semantic Steganographic Communication (SemSteCom) represents the absolute frontier of linguistic information hiding. Traditional textual steganography operates primarily at the syntactic or structural level, modifying characters, whitespace, or grammar to encode binary sequences5. Conversely, SemSteCom operates at the abstract layer of human meaning. It leverages the intrinsic redundancy and generative flexibility of natural language to embed covert data into the macroscopic semantic structures, conceptual entities, and contextual attributes of machine-generated text5. Formally, a semantic steganographic scheme is defined by a cover space ![][image1], a message space ![][image2], an encoder function ![][image3], and a decoder function ![][image4]. The defining characteristic of SemSteCom is its strict adherence to semantic distortion constraints, denoted as ![][image5], which ensures that the embedded information remains perceptually and contextually indistinguishable from natural language5. By shifting the embedding process from the symbol space (tokens, bits) to the latent semantic space, SemSteCom achieves robust, high-capacity covert channels that exhibit state-of-the-art resilience to both statistical and semantic steganalysis5. The ensuing analysis provides a comprehensive investigation into the mechanisms underpinning semantic steganography. It explores the evolution from rudimentary vocabulary-class encoding to the sophisticated architecture of generative language models serving as coverless steganographic engines. Furthermore, it delineates the mathematical formulations of provably secure encoder-decoder mappings, evaluates the theoretical limits of information transmission capacity, and examines the statistical and semantic signals utilized in modern steganalysis to detect these covert operations. ## **The Evolution of Lexical Manipulation and Vocabulary-Class Encoding** The conceptual foundation of semantic steganography is deeply rooted in early attempts to manipulate the lexical choices of a text without altering its underlying proposition. Natural language possesses an inherent lexical redundancy; there are frequently multiple valid linguistic pathways to express a singular concept7. Lexical steganography capitalizes on this redundancy by establishing deterministic mappings between specific vocabulary selections and covert binary payloads. ### **Syntactic Templates and Vocabulary Classification** Early automated linguistic steganography systems attempted to balance structural integrity with embedding capacity through context-free grammars (CFGs) and style sources. The NICETEXT framework, a seminal system in this domain, generated syntactically correct cover texts by categorizing a massive dictionary of words into specific semantic categories or "types"2. To encode a secret message, the system randomly selected a syntactic sentence template (e.g., \[Noun\]\[Preposition\]\[Verb\]\[Noun\]) and populated it by choosing words from the corresponding semantic categories. The specific word chosen within a category was dictated by its pre-assigned binary code, which matched the desired payload bitstream4. While mechanically sound for encoding, vocabulary-class encoding via rigid syntactic templates suffered from profound semantic drift. Because the system lacked an understanding of real-world logic, it frequently generated grammatically flawless but semantically nonsensical sentences (e.g., "crusty moose sleep")2. The generated texts were completely disjointed, lacking the macroscopic rhetorical structure and inter-sentence continuity required to pass casual human inspection, let alone rigorous algorithmic analysis. ### **Semantic Clustering and Synonym Substitution** To resolve the semantic incohesion inherent in generative templates, researchers pivoted to modification-based linguistic steganography, primarily through synonym substitution4. In this paradigm, an existing, human-authored cover text is parsed using natural language processing tools, such as NLTK, for part-of-speech (POS) tagging and semantic analysis12. Target words are identified, and a pre-compiled dictionary of synonyms provides interchangeable alternatives. Modern implementations of this technique utilize semantic clustering algorithms. Words are mapped into a high-dimensional vector space using word embeddings, and ![][image6]\-means or density-based clustering algorithms group words with high semantic similarity into discrete clusters. When a target word is encountered in the cover text, the encoder selects a substitute word from the same semantic cluster. To embed information, each word in the cluster is assigned a probability ranking or binary index13. By selecting the word with the highest probability within each cluster that matches the secret bitstream, the algorithm preserves text naturalness and imperceptibility. Furthermore, the requirement of high intra-cluster semantic similarity strictly minimizes semantic drift, ensuring the localized meaning of the sentence remains intact13. ### **Internal Token Layering and Dual Meanings** A more advanced iteration of lexical manipulation is internal token layering, a strategy frequently observed in large language model reasoning traces. In this approach, tokens or text segments are internally partitioned to carry dual meanings8. Rather than explicitly substituting synonyms, the encoder assigns additional private meanings to specific tokens through internal grouping schemes. The text appears entirely monitorable and innocuous to an external observer, but the sequence of selected tokens conveys a secondary, serial reasoning stream or hidden message that only the synchronized decoder can interpret7. ### **Table 1: Comparative Analysis of Lexical Encoding Frameworks** | Encoding Strategy | Core Mechanism | Semantic Fidelity | Primary Vulnerability | Information Capacity | | :---- | :---- | :---- | :---- | :---- | | **Syntactic Templates (NICETEXT)** | Maps bits to vocabulary classes inserted into rigid CFG templates. | Very Low; prone to logical absurdities and lack of macroscopic continuity. | Semantic analysis easily flags disjointed narrative structures. | Moderate; limited by dictionary size and template complexity. | | **Synonym Substitution** | Replaces words in an existing cover text with synonymous alternatives mapped to bits. | High locally, but prone to subtle register or contextual mismatches. | Algorithmic detection via synonym frequency and Graph Neural Networks (GNNs). | Low; bottlenecked by the natural frequency of substitutable words. | | **Semantic Clustering** | Groups words by vector similarity; selects words matching bitstream within tight clusters. | High; intra-cluster similarity restricts aggressive semantic drift. | Susceptible to Synonym Substitution-based Text Attacks (ISSA). | Moderate; constrained by cluster density and candidate pool size. | | **Internal Token Layering** | Assigns secondary private meanings to standard tokens via internal partitioning. | Very High; reads naturally to human observers. | Requires complex key synchronization; vulnerable to language model updates. | High; utilizes full token distribution capabilities. | ## **Constrained Text Generation (CTG) as a Steganographic Engine** The limitations of modifying existing texts—which inevitably leave statistical fingerprints—catalyzed a transition toward generative linguistic steganography (GLS)1. Instead of altering a cover text, GLS utilizes generative models to synthesize original text directly from the secret payload. This process fundamentally aligns with the broader field of Constrained Text Generation (CTG), which focuses on integrating external control conditions into the natural language generation process16. ### **The Mechanics of Constrained Generation** In standard CTG, a language model is directed to generate text that satisfies specific criteria, such as maintaining a particular sentiment, adhering to a storyline, or avoiding toxic terminology17. In the context of semantic steganography, the secret binary payload acts as the primary external constraint. The generative model must construct a sequence of tokens that perfectly encodes the binary string while simultaneously satisfying the linguistic constraints of fluency, coherence, and grammatical correctness16. Approaches to CTG in steganography generally fall into three categories: fully supervised fine-tuning, prompt-based conditioning, and progressive insertion/replacement models16. Models such as Constrained BART (CBART) and PAIR utilize progressive insertion frameworks, dynamically adding or replacing tokens during the generation process to satisfy lexical constraints without requiring architectural modifications to the underlying Transformer network16. ### **Entropy-Constrained Token Selection** A critical innovation bridging CTG and SemSteCom is entropy-constrained token selection. When utilizing an autoregressive language model, the probability of each generated token is conditional on all previously generated tokens in the sequence18. If the steganographic algorithm consistently forces the model to select low-probability tokens to satisfy the bitstream mapping, the output will quickly degenerate into incoherence. To mitigate this, advanced algorithms impose strict limits on the information entropy of the candidate token pool during generation5. For example, the ADLM-stega algorithm continually monitors the entropy ![][image7] of the candidate pool ![][image8]. It truncates the pool to ensure that the difference between the pool's entropy and a reference entropy derived from natural cover text, ![][image9], remains below a predefined threshold: ![][image10]5. By defining upper and lower bounds for token probability, the system maintains semantic coherence (by avoiding extreme low-probability tokens) while ensuring sufficient lexical diversity (by retaining enough high-probability tokens to encode the required bits). This dynamic candidate-pool truncation demonstrably lowers text perplexity and significantly enhances resistance to algorithmic steganalysis when compared to unconstrained generative models5. ## **Semantic-Space Mapping and Ontology-Entity Trees** While token-level constrained generation achieves high fluency, it remains highly fragile. Because the steganographic mapping relies on the exact sequence of selected tokens, any downstream text processing—such as synonym substitution by an intermediary, text re-rendering, or simple formatting changes—destroys the token sequence and irreversibly corrupts the payload19. To achieve true environmental robustness, SemSteCom elevates the embedding process from the microscopic symbol space to the macroscopic semantic space5. ### **Constructing the Ontology-Entity Framework** In semantic-space mapping, information is not encoded in *which* specific token is chosen, but rather in *what* concepts, entities, or attributes the generated sentence instantiates5. This is operationalized through the construction of an ontology-entity tree. An ontology-entity tree is a hierarchical knowledge graph. The upper layers of the tree consist of broad, abstract concepts (e.g., "Location", "Person", "Event"). Moving down the branches, the concepts become increasingly specific (e.g., "Tourism Location", "Politician"). The terminal leaf nodes of the tree represent concrete, discrete entities (e.g., "Washington", "Churchill")5. The steganographic process utilizing this framework proceeds in three distinct phases: > 1. **Semantic Mapping**: The secret bitstream is partitioned into fixed-length segments. Each binary segment is mapped to a specific path traversing the ontology tree, terminating at a unique entity leaf node. Because the tree contains extensive relational data, it avoids ambiguity; the path "Location ![][image11] Tourism Location ![][image11] Washington" clearly differentiates the payload from "Person ![][image11] Politician ![][image11] Washington"22. > 2. **Contextual Synthesis**: The encoder utilizes a Large Language Model (LLM) as an agentic generator. The selected entities and their ontological relationships are injected into the LLM via prompt engineering (e.g., "Write a descriptive paragraph that naturally includes the tourism location Washington and the event Inauguration"). The LLM freely generates fluent, cohesive text that incorporates these constraints14. > 3. **Semantic Extraction**: The receiver inputs the transmitted stego text into an Information Extraction (IE) or Named Entity Recognition (NER) pipeline. The system extracts the instantiated entities and maps them back against the shared ontology-entity tree. By tracing the entities back to their corresponding paths, the original binary segments are accurately reconstructed22. ### **Resilience to Semantic Noise and Translation** The implications of mapping payloads to entities rather than tokens are profound. Because the payload is intrinsically bound to the macroscopic meaning of the text, the channel becomes virtually immune to syntactic variations and structural attacks. An adversarial monitor could paraphrase the sentence, substitute synonyms, summarize the paragraph, or even translate the entire text into a different human language19. As long as the core entities survive the transformation—which they generally do, as they form the fundamental subject matter of the text—the semantic payload remains intact. This paradigm aligns seamlessly with emerging models in semantic communications, such as the Data, Information, Knowledge, Wisdom, Purpose (DIKWP) framework. In DIKWP-based mapping, communication focuses on delivering the *purpose* and *knowledge* of a message rather than flawless bit-level transmission. Semantic steganography exploits this by utilizing the "lateral" feedback pathways of LLMs, allowing the model's internal semantic reasoning to construct a natural carrier around the required knowledge points (entities), bypassing the brittleness of traditional symbol-error constraints23. ## **Encoder-Decoder Synchronization and Mapping Mechanisms** For any steganographic channel to function, regardless of whether it operates at the token or semantic level, the encoder (sender) and decoder (receiver) must maintain absolute synchronicity. The mapping mechanism must be deterministic, computationally reproducible, and mathematically secure against third-party interception. ### **Shared Context and Cryptographic Seeding** The foundation of the encoder-decoder relationship is a shared set of initial parameters. Both parties must possess identical models (e.g., the exact version of the LLM), identical inference parameters (e.g., temperature, top\-![][image12] bounds), and a shared initial context prompt ![][image13]24. Crucially, the mapping of bits to tokens or entities is not static; it is governed by a cryptographic Pseudo-Random Number Generator (PRNG). The sender and receiver exchange a symmetric private key ![][image14] via a secure out-of-band channel. This key seeds the PRNG, generating a synchronous keystream that dictates the dynamic mapping rules at each generation step25. Without the key ![][image14], an adversary observing the text cannot determine the mapping logic, as the relationship between the generated text and the underlying binary payload appears entirely stochastic. ### **Mathematical Coding Algorithms** Once the conditional probability distribution of the next token, ![][image15], is calculated by the LLM, the encoder must translate the secret bits into a specific token selection. Several mathematical algorithms facilitate this translation: > 1. **Huffman Coding (HC)**: The encoder constructs a dynamic Huffman tree based on the token probabilities at step ![][image16]. Tokens with higher probabilities are assigned shorter binary codes, while long-tail, low-probability tokens receive longer codes1. The encoder reads the requisite number of secret bits, traverses the tree, and outputs the corresponding token. While computationally efficient, Huffman coding often distorts the native probability distribution of the LLM, creating localized statistical anomalies that steganalysis tools can exploit1. > 2. **Arithmetic Coding (AC)**: Adapted from data compression theory, AC treats the secret message as a fractional value on the interval ![][image17]. The cumulative probability distribution of the LLM's vocabulary divides this interval into proportional sub-intervals. The encoder selects the token whose sub-interval completely contains the current fractional value of the secret message28. AC achieves near-optimal entropy utilization, making it highly efficient for maximizing capacity. However, it requires precise floating-point arithmetic to prevent drift between the encoder and decoder. > 3. **Self-Adjusting Asymmetric Numeral Systems (SA-ANS)**: ANS combines the compression efficiency of arithmetic coding with the processing speed of Huffman coding. In linguistic steganography, SA-ANS frameworks dynamically adjust the candidate token pool based on the LLM's probability distribution. By expanding the candidate set only when necessary to fulfill the local generation context, SA-ANS reduces the inclusion of high-rank, low-probability tokens, offering fine-grained control over the embedding rate while preserving text naturalness31. ### **Handling Token Collisions and Rank Consistency** In advanced sampling strategies, particularly those that do not rely on explicit model distributions (API-only access), the encoder generates a candidate set of tokens and constructs a mapping function ![][image18] from all possible ![][image19]\-bit strings to these tokens24. This introduces the risk of collisions, where different message strings map to the exact same token. Instead of avoiding collisions, which restricts embedding capacity, sophisticated algorithms maintain a dynamic list of all colliding strings, including the true secret message. In subsequent generation steps, the algorithm samples additional candidates to resolve the ambiguity, mathematically guaranteeing that the collision set shrinks to a size of ![][image20] (the true message) over a few autoregressive steps24. This necessitates strict ranking consistency; sorting algorithms applied to the token probabilities must be highly stable to ensure the decoder's resolution path perfectly mirrors the encoder's generation path25. ### **Table 2: Source Coding Algorithms in Generative Steganography** | Coding Algorithm | Operational Mechanism | Entropy Utilization | Computational Overhead | Statistical Security Profile | | :---- | :---- | :---- | :---- | :---- | | **Huffman Coding (HC)** | Constructs dynamic binary trees based on token probabilities. | Moderate | Low | Vulnerable; introduces localized distortions in the distribution. | | **Arithmetic Coding (AC)** | Maps messages to fractional intervals proportional to token probabilities. | Near-Optimal | High (requires high-precision floating-point synchronization) | High; closely mimics natural LLM probability outputs. | | **Asymmetric Numeral Systems (SA-ANS)** | Dynamically scales candidate pools to balance capacity and distribution. | High | Moderate | Very High; prevents forced selection of extreme low-probability tokens. | | **Rejection Sampling** | Generates multiple variants; rejects outputs that fail extraction verification. | Low | Very High (requires massive compute for multiple generation passes) | Maximum; text is generated without token-level mathematical forcing. | ## **Provable Security and Information-Theoretic Frameworks** Because heuristic coding schemes (like standard Bins or Huffman Coding) inevitably warp the LLM's natural output distribution to force the embedding of data, they leave subtle statistical fingerprints. To counter this, the field shifted toward Provably Secure Steganography (PSS), which evaluates covert channels through the rigorous lens of computational complexity and information theory24. Under Cachin’s foundational information-theoretic model, a stegosystem is considered perfectly secure if no probabilistic polynomial-time distinguisher can effectively differentiate between the distribution of the steganographic output and the natural cover output24. Mathematically, this requires the Kullback-Leibler (KL) divergence between the cover distribution (![][image21]) and the stego distribution (![][image22]) to be exactly zero: ![][image23]24. ### **Adaptive Dynamic Grouping (ADG)** Adaptive Dynamic Grouping (ADG) is a premier algorithm designed to approximate this condition of perfect computational indistinguishability1. At each generation step ![][image16], ADG obtains the conditional probability distribution of all tokens in the vocabulary. It recursively partitions the vocabulary ![][image24] into ![][image25] groups, where ![][image26] is the length of the secret bitstream fragment to be embedded1. The algorithm dynamically sorts the tokens such that the aggregate probability mass of each group, ![][image27], is nearly identical. Let ![][image28] denote the probability of the ![][image29]\-th token in the ![][image30]\-th group, and ![][image31] represent the total number of tokens in that group. The grouping constraint requires: ![][image32] To embed the ![][image26]\-bit message, the encoder converts the binary sequence to a decimal integer ![][image33], selects the corresponding group ![][image30], and samples a token from within that group according to its normalized internal probability ![][image34]29. The resulting steganographic sampling distribution ![][image22] across the entire vocabulary becomes ![][image35]. To evaluate the security, the KL divergence is calculated as follows: ![][image36] ![][image37] Applying Jensen's Inequality to the convex function ![][image38], the divergence reaches its absolute minimum of ![][image39] if and only if the aggregate probabilities of all groups are perfectly balanced: ![][image40]1. ADG mathematically proves that if the algorithm can flawlessly balance the probability mass of the ![][image41] groups at every step, the resulting stegotext is statistically flawless15. However, the computational burden of dynamically grouping tens of thousands of tokens at each autoregressive step limits ADG's scalability in high-throughput environments31. ### **Discop and Distribution Copies** A related paradigm for achieving provable security is the Discop framework, which constructs "distribution copies" during the generation process. Rather than grouping tokens, Discop assigns each candidate token an interval proportional to its probability within ![][image17]. It then generates multiple virtual copies of this distribution by rotating the intervals by specific displacements. To encode a message, the system selects which virtual "distribution copy" to sample from based on the secret bits. Because the marginal probability of each token remains identical across all distribution copies, Discop strictly maintains the original probability space, ensuring that the adversary's detection probability ![][image42] equals the random guessing baseline ![][image43]26. ### **Minimum Entropy Coupling (MEC)** While ADG and Discop utilize heuristic grouping and rotation to minimize divergence, recent breakthroughs have established a more fundamental mathematical framework. Information-theoretic research demonstrates that a steganographic procedure is perfectly secure under Cachin’s model *if and only if* it is induced by a coupling of probability distributions33. Let the encrypted payload (ciphertext) be represented by a uniformly random distribution ![][image44], and let the natural LLM output be the cover distribution ![][image13]. A coupling ![][image45] is a joint probability distribution over ![][image46] such that its marginal distributions perfectly match ![][image44] and ![][image13] respectively37. If an encoding function ![][image47] is induced by this coupling, it maps the uniform ciphertext into the text space in a way that exactly replicates the marginal distribution of ![][image13]. Consequently, the KL divergence is strictly zero, guaranteeing perfect theoretical security37. Furthermore, among all perfectly secure procedures, the one that maximizes mutual information ![][image48]—and therefore maximizes transmission capacity—is the procedure induced by a Minimum Entropy Coupling (MEC)33. While computing an exact MEC is NP-hard for the massive vocabularies of LLMs, Iterative Minimum Entropy Coupling (iMEC) algorithms, such as Autoregressive iMEC (ARIMEC), iteratively couple components of random vectors to approximate the solution. These algorithms achieve significantly higher encoding efficiency than baseline methods like ADG while maintaining impenetrable statistical security, suggesting that maximum-capacity steganography is fundamentally an entropy-minimization problem39. ## **Transmission Capacity and Payload Efficiency** The practical utility of a steganographic channel is dictated by its transmission capacity, quantified in bits per token (bpt) or bits per word (bpw)5. ### **Entropy Limits and Embedding Efficiency** The absolute maximum embedding capacity of a generative steganographic system is mathematically bounded by the inherent Shannon entropy of the language model's output distribution. A highly deterministic prediction (e.g., predicting the word "Arab" after "United") exhibits near-zero entropy, offering no variance with which to conceal data. Conversely, a highly uncertain prediction offers substantial entropy, allowing the encoder to embed multiple bits in a single token choice5. Embedding efficiency, or entropy utilization, measures the ratio of the actual bits embedded to the total available Shannon entropy at a given step27. Algorithms that boast high embedding efficiency maximize bandwidth without artificially injecting entropy into the text, which would instantly alert steganalysis tools. ### **Capacity Variances Across Frameworks** The capacity of a steganographic system varies drastically based on the underlying architecture: > 1. **Lexical Substitution**: Synonym substitution techniques are severely bottlenecked by the natural occurrence rate of target words in the cover text. These methods typically yield exceedingly low capacities, often less than ![][image49] bpw9. > 2. **Token-Level Generative Models**: Frameworks like ADG, Arithmetic Coding, and the RRC (Range Coding with Rotation) algorithm consistently achieve capacities between ![][image50] to ![][image51] bpt. Advanced models utilizing Minimum Entropy Coupling approach ![][image52] entropy utilization, driving transmission speeds upwards of 1,500 bits per second on modern LLM architectures like GPT-227. > 3. **Semantic-Space Mapping**: When mapping payloads to ontology-entity trees, the capacity is governed by the depth and breadth of the ontology graph—specifically, the number of available leaf nodes and intersecting attributes22. While the raw bpt metric may appear lower than arithmetic coding, semantic mapping allows for the synthesis of complex, multi-sentence paragraphs that can carry massive parallel payloads through composite entity structures, effectively multiplying the total embedding capacity of a single transmission22. ### **Table 3: Payload Capacity and Efficiency Benchmarks** | Steganographic Paradigm | Primary Constraint on Capacity | Average Embedding Rate | Entropy Utilization Efficiency | | :---- | :---- | :---- | :---- | | **Synonym Substitution** | Frequency of target words in pre-existing cover text. | ![][image53] bpw | Extremely Low | | **Adaptive Dynamic Grouping (ADG)** | Ability to perfectly balance probability mass into ![][image41] groups. | ![][image54] bpt | Moderate to High | | **Minimum Entropy Coupling (iMEC)** | Theoretical Shannon entropy of the LLM output distribution. | ![][image55] bpt | Near Optimal (![][image56]) | | **Ontology-Entity Trees** | Density of the knowledge graph and resolution of the NER extractor. | Variable (scales with text length) | N/A (Operates outside token-entropy bounds) | ## **Detectability: Statistical and Semantic Steganalysis** The rapid advancement of generative steganography has triggered a corresponding escalation in steganalysis—the science of detecting hidden payloads. The primary objective of steganalysis is not cryptographic decryption; rather, it is to prove with high statistical confidence that a digital artifact serves as a covert channel, thereby neutralizing its utility45. ### **Passive Statistical Steganalysis** Passive statistical steganalysis relies on identifying microscopic anomalies in the textual distribution. Early detectors evaluated character frequencies, whitespace irregularities, and n-gram probabilities10. In the era of generative AI, steganalysis models evaluate intercepted text against reference language models to calculate localized perplexity and cross-entropy. If an intercepted text exhibits consistently higher perplexity, unusual vocabulary distributions, or unnatural variance in token entropy compared to baseline human or LLM-generated text, it is flagged as steganographic5. Deep Neural Networks (DNNs) are heavily deployed to extract these features. For instance, Sentence-level Convolutional Neural Networks (CNNs) capture variable sentence lengths and local lexical anomalies using multi-window pooling layers, providing robust classification against heuristic embedding schemes like Huffman coding47. ### **The Psic Effect and the Conflict of Imperceptibility** Token-level generative steganography faces a critical, inherent vulnerability known as the Psic Effect (Perceptual-imperceptibility and statistical-imperceptibility conflict)15. To evade algorithmic steganalysis, a provably secure framework (like ADG) enforces strict statistical parity between the stego text and the LLM's natural probability distribution to ensure ![][image57]. However, the LLM's raw, microscopic output probabilities do not always perfectly align with macroscopic human semantic planning. By forcing mathematical compliance at the token level, the algorithm occasionally selects words that disrupt the tone, logical flow, or contextual coherence of the broader paragraph18. This creates a zero-sum conflict: optimizing purely for algorithmic statistical security often degrades perceptual and semantic security. Human evaluators, or advanced semantic classifiers operating on Transformer architectures like BERT, easily detect these logical inconsistencies15. This vulnerability underscores the necessity of semantic-space mapping, which relinquishes rigid microscopic statistical control in favor of absolute macroscopic semantic coherence5. ### **Active Attacks and Structural Disruption** While statistical steganalysis attempts to passively detect the channel, active steganalysis seeks to proactively destroy it. Active attacks disrupt the symmetry between the encoder and decoder, rendering the payload unrecoverable. The Synonym Substitution-based Text Attack (ISSA) is a prominent example. In an ISSA attack, an intermediary processing the text swaps random words with their synonyms13. For token-level generative models, this attack is catastrophic. Because algorithms like MEC and ADG rely on the exact autoregressive sequence of preceding tokens to calculate the probability distribution for the current token, a single substituted word desynchronizes the context ![][image58]. This triggers a cascading failure, corrupts the probability space, and permanently breaks the decoding chain for all subsequent tokens18. Semantic steganography via ontology-entity trees was developed specifically to counter active attacks. Because the payload is tied to the high-level concepts instantiated in the text, synonym substitutions, paraphrasing, or even translation into another language will not destroy the payload, provided the core entities (e.g., the subject of the sentence) survive the transformation14. ### **Table 4: Steganalysis Vectors and Corresponding Defenses** | Steganalysis Vector | Attack Type | Mechanism | Countermeasure / Defense | | :---- | :---- | :---- | :---- | | **Perplexity & Entropy Analysis** | Passive | Flags text with abnormally high variance or statistical divergence from baseline LLM outputs. | Provably Secure Steganography (ADG, MEC) to ensure ![][image59]. | | **Sentence-Level CNNs** | Passive | Detects localized syntactic anomalies and variable structuring caused by heuristic encoders. | Entropy-Constrained Token Selection (truncating the candidate pool). | | **Synonym Substitution Attack (ISSA)** | Active | Arbitrarily replaces words in transit to desynchronize the autoregressive decoding context. | Semantic-Space Mapping (Ontology-Entity Trees) immune to symbol changes. | | **Semantic Drift / Psic Effect Detection** | Passive | Uses human evaluators or BERT to detect macroscopic logical inconsistencies in the narrative. | Rejection Sampling; prioritizing conceptual integrity over token statistics. | ## **Concluding Synthesis** The transition from classical lexical manipulation to Semantic Steganographic Communication (SemSteCom) illustrates a profound evolution in the architecture of information hiding. Early frameworks, reliant on rigid syntactic templates and dictionary-based synonym substitution, were fundamentally constrained by the immutability of pre-existing cover texts and an inability to comprehend real-world semantics. These limitations rendered them vulnerable to both semantic drift and targeted algorithmic detection. The integration of Large Language Models redefined the carrier medium, shifting the paradigm to coverless, generative steganography. By treating the autoregressive text generation process as an entropic, probabilistic landscape, frameworks such as Adaptive Dynamic Grouping and Minimum Entropy Coupling mathematically demonstrate that statistically undetectable information transmission is achievable. These Provably Secure Steganography systems prove that when a payload is mapped through an optimal coupling, the resulting sequence is computationally indistinguishable from benign generative output, achieving zero Kullback-Leibler divergence. However, the theoretical perfection of microscopic, token-level embedding is counterbalanced by its extreme fragility in adversarial or noisy environments. Consequently, the vanguard of the field has shifted toward pure semantic-space mapping via ontology-entity trees and constrained text generation. By abstracting the payload into high-level conceptual requirements and allowing the artificial intelligence to generate the intermediary syntax organically, the steganographic data ceases to be a statistical anomaly grafted onto the text; it becomes the fundamental meaning of the text itself. As generative models continue to blur the boundary between human and machine communication, the future of semantic steganography will rely on this fusion of information-theoretic security and complex cognitive alignment to maintain robust, covert channels in an increasingly monitored digital ecosystem. #### **Works cited** > 1. Provably Secure Generative Linguistic Steganography \- ACL Anthology, [https://aclanthology.org/2021.findings-acl.268.pdf](https://aclanthology.org/2021.findings-acl.268.pdf) > 2. CERIAS Tech Report 2004-13 LINGUISTIC STEGANOGRAPHY: SURVEY, ANALYSIS, AND ROBUSTNESS CONCERNS FOR HIDING INFORMATION IN TEXT by, [https://www.cerias.purdue.edu/tools\_and\_resources/bibtex\_archive/archive/2004-13.pdf](https://www.cerias.purdue.edu/tools_and_resources/bibtex_archive/archive/2004-13.pdf) > 3. AN OVERVIEW OFVARIOUS FORMS OF LINGUISTIC STEGANOGRAPHYAND THEIRAPPLICATIONS IN PROTECTING DATA \- Research and Reviews, [https://www.rroij.com/open-access/an-overview-of-various-forms-of-linguistic-steganography-and-their-applications-in-protecting-data-33-37.pdf](https://www.rroij.com/open-access/an-overview-of-various-forms-of-linguistic-steganography-and-their-applications-in-protecting-data-33-37.pdf) > 4. Hiding the hidden message: Approaches to textual steganography \- ResearchGate, [https://www.researchgate.net/publication/228938657\_Hiding\_the\_hidden\_message\_Approaches\_to\_textual\_steganography](https://www.researchgate.net/publication/228938657_Hiding_the_hidden_message_Approaches_to_textual_steganography) > 5. Semantic Steganographic Communication \- Emergent Mind, [https://www.emergentmind.com/topics/semantic-steganographic-communication-semstecom](https://www.emergentmind.com/topics/semantic-steganographic-communication-semstecom) > 6. (PDF) Linguistic Steganography: From Symbolic Space to Semantic Space \- ResearchGate, [https://www.researchgate.net/publication/346553778\_Linguistic\_Steganography\_From\_Symbolic\_Space\_to\_Semantic\_Space](https://www.researchgate.net/publication/346553778_Linguistic_Steganography_From_Symbolic_Space_to_Semantic_Space) > 7. Hidden Reasoning in LLMs: A Taxonomy \- LessWrong, [https://www.lesswrong.com/posts/ZrgFfeWuckpwK5Lyi/hidden-reasoning-in-llms-a-taxonomy](https://www.lesswrong.com/posts/ZrgFfeWuckpwK5Lyi/hidden-reasoning-in-llms-a-taxonomy) > 8. Hidden Reasoning in LLMs: A Taxonomy \- AI Alignment Forum, [https://www.alignmentforum.org/posts/ZrgFfeWuckpwK5Lyi/hidden-reasoning-in-llms-a-taxonomy](https://www.alignmentforum.org/posts/ZrgFfeWuckpwK5Lyi/hidden-reasoning-in-llms-a-taxonomy) > 9. Practical Linguistic Steganography using Contextual Synonym Substitution and a Novel Vertex Coding Method \- ACL Anthology, [https://aclanthology.org/J14-2006.pdf](https://aclanthology.org/J14-2006.pdf) > 10. linguistic steganography: survey, analysis, and robustness concerns for hiding information in text \- Semantic Scholar, [https://www.semanticscholar.org/paper/LINGUISTIC-STEGANOGRAPHY%3A-SURVEY%2C-ANALYSIS%2C-AND-FOR-Bennett/9ea284ed75ef281b3f53dae5951f5f00d86475dc](https://www.semanticscholar.org/paper/LINGUISTIC-STEGANOGRAPHY%3A-SURVEY%2C-ANALYSIS%2C-AND-FOR-Bennett/9ea284ed75ef281b3f53dae5951f5f00d86475dc) > 11. Semantic-Preserving Linguistic Steganography by Pivot Translation and Semantic-Aware Bins Coding \- IEEE Computer Society, [https://www.computer.org/csdl/journal/tq/2024/01/10049662/1KYoKNjrRD2](https://www.computer.org/csdl/journal/tq/2024/01/10049662/1KYoKNjrRD2) > 12. A Multi-Layer Hybrid Text Steganography For Secret Communication Using Word Tagging And RGB Color Coding, [https://ijcnc.com/ijnsa-01/](https://ijcnc.com/ijnsa-01/) > 13. Research on Making Two Models Based on the Generative Linguistic Steganography for Securing Linguistic Steganographic Texts from Active Attacks \- MDPI, [https://www.mdpi.com/2073-8994/17/9/1416](https://www.mdpi.com/2073-8994/17/9/1416) > 14. A Novel Framework of Semantic-Based Text Steganography \- IEEE Computer Society, [https://www.computer.org/csdl/journal/tq/2026/02/11249432/2bDPXpf5QOI](https://www.computer.org/csdl/journal/tq/2026/02/11249432/2bDPXpf5QOI) > 15. Provably Secure Generative Linguistic Steganography | Request PDF \- ResearchGate, [https://www.researchgate.net/publication/352117412\_Provably\_Secure\_Generative\_Linguistic\_Steganography](https://www.researchgate.net/publication/352117412_Provably_Secure_Generative_Linguistic_Steganography) > 16. A recent survey on controllable text generation: A causal perspective \- PMC \- NIH, [https://pmc.ncbi.nlm.nih.gov/articles/PMC12167900/](https://pmc.ncbi.nlm.nih.gov/articles/PMC12167900/) > 17. (PDF) A Survey of Controllable Text Generation using Transformer-based Pre-trained Language Models \- ResearchGate, [https://www.researchgate.net/publication/357875343\_A\_Survey\_of\_Controllable\_Text\_Generation\_using\_Transformer-based\_Pre-trained\_Language\_Models](https://www.researchgate.net/publication/357875343_A_Survey_of_Controllable_Text_Generation_using_Transformer-based_Pre-trained_Language_Models) > 18. GTSD: Generative Text Steganography Based on Diffusion Model | Request PDF, [https://www.researchgate.net/publication/392956284\_GTSD\_Generative\_Text\_Steganography\_Based\_on\_Diffusion\_Model](https://www.researchgate.net/publication/392956284_GTSD_Generative_Text_Steganography_Based_on_Diffusion_Model) > 19. Semantic Steganography: A Framework for Robust and High-Capacity Information Hiding using Large Language Models \- ResearchGate, [https://www.researchgate.net/publication/387105051\_Semantic\_Steganography\_A\_Framework\_for\_Robust\_and\_High-Capacity\_Information\_Hiding\_using\_Large\_Language\_Models](https://www.researchgate.net/publication/387105051_Semantic_Steganography_A_Framework_for_Robust_and_High-Capacity_Information_Hiding_using_Large_Language_Models) > 20. (PDF) Cross-Modal Text Steganography Against Synonym Substitution-Based Text Attack, [https://www.researchgate.net/publication/369337773\_Cross-Modal\_Text\_Steganography\_Against\_Synonym\_Substitution-Based\_Text\_Attack](https://www.researchgate.net/publication/369337773_Cross-Modal_Text_Steganography_Against_Synonym_Substitution-Based_Text_Attack) > 21. Semantic Steganography: A Framework for Robust ... \- OpenReview, [https://openreview.net/pdf/92bb0f59e1fefa96159ec5b2d529e2d951aa3123.pdf](https://openreview.net/pdf/92bb0f59e1fefa96159ec5b2d529e2d951aa3123.pdf) > 22. arXiv:2412.11043v1 \[cs.CR\] 15 Dec 2024, [https://arxiv.org/pdf/2412.11043](https://arxiv.org/pdf/2412.11043) > 23. A Review of Personalized Semantic Secure Communications Based on the DIKWP Model, [https://www.mdpi.com/2079-9292/14/18/3671](https://www.mdpi.com/2079-9292/14/18/3671) > 24. Provable Secure Steganography Based on Adaptive Dynamic Sampling \- arXiv, [https://arxiv.org/html/2504.12579v3](https://arxiv.org/html/2504.12579v3) > 25. A high-capacity linguistic steganography based on entropy-driven rank-token mapping, [https://arxiv.org/html/2510.23035v1](https://arxiv.org/html/2510.23035v1) > 26. Discop: Provably Secure Steganography in Practice Based on “Distribution Copies” \- Jinyang Ding, [https://dingjinyang.github.io/uploads/Discop\_sp23\_paper.pdf](https://dingjinyang.github.io/uploads/Discop_sp23_paper.pdf) > 27. Efficient Provably Secure Linguistic Steganography via Range Coding \- arXiv, [https://arxiv.org/html/2604.08052v2](https://arxiv.org/html/2604.08052v2) > 28. Paraphrasing Is (At Best) a Partial Defence Against Steganography in LLMs \- LessWrong, [https://www.lesswrong.com/posts/vf6ocxgHCSsDwC7H8/paraphrasing-is-at-best-a-partial-defence-against](https://www.lesswrong.com/posts/vf6ocxgHCSsDwC7H8/paraphrasing-is-at-best-a-partial-defence-against) > 29. (PDF) Provably Secure Generative Linguistic Steganography \- ResearchGate, [https://www.researchgate.net/publication/352029330\_Provably\_Secure\_Generative\_Linguistic\_Steganography](https://www.researchgate.net/publication/352029330_Provably_Secure_Generative_Linguistic_Steganography) > 30. A high-capacity linguistic steganography based on entropy-driven rank-token mapping \- arXiv, [https://arxiv.org/pdf/2510.23035](https://arxiv.org/pdf/2510.23035) > 31. Linguistic Steganography via Self-Adjusting Asymmetric Number System \- MIT Press Direct, [https://direct.mit.edu/coli/article/52/1/113/132854/Linguistic-Steganography-via-Self-Adjusting](https://direct.mit.edu/coli/article/52/1/113/132854/Linguistic-Steganography-via-Self-Adjusting) > 32. SparSamp: Efficient Provably Secure Steganography Based on Sparse Sampling \- USENIX, [https://www.usenix.org/system/files/usenixsecurity25-wang-yaofei.pdf](https://www.usenix.org/system/files/usenixsecurity25-wang-yaofei.pdf) > 33. ICLR Poster Perfectly Secure Steganography Using Minimum Entropy Coupling, [https://iclr.cc/virtual/2023/poster/11490](https://iclr.cc/virtual/2023/poster/11490) > 34. \[2106.02011\] Provably Secure Generative Linguistic Steganography \- arXiv, [https://arxiv.org/abs/2106.02011](https://arxiv.org/abs/2106.02011) > 35. Discop: Provably Secure Steganography in Practice Based on "Distribution Copies", [https://www.computer.org/csdl/proceedings-article/sp/2023/933600c238/1OXGXJFA0uI](https://www.computer.org/csdl/proceedings-article/sp/2023/933600c238/1OXGXJFA0uI) > 36. \[2210.14889\] Perfectly Secure Steganography Using Minimum Entropy Coupling \- arXiv, [https://arxiv.org/abs/2210.14889](https://arxiv.org/abs/2210.14889) > 37. Perfectly Secure Steganography Using Minimum Entropy Coupling \- ResearchGate, [https://www.researchgate.net/publication/364777247\_Perfectly\_Secure\_Steganography\_Using\_Minimum\_Entropy\_Coupling](https://www.researchgate.net/publication/364777247_Perfectly_Secure_Steganography_Using_Minimum_Entropy_Coupling) > 38. PERFECTLY SECURE STEGANOGRAPHY USING MINIMUM ENTROPY COUPLING \- OpenReview, [https://openreview.net/pdf?id=HQ67mj5rJdR](https://openreview.net/pdf?id=HQ67mj5rJdR) > 39. Computing Low-Entropy Couplings for Large-Support Distributions \- arXiv, [https://arxiv.org/html/2405.19540v1](https://arxiv.org/html/2405.19540v1) > 40. \[2405.19540\] Computing Low-Entropy Couplings for Large-Support Distributions \- arXiv, [https://arxiv.org/abs/2405.19540](https://arxiv.org/abs/2405.19540) > 41. Computing Low-Entropy Couplings for Large-Support Distributions \- OpenReview, [https://openreview.net/forum?id=Tpk0p9QBM6](https://openreview.net/forum?id=Tpk0p9QBM6) > 42. New breakthrough enables perfectly secure digital communications \- EurekAlert\!, [https://www.eurekalert.org/news-releases/981758](https://www.eurekalert.org/news-releases/981758) > 43. Coverless Image Steganography Without Embedding | Request PDF \- ResearchGate, [https://www.researchgate.net/publication/313080679\_Coverless\_Image\_Steganography\_Without\_Embedding](https://www.researchgate.net/publication/313080679_Coverless_Image_Steganography_Without_Embedding) > 44. Stego Image Examples. A series of stego images were generated under... | Download Scientific Diagram \- ResearchGate, [https://www.researchgate.net/figure/Stego-Image-Examples-A-series-of-stego-images-were-generated-under-randomly-sampled\_fig1\_399461793](https://www.researchgate.net/figure/Stego-Image-Examples-A-series-of-stego-images-were-generated-under-randomly-sampled_fig1_399461793) > 45. An Overview of Steganography | Digitnet, [https://digitnet.github.io/m4jpeg/downloads/pdf/an-overview-of-steganography.pdf](https://digitnet.github.io/m4jpeg/downloads/pdf/an-overview-of-steganography.pdf) > 46. A Review on Text Steganography Techniques \- MDPI, [https://www.mdpi.com/2227-7390/9/21/2829](https://www.mdpi.com/2227-7390/9/21/2829) > 47. Detecting the Manipulation of Text Structure in Text Steganography Using Machine Learning \- SciTePress, [https://www.scitepress.org/Papers/2023/122609/122609.pdf](https://www.scitepress.org/Papers/2023/122609/122609.pdf) > 48. Cross-Modal Scene Semantic Alignment for Image Complexity Assessment \- BMVA Archive, [https://bmva-archive.org.uk/bmvc/2025/assets/papers/Paper\_37/paper.pdf](https://bmva-archive.org.uk/bmvc/2025/assets/papers/Paper_37/paper.pdf) [image1]: [image2]: [image3]: [image4]: [image5]: [image6]: [image7]: [image8]: [image9]: [image10]: [image11]: [image12]: [image13]: [image14]: [image15]: [image16]: [image17]: [image18]: [image19]: [image20]: [image21]: [image22]: [image23]: [image24]: [image25]: [image26]: [image27]: [image28]: [image29]: [image30]: [image31]: [image32]: [image33]: [image34]: [image35]: [image36]: [image37]: [image38]: [image39]: [image40]: [image41]: [image42]: [image43]: [image44]: [image45]: [image46]: [image47]: [image48]: [image49]: [image50]: [image51]: [image52]: [image53]: [image54]: [image55]: [image56]: [image57]: [image58]: [image59]: