Structural Steganography in Normal-Looking English Writing

Executive summary

Linguistic steganography hides information not in an attachment or image but in the choices used to realize ordinary language: which synonym is selected, whether a sentence is active or passive, whether a word has odd or even length, where punctuation occurs, which spelling convention is used, or even which kind of whitespace separates visible words. The central technical problem is a three-way trade-off among payload capacity, naturalness/stealth, and robustness. Information-theoretically, a perfectly secure system would make the statistical distribution of stegotext indistinguishable from that of ordinary cover text; Cachin formalized this distinction in terms of hypothesis testing and relative entropy. In linguistic systems, however, increasing payload usually forces more carrier choices and therefore increases the chance of unnatural or statistically atypical language. source

The techniques in this report divide naturally into three families. Counting and positional channels—word lengths, sentence lengths, acrostics, and nth-word selection—are transparent and easy to implement, but are generally destroyed by paraphrasing. Linguistic-choice channels—punctuation, contractions, voice, synonyms, tense, number, and orthographic variants—can be much harder for a casual reader to notice because they exploit genuine language variation, but their usable capacity is sparse: only contexts with multiple acceptably equivalent realizations are legitimate carrier sites. Work on automatic paraphrase generation, contextual synonym substitution, adjective deletion, word ordering, and morphosyntactic alteration has repeatedly found that grammaticality and contextual naturalness are major constraints on usable capacity. source

Formatting channels—capitalization, spaces, tabs, Unicode whitespace, and line breaks—can be nearly invisible to a human while simultaneously being trivial for software to expose. The classic SNOW approach, for example, appends spaces and tabs at line ends; newer work substitutes visually similar Unicode whitespace. Such channels therefore have unusually high visual stealth but extremely poor robustness to reformatting, canonicalization, copy/paste pipelines, or editors that trim whitespace. source

A useful distinction is between nominal capacity and safe capacity. If a carrier location offers \(k\) genuinely interchangeable states, its information-theoretic ceiling is

\[
C_i=\log_2(k)\quad\text{bits per eligible site}.
\]

Thus a binary choice nominally carries one bit. But the effective document-level rate is

\[
R_{\text{word}}=
\frac{\sum_{i\in E}\log_2 k_i-\text{overhead}}{N_{\text{words}}},
\]

where \(E\) is the set of usable sites and the overhead includes synchronization, error correction, and sites deliberately skipped for naturalness. Historical linguistic-steganography experiments illustrate this gap: Chang and Clark's review of prior empirical work reports roughly 0.67 bits per sentence for lexical substitution and roughly 0.5–1.0 bits per sentence for several syntactic-transformation approaches, far below what one would obtain by naïvely treating every word or clause as freely modifiable. source

For the specific methods requested here, the broad conclusions are:

A defender should therefore not rely on visual inspection alone. Effective detection combines raw-character inspection, normalization-difference tests, modulo/count statistics, positional extraction searches, stylometry, syntactic parsing, contextual language-model scoring, and—in higher-end systems—learned semantic steganalysis. Research has demonstrated detectors based on word correlations, perplexity-like linguistic statistics, feature-rich text models, and neural semantic representations; TS-CNN, for example, was explicitly designed to learn subtle distributional differences between cover and steganographic text in semantic space. Its near-perfect results were obtained on the authors' particular CT-Steg benchmark and should not be generalized as a universal detection rate. source

Finally, robustness should not be confused with stealth. A representation can be visually imperceptible and nevertheless be destroyed by a single normalization pass. Conversely, contemporary multi-bit text watermarking research explicitly treats deletion, synonym substitution, and paraphrasing as adversarial post-processing and uses redundancy or error-correcting codes to survive them. That is qualitatively different from most of the hand-engineered structural channels examined here, which usually encode a bit in one local textual choice and consequently have little inherent redundancy. source

Scope, metrics, and threat model

The literature uses linguistic steganography, natural-language watermarking, and text information hiding for overlapping but not identical problems. Steganography emphasizes concealing the existence of a message; watermarking often emphasizes reliably recovering an identifier after alteration. Nevertheless, they use many of the same carrier transformations—synonym choices, syntax, word order, morphology, punctuation, and formatting—and attacks on one class are highly relevant to the other. Bennett's early survey emphasizes both the unusually difficult statistical structure of natural language and the importance of robustness and steganalysis, while later work ranges from contextual paraphrases and lexical substitutions to masked-language-model editing and fully generative coding. source

Evaluation scales used here

The ratings below are analytical rather than measurements from a common benchmark, because no single published benchmark evaluates all eleven requested mechanisms under identical English-language conditions.

Human stealth is scored from 1 to 5, where 5 means a normal reader is very likely to overlook the carrier property and 1 means an attentive reader is likely to notice it.

Paraphrase robustness and formatting robustness are separately scored from 1 to 5:

• 1 — very fragile: a routine transformation normally destroys synchronization or symbols.
• 2 — fragile: survives only limited edits.
• 3 — moderate: survives some ordinary transformations.
• 4 — strong: generally unaffected by that class of transformation.
• 5 — intrinsic: the transformation normally leaves the encoded property unchanged.

The distinction is crucial. Reflowing a paragraph generally does not change whether its verbs are active or passive, so voice has high formatting robustness. Rephrasing the paragraph, however, can freely change voice, so its paraphrase robustness is poor. Contemporary watermarking papers likewise treat paraphrase separately from simple transmission or formatting errors. source

Computational detectability is stated from the defender's perspective: high means that a detector, once it knows which statistical family to inspect, has relatively direct evidence. This is not the same thing as proving that a message exists. Natural prose itself varies in sentence length, contractions, punctuation, voice, and spelling, so valid statistical testing requires an appropriate null model—ideally matched by genre, author, platform, and editorial style. Punctuation alone, for example, carries enough stylistic structure to distinguish aspects of authors and genres in stylometric research, illustrating why a generic “50/50 punctuation should be normal” assumption is inadequate. source

Generic encode/decode model

For almost every structural system considered here, encoding can be abstracted as selecting one acceptable realization from a set:

input: payload bits B, ordinary carrier text T

1. Identify eligible carrier sites E in T.
2. For each site i, enumerate acceptable alternatives A_i.
3. Reject alternatives that materially change meaning,
   violate grammar, or are implausible in context.
4. Map the next payload symbol to one member of A_i.
5. Continue until the payload plus synchronization/ECC fits.
6. Emit the modified text.

decode:
1. Reproduce the same tokenization / parsing / site selection.
2. At each eligible site, classify the observed alternative.
3. Convert alternatives back to symbols.
4. Remove synchronization and error-correction overhead.

This is essentially the design pressure found in research on automatically generated paraphrases, contextual synonym substitution, adjective deletion, and word-order transformations: generating alternatives is easy compared with ensuring that they remain grammatical, semantically faithful, and statistically natural. Chang and Clark used syntactic filters and language-frequency evidence to certify transformations, while later edit-based work uses contextual language models for the same broad purpose. source

flowchart LR
    A[Benign payload<br/>e.g. OK] --> B[Bits / symbols]
    B --> C[Find eligible<br/>carrier sites]
    C --> D[Generate acceptable<br/>textual alternatives]
    D --> E[Map symbol to<br/>structural choice]
    E --> F[Natural-looking<br/>stegotext]

    F --> G{Transmission}
    G -->|unchanged| H[Feature extractor]
    G -->|formatting / edits| I[Corrupted or<br/>normalized structure]
    I --> H

    H --> J[Recover symbols]
    J --> K[ECC / synchronization]
    K --> L[Benign payload]

    F --> M[Steganalysis]
    M --> N[Raw-character tests]
    M --> O[Statistical / stylometric tests]
    M --> P[Syntactic / semantic models]

The resulting security problem can be framed as a statistical hypothesis test between a distribution of normal covers and a distribution of encoded texts. Cachin's information-theoretic model uses relative entropy to characterize distinguishability; in practical natural-language systems, the encoder therefore wants its choice distribution to approximate the natural conditional distribution of linguistic alternatives rather than simply choosing alternatives 50/50. source

Technique-by-technique analysis

Word-length encoding. A simple implementation assigns a bit to a length property—for example, even number of alphabetic characters = 0 and odd = 1—and selects words of the required parity at predetermined carrier positions. A more general system uses word length modulo \(m\), giving an algebraic ceiling of \(\log_2m\) bits at a site with all \(m\) classes genuinely available. With parity the nominal ceiling is therefore 1 bit per controlled word, although safe effective capacity is far lower because most words cannot be replaced by arbitrary equal-meaning alternatives of either parity without stylistic or semantic cost. This is best regarded as a structural analogue of the lexical-substitution problem studied extensively in linguistic steganography: candidate selection has to respect context, not merely the desired code value. source

For a harmless four-bit example, under even = 0 and odd = 1, the deliberately selected carrier words calm (4), sun (3), kind (4), tea (3) read 0101. A practical encoder would not juxtapose those words artificially; it would select eligible words distributed through ordinary prose.

def decode_word_parity(words, positions):
    """0 = even alphabetic length, 1 = odd."""
    bits = []
    for i in positions:
        n = sum(ch.isalpha() for ch in words[i])
        bits.append(str(n & 1))
    return "".join(bits)

Human stealth is 4/5 when sparse but drops sharply if forced substitutions produce unusual diction. Paraphrase robustness is 1/5: even a harmless synonym substitution can flip length parity. Formatting robustness is 5/5 so long as token identities and the tokenizer's definition of a word remain stable. Computational detection is medium to high once the scheme family is suspected: calculate length-modulo histograms, compare them with a matched corpus, test runs of parity values, inspect autocorrelation at possible carrier intervals, and condition word-length distributions on part of speech or lexical context. A defender can mitigate the channel by meaning-preserving lexical rewriting or broader paraphrasing; simple whitespace normalization alone does not remove it. Research on lexical-substitution attacks and contextual substitution underscores the vulnerability of lexical channels to rewording. source

Sentence-length encoding. Here the unit is a sentence rather than a word. One can encode 0 with an even number of tokens and 1 with an odd number, or define several length bins. Binary parity gives 1 nominal bit per sentence; \(k\) usable bins give at most \(\log_2 k\) bits per sentence. An encoder changes sentence length by choosing contractions, optional modifiers, syntactic variants, or sentence splitting while preserving the proposition. Sentence-level transformations have a substantial history in natural-language watermarking, and prior empirical syntactic systems reported rates on the order of fractions of a bit to about a bit per sentence rather than arbitrary multi-bit rates. source

bit 0 -> realize sentence with an even token count
bit 1 -> realize sentence with an odd token count

decoder:
for each sentence:
    output word_count(sentence) mod 2

Human stealth is approximately 4/5 because readers seldom count words, although repeated length manipulation may create a perceptible rhythm. Paraphrase robustness is 1/5; formatting robustness is 4/5 because line wrapping is irrelevant but punctuation or sentence-boundary normalization may change segmentation. Detection should compute sentence-length modulo distributions, runs, lag autocorrelation, and periodicity, while comparing against a genre-appropriate length model. Splitting, merging, or paraphrasing sentences is an effective destructive normalization.

First- and last-letter acrostics. An acrostic uses boundary characters—typically first letters of lines, paragraphs, sentences, or words—while a telestich-like channel uses final letters. The decoder simply enumerates the agreed boundary units and concatenates the selected characters. If one can freely choose among all 26 English initial letters, the alphabetic ceiling is \(\log_2 26\approx4.70\) bits per carrier unit; this is an upper bound, not realistic linguistic capacity. A binary partition of initials—for instance A–M versus N–Z—provides 1 bit per unit and gives the encoder much more freedom.

A harmless sentence-initial acrostic for SAFE is:

Small gardens thrive in spring. Afternoon rain helps. Fresh herbs grow quickly. Every bed looks healthy.

This illustrates both the strength and weakness of the method: it is almost effortless to decode once someone decides to inspect sentence initials. Human stealth is therefore 3/5—often overlooked casually, but conspicuous under targeted inspection. Paraphrase robustness is 1/5. Formatting robustness is 1/5 for line-based acrostics, because reflow changes line starts, but around 4/5 for sentence-based acrostics under mere line reflow.

Detection is straightforward to automate: extract first and last letters at multiple granularities, scan line/sentence/paragraph boundaries, and score resulting strings against character language models, dictionaries, or expected plaintext structure. When scanning many offsets and granularities, a defender should correct for multiple hypothesis testing; otherwise accidental short words such as SAFE will produce false alarms in large corpora. Mitigation consists of reflow for line-based channels and rewriting sentence or paragraph boundaries for linguistic ones.

def boundary_strings(sentences):
    first = "".join(s.lstrip()[0] for s in sentences if s.strip())
    last = "".join(
        next(c for c in reversed(s.rstrip()) if c.isalpha())
        for s in sentences if s.strip()
    )
    return first, last

Nth-word selection. Instead of modifying an obvious visible feature, sender and receiver agree on a positional rule such as “take every seventh word starting at offset three,” then interpret the chosen word, its initial, its length, or another property. If the selected word carries one binary property, a regular period-\(n\) system gives roughly \(1/n\) nominal bits per surface word. If a selected initial could freely encode A–Z, the ceiling becomes about \(4.70/n\) bits per surface word, again before linguistic constraints.

For illustration, the visible token indices might be

1  2  3  4     5  6  7  8    9  10 11 12
... ... ... BLUE  ... ... ... SKY  ... ... ... ...

with every fourth word carrying the harmless payload BLUE SKY. More subtle versions encode bits through properties of the selected words rather than making the selected sequence itself readable.

Human stealth is 4–5/5 because position is not visually marked, but the method suffers a severe synchronization problem: a single inserted or deleted word shifts every subsequent fixed-period position. Consequently paraphrase robustness is 1/5 and robustness to insertion/deletion is also 1/5. Pure reformatting that leaves token order intact is about 4/5. Detection can scan plausible \(n\) and offset values, score extracted subsequences for lexical coherence, or test whether unusual lexical properties recur periodically. Mitigation is correspondingly simple: even small meaning-preserving token insertions/deletions, or paraphrasing, desynchronize a fixed-index channel.

def scan_nth_initials(words, max_stride=20):
    for n in range(2, max_stride + 1):
        for offset in range(n):
            s = "".join(w[0] for w in words[offset::n] if w)
            yield n, offset, s   # score s with a char/word LM

Punctuation choices. At a syntactically permissible ambiguity site, two approximately equivalent punctuation realizations can represent 0 and 1—for example, a parenthetical aside expressed with commas rather than parentheses, or a context in which a period and semicolon support essentially the same propositional content. Care is necessary: many punctuation substitutions are not semantically or rhetorically interchangeable. A binary eligible site carries 1 nominal bit; its rate per word is the number of such safe sites divided by document length. Explicit punctuation-based text-steganography schemes have appeared in the literature, although individual designs are often language-specific. source

The attractive property is that punctuation is genuinely variable, making human stealth around 3–4/5 when choices conform to the author's normal style. Yet that same stylistic regularity assists detection. Research on punctuation sequences shows that punctuation distributions can act as stylometric signatures of authors and genres, so a detector can model punctuation \(n\)-grams, mark frequencies conditional on syntax, repeated binary alternations, and deviations from an author's baseline. source

Paraphrase robustness is only 1–2/5. Formatting robustness is 2–3/5 because sophisticated formatters, smart-quote normalization, Markdown conversion, or editorial repunctuation can alter marks. Mitigations include applying a house punctuation style, normalizing quote/dash variants, and repunctuating from a parser or controlled rewrite.

Contraction usage. English frequently provides paired realizations such as do not/don't, we are/we're, and it is/it's. At a context where both are grammatically and stylistically acceptable, expanded = 0 and contracted = 1 yields 1 bit per eligible contraction site.

For example:

0: We are ready, and it is fine.
1: We're ready, and it's fine.

With separate carrier positions, the two choices could encode 00, 01, 10, or 11. The difficulty is that contraction choice is strongly associated with register, speaker style, surrounding syntax, and ambiguity—it's, for example, cannot stand for possessive its. Thus not every theoretical pair is an eligible site. This is structurally analogous to morphosyntactic and lexical-alternative channels in natural-language watermarking, where only contextually valid transformations are usable. source

Human stealth is 4/5 in informal writing but can be much lower in formal prose or if contraction frequency changes abruptly. Paraphrase robustness is 1–2/5, while ordinary formatting robustness is 5/5. A detector can estimate contracted versus expanded probabilities conditional on auxiliary, pronoun, genre, and neighboring tokens; a runs test can flag suspicious alternation. The strongest simple mitigation is canonicalization: expand all recognized contractions in a defensive analysis copy, or rewrite them according to one style policy.

Active versus passive voice. A proposition such as The editor approved the draft can sometimes be realized as The draft was approved by the editor. Map active = 0 and passive = 1, giving at most 1 bit per eligible clause. Actual capacity is substantially below one bit per sentence because many clauses lack a natural passive alternative, omit an explicit agent, or acquire different discourse focus when transformed. Work on sentence-level and morphosyntactic natural-language watermarking demonstrates the broader use of syntactic alternations as carriers, while Chang and Clark explored related syntactic variability through word-order generation. source

Human stealth is around 3/5: occasional passive clauses are unremarkable, but systematically forcing one voice can make prose sound unnatural or alter information structure. Paraphrase robustness is 1/5 and formatting robustness 5/5. A dependency parser can count passive constructions and condition their probability on verb, genre, clause type, and discourse position; suspicious regular alternation can be tested with run or sequence models. Language-model surprisal provides another signal because a grammatically legal passive may still be contextually awkward. Defensive rewriting into a consistent voice or ordinary paraphrasing destroys the channel.

Grammatical alternates: synonym, tense, and number. This is the richest of the requested structural categories. At any site with \(k\) meaning-preserving alternatives, nominal capacity is \(\log_2 k\) bits. Synonyms are the best-studied case: lexical watermarking and steganography systems construct substitution sets, filter them for context, and assign code symbols to the remaining variants. Topkara and colleagues specifically studied resilient synonym substitution; Taskiran and colleagues studied attacks on lexical natural-language steganography; Chang and Clark later developed contextual synonym substitution with coding designed around acceptable candidate sets. source

Tense and number require more caution than synonyms. Switching walks to walked, or singular to plural, usually changes factual meaning, so these are only safe carrier dimensions in constrained contexts where the variation is already semantically licensed—for example, conventional collective-noun agreement or a discourse where two tense realizations truly preserve temporal interpretation. The broader morphosyntactic-watermarking literature demonstrates that grammatical features can be carriers, but it does not make arbitrary morphology meaning-neutral. source

Human stealth can reach 4–5/5 for well-selected substitutions. Paraphrase robustness is nevertheless only 1–2/5, because a paraphraser is specifically free to replace lexical and grammatical realizations. Formatting robustness is 5/5. Detection methods include contextual language-model probability, lexical-choice distributions, semantic-similarity checks, word-correlation statistics, morphological-feature histograms, and comparisons against an author's baseline. Chang and Clark's early paraphrase system combined syntactic checking with large \(n\)-gram evidence; Ueoka, Murawaki, and Kurohashi later used a masked language model to select edit-based steganographic changes and explicitly investigated the security–payload trade-off. source

Large paraphrase corpora and paraphrastic sentence embeddings can also support the defender: ParaNMT-50M contains more than 50 million English–English sentence pairs generated through neural machine translation and was used to train paraphrastic sentence representations. Such representations permit comparison of the observed sentence with meaning-preserving alternatives, potentially revealing suspiciously constrained lexical realization without treating semantic deviation as the only signal. source

Capitalization. The simple binary channel maps lower-case versus upper-case realization to 0/1. In theory that means 1 bit per case-flexible position. In ordinary English prose, however, most capitalization is strongly prescribed: sentence starts, I, proper nouns, acronyms, and ordinary interior common nouns do not provide unconstrained binary choices. Arbitrary capitalization consequently has high nominal capacity only by sacrificing the “normal-looking” requirement.

More plausible carrier sites are style-governed contexts such as headings or title capitalization. For example, a particular editorial scheme might use Project Notes versus Project notes at an otherwise ambiguous title position. Such opportunities are sparse, so the effective capacity of genuinely natural capitalization channels is low.

Human stealth is 2/5 for arbitrary interior case changes and perhaps 4/5 in genuinely variable headings. Paraphrase robustness is 1/5 and formatting robustness 1–3/5, because editors, case-folding systems, title-case tools, and markup conversions can normalize case. Machine detectability is high: compare observed capitalization against sentence boundaries, named-entity predictions, dictionaries of conventional names, and a style guide. Mitigation consists of canonical case normalization appropriate to the document type.

Whitespace and line breaks. These are unusual because their human and machine properties point in opposite directions. In a binary scheme, ordinary space versus tab, ASCII space versus another Unicode space, single versus double space, or one of two legal line endings carries 1 bit per eligible boundary; \(k\) distinguishable whitespace symbols theoretically provide \(\log_2k\) bits. SNOW is a concrete long-standing implementation that conceals data by appending spaces and tabs to line ends, characters invisible in most text viewers. source

More recent research explores replacing ordinary whitespace with visually similar Unicode whitespace while preserving the visible text. TREND, for example, treats Unicode whitespace substitutions as a byte-oriented information-hiding channel and evaluates capacity and robustness experimentally, while also acknowledging capacity and robustness limitations. source

For a safe visible illustration, use symbolic notation rather than actual hidden characters:

bit 0: word[ASCII SPACE]word
bit 1: word[chosen alternate whitespace]word

Human visual stealth is 5/5, arguably the best of all methods here. Computational detectability is also 5/5 in the opposite sense—easy to expose once raw code points are inspected. Paraphrase robustness is 1/5 and formatting robustness 1/5: reflow, trimming, HTML rendering, Markdown processing, Unicode-space normalization, or editor cleanup can alter the channel. A detector should enumerate Unicode code points, flag nonstandard separators, compare line endings, inspect trailing spaces/tabs, and calculate whether canonicalizing whitespace changes the underlying bytes.

import unicodedata

def suspicious_whitespace(text):
    findings = []
    for i, ch in enumerate(text):
        if ch.isspace() and ch not in {" ", "\n", "\r", "\t"}:
            findings.append(
                (i, f"U+{ord(ch):04X}", unicodedata.name(ch, "UNKNOWN"))
            )
    return findings

For mitigation, preserve a forensic copy first, then trim trailing whitespace, convert separators to the platform's canonical representation, standardize line endings, and reflow prose. Raw preservation matters because normalization that successfully eliminates the channel also eliminates evidence useful for determining what was present.

Orthographic variants. English provides locale- and style-dependent pairs such as color/colour, center/centre, and numerous other American/British differences. Shirali-Shahreza proposed explicitly hiding information by substituting US and UK spellings in English text. A binary variant pair provides 1 bit per eligible occurrence. source

Human stealth is 4/5 when all choices are individually plausible, but this is conditional: a document that randomly alternates American and British conventions can look less natural than either convention by itself. Paraphrase robustness is 1–2/5—unchanged words retain their symbol, but lexical rewriting removes it—whereas formatting robustness is 5/5. Detection is particularly straightforward with a paired-variant lexicon: classify each occurrence by dialect, estimate within-document consistency, and test whether alternation resembles ordinary locale usage or an artificial code sequence. Spellcheckers and editorial style tools are effective mitigations because forcing the entire document to one orthographic standard erases the distinction. source

Comparative matrix and visual synthesis

The following table separates human stealth from computational detectability because visually unobtrusive properties can be among the easiest machine signals to expose. Capacity is nominal unless an empirical value is specifically identified. The robustness scores are the analytical scale defined above, not cross-paper benchmark results; published linguistic-steganography systems differ too much in corpora, carrier selection, message coding, and attack models for their raw performance numbers to be treated as directly interchangeable. source

The empirical linguistic-steganography literature supports the broad capacity hierarchy but also warns against equating combinatorial alternatives with usable payload. Contextual lexical schemes and syntactic transformation systems report rates around a fraction of a bit to roughly a bit per sentence in several early studies because many mathematically possible transformations must be rejected as linguistically unsuitable. source

The next chart is deliberately qualitative. Coordinates summarize the nominal capacity potential and paraphrase robustness of the structural mechanisms in this report; they are not measurements from a single experiment.

quadrantChart
    title Nominal structural capacity versus paraphrase robustness
    x-axis Lower nominal capacity --> Higher nominal capacity
    y-axis Fragile under paraphrase --> More resistant to paraphrase
    quadrant-1 High capacity / more robust
    quadrant-2 Low capacity / more robust
    quadrant-3 Low capacity / fragile
    quadrant-4 High capacity / fragile
    Word length: [0.55, 0.16]
    Sentence length: [0.18, 0.12]
    Acrostic: [0.68, 0.08]
    Nth-word: [0.47, 0.10]
    Punctuation: [0.31, 0.21]
    Contractions: [0.25, 0.27]
    Voice: [0.20, 0.20]
    Grammar alternates: [0.48, 0.31]
    Capitalization: [0.38, 0.08]
    Whitespace: [0.90, 0.05]
    Orthography: [0.27, 0.29]

The striking feature is the lack of anything in the upper-right corner. That is not accidental. Most of these channels store the symbol in a surface realization, while paraphrasing is explicitly designed to change surface realization while approximately preserving meaning. Robust modern text watermarking therefore seeks invariant features, distributes message redundancy across multiple tokens, or adds error-correcting codes. A 2025 USENIX Security system, for example, explicitly lists deletion, synonym substitution, and paraphrasing among the post-processing operations a practical watermark should tolerate and uses error-correction mechanisms to tolerate edits. source

There is also a useful inverse relationship between formatting robustness and ease of defensive normalization. Linguistic choices such as contractions, voice, synonyms, and orthography survive line wrapping because their words remain intact; raw formatting channels do not. Conversely, precisely because whitespace and capitalization are not semantic, defenders can aggressively canonicalize them with little semantic risk.

A second conceptual comparison is therefore:

                    SIMPLE FORMATTING NORMALIZATION
                    weak                          strong
                   resistance                   resistance

Whitespace         █
Capitalization     ██
Line acrostic      █
Punctuation        ███
Sentence length    ████
Nth-word*          ████
Word length        █████
Orthography        █████
Contractions       █████
Voice              █████
Lexical/grammar    █████

*high only while token insertion/deletion does not occur

This chart summarizes the present analysis rather than a published benchmark. It explains why a defensive pipeline should normalize surface formatting before moving on to the costlier syntactic and semantic tests.

Steganalysis, detection tests, and mitigation architecture

The strongest defender does not ask, “Which one steganography algorithm is this?” at the outset. A better strategy treats covert structure as an anomaly-detection problem at several representations of the same document. That approach is consistent with both the information-theoretic view—distinguish stego and cover distributions—and the steganalysis literature, which has progressed from hand-designed statistical features to semantic representations learned by neural models. source

Raw representation checks

First preserve the exact bytes or Unicode string, then compute a canonicalized copy and compare them. This catches channels that normal rendering hides:

import re
import unicodedata

def structural_audit(text):
    return {
        "non_ascii_whitespace": [
            (i, f"U+{ord(c):04X}")
            for i, c in enumerate(text)
            if c.isspace() and c not in " \t\r\n"
        ],
        "trailing_ws_lines": [
            i for i, line in enumerate(text.splitlines(), 1)
            if line != line.rstrip()
        ],
        "tabs": text.count("\t"),
        "crlf": text.count("\r\n"),
        "lf_total": text.count("\n"),
        "compatibility_changed":
            unicodedata.normalize("NFKC", text) != text,
    }

The important forensic sequence is detect first, normalize second. Converting Unicode whitespace, trimming line endings, or case-folding may make the covert channel harmless, but it also destroys the evidence that identified which channel was present. Whitespace systems such as SNOW and Unicode-space replacement methods illustrate why examination of the raw representation is essential. source

Count and periodicity tests

Length and positional channels often generate constraints that ordinary writing has no reason to obey. A basic parity test can be augmented with runs and lag autocorrelation:

import numpy as np

def word_parities(words):
    return np.array([
        sum(ch.isalpha() for ch in w) % 2
        for w in words
    ])

def lag_correlations(bits, max_lag=20):
    out = {}
    for lag in range(1, min(max_lag, len(bits) - 1) + 1):
        a, b = bits[:-lag], bits[lag:]
        if a.std() and b.std():
            out[lag] = float(np.corrcoef(a, b)[0, 1])
    return out

A simple 50/50 binomial test is not sufficient evidence because natural word-length parity need not be balanced. The appropriate null is an empirical corpus matched to language, genre, and ideally writer. More powerful tests can model \(P(\text{length class}\mid\text{part of speech, context})\) and then inspect whether the residual sequence contains suspicious regularity. The same approach applies to sentence-count parity.

Nth-word schemes warrant a stride scan. For each plausible stride \(n\) and offset \(o\), extract selected words or initials, calculate character- or word-language-model likelihood, and compare the best score with scores from randomized controls. Correcting for the number of \(n,o\) combinations is important because broad searches almost inevitably yield accidental short fragments.

Stylometric tests

Punctuation, contractions, voice, spelling, and capitalization are naturally occurring stylistic features, so their detection should be conditional rather than rule-based. An illustrative feature vector is:

sentence_length_mean, sentence_length_mod2_rate
word_length_mod2_rate
comma_rate, semicolon_rate, dash_rate, parenthesis_rate
punctuation_bigram_frequencies
contraction_rate_by_auxiliary
passive_clause_rate
US_variant_rate, UK_variant_rate
unexpected_mid_sentence_capital_rate
nonstandard_whitespace_rate

A defender can train a one-class model or calculate likelihood under a matched author/genre profile, then investigate documents with unusually low probability. Punctuation is particularly suitable because stylometric research shows that punctuation sequences contain stable structural information even when words themselves are removed. source

This also highlights a central false-positive risk: natural style is not random. An author may consistently avoid contractions, strongly prefer passive voice in technical writing, or mix spelling conventions because several editors contributed. A detector that labels any imbalance as covert coding will perform poorly. The stronger signal is an implausible conditional pattern: abrupt switches, surprisingly regular alternation, or choices that repeatedly coincide with a hidden binary partition.

Syntactic and semantic tests

For active/passive and grammatical transformations, parse the document and extract syntactic features rather than relying on strings. A passive detector, for example, can estimate the proportion and sequence of passive clauses and compare those values with expected probabilities given verbs and context. For synonym channels, a masked language model can ask whether the observed lexical choice is unusually improbable relative to close substitutes.

This direction follows the evolution of linguistic-steganography research. Chang and Clark used syntactic filtering and \(n\)-gram evidence to select plausible paraphrases and adjective deletions; Ueoka and colleagues used a masked language model to make context-sensitive edit choices. The same models can be turned around for steganalysis: if many selected words repeatedly occupy the “second-best but code-compatible” region rather than the naturally most likely region, their aggregate distribution may become suspicious. source

Neural steganalysis goes one step further by learning the distributional differences directly. TS-CNN was designed to extract high-level semantic features and discriminate cover from steganographic text in semantic space; on its CT-Steg dataset of 216,000 texts, its authors reported nearly 100% precision and recall under their experimental conditions. That number is evidence that semantic perturbations can be detectable, not evidence that arbitrary unseen structural schemes can be detected at 100%. Distribution shift remains critical. source

Paraphrase as both detector and sanitizer

Paraphrasing has two defensive uses. First, a paraphrase model can produce several semantically close realizations and reveal whether some strange surface feature disappears without affecting meaning. Second, regenerating the text can actively destroy length, acrostic, nth-word, punctuation, contraction, voice, orthography, and formatting channels simultaneously.

Large paraphrase resources make this operationally plausible. ParaNMT-50M provides tens of millions of English–English paraphrase pairs and paraphrastic sentence representations; earlier linguistic-steganography research itself used automatically generated paraphrases as an encoding space. source

Paraphrasing should not be treated as a universal steganography remover. A robust system may distribute redundancy, select paraphrase-invariant properties, or use error correction specifically to survive edits. Modern robust-watermarking research therefore evaluates synonym substitution, word deletion, and paraphrasing explicitly rather than assuming that rewriting guarantees destruction. source

Defensive canonicalization recipe

For ordinary document pipelines where retaining exact prose is not essential, the following sequence attacks most of the simple channels in this report:

Raw original
   |
   +--> hash/archive forensic original
   |
   v
standardize Unicode and line endings
   |
trim/collapse non-semantic whitespace
   |
apply one capitalization and punctuation style
   |
apply one US/UK spelling standard
   |
canonicalize contractions when appropriate
   |
sentence-level meaning-preserving paraphrase
   |
optional second paraphrase / syntactic rewrite
   |
re-tokenize and run structural tests again

Each stage has a different target. Unicode and whitespace normalization erase invisible format channels; style normalization attacks capitalization, punctuation, and orthography; contraction normalization attacks a lexical binary channel; syntactic rewriting breaks voice and positional/count constraints; and paraphrasing disrupts lexical alternatives. The semantic rewrite is the most aggressive step and therefore the one most likely to alter nuance, so in integrity-sensitive environments it should be applied only to a derived copy.

A compact screening algorithm

For high-volume defensive use, a multichannel score is preferable to eleven unrelated yes/no detectors:

function STEGO_SCREEN(document, baseline):
    raw_features  = inspect_unicode_whitespace_case(document)
    count_features = lengths_modulo_runs_autocorrelation(document)
    positional = scan_acrostics_and_nth_word_sequences(document)
    style = punctuation_contraction_spelling_features(document)
    syntax = voice_and_morphology_features(parse(document))
    semantic = contextual_choice_anomalies(document)

    z = compare_with_matched_baseline(
            raw_features,
            count_features,
            positional,
            style,
            syntax,
            semantic)

    return calibrated_anomaly_score(z)

The important word is calibrated. A high-scoring document warrants examination; it does not prove hidden communication. Cachin's formalization makes the underlying point precise: detection is a statistical decision problem. The better the stegosystem approximates the normal distribution of covers, the less evidence any finite detector receives. source

Research conclusions and source landscape

The oldest structural methods are appealing because they are understandable: a reader can literally count words, inspect initials, or compare spaces. But that transparency is also their principal weakness. Word length, sentence length, acrostics, nth-word indexing, capitalization, and raw whitespace should be considered fragile channels, suitable for demonstrating the principle of linguistic steganography but poorly suited to environments that perform rewriting, normalization, or editing.

The more interesting research territory lies in choice among semantically acceptable alternatives. Natural-language watermarking and steganography work has investigated sentence-level transformations, synonym substitution, word ordering, adjective deletion, morphosyntactic alternatives, contextual paraphrases, and masked-language-model edits. Across this literature, the recurring design challenge is not whether two strings can encode different bits; it is whether both strings belong to the distribution of text a normal writer might actually have produced. source

That observation explains why the simplistic formula “one binary choice = one bit” must be handled carefully. It is an alphabet-size bound, not a prediction of practical throughput. Forcing every eligible choice toward exactly 50/50 usage may itself create a detectable distribution if ordinary speakers choose one alternative 90% of the time. Secure coding should ideally reproduce the natural conditional distribution of alternatives—precisely the direction suggested by Cachin's statistical security formulation and pursued more generally by probabilistically generated linguistic steganography. source

There is also a substantial conceptual shift between early hand-designed channels and the current research frontier. Edit-based language-model systems already use contextual probabilistic models to conceal changes more naturally. By 2026, work such as range-coding and asymmetric-number-system linguistic steganography is concentrating on efficient probabilistic coding under language-model distributions rather than merely toggling one visible linguistic feature. Recent papers report designs intended to improve entropy utilization, controllable embedding rates, linguistic quality, and statistical resemblance to ordinary generated text. These methods are outside the eleven requested structural channels, but they provide an important benchmark: the modern goal is to make the coding distribution follow the language distribution, rather than to hide a deterministic binary pattern inside it. source

For defenders, the corresponding lesson is that canonicalization is extremely effective against simple structural steganography but insufficient against general linguistic steganography. Whitespace and capitalization can be normalized mechanically; spelling can be standardized; positional channels can be broken by insertion and paraphrase. Contextual lexical and generative systems require statistical or semantic steganalysis, and even then results are distribution-dependent. Neural steganalysis research demonstrates that high-level semantic signals can be useful, while paraphrase research supplies tools for constructing meaning-preserving controls against which suspicious realizations can be compared. source

The practical ranking is therefore nuanced. Whitespace has the best visual stealth but among the worst overall resilience. Orthographic and contraction channels offer an unusually favorable simplicity/stealth combination but little paraphrase resistance. Syntactic and lexical alternates offer the best route to genuinely natural-looking linguistic coding, but they cost more computationally and remain vulnerable to semantic rewriting. Acrostic, count, and nth-word methods are easiest to understand and detect once suspected. None of the requested structural techniques simultaneously achieves high payload, high human stealth, high statistical stealth, and high paraphrase robustness. That absence is the central result of both the analytical comparison and the historical research trajectory: overcoming that trade-off is precisely what has driven linguistic steganography from hand-crafted transformations toward probabilistic language modeling, distribution-preserving coding, and explicit error correction. source