# Neural Linguistic Steganography — Reading List

Curated by Yuntian Deng. Updated 2026-10-19.

[Papers](https://steganography.live/reading-list/papers/) / fang-2017

Early neural approaches

# Generating Steganographic Text with LSTMs

Tina Fang, Martin Jaggi, Katerina Argyraki

First arXiv submission: May 30, 2017 · ACL 2017 Student Research Workshop

Published version: July 2017. The publication and preprint records below retain their own dates and identifiers.

Uses an LSTM language model and vocabulary bins to generate text carrying a secret bitstream. Experiments on tweets and email explore the trade-off between embedding capacity and text quality.

[Read paper ↗](https://aclanthology.org/P17-3017/) · [PDF ↗](https://aclanthology.org/P17-3017.pdf) · [Code ↗](https://github.com/tbfang/steganography-lstm)

## Relationship to Neural Linguistic Steganography

The 2019 Neural Linguistic Steganography paper cites this earlier neural method and reimplements its block-based encoding with GPT-2 as a baseline.

## Scope and limitations

The paper leaves formal evaluation against human judges and steganalysis methods to future work; its qualitative examples alone do not establish statistical undetectability.

## Cite this paper

### Published version

Tina Fang, Martin Jaggi, Katerina Argyraki. [Generating Steganographic Text with LSTMs](https://aclanthology.org/P17-3017/). Proceedings of ACL 2017, Student Research Workshop, 2017

[Published version BibTeX](https://steganography.live/reading-list/papers/fang-2017/publication.bib) · [Published version CSL-JSON](https://steganography.live/reading-list/papers/fang-2017/publication.csl.json)
Show BibTeX`@inproceedings{fang-2017-publication,
  title = {{Generating Steganographic Text with LSTMs}},
  author = {Fang, Tina and Jaggi, Martin and Argyraki, Katerina},
  year = {2017},
  booktitle = {Proceedings of ACL 2017, Student Research Workshop},
  pages = {100--106},
  publisher = {Association for Computational Linguistics},
  url = {https://aclanthology.org/P17-3017/}
}
`

### arXiv preprint

Tina Fang, Martin Jaggi, Katerina Argyraki. [Generating Steganographic Text with LSTMs](https://arxiv.org/abs/1705.10742v1). arXiv:1705.10742. First submission: May 30, 2017.

This citation records the first arXiv version and its original title. The version-specific link distinguishes it from later revisions; cite the version supporting your claim.

[arXiv preprint BibTeX](https://steganography.live/reading-list/papers/fang-2017/preprint.bib) · [arXiv preprint CSL-JSON](https://steganography.live/reading-list/papers/fang-2017/preprint.csl.json)
Show BibTeX`@misc{fang-2017-preprint,
  title = {{Generating Steganographic Text with LSTMs}},
  author = {Fang, Tina and Jaggi, Martin and Argyraki, Katerina},
  year = {2017},
  publisher = {arXiv},
  eprint = {1705.10742v1},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/1705.10742v1}
}
`

## Primary sources

- [Published author order, title, venue, July 2017, pages; no DOI listed.](https://aclanthology.org/P17-3017/)

- [First arXiv submission May 30, 2017.](https://arxiv.org/abs/1705.10742)

- [Sections 3–4 describe LSTM/bin encoding and experiments; section 5 identifies future security evaluation.](https://aclanthology.org/P17-3017.pdf)

- [Sections 2 and 4 identify Fang et al. as the Block baseline and explain the GPT-2 reimplementation.](https://aclanthology.org/D19-1115.pdf)

- [Author repository explicitly identifies itself as code for this paper.](https://github.com/tbfang/steganography-lstm)

## Read or reuse this entry

[JSON record](https://steganography.live/reading-list/papers/fang-2017/record.json) · [Markdown](https://steganography.live/reading-list/papers/fang-2017/index.md) · [Find in the full list](https://steganography.live/reading-list/papers/#paper-fang-2017)

These notes are an editorial reading aid. Consult the primary sources for the authors’ claims, assumptions, and experiments.


---

[Papers](https://steganography.live/reading-list/papers/) / rnn-stega

Early neural approaches

# RNN-Stega: Linguistic Steganography Based on Recurrent Neural Networks

Zhong-Liang Yang, Xiao-Qing Guo, Zi-Ming Chen, Yong-Feng Huang, Yu-Jin Zhang

First online publication (IEEE): September 24, 2018 · IEEE TIFS 2019 (online 2018)

Published version: May 2019. The first online date and journal issue date are distinct.

Generates cover text with a recurrent language model and dynamically encodes candidate words using fixed-length or Huffman variable-length codes. It evaluates generation efficiency, embedding capacity, text quality, and resistance to the tested steganalysis methods.

[Read paper ↗](https://ieeexplore.ieee.org/document/8470163)

## Relationship to Neural Linguistic Steganography

The 2019 Neural Linguistic Steganography paper compares against this work's Huffman approach using the same GPT-2 language model as its own arithmetic method.

## Scope and limitations

The paper describes a capacity–quality trade-off and the cost of rebuilding a Huffman tree at each generation step. These empirical results should not be read as a distribution-preservation guarantee.

## Cite this paper

### Published version

Zhong-Liang Yang, Xiao-Qing Guo, Zi-Ming Chen, Yong-Feng Huang, Yu-Jin Zhang. [RNN-Stega: Linguistic Steganography Based on Recurrent Neural Networks](https://ieeexplore.ieee.org/document/8470163). IEEE Transactions on Information Forensics and Security, 2019

[Published version BibTeX](https://steganography.live/reading-list/papers/rnn-stega/publication.bib) · [Published version CSL-JSON](https://steganography.live/reading-list/papers/rnn-stega/publication.csl.json)
Show BibTeX`@article{rnn-stega-publication,
  title = {{RNN-Stega: Linguistic Steganography Based on Recurrent Neural Networks}},
  author = {Yang, Zhong-Liang and Guo, Xiao-Qing and Chen, Zi-Ming and Huang, Yong-Feng and Zhang, Yu-Jin},
  year = {2019},
  journal = {IEEE Transactions on Information Forensics and Security},
  doi = {10.1109/TIFS.2018.2871746},
  pages = {1280--1295},
  volume = {14},
  number = {5},
  publisher = {IEEE},
  url = {https://ieeexplore.ieee.org/document/8470163}
}
`

## Primary sources

- [Publisher record: first online publication on September 24, 2018; May 2019 journal issue, pages, and DOI.](https://ieeexplore.ieee.org/document/8470163)

- [Publisher-deposited complete author spellings, title, May 2019 issue metadata, DOI.](https://api.crossref.org/works/10.1109/TIFS.2018.2871746)

- [Full manuscript explicitly uploaded by author Zhongliang Yang; section III-B gives FLC/VLC and Huffman rebuilding trade-off; section IV gives evaluations.](https://www.researchgate.net/publication/327852903_RNN-Stega_Linguistic_Steganography_Based_on_Recurrent_Neural_Networks)

- [Sections 2 and 4 describe the Huffman comparison and shared-model reimplementation.](https://aclanthology.org/D19-1115.pdf)

- [Author-lab description of the RNN-Stega project.](https://raw.githubusercontent.com/YangzlTHU/Linguistic-Steganography-and-Steganalysis/master/Steganography/RNN-Stega/README.md)

## Read or reuse this entry

[JSON record](https://steganography.live/reading-list/papers/rnn-stega/record.json) · [Markdown](https://steganography.live/reading-list/papers/rnn-stega/index.md) · [Find in the full list](https://steganography.live/reading-list/papers/#paper-rnn-stega)

These notes are an editorial reading aid. Consult the primary sources for the authors’ claims, assumptions, and experiments.


---

[Papers](https://steganography.live/reading-list/papers/) / dai-cai-2019

Security and distribution matching

# Towards Near-imperceptible Steganographic Text

Falcon Z. Dai, Zheng Cai

First arXiv submission: July 15, 2019 · ACL 2019

Published version: July 2019. The publication and preprint records below retain their own dates and identifiers.

Analyzes how binning and variable-length encoding alter a language model's output distribution. Its patient-Huffman method skips message embedding at steps where the induced distribution would differ too much from the model.

[Read paper ↗](https://aclanthology.org/P19-1422/) · [PDF ↗](https://aclanthology.org/P19-1422.pdf) · [Code ↗](https://github.com/falcondai/lm-steganography)

## Relationship to Neural Linguistic Steganography

Neural Linguistic Steganography explicitly identifies this as concurrent research on distributional analysis and modified Huffman coding, distinct from its arithmetic-coding approach.

## Scope and limitations

Tight total-variation bounds require restrictive per-step thresholds, with useful throughput depending on the model's distributions; the paper also identifies vulnerability to an active adversary modifying text.

## Cite this paper

### Published version

Falcon Z. Dai, Zheng Cai. [Towards Near-imperceptible Steganographic Text](https://aclanthology.org/P19-1422/). Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, 2019

[Published version BibTeX](https://steganography.live/reading-list/papers/dai-cai-2019/publication.bib) · [Published version CSL-JSON](https://steganography.live/reading-list/papers/dai-cai-2019/publication.csl.json)
Show BibTeX`@inproceedings{dai-cai-2019-publication,
  title = {{Towards Near-imperceptible Steganographic Text}},
  author = {Dai, Falcon Z. and Cai, Zheng},
  year = {2019},
  booktitle = {Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics},
  doi = {10.18653/v1/P19-1422},
  pages = {4303--4308},
  publisher = {Association for Computational Linguistics},
  url = {https://aclanthology.org/P19-1422/}
}
`

### arXiv preprint

Falcon Z. Dai, Zheng Cai. [Towards Near-imperceptible Steganographic Text](https://arxiv.org/abs/1907.06679v1). arXiv:1907.06679. First submission: July 15, 2019.

This citation records the first arXiv version and its original title. The version-specific link distinguishes it from later revisions; cite the version supporting your claim.

[arXiv preprint BibTeX](https://steganography.live/reading-list/papers/dai-cai-2019/preprint.bib) · [arXiv preprint CSL-JSON](https://steganography.live/reading-list/papers/dai-cai-2019/preprint.csl.json)
Show BibTeX`@misc{dai-cai-2019-preprint,
  title = {{Towards Near-imperceptible Steganographic Text}},
  author = {Dai, Falcon Z. and Cai, Zheng},
  year = {2019},
  publisher = {arXiv},
  eprint = {1907.06679v1},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/1907.06679v1}
}
`

## Primary sources

- [Published title, authors, venue, date, DOI, pages.](https://aclanthology.org/P19-1422/)

- [First arXiv submission July 15, 2019.](https://arxiv.org/abs/1907.06679)

- [Section 3.3 gives patient-Huffman and threshold qualification; section 4 identifies active-adversary limitations.](https://aclanthology.org/P19-1422.pdf)

- [Section 2 calls Dai and Cai concurrent work.](https://aclanthology.org/D19-1115.pdf)

- [Author repository explicitly accompanies the paper and implements patient-Huffman.](https://github.com/falcondai/lm-steganography)

## Read or reuse this entry

[JSON record](https://steganography.live/reading-list/papers/dai-cai-2019/record.json) · [Markdown](https://steganography.live/reading-list/papers/dai-cai-2019/index.md) · [Find in the full list](https://steganography.live/reading-list/papers/#paper-dai-cai-2019)

These notes are an editorial reading aid. Consult the primary sources for the authors’ claims, assumptions, and experiments.


---

[Papers](https://steganography.live/reading-list/papers/) / neural-linguistic-steganography

Neural Linguistic Steganography

# Neural Linguistic Steganography

Zachary M. Ziegler*, Yuntian Deng*, Alexander M. Rush

* Zachary M. Ziegler and Yuntian Deng contributed equally.

First arXiv submission: September 3, 2019 · EMNLP-IJCNLP 2019

Published version: November 2019. The publication and preprint records below retain their own dates and identifiers.

Combines arithmetic coding with large pretrained language models to encode secret information into generated text while closely matching the model's distribution. GPT-2 experiments evaluate information capacity, statistical divergence, and human judgments of contextual continuations, and demonstrate encoding natural-language messages into unrelated cover text.

[Read paper ↗](https://aclanthology.org/D19-1115/) · [PDF ↗](https://aclanthology.org/D19-1115.pdf) · [Code ↗](https://github.com/harvardnlp/NeuralSteganography)

## Relationship to Neural Linguistic Steganography

The original paper associated with this research site and its STEGASURAS implementation. The published paper links steganography.live and the official repository.

## Scope and limitations

The statistical experiments measure divergence from the language model, not an inaccessible true human-language distribution. Truncation and temperature choices create a practical trade-off between human plausibility and distribution matching.

## Cite this paper

### Published version

Zachary M. Ziegler, Yuntian Deng, Alexander M. Rush. [Neural Linguistic Steganography](https://aclanthology.org/D19-1115/). Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), 2019

[Published version BibTeX](https://steganography.live/reading-list/papers/neural-linguistic-steganography/publication.bib) · [Published version CSL-JSON](https://steganography.live/reading-list/papers/neural-linguistic-steganography/publication.csl.json)
Show BibTeX`@inproceedings{neural-linguistic-steganography-publication,
  title = {{Neural Linguistic Steganography}},
  author = {Ziegler, Zachary M. and Deng, Yuntian and Rush, Alexander M.},
  year = {2019},
  booktitle = {Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP)},
  doi = {10.18653/v1/D19-1115},
  pages = {1210--1215},
  publisher = {Association for Computational Linguistics},
  url = {https://aclanthology.org/D19-1115/}
}
`

### arXiv preprint

Zachary M. Ziegler, Yuntian Deng, Alexander M. Rush. [Neural Linguistic Steganography](https://arxiv.org/abs/1909.01496v1). arXiv:1909.01496. First submission: September 3, 2019.

This citation records the first arXiv version and its original title. The version-specific link distinguishes it from later revisions; cite the version supporting your claim.

[arXiv preprint BibTeX](https://steganography.live/reading-list/papers/neural-linguistic-steganography/preprint.bib) · [arXiv preprint CSL-JSON](https://steganography.live/reading-list/papers/neural-linguistic-steganography/preprint.csl.json)
Show BibTeX`@misc{neural-linguistic-steganography-preprint,
  title = {{Neural Linguistic Steganography}},
  author = {Ziegler, Zachary M. and Deng, Yuntian and Rush, Alexander M.},
  year = {2019},
  publisher = {arXiv},
  eprint = {1909.01496v1},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/1909.01496v1}
}
`

## Primary sources

- [Publication title, venue, November 2019, DOI and pages.](https://aclanthology.org/D19-1115/)

- [Title page establishes full author names and equal contribution; sections 3–4 support method, evaluations and limitations; page 2 links site and code.](https://aclanthology.org/D19-1115.pdf)

- [Only listed version is v1, September 3, 2019.](https://arxiv.org/abs/1909.01496)

- [Official implementation identifies paper and links steganography.live; June 2025 compatibility update is separately credited.](https://github.com/harvardnlp/NeuralSteganography)

## Read or reuse this entry

[JSON record](https://steganography.live/reading-list/papers/neural-linguistic-steganography/record.json) · [Markdown](https://steganography.live/reading-list/papers/neural-linguistic-steganography/index.md) · [Find in the full list](https://steganography.live/reading-list/papers/#paper-neural-linguistic-steganography)

These notes are an editorial reading aid. Consult the primary sources for the authors’ claims, assumptions, and experiments.


---

[Papers](https://steganography.live/reading-list/papers/) / saac

Extensions and reliability

# Near-imperceptible Neural Linguistic Steganography via Self-Adjusting Arithmetic Coding

Jiaming Shen, Heng Ji, Jiawei Han

First arXiv submission: October 1, 2020 · EMNLP 2020

Published version: November 2020. The publication and preprint records below retain their own dates and identifiers.

Introduces self-adjusting arithmetic coding, choosing the candidate-set size at each generation step to control divergence from the language model. It supplies an imperceptibility analysis and evaluates capacity, divergence, and human judgments across multiple datasets.

[Read paper ↗](https://aclanthology.org/2020.emnlp-main.22/) · [PDF ↗](https://aclanthology.org/2020.emnlp-main.22.pdf) · [Code ↗](https://github.com/mickeysjm/StegaText)

## Relationship to Neural Linguistic Steganography

The introduction explicitly states that SAAC builds on Ziegler, Deng, and Rush's 2019 arithmetic-coding method, replacing a fixed truncation size with an adaptive one.

## Scope and limitations

Its distributional guarantee is relative to the underlying language model; choosing the truncation threshold still trades embedding behavior and computation against divergence.

## Cite this paper

### Published version

Jiaming Shen, Heng Ji, Jiawei Han. [Near-imperceptible Neural Linguistic Steganography via Self-Adjusting Arithmetic Coding](https://aclanthology.org/2020.emnlp-main.22/). Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), 2020

[Published version BibTeX](https://steganography.live/reading-list/papers/saac/publication.bib) · [Published version CSL-JSON](https://steganography.live/reading-list/papers/saac/publication.csl.json)
Show BibTeX`@inproceedings{saac-publication,
  title = {{Near-imperceptible Neural Linguistic Steganography via Self-Adjusting Arithmetic Coding}},
  author = {Shen, Jiaming and Ji, Heng and Han, Jiawei},
  year = {2020},
  booktitle = {Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP)},
  doi = {10.18653/v1/2020.emnlp-main.22},
  pages = {303--313},
  publisher = {Association for Computational Linguistics},
  url = {https://aclanthology.org/2020.emnlp-main.22/}
}
`

### arXiv preprint

Jiaming Shen, Heng Ji, Jiawei Han. [Near-imperceptible Neural Linguistic Steganography via Self-Adjusting Arithmetic Coding](https://arxiv.org/abs/2010.00677v1). arXiv:2010.00677. First submission: October 1, 2020.

This citation records the first arXiv version and its original title. The version-specific link distinguishes it from later revisions; cite the version supporting your claim.

[arXiv preprint BibTeX](https://steganography.live/reading-list/papers/saac/preprint.bib) · [arXiv preprint CSL-JSON](https://steganography.live/reading-list/papers/saac/preprint.csl.json)
Show BibTeX`@misc{saac-preprint,
  title = {{Near-imperceptible Neural Linguistic Steganography via Self-Adjusting Arithmetic Coding}},
  author = {Shen, Jiaming and Ji, Heng and Han, Jiawei},
  year = {2020},
  publisher = {arXiv},
  eprint = {2010.00677v1},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2010.00677v1}
}
`

## Primary sources

- [Published bibliographic metadata and DOI.](https://aclanthology.org/2020.emnlp-main.22/)

- [First arXiv submission October 1, 2020.](https://arxiv.org/abs/2010.00677)

- [Introduction explicitly identifies extension of 2019 method; sections 2–3 define relative imperceptibility/adaptive K; page 1 links code.](https://aclanthology.org/2020.emnlp-main.22.pdf)

- [Official code repository linked by the paper.](https://github.com/mickeysjm/StegaText)

## Read or reuse this entry

[JSON record](https://steganography.live/reading-list/papers/saac/record.json) · [Markdown](https://steganography.live/reading-list/papers/saac/index.md) · [Find in the full list](https://steganography.live/reading-list/papers/#paper-saac)

These notes are an editorial reading aid. Consult the primary sources for the authors’ claims, assumptions, and experiments.


---

[Papers](https://steganography.live/reading-list/papers/) / minimum-entropy-coupling

Security and distribution matching

# Perfectly Secure Steganography Using Minimum Entropy Coupling

Christian Schroeder de Witt*, Samuel Sokota*, J. Zico Kolter, Jakob Foerster, Martin Strohmeier

* Christian Schroeder de Witt and Samuel Sokota contributed equally.

First arXiv submission: October 24, 2022 · ICLR 2023

Published version: 2023. The publication and preprint records below retain their own dates and identifiers.

Characterizes perfect steganographic security through couplings and maximal information throughput through minimum entropy couplings under its information-theoretic model. It develops an iterative method and compares it with arithmetic coding, Meteor, and adaptive dynamic grouping on text, audio, and image-model distributions.

[Read paper ↗](https://openreview.net/forum?id=HQ67mj5rJdR) · [PDF ↗](https://arxiv.org/pdf/2210.14889) · [Code ↗](https://github.com/schroederdewitt/perfectly-secure-steganography)

## Relationship to Neural Linguistic Steganography

Explicitly cites and evaluates the 2019 arithmetic-coding implementation as a baseline, while proposing a different coupling-based construction with a different security guarantee.

## Scope and limitations

The guarantee assumes a passive adversary, unmodified transmission, and access to the cover distribution; matching a model does not establish that it exactly models real-world communication.

## Cite this paper

### Published version

Christian Schroeder de Witt, Samuel Sokota, J. Zico Kolter, Jakob Foerster, Martin Strohmeier. [Perfectly Secure Steganography Using Minimum Entropy Coupling](https://openreview.net/forum?id=HQ67mj5rJdR). International Conference on Learning Representations, 2023

[Published version BibTeX](https://steganography.live/reading-list/papers/minimum-entropy-coupling/publication.bib) · [Published version CSL-JSON](https://steganography.live/reading-list/papers/minimum-entropy-coupling/publication.csl.json)
Show BibTeX`@inproceedings{minimum-entropy-coupling-publication,
  title = {{Perfectly Secure Steganography Using Minimum Entropy Coupling}},
  author = {Schroeder de Witt, Christian and Sokota, Samuel and Kolter, J. Zico and Foerster, Jakob and Strohmeier, Martin},
  year = {2023},
  booktitle = {International Conference on Learning Representations},
  url = {https://openreview.net/forum?id=HQ67mj5rJdR}
}
`

### arXiv preprint

Christian Schroeder de Witt, Samuel Sokota, J. Zico Kolter, Jakob Foerster, Martin Strohmeier. [Perfectly Secure Steganography Using Minimum Entropy Coupling](https://arxiv.org/abs/2210.14889v1). arXiv:2210.14889. First submission: October 24, 2022.

This citation records the first arXiv version and its original title. The version-specific link distinguishes it from later revisions; cite the version supporting your claim.

[arXiv preprint BibTeX](https://steganography.live/reading-list/papers/minimum-entropy-coupling/preprint.bib) · [arXiv preprint CSL-JSON](https://steganography.live/reading-list/papers/minimum-entropy-coupling/preprint.csl.json)
Show BibTeX`@misc{minimum-entropy-coupling-preprint,
  title = {{Perfectly Secure Steganography Using Minimum Entropy Coupling}},
  author = {Schroeder de Witt, Christian and Sokota, Samuel and Kolter, J. Zico and Foerster, Jakob and Strohmeier, Martin},
  year = {2022},
  publisher = {arXiv},
  eprint = {2210.14889v1},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2210.14889v1}
}
`

## Primary sources

- [Full authors and first submission October 24, 2022; version history retained separately from ICLR year.](https://arxiv.org/abs/2210.14889)

- [Title page identifies ICLR 2023 and equal contributions; sections 3–5 give coupling characterization and 2019 baseline; section 7 states assumptions/limitations; section 8 links code.](https://arxiv.org/pdf/2210.14889)

- [Official ICLR 2023 poster record verifies title/authors and directly links the OpenReview forum HQ67mj5rJdR.](https://iclr.cc/virtual/2023/poster/11490)

## Read or reuse this entry

[JSON record](https://steganography.live/reading-list/papers/minimum-entropy-coupling/record.json) · [Markdown](https://steganography.live/reading-list/papers/minimum-entropy-coupling/index.md) · [Find in the full list](https://steganography.live/reading-list/papers/#paper-minimum-entropy-coupling)

These notes are an editorial reading aid. Consult the primary sources for the authors’ claims, assumptions, and experiments.


---

[Papers](https://steganography.live/reading-list/papers/) / llm-watermark

Watermarking

# A Watermark for Large Language Models

John Kirchenbauer*, Jonas Geiping*, Yuxin Wen, Jonathan Katz, Ian Miers, Tom Goldstein

* John Kirchenbauer and Jonas Geiping contributed equally.

First arXiv submission: January 24, 2023 · ICML 2023

Published version: July 2023. The publication and preprint records below retain their own dates and identifiers.

Embeds a statistical watermark by softly favoring a pseudorandom set of tokens during generation. It develops a detection test that does not require the language model and analyzes how the token distribution affects detection strength.

[Read paper ↗](https://proceedings.mlr.press/v202/kirchenbauer23a.html) · [PDF ↗](https://proceedings.mlr.press/v202/kirchenbauer23a/kirchenbauer23a.pdf) · [Code ↗](https://github.com/jwkirchenbauer/lm-watermarking)

## Relationship to Neural Linguistic Steganography

Its related-work section cites Neural Linguistic Steganography among earlier neural information-hiding methods. Its provenance-detection objective differs from concealing the existence of an arbitrary message.

## Scope and limitations

Low-entropy text offers less freedom to embed a detectable signal without affecting quality; detection and robustness depend on text length, entropy, and adversarial modifications.

## Cite this paper

### Published version

John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, Tom Goldstein. [A Watermark for Large Language Models](https://proceedings.mlr.press/v202/kirchenbauer23a.html). Proceedings of the 40th International Conference on Machine Learning, 2023

[Published version BibTeX](https://steganography.live/reading-list/papers/llm-watermark/publication.bib) · [Published version CSL-JSON](https://steganography.live/reading-list/papers/llm-watermark/publication.csl.json)
Show BibTeX`@inproceedings{llm-watermark-publication,
  title = {{A Watermark for Large Language Models}},
  author = {Kirchenbauer, John and Geiping, Jonas and Wen, Yuxin and Katz, Jonathan and Miers, Ian and Goldstein, Tom},
  year = {2023},
  booktitle = {Proceedings of the 40th International Conference on Machine Learning},
  pages = {17061--17084},
  volume = {202},
  publisher = {PMLR},
  url = {https://proceedings.mlr.press/v202/kirchenbauer23a.html}
}
`

### arXiv preprint

John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, Tom Goldstein. [A Watermark for Large Language Models](https://arxiv.org/abs/2301.10226v1). arXiv:2301.10226. First submission: January 24, 2023.

This citation records the first arXiv version and its original title. The version-specific link distinguishes it from later revisions; cite the version supporting your claim.

[arXiv preprint BibTeX](https://steganography.live/reading-list/papers/llm-watermark/preprint.bib) · [arXiv preprint CSL-JSON](https://steganography.live/reading-list/papers/llm-watermark/preprint.csl.json)
Show BibTeX`@misc{llm-watermark-preprint,
  title = {{A Watermark for Large Language Models}},
  author = {Kirchenbauer, John and Geiping, Jonas and Wen, Yuxin and Katz, Jonathan and Miers, Ian and Goldstein, Tom},
  year = {2023},
  publisher = {arXiv},
  eprint = {2301.10226v1},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2301.10226v1}
}
`

## Primary sources

- [Full authors, ICML venue, July 23–29 2023, PMLR volume and pages; no publication DOI listed.](https://proceedings.mlr.press/v202/kirchenbauer23a.html)

- [First submission January 24, 2023; later revised versions distinguished.](https://arxiv.org/abs/2301.10226)

- [Title-page equal contributions/code; sections 1.2–5 cover entropy and robustness; related work cites Ziegler et al. 2019.](https://proceedings.mlr.press/v202/kirchenbauer23a/kirchenbauer23a.pdf)

## Read or reuse this entry

[JSON record](https://steganography.live/reading-list/papers/llm-watermark/record.json) · [Markdown](https://steganography.live/reading-list/papers/llm-watermark/index.md) · [Find in the full list](https://steganography.live/reading-list/papers/#paper-llm-watermark)

These notes are an editorial reading aid. Consult the primary sources for the authors’ claims, assumptions, and experiments.


---

[Papers](https://steganography.live/reading-list/papers/) / secret-collusion

Agent communication

# Secret Collusion among AI Agents: Multi-Agent Deception via Steganography

Sumeet Ramesh Motwani, Mikhail Baranchuk, Martin Strohmeier, Vijay Bolina, Philip H.S. Torr, Lewis Hammond, Christian Schroeder de Witt

First arXiv submission: February 12, 2024 · NeurIPS 2024

Published version: 2024. The publication and preprint records below retain their own dates and identifiers.

Formalizes secret collusion among generative AI agents and develops capability evaluations for covert communication and coordination. It studies individual and multi-agent settings alongside the assumptions and limitations of monitoring and other mitigations.

[Read paper ↗](https://proceedings.neurips.cc/paper_files/paper/2024/hash/861f7dad098aec1c3560fb7add468d41-Abstract-Conference.html) · [PDF ↗](https://proceedings.nips.cc/paper_files/paper/2024/file/861f7dad098aec1c3560fb7add468d41-Paper-Conference.pdf)

## Relationship to Neural Linguistic Steganography

Section 2 identifies Ziegler et al. 2019 as an early AI-generated steganography approach using arithmetic coding; the paper studies the broader agent-security setting rather than extending the STEGASURAS implementation.

## Scope and limitations

Its evaluated models show limited advanced steganographic capabilities, and the authors call for more complex multi-agent and real-world evaluations; the results are not evidence that every agent autonomously uses covert channels.

## Cite this paper

### Published version

Sumeet Ramesh Motwani, Mikhail Baranchuk, Martin Strohmeier, Vijay Bolina, Philip H.S. Torr, Lewis Hammond, Christian Schroeder de Witt. [Secret Collusion among AI Agents: Multi-Agent Deception via Steganography](https://proceedings.neurips.cc/paper_files/paper/2024/hash/861f7dad098aec1c3560fb7add468d41-Abstract-Conference.html). Advances in Neural Information Processing Systems, 2024

[Published version BibTeX](https://steganography.live/reading-list/papers/secret-collusion/publication.bib) · [Published version CSL-JSON](https://steganography.live/reading-list/papers/secret-collusion/publication.csl.json)
Show BibTeX`@inproceedings{secret-collusion-publication,
  title = {{Secret Collusion among AI Agents: Multi-Agent Deception via Steganography}},
  author = {Motwani, Sumeet Ramesh and Baranchuk, Mikhail and Strohmeier, Martin and Bolina, Vijay and Torr, Philip H.S. and Hammond, Lewis and Schroeder de Witt, Christian},
  year = {2024},
  booktitle = {Advances in Neural Information Processing Systems},
  doi = {10.52202/079017-2336},
  volume = {37},
  url = {https://proceedings.neurips.cc/paper_files/paper/2024/hash/861f7dad098aec1c3560fb7add468d41-Abstract-Conference.html}
}
`

### arXiv preprint

Sumeet Ramesh Motwani, Mikhail Baranchuk, Martin Strohmeier, Vijay Bolina, Philip H.S. Torr, Lewis Hammond, Christian Schroeder de Witt. [Secret Collusion Among Generative AI Agents](https://arxiv.org/abs/2402.07510v1). arXiv:2402.07510. First submission: February 12, 2024.

This citation records the first arXiv version and its original title. The version-specific link distinguishes it from later revisions; cite the version supporting your claim.

[arXiv preprint BibTeX](https://steganography.live/reading-list/papers/secret-collusion/preprint.bib) · [arXiv preprint CSL-JSON](https://steganography.live/reading-list/papers/secret-collusion/preprint.csl.json)
Show BibTeX`@misc{secret-collusion-preprint,
  title = {{Secret Collusion Among Generative AI Agents}},
  author = {Motwani, Sumeet Ramesh and Baranchuk, Mikhail and Strohmeier, Martin and Bolina, Vijay and Torr, Philip H.S. and Hammond, Lewis and Schroeder de Witt, Christian},
  year = {2024},
  publisher = {arXiv},
  eprint = {2402.07510v1},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2402.07510v1}
}
`

## Primary sources

- [Published title, complete authors, NeurIPS 2024 volume 37 and DOI.](https://proceedings.neurips.cc/paper_files/paper/2024/hash/861f7dad098aec1c3560fb7add468d41-Abstract-Conference.html)

- [First submission February 12, 2024 and subsequent version dates.](https://arxiv.org/abs/2402.07510)

- [Conference-era full text; section 2 links original arithmetic work, sections 5–6 describe evaluations, section 8 states current capability limits and evaluation needs.](https://arxiv.org/html/2402.07510v3)

- [Version-specific record verifies original title and February 12, 2024 submission date.](https://arxiv.org/abs/2402.07510v1)

## Read or reuse this entry

[JSON record](https://steganography.live/reading-list/papers/secret-collusion/record.json) · [Markdown](https://steganography.live/reading-list/papers/secret-collusion/index.md) · [Find in the full list](https://steganography.live/reading-list/papers/#paper-secret-collusion)

These notes are an editorial reading aid. Consult the primary sources for the authors’ claims, assumptions, and experiments.


---

[Papers](https://steganography.live/reading-list/papers/) / syncpool

Extensions and reliability

# Provably Secure Disambiguating Neural Linguistic Steganography

Yuang Qi, Kejiang Chen, Kai Zeng, Weiming Zhang, Nenghai Yu

First arXiv submission: March 26, 2024 · IEEE TDSC 2025 (preprint 2024)

Published version: May 2025. The publication and preprint records below retain their own dates and identifiers.

Introduces SyncPool to resolve subword segmentation ambiguity while preserving the model's token distribution. It groups prefix-related tokens and uses synchronized pseudorandom sampling so a receiver can recover token choices from detokenized text.

[Read paper ↗](https://ieeexplore.ieee.org/document/10804596) · [PDF ↗](https://arxiv.org/pdf/2403.17524) · [Code ↗](https://github.com/7-yaya/SyncPool)

## Relationship to Neural Linguistic Steganography

Cites Neural Linguistic Steganography within neural generation-based methods and addresses a shared implementation issue for modern token-based steganography; it is not presented here as a direct arithmetic-coder replacement.

## Scope and limitations

Grouping ambiguous tokens sacrifices some usable entropy and reduces embedding rate; the paper explicitly analyzes this reliability–capacity trade-off.

## Cite this paper

### Published version

Yuang Qi, Kejiang Chen, Kai Zeng, Weiming Zhang, Nenghai Yu. [Provably Secure Disambiguating Neural Linguistic Steganography](https://ieeexplore.ieee.org/document/10804596). IEEE Transactions on Dependable and Secure Computing, 2025

[Published version BibTeX](https://steganography.live/reading-list/papers/syncpool/publication.bib) · [Published version CSL-JSON](https://steganography.live/reading-list/papers/syncpool/publication.csl.json)
Show BibTeX`@article{syncpool-publication,
  title = {{Provably Secure Disambiguating Neural Linguistic Steganography}},
  author = {Qi, Yuang and Chen, Kejiang and Zeng, Kai and Zhang, Weiming and Yu, Nenghai},
  year = {2025},
  journal = {IEEE Transactions on Dependable and Secure Computing},
  doi = {10.1109/TDSC.2024.3519322},
  pages = {2430--2442},
  volume = {22},
  number = {3},
  publisher = {IEEE},
  url = {https://ieeexplore.ieee.org/document/10804596}
}
`

### arXiv preprint

Yuang Qi, Kejiang Chen, Kai Zeng, Weiming Zhang, Nenghai Yu. [Provably Secure Disambiguating Neural Linguistic Steganography](https://arxiv.org/abs/2403.17524v1). arXiv:2403.17524. First submission: March 26, 2024.

This citation records the first arXiv version and its original title. The version-specific link distinguishes it from later revisions; cite the version supporting your claim.

[arXiv preprint BibTeX](https://steganography.live/reading-list/papers/syncpool/preprint.bib) · [arXiv preprint CSL-JSON](https://steganography.live/reading-list/papers/syncpool/preprint.csl.json)
Show BibTeX`@misc{syncpool-preprint,
  title = {{Provably Secure Disambiguating Neural Linguistic Steganography}},
  author = {Qi, Yuang and Chen, Kejiang and Zeng, Kai and Zhang, Weiming and Yu, Nenghai},
  year = {2024},
  publisher = {arXiv},
  eprint = {2403.17524v1},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2403.17524v1}
}
`

## Primary sources

- [Full authors, March 26 2024 first submission; December 2024 version says accepted at TDSC.](https://arxiv.org/abs/2403.17524)

- [Publisher-deposited journal title, full authors, May 2025 volume 22 issue 3, pages and DOI.](https://api.crossref.org/works/10.1109/TDSC.2024.3519322)

- [Sections III and IV give construction/evaluations; section V explicitly states embedding-rate loss; introduction links official SyncPool code; reference 4 is NLS.](https://arxiv.org/html/2403.17524v2)

## Read or reuse this entry

[JSON record](https://steganography.live/reading-list/papers/syncpool/record.json) · [Markdown](https://steganography.live/reading-list/papers/syncpool/index.md) · [Find in the full list](https://steganography.live/reading-list/papers/#paper-syncpool)

These notes are an editorial reading aid. Consult the primary sources for the authors’ claims, assumptions, and experiments.


---

[Papers](https://steganography.live/reading-list/papers/) / tokenization

Extensions and reliability

# Addressing Tokenization Inconsistency in Steganography and Watermarking Based on Large Language Models

Ruiyi Yan, Yugo Murawaki

First arXiv submission: August 28, 2025 · EMNLP 2025

Published version: November 2025. The publication and preprint records below retain their own dates and identifiers.

Studies tokenization inconsistencies between generated token sequences and the text a receiver retokenizes. It proposes stepwise verification for steganography and post-hoc rollback for watermark detection, evaluating how these changes affect reliability, text quality, and detection.

[Read paper ↗](https://aclanthology.org/2025.emnlp-main.361/) · [PDF ↗](https://aclanthology.org/2025.emnlp-main.361.pdf) · [Code ↗](https://github.com/ryehr/Consistency)

## Relationship to Neural Linguistic Steganography

Section 4.1 explicitly uses Ziegler et al.'s arithmetic coding in all steganography experiments, extending the reliability layer around the 2019 approach rather than replacing its coding principle.

## Scope and limitations

Steganographic extraction assumes an attacker does not modify the text. The authors report smaller watermarking gains because inconsistent tokens are infrequent and note that a complete theory of the inconsistency mechanism remains open.

## Cite this paper

### Published version

Ruiyi Yan, Yugo Murawaki. [Addressing Tokenization Inconsistency in Steganography and Watermarking Based on Large Language Models](https://aclanthology.org/2025.emnlp-main.361/). Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, 2025

[Published version BibTeX](https://steganography.live/reading-list/papers/tokenization/publication.bib) · [Published version CSL-JSON](https://steganography.live/reading-list/papers/tokenization/publication.csl.json)
Show BibTeX`@inproceedings{tokenization-publication,
  title = {{Addressing Tokenization Inconsistency in Steganography and Watermarking Based on Large Language Models}},
  author = {Yan, Ruiyi and Murawaki, Yugo},
  year = {2025},
  booktitle = {Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing},
  doi = {10.18653/v1/2025.emnlp-main.361},
  pages = {7076--7098},
  publisher = {Association for Computational Linguistics},
  url = {https://aclanthology.org/2025.emnlp-main.361/}
}
`

### arXiv preprint

Ruiyi Yan, Yugo Murawaki. [Addressing Tokenization Inconsistency in Steganography and Watermarking Based on Large Language Models](https://arxiv.org/abs/2508.20718v1). arXiv:2508.20718. First submission: August 28, 2025.

This citation records the first arXiv version and its original title. The version-specific link distinguishes it from later revisions; cite the version supporting your claim.

[arXiv preprint BibTeX](https://steganography.live/reading-list/papers/tokenization/preprint.bib) · [arXiv preprint CSL-JSON](https://steganography.live/reading-list/papers/tokenization/preprint.csl.json)
Show BibTeX`@misc{tokenization-preprint,
  title = {{Addressing Tokenization Inconsistency in Steganography and Watermarking Based on Large Language Models}},
  author = {Yan, Ruiyi and Murawaki, Yugo},
  year = {2025},
  publisher = {arXiv},
  eprint = {2508.20718v1},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2508.20718v1}
}
`

## Primary sources

- [Full authors, November 2025 venue metadata, pages and DOI.](https://aclanthology.org/2025.emnlp-main.361/)

- [First submission August 28, 2025.](https://arxiv.org/abs/2508.20718)

- [Page 1 links code; sections 2–4 describe methods; section 4.1 explicitly uses Ziegler et al. arithmetic coding; Limitations states threat model and scope of improvement.](https://aclanthology.org/2025.emnlp-main.361.pdf)

## Read or reuse this entry

[JSON record](https://steganography.live/reading-list/papers/tokenization/record.json) · [Markdown](https://steganography.live/reading-list/papers/tokenization/index.md) · [Find in the full list](https://steganography.live/reading-list/papers/#paper-tokenization)

These notes are an editorial reading aid. Consult the primary sources for the authors’ claims, assumptions, and experiments.


---

[Reading list](https://steganography.live/reading-list/) / Guides

THE MECHANISM

# How does arithmetic coding hide a message in text?

Follow the path from secret bits to language-model token choices, and back again.

[The setting](https://steganography.live/reading-list/guides/arithmetic-coding/#setting) · [A small example](https://steganography.live/reading-list/guides/arithmetic-coding/#intervals) · [Decoding](https://steganography.live/reading-list/guides/arithmetic-coding/#decoding) · [Practical details](https://steganography.live/reading-list/guides/arithmetic-coding/#practical)

## A language model supplies choices

A generative language model assigns probabilities to the next token given the text so far. Linguistic steganography uses those choices to carry an additional message. The visible text is the cover; the hidden message is recovered by someone who knows the coding procedure and the same language model.

[Neural Linguistic Steganography](https://steganography.live/reading-list/papers/neural-linguistic-steganography/), by Zachary M. Ziegler*, Yuntian Deng*, and Alexander M. Rush (2019; * equal contribution), combines arithmetic coding with a large pretrained language model. Its contribution includes the coding method, analysis of the generated distribution, capacity and text-quality experiments, and a demonstration that turns natural-language messages into unrelated cover text. STEGASURAS is the accompanying [interactive demo](https://steganography.live/).

Earlier approaches assigned bits to vocabulary bins or used Huffman codes. Arithmetic coding instead keeps a single interval that is refined as tokens are generated. This allows token selection to track a probability distribution more closely than a coarse assignment of a fixed number of bits to each token. The 2019 paper compares these approaches under a shared GPT-2 model. [Read Sections 2–4 of the original paper.](https://aclanthology.org/D19-1115.pdf)

## A small, idealized example

Imagine four possible next tokens with probabilities 1/2, 1/4, 1/8, and 1/8. Split the interval from 0 to 1 into pieces with those widths. Treat a stream of secret bits as the binary digits of a number inside the interval.

A · 1/2 B · 1/4 C · 1/8 D · 1/8
A: [0, 0.5); B: [0.5, 0.75); C: [0.75, 0.875); D: [0.875, 1). These illustrative probabilities are not a measurement from the paper.

The bitstream beginning `0.101…` falls inside B’s interval, so the sender emits B. The next language-model distribution depends on B and the earlier context. The coder subdivides B’s interval using that new distribution and selects another token. As the interval narrows, more message bits become determined.

If the message bits behave like uniform random bits, a region with half the interval’s width is selected half the time in the ideal construction. This is the connection between message coding and distribution matching. In this toy example, B’s interval fixes the first two binary digits to `10`; subsequent choices reveal further bits. Real implementations use finite-precision integer arithmetic and renormalization rather than retaining an indefinitely precise real number.

## Why the receiver can recover the message

The receiver reads the cover tokens and reconstructs the same probability partitions in the same order. Each observed token selects the same subinterval used by the sender. Bits common to every number in the narrowed interval can then be recovered.

That agreement depends on the complete procedure: model and weights, context, tokenization, candidate selection, probability transformations, token ordering, numerical precision, and message framing. A matching model name alone is not enough. The [original implementation](https://github.com/harvardnlp/NeuralSteganography) provides the concrete arithmetic-coding and decoding procedure.

**Steganography and encryption answer different questions.** Encryption conceals a message’s contents. Steganography tries to conceal that a message is being carried at all. An arithmetic coder by itself does not provide a general confidentiality guarantee; its distributional behavior also depends on the input-bit assumptions.

## Where the ideal model meets an implementation

Temperature and vocabulary truncation alter the distribution used for generation. Restricting choices can improve human judgments of text while moving the generated distribution away from the original model. The original paper measures that tension. [Self-adjusting arithmetic coding](https://steganography.live/reading-list/papers/saac/) subsequently replaces a fixed candidate-set size with an adaptive one, explicitly building on the 2019 method.

There is a separate text-interface problem: the generated token sequence may not be the sequence obtained by converting the visible text back to tokens. [Yan and Murawaki (2025)](https://steganography.live/reading-list/papers/tokenization/) study this inconsistency and use the 2019 arithmetic-coding method throughout their steganography experiments. Coding and tokenization reliability are distinct layers that must work together for successful extraction.

Continue with [capacity, detectability, and security](https://steganography.live/reading-list/guides/capacity-and-security/) to see what a fluent example or a successful round trip does—and does not—establish.

[Read this guide as Markdown](https://steganography.live/reading-list/guides/arithmetic-coding/index.md) · [Browse the bibliography](https://steganography.live/reading-list/papers/)


---

[Reading list](https://steganography.live/reading-list/) / Guides

THE GUARANTEE

# Capacity, detectability, and security are different measurements

Read steganography results by asking what is measured, which distribution is protected, and what the observer can do.

[Capacity](https://steganography.live/reading-list/guides/capacity-and-security/#capacity) · [Distributions](https://steganography.live/reading-list/guides/capacity-and-security/#distribution) · [Observers](https://steganography.live/reading-list/guides/capacity-and-security/#observers) · [Reliability](https://steganography.live/reading-list/guides/capacity-and-security/#reliability)

## How much information does the text carry?

Embedding rate is often reported as bits per generated token or word. It measures payload density. The unit matters: different tokenizers divide the same text differently, so bits per token are not automatically comparable across systems.

In an ideal probability-matching construction with uniform message bits, the model’s uncertainty provides room for information. A token of probability p has information content −log₂(p); averaging this quantity gives the distribution’s entropy. Practical payload rate also reflects finite precision, framing, candidate restrictions, and reliability measures. [Neural Linguistic Steganography, Sections 3–4](https://aclanthology.org/D19-1115.pdf), evaluates coding rate alongside other properties.

A larger rate is useful only in relation to the intended task. A decoder may recover many bits from text that is easy to flag. Conversely, a conservative method may preserve a distribution well while carrying fewer bits. Comparisons should report both rate and the relevant detection or distribution measure.

## Which distribution is the reference?

It helps to distinguish three objects: the distribution of ordinary communication in a setting, a language model’s approximation to that distribution, and the distribution produced by the steganographic encoder. Matching the model addresses the gap between the last two. It does not by itself show that the model matches the real-world communication channel.

The 2019 paper studies the distribution induced by arithmetic coding and reports divergence from the language model, as well as human judgments of generated continuations. Its truncation and temperature experiments show why a statistically closer sample need not receive the best human plausibility rating. These are separate measurements, each with its own reference. [See the original experiments.](https://aclanthology.org/D19-1115.pdf)

[Dai and Cai (2019)](https://steganography.live/reading-list/papers/dai-cai-2019/) analyze changes induced by binning and variable-length coding and propose patient-Huffman, which skips embedding when a step would cause too much distributional change. [SAAC (2020)](https://steganography.live/reading-list/papers/saac/) adjusts candidate-set size to control divergence for arithmetic coding. Both make the connection between coding choices, throughput, and a specified distribution explicit.

**“Perfectly secure” names a guarantee under a model.** [Schroeder de Witt and colleagues](https://steganography.live/reading-list/papers/minimum-entropy-coupling/) characterize perfect steganographic security using couplings and develop a minimum-entropy-coupling approach. The guarantee retains its assumptions: a passive observer, unmodified transmission, and access to the cover distribution. The paper discusses these limits explicitly.

## What can the observer see or change?

A passive observer tries to distinguish a cover-only sample from text carrying a hidden message. A human rating, the accuracy of a trained steganalyzer, and an information-theoretic bound answer different versions of this question. A weak detector’s failure is evidence about that detector and evaluation setting, not proof that every detector must fail.

An active observer can modify the transmitted text. Rephrasing or even small edits can disrupt a token-level code and prevent extraction. This is a reliability or robustness question in addition to a detection question. Dai and Cai discuss active modification as a limitation; Yan and Murawaki’s steganographic extraction setup assumes the attacker does not alter the text. [Dai and Cai, Section 4](https://aclanthology.org/P19-1422.pdf); [Yan and Murawaki, Limitations](https://aclanthology.org/2025.emnlp-main.361.pdf).

## Can the intended receiver decode the text?

Even an untouched string can expose a mismatch between token sequences and visible text. [SyncPool](https://steganography.live/reading-list/papers/syncpool/) addresses ambiguous subword segmentation through synchronized grouping and sampling while preserving the modeled token distribution; grouping also reduces available embedding rate. [Stepwise verification](https://steganography.live/reading-list/papers/tokenization/) addresses tokenization inconsistency around arithmetic-coded generation. These works examine the interface needed for the theoretical coder to survive a text round trip.

When comparing results, record the language model and tokenizer, generation settings, payload unit, statistical reference, observer capabilities, extraction success, and any text modifications. That makes it possible to tell whether a gain concerns capacity, detectability, or delivery reliability—and whether the conditions match another paper’s experiment.

Continue with [watermarking and agent communication](https://steganography.live/reading-list/guides/watermarking-and-agents/) for two related settings with different objectives.

[Read this guide as Markdown](https://steganography.live/reading-list/guides/capacity-and-security/index.md) · [Browse the bibliography](https://steganography.live/reading-list/papers/)


---

[Reading list](https://steganography.live/reading-list/) / Guides

THE CONNECTIONS

# From hidden messages to watermarks and agent communication

Shared token-level ideas connect these fields, while their objectives and evidence remain distinct.

[Watermarking](https://steganography.live/reading-list/guides/watermarking-and-agents/#watermarking) · [Shared interfaces](https://steganography.live/reading-list/guides/watermarking-and-agents/#tokenization) · [Agents](https://steganography.live/reading-list/guides/watermarking-and-agents/#agents) · [Reading the connections](https://steganography.live/reading-list/guides/watermarking-and-agents/#reading)

## Information hiding and provenance detection

Linguistic steganography hides a message in generated text while trying to conceal the existence of that message. A language-model watermark typically adds a signal that a designated detector can recognize as evidence about the text’s generation process. Both use freedom in token selection, but the success criteria differ.

[A Watermark for Large Language Models](https://steganography.live/reading-list/papers/llm-watermark/) (Kirchenbauer and colleagues, 2023) softly favors a pseudorandom set of tokens and supplies a statistical detection test that does not require the language model. The related-work section explicitly cites [Neural Linguistic Steganography](https://steganography.live/reading-list/papers/neural-linguistic-steganography/). This is a documented connection in the literature; the watermark paper develops its own generation and detection construction. [Read the ICML paper.](https://proceedings.mlr.press/v202/kirchenbauer23a/kirchenbauer23a.pdf)

A watermark detector’s statistical confidence is not an arbitrary hidden message recovered by a steganographic decoder. Nor does the existence of a detectable watermark imply that its presence will be obvious to a casual reader. To compare systems, specify who has the detector or decoding information and what the system is intended to reveal or conceal.

## A shared interface can create a shared failure mode

Both approaches often operate on model tokens but communicate through a text string. Converting generated tokens to text and then retokenizing can yield a different token sequence. An encoder’s decisions and a receiver’s reconstruction may then disagree.

[Addressing Tokenization Inconsistency in Steganography and Watermarking Based on Large Language Models](https://steganography.live/reading-list/papers/tokenization/) (Yan and Murawaki, 2025) makes this shared issue explicit. It develops stepwise verification for steganography and post-hoc rollback for watermark detection. Its steganography experiments all use Ziegler, Deng, and Rush’s arithmetic-coding method, providing a direct connection to the 2019 work at the reliability layer. [See Section 4.1 and the method sections.](https://aclanthology.org/2025.emnlp-main.361.pdf)

The paper reports smaller gains for watermarking, where inconsistent tokens are less frequent in its setup. That matters when transferring an explanation across tasks: a common source of error does not imply equal effects on every application.

## The communication channel becomes part of the agent setting

When language-model agents exchange text, that text is a communication channel. A message can have an ordinary task-related reading and, if a coding convention is shared, a second interpretation. Studying this possibility requires distinguishing an explicitly supplied encoding scheme from a scheme agents independently develop or successfully execute.

[Secret Collusion among AI Agents: Multi-Agent Deception via Steganography](https://steganography.live/reading-list/papers/secret-collusion/) (Motwani and colleagues, NeurIPS 2024) formalizes secret collusion and evaluates capabilities relevant to covert communication and coordination. Section 2 discusses the 2019 arithmetic-coding work as an earlier approach to AI-generated steganography. Its broader research question concerns agents, coordination, and the limits of monitoring. [Read the conference-era version.](https://arxiv.org/html/2402.07510v3)

**Available mechanisms and observed agent behavior are different evidence.** A working external arithmetic coder demonstrates a possible channel. It does not show that an unassisted agent can construct, use, or discover that channel. The collusion paper reports limited advanced steganographic capabilities in the models it evaluates and calls for more complex multi-agent and real-world testing.

A useful experiment identifies who controls the encoder, whether agents share a model or codebook, what information the observer receives, and whether a hidden message is actually recovered. It also separates the ability to carry a message from evidence of autonomous covert coordination.

## Three supported connections

- **Documented citation:** the ICML watermarking paper cites Neural Linguistic Steganography among neural information-hiding methods.

- **Direct methodological use:** the 2025 tokenization study uses the 2019 arithmetic coder in its steganography experiments and adds reliability measures around it.

- **A broader research setting:** the NeurIPS collusion paper connects earlier steganographic mechanisms to communication and monitoring in agent systems.

These relationships show why the original research remains useful to read alongside newer language-model work. Each connection is supported by a primary paper, without treating citation alone as proof of implementation inheritance or autonomous agent behavior.

[Read this guide as Markdown](https://steganography.live/reading-list/guides/watermarking-and-agents/index.md) · [Browse the bibliography](https://steganography.live/reading-list/papers/)