THE GUARANTEE
Capacity, detectability, and security are different measurements
Read steganography results by asking what is measured, which distribution is protected, and what the observer can do.
How much information does the text carry?
Embedding rate is often reported as bits per generated token or word. It measures payload density. The unit matters: different tokenizers divide the same text differently, so bits per token are not automatically comparable across systems.
In an ideal probability-matching construction with uniform message bits, the model’s uncertainty provides room for information. A token of probability p has information content −log₂(p); averaging this quantity gives the distribution’s entropy. Practical payload rate also reflects finite precision, framing, candidate restrictions, and reliability measures. Neural Linguistic Steganography, Sections 3–4, evaluates coding rate alongside other properties.
A larger rate is useful only in relation to the intended task. A decoder may recover many bits from text that is easy to flag. Conversely, a conservative method may preserve a distribution well while carrying fewer bits. Comparisons should report both rate and the relevant detection or distribution measure.
Which distribution is the reference?
It helps to distinguish three objects: the distribution of ordinary communication in a setting, a language model’s approximation to that distribution, and the distribution produced by the steganographic encoder. Matching the model addresses the gap between the last two. It does not by itself show that the model matches the real-world communication channel.
The 2019 paper studies the distribution induced by arithmetic coding and reports divergence from the language model, as well as human judgments of generated continuations. Its truncation and temperature experiments show why a statistically closer sample need not receive the best human plausibility rating. These are separate measurements, each with its own reference. See the original experiments.
Dai and Cai (2019) analyze changes induced by binning and variable-length coding and propose patient-Huffman, which skips embedding when a step would cause too much distributional change. SAAC (2020) adjusts candidate-set size to control divergence for arithmetic coding. Both make the connection between coding choices, throughput, and a specified distribution explicit.
“Perfectly secure” names a guarantee under a model. Schroeder de Witt and colleagues characterize perfect steganographic security using couplings and develop a minimum-entropy-coupling approach. The guarantee retains its assumptions: a passive observer, unmodified transmission, and access to the cover distribution. The paper discusses these limits explicitly.
What can the observer see or change?
A passive observer tries to distinguish a cover-only sample from text carrying a hidden message. A human rating, the accuracy of a trained steganalyzer, and an information-theoretic bound answer different versions of this question. A weak detector’s failure is evidence about that detector and evaluation setting, not proof that every detector must fail.
An active observer can modify the transmitted text. Rephrasing or even small edits can disrupt a token-level code and prevent extraction. This is a reliability or robustness question in addition to a detection question. Dai and Cai discuss active modification as a limitation; Yan and Murawaki’s steganographic extraction setup assumes the attacker does not alter the text. Dai and Cai, Section 4; Yan and Murawaki, Limitations.
Can the intended receiver decode the text?
Even an untouched string can expose a mismatch between token sequences and visible text. SyncPool addresses ambiguous subword segmentation through synchronized grouping and sampling while preserving the modeled token distribution; grouping also reduces available embedding rate. Stepwise verification addresses tokenization inconsistency around arithmetic-coded generation. These works examine the interface needed for the theoretical coder to survive a text round trip.
When comparing results, record the language model and tokenizer, generation settings, payload unit, statistical reference, observer capabilities, extraction success, and any text modifications. That makes it possible to tell whether a gain concerns capacity, detectability, or delivery reliability—and whether the conditions match another paper’s experiment.
Continue with watermarking and agent communication for two related settings with different objectives.