Hidden Messages in AI Text: New Steganography Method Boosts Capacity Twentyfold

Researchers in China have unveiled a technique that lets secret messages ride inside text generated by diffusion language models with dramatically higher capacity than before, while keeping the output statistically indistinguishable from ordinary machine-generated prose. The method, called TE-CSA for Trajectory Entropy-aware Cross-Step Aggregation, was described in a study published in the journal Cybersecurity by Runxuan Deng, Xiaowei Yi, Hong Zhang, Yun Cao, and Changjun Liu of the Institute of Information Engineering at the Chinese Academy of Sciences and the University of Chinese Academy of Sciences. In controlled experiments, the framework achieved up to 18.60 times higher embedding capacity and 20.40 times higher embedding rate than an architecture-matched baseline, lifting the payload from 0.09 to 1.84 bits per token.

Linguistic steganography is the art of hiding secret information inside innocuous-looking text. In a typical covert communication scenario, a sender embeds a hidden message into seemingly normal sentences and transmits the resulting stegotext over a public channel, where the intended recipient recovers the payload. Unlike older modification-based approaches that alter existing documents, generative linguistic steganography embeds information directly during text generation, so that the statistical distribution of the stegotext remains close to that of ordinary language model output. This distribution-preserving property has become a foundational principle of provably secure linguistic steganography, because a message that leaves no statistical fingerprint cannot, in principle, be detected.

The new work targets a specific and increasingly important class of text generators: diffusion language models. Rather than predicting tokens one after another from left to right, as autoregressive models do, diffusion models progressively denoise noisy token states over many inference steps. At each denoising step, the model produces a token-level probability distribution for every position in the sequence. The researchers recognized that this iterative process exposes a whole trajectory of intermediate distributions, each one a potential embedding opportunity with its own entropy characteristics. Previous diffusion-based steganography methods, however, largely ignored this trajectory-level structure.

The team’s motivational study revealed the core problem. Analyzing candidate embedding positions across diffusion trajectories under their default settings, they found that embedding opportunities are highly sparse: the majority of denoising timesteps provide no valid candidates at all, and candidate-rich timesteps occur only occasionally. Existing token-level diffusion steganography methods such as STEAD perform embedding independently within each isolated timestep, which means that when a single step lacks enough compatible candidates, otherwise usable positions are simply wasted. This timestep-local design, the authors argue, is the fundamental bottleneck limiting embedding capacity.

TE-CSA’s answer is an accumulate-then-trigger strategy. Instead of consuming candidates immediately, the framework continuously extracts candidate positions from every denoising timestep and stores them in a global pending pool. When the pool contains at least three compatible positions, the framework constructs an embedding group from the three highest-capacity candidates. Because the same secret bit segment is redundantly embedded across the three positions, the effective capacity of each group is determined by its weakest member, the minimum capacity among the three. This group constraint is central to the paper’s theoretical analysis, in which the authors derive a trajectory-level capacity bound and prove that sorting candidates by capacity and grouping them consecutively attains that bound when the complete retained candidate set is available.

The second key ingredient is entropy-aware filtering. From an information-theoretic standpoint, not all candidate positions are equally valuable. Positions whose token distributions are highly concentrated, meaning the model is already nearly certain which token to place there, carry almost no usable uncertainty and act as bottlenecks: if such a low-capacity position joins an otherwise high-capacity group, it caps the group’s payload. Computing full Shannon entropy for every candidate would be expensive, so the framework uses a min-entropy-inspired approximation based on the maximum token probability, which requires only identifying the most probable token in each local distribution. Candidates whose estimated capacity falls below a threshold are removed before group construction. The strongest filtering configuration, TE-CSA-τ3, retains only positions with capacity of at least 4.

Embedding itself proceeds through distribution-preserving probabilistic sampling. The secret bit sequence is mapped into a continuous value in the interval from 0 to 1 using binary fraction encoding, and the token probability space at each candidate position is partitioned into cumulative intervals. The value falls into one interval, and the corresponding token is sampled under constraints that keep the selection consistent with the original diffusion distribution. Crucially, the authors emphasize that cross-step aggregation and entropy filtering only decide which candidate positions participate in embedding; they do not modify the token probabilities themselves. The security property is therefore inherited from the underlying interval-based embedding mechanism, a point the authors frame as conditional distribution-preserving security rather than unconditional provable security. During extraction, the receiver reconstructs the same candidate sets, filtering decisions, groups, and intervals to recover the message without altering the received text.

The experimental results are striking. Under the default generation setting of length 256, temperature 1.3, and top-p 0.98, the STEAD baseline achieved only 25.30 bits of embedding capacity, while TE-CSA variants reached 469.90 bits without filtering and 470.50 bits with the strongest filtering, an 18.60-fold improvement. The embedding rate rose from 0.09 to 1.84 bits per token, a 20.40-fold gain. Importantly, the improvement does not come from creating new entropy but from converting a far larger fraction of the embedding opportunities already scattered across the diffusion trajectory into effective embedding groups. Runtime overhead remained modest: encoding took 51.53 seconds for TE-CSA-τ3 versus 49.76 seconds for STEAD, because the framework requires no extra denoising iterations or auxiliary neural networks.

Quality and detectability held up as well. Measured by relative perplexity variation, the no-filter variant perturbed generation by 11.20 percent, but entropy-aware filtering cut that figure in half to 5.60 percent while leaving capacity essentially unchanged, validating the claim that low-entropy positions introduce disproportionate distortion for minimal gain. In steganalysis tests against three neural detectors, FCN, R-BiLSTM-C, and BiLSTM-Dense, detection error rates for TE-CSA-τ3 hovered near the 50 percent random-guessing level, at 50.10, 50.06, and 51.38 percent respectively, suggesting the evaluated detectors could barely distinguish stegotext from normal diffusion-generated text. The authors caution that these results characterize practical resistance under the selected detectors, not universal undetectability, and note that LLM-based steganalysis remains a future evaluation frontier.

The study also situates TE-CSA among competing approaches. GTSD, an earlier diffusion-based method, embeds information through prompt mapping and batch selection, with reported rates of roughly 1.56 to 3.94 bits per token depending on configuration, while CascSamp achieves 3.42 bits per token on an autoregressive backbone. TE-CSA reaches a comparable order of magnitude within the more constrained token-level diffusion setting, without requiring pre-shared prompt tables or external mapping resources. The authors acknowledge limitations: the framework depends on trajectories with sufficient candidate diversity, its fixed thresholds may be suboptimal under dynamic generation conditions, and adaptive parameter selection could further improve the capacity-quality-efficiency trade-off. Future directions include extending the approach to other diffusion architectures, longer texts, and multimodal diffusion generation, as well as testing against more advanced steganalyzers.

Subject of Research: High-capacity distribution-preserving linguistic steganography in diffusion language models using trajectory entropy-aware cross-step aggregation

Article Title: TE-CSA: trajectory entropy-aware cross-step aggregation for improving embedding capacity of distribution-preserving linguistic steganography

Article References: TE-CSA: trajectory entropy-aware cross-step aggregation for improving embedding capacity of distribution-preserving linguistic steganography. (n.d.). https://doi.org/10.1186/s42400-026-00668-2

Image Credits: AI Generated

DOI: 10.1186/s42400-026-00668-2

Keywords: linguistic steganography, diffusion language models, information hiding, entropy, embedding capacity, distribution preservation, cybersecurity, text generation, steganalysis, information theory, covert communication, natural language processing