StegoZip: Enhancing Linguistic Steganography Payload in Practice with Large Language Models
Authors: Jun Jiang
Zijin Yang
Weiming Zhang
Nenghai Yu
Kejiang Chen
Venue: NeurIPS 2025 poster ()
Keywords: linguistic steganography
payloads
generative steganography
Primary area: social_and_economic_aspects_of_machine_learning
TL;DR: Enhancing Linguistic Steganography Payload in Practice with Large Language Models

Abstract: Generative steganography has emerged as an active research area, yet its practical system is constrained by the inherent secret payload limitation caused by low entropy in generating stego texts. This payload limitation necessitates the use of lengthy stego texts or frequent transmissions, which increases the risk of suspicion by adversaries. Previous studies have mainly focused on payload enhancement through optimized entropy utilization while overlooking the crucial role of secret message processing. To address this gap, we propose StegoZip, a framework that leverages large language models to optimize secret message processing. StegoZip consists of two core components: semantic redundancy pruning and index-based compression coding. The former dynamically prunes the secret message to extract a low-semantic representation, whereas the latter further compresses it into compact binary codes. When integrated with state-of-the-art steganographic methods under lossless decoding, StegoZip achieves 2.5$\times$ the payload of the baselines while maintaining comparable processing time in practice. This enhanced payload significantly improves covertness by mitigating the risks associated with frequent transmissions while maintaining provable content security.

StegoZip: Enhancing Linguistic Steganography Payload in Practice with Large Language Models
Jun Jiang'
Zijin Yang Weiming Zhang', Nenghai Yu', Kejiang Chen
1. University Science and Technology of China, China
2. Anhui Province Key Laboratory of Digital Security, China
{jungle0430tmail., chenkj@@ustc..du....
Codes:
Abstract
Generative steganography has emerged active research area, yet its practical system is constrained by the inherent secret payload limitation caused by low entropy in generating stego texts. This payload limitation necessitates the use of lengthy stego texts or frequent transmissions, which increases the risk of suspicion by adversaries. Previous studies have mainly focused payload enhancement through optimized entropy utilization while overlooking the crucial role of secret message processing. To address this gap, we propose StegoZip. framework that leverages large language models to optimize secret message processing. StegoZip consists of two core components: semantic redundancy pruning and index-based compression coding. The former dynamically prunes the secret message to extract lew-semantic representation, whereas the latter further compresses it into com- pact binary codes. When integrated with state-of-the art steganographic methods under lossless decoding, StegoZip achieves 2.5x the payload of the baselines while maintaining comparable processing time in practice. This enhanced pay load significantly improves covertness by mitigating the risks associated with frequent transmissions while maintaining provable content security.
Introduction
Steganography is an information-hicn hidding technique that enables covert communication by imper- ceptibly modifying cover data avoid detection by adversaries [33) For example, establish collaboration with target customers while preventing detection by competitors, company may em- ploy steganography to transmit commercial information through public channels by embedding trade secrets into innocuous cover data. Unlike cryptography, which secures content through encryption, steganography ensures security by eliminating physical statistical traces of hidden information in the cover data, thereby avoiding suspicion from adversaries at the behavioral level [46)
L Linguistic steganography, which exploits text the most prevalent communication medium, as shown in Figure [] typically follows two core phases during message encoding [7 1) Message preprocessing secret messages through compression, encryption, and format conversion. 2) Message Embedding: most of these methods adopt channel coding methods to embed messages while balancing imperceptibility and payload, exemplified by Syndrome-Trelle
Processing:
Codes (STC) (10] and Steganographic Polar Codes (SPC) [II. After transmission of the stego texts via the public channel, authorized receivers can reconstruct the secret message by applying inverse transformations
using shared keys. However, traditional modification based methods [10] invariably introduce detectable statistical discrepancies between the cover texts and the stego texts 15.
"Corresponding authors: Kejiang Chenjchenkj@une @uttekkkjustc.ccu.cm
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

0110 01101 0110
101001
oommtr 1011IDO + Secret Message
Secret
Message Processing
Message Embedding
Stego
Public
Message
Message De-Preoceesing
Message
Text
Channel
Extraction
Figure 1: The general process of linguistic steganography.
With breakthroughs in generative large language models (LLMs) [16], transformative paradigm shift has emerged in the field of steganography. These models not only generate texts that are closely aligned with human text distributions but also, more importantly, explicitly output token-level sampling probability distributions. By embedding secret messages while maintaining the original distributions and sampling randomness, it is feasible to develop provably secure steganography [6 17- 24). For example, Discop [23] generates multiple "distribution copies" for a given probability distribution and employs the index values of these copies encode secret messages. SparSamp [24 achieves efficient message embedding by combining sparse sampling with message-derived random numbers, significantly reducing computational complexity while maintaining security.
However, practical steganographic systems are still constrained by the relatively low secret payload, which is defined as the ratio of the secret message length to the stego text length. To transmit the secret message, the stego text often has to be considerably longer than the secret message itself. Consequently, the sender must either use lengthy stego texts multiple transmissions to ensure the integrity of the secret message. These anomalous behaviors are more likely to expose the purpose of steganography necessitate
complex compensatory actions.
While state-of-the-art (SOTA) methods enhance payload through iterative embedding [88] 21-244 or sampling distribution optimization 225 they focus mainly on the message embedding phase, i.e., how to leverage the statistical characteristics of cover texts to embed secret messages more efficiently. This singular focus, however, is still bound by the limitations of entropy and overlooks critical opportunities for message processing optimization by LLMs, particularly in terms of redundancy elimination and semantic compression of secret messages before embedding operations.
On the basis of these insights, we propose StegoZip, a framework designed address the payload limitations in practical linguistic steganography through LLM-driven secret message automated processing. The framework consists of two key components: Dynamic Semantic Redundancy Pruning (DSRP) and Index-Based Compression Coding (ICC). DSRP uses LLMs to analyze semantic redundancy in original messages, dynamically removing low-information elements to generate pruned, low-semantic content. In addition, a restorer fine-tuned on public datasets can losslessly reconstruct the original semantic richness from the pruned content. Moreover, inspired by Shannon's 's information theory (28) and advancing existing LLM-based compression methods [29], ICC further compresses low-semantic content into compact index sequences. Furthermore, after secudo-randomzaatie StegoZip maintains the security of the underlying steganographic algorithm during secret message embedding. In summary, our main contributions are as follows:
We reveal the communication risks arising from the payload limitations in practical linguistic steganographic systems, highlighting that inefficient message processing optimization restricts the capacity of secure covert communication.
We propose StegoZip, framework for secret message automated processing that enhances payload in SOTA steganographic systems while maintaining security during secret message embedding.
By incorporating StegoZip into SOTA steganographic systems, we achieve 2.5x the payload the baselines while preserving a comparable steganographic processing time for lossless reconstruction of secret messages, demonstrating practical viability for real-world deployment.
2 Related Work
2.1 Generative Linguistic Steganography
L Linguistic steganography hides secret messages within a cover text. Traditional methods, e.g.. Syndrome-Trelle Codes (STC) [10, and Steganographic Polar Codes (SPC) M1, achieve this by modifying components of the cover text. However, these methods often induce statistical deviations

---

from the natural distribution, making the stego text vulnerable to detection by adversaries. In contrast, generative language modeling has revolutionized the field by enabling the embedding of secret messages into generative data [77. These models learn the underlying distributions of natural language and serve as effective sampling mechanisms, producing content that is increasingly statistically indistinguishable from human text. This capability forms the foundation for secure steganography, as it allows for secret messages to be embedded during the token generation process without disrupting the statistical properties of the output [8 30). By iteratively sampling from explicit probability distributions over tokens, generative models ensure both security and naturalness in the resulting stego text.
Recent advances in generative linguistic steganography have capitalized on these principles. Notable examples include ADG [20]. which partitions the vocabulary into clusters of similar probabilities and uses the cluster indices to represent secret messages. Meteor 21 employs range-reversible sampling that encodes messages as sampling interval offsets while compressing code length via shared prefixes. iMEC [22] attains near-theoretical embedding limits by iteratively optimizing message encoding paths based on minimum entropy coupling theory, maximizing embedding capacity with minimal distortion. Discop [23] takes a novel method by generating multiple "distribution copies" from a given probability distribution and encoding secret messages via indices of these copies. SparSamp [24 combines sparse sampling with message-derived random numbers, drastically reducing computational complexity while preserving high levels of security.
While these state-of-the- the-art (SOTA) methods have significantly improved payload through iterative embedding [8 24 or sampling distribution optimization (25 they are still constrained by the inherently low entropy in the probabilities of text generation. This limitation caps payload efficiency, as the distribution of natural language tokens leaves little room for substantial expansion. However, the advent of large-scale language models presents transformative opportunities not only in optimizing the embedding stage but also in rethinking the processing and compression of secret messages. light of this, we propose StegoZip for advanced message processing and compression.
3 Methodology
3.1 Overview
As shown in Figure 2 StegoZip operates through two LLM-driven components: Dynamic Semantic Redundancy Pruming (DSRP) and -ased Compressed Coding (ICC). The process begins with the use of L.LMs to systematically eliminate redundant, low-information elements via semantic pruning. To prevent the removal of critical information, this step incorporates entity detection and self-checking mechanisms. Once semantic pruning is complete, the framework employs the LLM again to perform probability-driven index-based compression, producing rank sequences. These sequences undergo binary encoding and pseudo-randommizaioon resulting in pseudo-random bit streams. The resulting bit streams are then embedded into cover texts through a steganographic embedding algorithm, enabling secure and covert transmission over public communication channels.
The authorized receiver, equipped with prior knowledge of the steganographic embedding method, binary encoding schema, and LLM configurations, performs the reverse transformations to decode the compressed messages. After successful extraction, a shared semantic restorer R, fine-tuned on public datasets, losslessly reconstructs the original secret messages in a context-aware manner. To maintain synchronization between the sender and receiver, the sender also uses R as the LLM for both DSRP and ICC. Further details of each module are described the following sections.
3.2 Private Restorer in StegoZip Framework
The private restorer R serves as a core component of the StegoZip framework, derived through fine- tuning a base language model. In natural communication, rich semantic content enables the receiver to fully understand the sender's perspective. However, such semantic abundance introduces significant redundancy, which increases the payload burden during transmission over public channels. Thus, this redundancy limits practical applications in resource-constrained communication scenarios, e.g., covert communication. To address this, the framework harnesses the advanced language comprehension capabilities of L.LMs to perform semantic pruning, retaining only the most critical elements of the secret messages for public transmission.
3

---

Semantic Pruning
(Entity Fliter)
Tayasu to upen south Chiss plant Japas cammikrr Toyola
vesture produce saloon southem China
Tokerizer
14374
358 20523
Profi for price)
Comppessed Mossage Tokes
Toyata (1 [] China plast Jopan cannaker Toyota
produce
southern
[+] fi Funio
Rank: 122
Token
Proh
Self- Self-Checkong
Toyota [o] [esublish] [a] China plant Agaan cornaker Toyota ccress x (vnuur) to produce eakon can [is] souhem Chiss m7y
[3N]j Baski
657
638
02744
5465
01001
0.0005
Nistee his are a and romooatee sprcistior... ... Üher: Toyota (1 [opeal (soutl) Chisa plant Japaz canmaker Toyata crtars (] [ producee salonn can [] suthem Chiraa
Sequence
Step1: DSRP
m
Step2: ICC
122, 89, 687, 0,
(001co1... B
11010011
Corract
my
53.1 wer.
Step3: Public Transmission
Restore
prior)
Seguence
TuKK
Encoder
mi
Pr(zals
1. [open) (.out)))
Split
7L... [25]
Back
Tokes
Puob
Stego Text
m
Tokenizer
0b.... [198]
Kank:
668
67714
5455
723
Rank Token
Sigumagaphic Algunidam
Step4:
Message
Decoding
Figure 2: The framework of StegoZip comprises core components: Dynamic Semantic Redun- dancy Pruning (DSRP) and andex-Based Compressed Coding (ICC).
However, relying solely on human perception to interpret the pruned messages can lead to ambiguity or misunderstanding, as the compressed content may lack sufficient contextual clarity. To address this issue, the framework harnesses the context-aware capabilities of LLMs to reconstruct the original rich semantics from the compressed messages. Notably, deploying large-scale LLMs in covert communication scenarios is often impractical because of their substantial computational and resource requirements, whereas smaller models (e.g., 3B, 7B) lack the capacity to reliably comprehend and execute restoration tasks. To balance these constraints, the framework fine-tunes smaller base LLM, creating private shared restorer model used by both the sender and receiver to ensure lossless synchronization and significantly enhance communication fidelity. The fine-tuning process involves three key steps: Self-Information Calculation, Semantic Pruning, and Instruction Fine-tuning.
Self- lnff-mnformation Calculation. Instruction fine-tuning begins by constructing a dataset tailored for semantic restoration. This necessitates preparing paired data where the input comprises text with low semantic content, while the output retains rich semantic details. Given a public text dataset Dp. for each sample T E DD designated as output, its compressed content serves as the corresponding input. This is achieved by leveraging the concept of self-information from information theory to measure the information content of each lexical unit (e.g.. words or any meaningful segments derived from tokenization) in Zp. This metric quantifies the significance of lexical unit based on its sampling probability as determined by the base language model. For each lexical unit u E xp consisting tokens u = (w) (kk)) }, its self-information 4xx (u) is calculated as:
hee (u) Σ
Σ 1=1
P(w())) = Σ (-logg((oo I
where p(w()) (ee) is the conditional probability of the t-th token w sampled, given its preceding tokens Wiet as estimated by the LLM. The less likely a token is to be sampled, the greater its self-information.
Once the self-information of all lexical units in x, is calculated, units with low information are removed through q-quaneeee pruning:
Semantic Pruning.
Comprecsed Detaae
Self ont-larfmeatonn
D. {zp ② 1 (4)(u) Tax Yu E xp) xp E Dp).
(2)
Instruction Fine- Fine-tuning Detaset
where @ denotes element-wise multiplication, 1(-) is indi- cator function, and Ta represents the a-quantile satisfying:
buch yourne making Molecer engent ie anomone and fene aerraa Uven Toe
Ta inf
1
1
()) 2a
S
(3)
Restorer
Fpl
Figure 3: Fine-tuning restorer
Instruction Fine-tuning, After semantic pruning, the semantic- compressed dataset De, combined with the original dataset Dp. is used to construct the instruction

---

fine-tuning dataset Drr through lemplate-based pairing, as illustrated in Figure 3 The base LLM fine-tuned to reconstruct rich semantics by inserting words within square brackets "I] without altering or deleting any existing content in the compressed text. This ensures precise restoration while preserving the original structure. The fine-tuned restorer R, shared by both sender and receiver, enables lossless and synchronized semantic reconstruction in the StegoZip framework.
3.3 Dynamic Semantic Redundancy Pruning
With the shared private restorer established, the StegoZip module integrates seamlessly into the steganographic system, employing a dynamic pruning mechanism through two phases similar to the restorer fine-tuning process: Self Information Calculation and Semantic Pruning.
For a secret message m, its compressed form m. is derived using R and ceff-information processing: m. = m
hh (u) : Here, T, is dynamic threshold that adjusts based on the average self-information of m and the empirical fine-tuning dataset Dp:
T/a Ta (1- 1(m)- - (((p) T(D,)
where Ta is the predefined threshold from Eq. 3 7(m) is the average self-information of secret message m and (D,) is the average self-information of [(x,) from the public dataset Dp. This ensures dynamic adjustment of the pruning ratio based on the entropy of m, preventing excessive pruning in short, high-entropy texts. Extremely high self-information values (oo) are ignored.
However, this process risks losing critical information, e.g., names, numbers, other key entities. To address this, entity detection is performed prior to pruning, ensuring that essential details are preserved intact, with their self-ime inforrmfootnonn designated as infinity co. Additionally, to guarantee that the recipient can reconstruct the message without loss, the sender conducts a self-checking process. Using the restorer R. the sender attempts to reconstruct the original secret messages. Any portions that cannot be accurately aligned are replaced with their original content and marked with square brackets "[]", as shown in Figure 2 Through this careful preprocessing, the resulting compressed secret messages m', retain low semantic redundancy while safeguarding crucial elements. Moreover, having been exposed to numerous instances of compressed text during fine-tuning, R is better equipped to compress text when using the same prefix in subsequent encoding tasks through ICC.
3.4 Index-Based Compressed Coding
After dynamic semantic pruning, the compressed message m is transformed into binary codes via probability-dri -riive index encoding. Inspired by LLMzip (2)]. this method leverages the token prediction capabilities of the L.M to achieve high compression ratios.
Let the tokenized sentence be represented W. (wi,..., w. of length where each w; W. denotes as a token. The rank of each token W; is defined as its sorted index when the vocabulary is ordered by descending conditional probability:
r(w:) = +
Σ w w'EVYWw
(p wee) > p (w. wer)),
(5)
where 1(.) is an indicator function. This probability-driven token-rank mapping ensures efficient compression, as tokens with higher probabilities are assigned lower ranks. Since the fine-tuned restorer R has been exposed to numerous instances of semantic pruning text with the same template prefix, it is particularly effective at encoding such texts, thereby achieving a higher compression rate.
The rank sequence is then converted into bit format B via Huffman encoding, lossless compression method that minimizes the bit form of frequent ranks. To ensure secure steganographic embedding, the bit sequence B is neeudo-randomized. This is achieved by performing an XOR operation between B and a pseudo-random binary key K, which is generated by a secure stream encryption algorithm, e.g., ChaCha20 (11. The resulting pseudo-random bit stream S is then embedded into the cover text via a secure steganographic embedding function, ensuring provable security while maintaining the integrity of the compressed message. For a detailed proof of security, please refer to Appendix A
5

---

3.5 Secret Message Restoration
The decoding framework enables lossless reconstruction of the secret message through invertible transformations mirroring the encoding process. For the stego text 2.. the embedded bit stream S is extracted via the negotiated steganographic extraction function. The receiver then reverses the using cryptographically synchronized parameters and Huffman decoding with the same shared codebook to obtain the original rank sequences. Furthermore, the receiver replicates the index-based compression coding generation process via inverse rank-token mapping, converting each rank into its corresponding token to reconstruct the semantic pruning message m'.-
Since ml may lack sufficient semantic detail for complete comprehension, the shared restorer R semantic expansion to restore the full secret message. During this step, m. is split into the compressed representation m, and the portion marked during the sender's self- checking process in the DSRP phase. The restorer synchronizes with the sender's self-checking process, producing the intermediary text m, with the same errors. Finally, the marked portions are used to correct any errors in my, ensuring the complete restoration of the original secret message.
employs instruction-guidee
4 Experiments
4.1 Implementation Details
LLMs. In this paper, we utilize two widely used LLMs: Qwen2.5-7B 132 and DeepSeck-RI-Distine Llama-8B (DS-Llama-8B) 33 for index-based coding and restoration tasks, and greedy sampling is employed. To prevent fine-tuning that could compromise the security of the original generative steganography algorithm, we use separate LLaMAA-7B (34] for stego text generation. In this process, random sampling with temperature of 0.9 is applied, without incorporating top-p or top-k sampling. We use LoRA (35] to fine-tune the base LLMS for two epochs, and more detailed experimental settings are shown in the Appendix
Datasets. Text datasets are used fine-tune the restorer and generate stego text. For fine-tuning, the IMDb (36] dataset (average length: 1,300 characters) is split into 25,000 training texts and 25,000 test texts, but only 2,000 are randomly sampled for testing. For the AGNews [37] dataset (average length: 241 characters), only the "business" category is selected and divided into 30,000 training texts and 1,900 test texts. For stego text generation, the WikiText-2-v randomly sampled, and the first two sentences are extracted as prompts to guide generation.
38 dataset used. Texts are
Baselines. In the main experiment, the parameters for the proposed Dynamic Semantic Redundancy Pruning are set to a = 0.4 and 1.0. To the best of our knowledge, existing linguistic stegano- graphic systems do not specifically address message processing. Therefore, adopt common setup, using Huffman compression after tokenizing the original secret messages as the baseline message processing. The tokenizers [32] 33 we use employ Byte Pair Encoding (BPE) 33 based on bytes, which inherently provides some degree of compression. We consider SOTA methods for the underlying generative steganography: Discop 23 and SparSamp (24 For fair comparison, we
evaluate performance using sentences that do not have token ambiguity 40 41
Evaluation metrics. We evaluate StegoZip from both efficiency and semantic retention perspectives:
Efficiency: We divide the efficiency into payload and processing time. The payload refers to the ratio of the secret message length to the stego text length, which is the most important metric for assessing StegoZip's 's compression capability. The processing time encompasses the average encoding time, which spans from processing the secret message to the completion of generating the stego text, and the average decoding time, which involves extracting the bit stream from the stego text and restoring the original secret message.
We evaluate the semantic retention from restored and compressed messages at the word and semantic levels via the metric Rouge, [42] and BERTScore [43] Rouge- calculates the proportion of single words from the original secret message that appear the target secret message, whereas BERTScore, which leverages BERT's contextual embeddings to calculate the similarity between the original and target secret messages, provides a measure of semantic similarity. Higher values of these metries are better.
Semantic Retention:

---

Table The efficiency of StegoZip: StegoZip significantly enhances the payload while maintaining a comparable steganographie processing time cycle.
Model
Dataset
Steganography
Payload (%) t
Encoding Time (s) 4
Decoding Time (s) 4
Discop
26]
18.91
14.82
14.93
AGNews
StegoZip
45.23 (t 26.32)
12.94 (L 1.88)
12.73 (L 2.20)
37
SparSamp
19.03
10.55
10.61
Qwen2.5-7B
StegoZip
44.49 (1 25.46)
11.23 (1 0.68)
11.15 (f 0.54)
32
Discop
23
18.30
70,20
69.21
IMDb 36
StegoZip
49.64 (1 31.34)
56.62 (4 13.58)
54.91 (L 14.3)
SparSamp
24
19.12
63.12
63.04
StegoZip
49.74 (1 30.62)
55.67 (4 7.45)
52.36 (L) 10.68)
Discop
23
18.75
14.98
14.30
AGNews 37
StegoZip
44.83 (1 26.08)
12.33 (4 2.65)
11.95 (L 2.35)
DS-
SparSamp
24
18.48
10. 16
10.18
Llama-8B
StegoZip
43.60 (1 25.12)
10.62 (1 0.46)
10.61 (1 0.43)
33
Discop
23
18.33
68.15
69.23
IMDb 36
StegoZip
49.31 (1 30.98)
55.91 (4 12.24)
53.47 (L 15.76)
SparSamp [24
19.76
61.55
60.93
StegoZip
49.41 (1 29.65)
49.56 (4 11.99)
46.46 (4) 14.47)
Table 2: Before StegoZip can reconstruct secret messages losslessly (achieving a metric score of 1.0000), compressed secret messages still retain high degree of semantic preservation. Below, R C denotes the semantic retention of restored/compressed secret messages relative to the original.
Model
Dataset
Rouge; (R / C)
BERTScore C)
AGNews 37
1.0000/0.845
1.0000/0.9633
Qwen2.5-7B 32
IMDb 36
1.0000/0.9445
1.0000/0.9833
AGNews 37
1.0000/0.8657
1.0000/0.966
DS-Llama-
IMDb (36
1.0000/0.9185
1.0000/0.9758
4.2 Main Performance of StegoZip
Efficiency of StegoZip. The experimental results in Table [ demonstrate that the proposed StegoZip framework significantly enhances the original steganographic system, achieving a 2.5x the payload of the baselines. This improvement attributed the integration of Dynamic Semantic Redundancy Pruning (DSRP) and probability-driven Index Compression Coding (ICC), which collaboratively compresses lexical units in secret messages with high efficiency. When dealing with longer secret messages (the average character count of the IMDb dataset is five times that of the AGNews dataset), StegoZip demonstrates better compression performance due to the availability of richer contextual information. Complementing these results, Table 2 provides a rigorous evaluation of message fidelity, where both the restored and compressed secret messages are compared the original using Rouge, (word-level similarity) and BERTScore (semantic-level alignment). The results confirm that StegoZip achieves lossless reconstruction of secret messages at the receiver end, whereas the compression process preserves the core semantic meaning of the original content. Overall, the StegoZip framework harnesses the advanced semantic understanding capabilities of LLMs to eliminate low-in wwwiinformatio units in secret messages, encoding them into densely packed and secure binary bit stream. This ensures efficient representation without compromising the lossless decoding process. By doing so, the method significantly reduces the payload burden for covert communication over public channels, while simultaneously enhancing both security and efficiency.
Time Consumption. Although StegoZip introduces additional preprocessing steps, including Self- Checking, ICC, De-ICC, and Restore, which may appear time-intensive, the results in Table and Figure reveal that the optimized payload efficiency ensures a comparable steganographic embedding and extraction time. This is attributed to the reduced amount of binary code that needs to be embedded per stego text, significantly decreasing the time required for both the embedding and
7

---

160
Audia
Baxp
0000 Click
1C2 Ented Seao Se300 Rooos
D88 Click
EC Debed Donc Se Jume
DS0 Chick
10C Saled Draet bedce Rono
5007 Out
DXC Bald bana BocC Rune
(4) UQQuen-hhupp
Upere-Spertamp
(5) D.DepSSee-Duae Dhucrp
(40 Decppede SpurSarp
Figure 4: Comparison of time consumption across different stages of steganographic processing.
Roger
BEKTScor
Paykoa
Resgei
BEXTScore
100
100
46
100
1,00
Payloud (56)
035
(50
0.5
005
Payloa (98)
0.95
0.11 (3) Qwee-o
0.23
0.15
0.0 0 0.30
0:11
0.00
0.01
6.10
0111
0.20
(b) DeepStck-a
(6) Qwennn
(b) DeepSeck-n
Figure 5: Effect of pruning quantile a.
Figure 6: Effect of adaptive coefficient 7).
Table 3: Efficiency comparison of LLMs of varying sizes in compression and restoration.
Model Size
Payload (%)f
Encoding Time (s)
Decoding Time (s)
Rouger
BERTScore +
Qwen2.5-0.5B
40.21
8,53
8.56
0.9251
0.9801
Qwen2,5-1.55
41.15
9.23
9.08
0,8982
0.9753
Qwen2.5-3B
41.92
9.56
9.47
0.8884
0.9705
Qwen2.5-7B
45.23
12.94
12.73
0.8485
0,9633
Qwen2.5-14B
46.09
21.54
21.51
0.8428
0.9611
extraction processes. Moreover, the increased payload efficiency enhances security by reducing the amount of stego text required for transmission. At the behavioral level. this reduction minimizes the likelihood of arousing suspicion from adversaries under equivalent communication requirements when compared with traditional methods. These advancements position StegoZip as a practical and effective solution for balancing capacity, efficiency, and security in linguistic steganography systems.
4.3 Parameter Tuning and Resultant Impact
Pruning Quantile a. investigate the impact of the self-information pruning quantile a on both the steganographic payload and the semantic preservation of compressed secret messages. Within the range a [0.25, 0.45), as shown Figure the key semantic information in the compressed text progressively reduced increases. A moderate pruning ratio enhances the payload the pruning effect becomes more pronounced. However, excessive pruning disrupts the restorer R's ability to effectively reconstruct the original semantics. This leads to increased errors during self-checking and more extensive corrections, ultimately resulting in a decreased payload. Striking an optimal balance for is therefore critical, it directly determines the trade-off between payload and semantic fidelity.
daptiie Coefficient r7. The adaptive coefficient 7) plays an important role shaping the performance of StegoZip within the DSRP module. As shown in Figure 6 the model navigates the trade-off between compression efficiency and semantic resilience as 1) increases. Lower values of v) favor aggressive compression, maximizing efficiency but risking over-compression, which may result in the loss essential semantic information and hinder accurate restoration. Conversely, higher values are more cautious, prioritizing the preservation of semantic integrity at the cost of reduced compression efficiency. Moreover, different samples exhibit varying levels of complexity and information density, necessitating dynamic adjustments 17 to meet diverse compression demands. This adaptability ensures that StegoZip achieves balance between compression and semantic restoration, enhancing its versatility across diverse scenarios.
Model Size of L.Mss. We examine the influence of large language model size on performance in compression and restoration tasks, and the results are shown in Table As model size increases, the payload clearly tends to increase. This can be attributed to larger models, with their more complex architectures and greater number of parameters, being better equipped to capture richer semantic

---

Table The generalization of the Restorer R across different domain datasets.
TestSet
AGNews-business
AGNews-world
AGNews-Mixed
IMDb
Mixed
AGNews-business
45.23
45.32
43.48
50.32
47.26
AGNews-world
44.90
47.69
44.28
49.53
46.94
AGNews-Mixed
46.01
47.03
45.08
50.49
47.70
IMDb
40.85
41.31
41.59
49.74
44.87
Mixed
44.82
45.07
43.87
50.01
45.73
Table 5: Ablation study the components of StegoZip, where "w/o" indicates employed.
Model
Discop-StegoZip
w/o DSRP w/o instruction in ICC
w/o R in ICC
w/o ICC
Discop
Qwen2.5-7B
45.23
31.78
42.71
40.05
23.17 22.54
18.19 19.19
DS-Llama-88 -B
44.83
30.22
41.13
38.91
18.30
information and patterns. As result, they can effectively prume more redundant semantics during compression. However, the encoding and decoding times also increase with model size. Hence, in practical applications, larger models with higher payloads are better suited for tasks where real-time processing is not critical. On the other hand, smaller models, which offer faster processing times, are more appropriate for scenarios requiring quick responses.
4.4 Cross-Domain Transferability Analysis
Initially, fine-tuning the small-scale LLMs aimed solely enable them understand the restoration task, without accounting for the domain of the secret messages. Nonetheless, given the specialized nature of covert communications, interacting parties can often predict the domain of the covert information. We analyze the impact of domain differences between the dataset used to train the restorer and the test set on the payload, as shown in Table For this study, we compare categories including business and world within the AGNews dataset 37 which share some similarities, against the IMDb dataset [36], which differs significantly in both content and style. Additionally, we test mixed configuration where both datasets are combined in equal proportions. While rross-domain differences do not affect the lossless reconstruction of messages, they can slightly reduce the payload, and hybrid training substantially mitigates this effect. These results highlight the resilience of the StegoZip across domains, with hybrid training maintaining a high payload despite domain shifts.
4.5 Ablation Study
We conduct ablation experiments on the AGNews dataset [37] to assess the importance of each component in the StegoZip, as shown in Table The results confirm that both DSRP and ICC are critical the framework's performance. Notably, incorporating an instruction template during ICC enables the restorer R to predict subsequent compressed content more accurately. This improvement can be attributed to providing the restorer with a priori knowledge of the format and content of compressed secret messages, particularly tokens used for marking. These findings underscore the significance of each component in achieving both high compression and restoration fidelity.
4.6 Steganalysis Experiment
To further verify the security of StegoZip, we conduct steganalysis experiments. We generate 1,000 cover texts and 1,000 stego texts using LLaMA2-7B [34] and employ three steganalysis analyzers: TS-FCN 44. LSTMATT [5), and SeSy 12]. The datasets are split into training, validation, and testing sets with a ratio of 3:1:1. The experiments are configured with learning rate of 3 x 10-5 and trained for five epochs. To ensure robustness, the process is repeated five times, and the average accuracy on the test set is used as the steganalysis accuracy metric. For the restorer R, we use the fine-tuned Qwen2.5-7B 32 model. is important to note that the provable security here refers to being indistinguishable from normal generated text, not from human-written text. Provably secure steganography involves disguising steganographic behavior as normal generated text, as detailed in Appendix A and in previous works 23 24

---

Table 6: Steganalysis accuracy with and without using StegoZip.
Method
TS-FCN 4 (%)
LSTMATT 45 (%)
SeSy [22 (%)
Discop
51.25=2.77 50,90=2.15
50.70=3.02
49.20=2.23
Discop StegoZip
52.35+2.71
51.30==0.92
SparSamp
51.40=1.64
49.85++199
49.10+2.008
SparSamp + StegoZip
49.80-1.42
52.35
50.05+ 1.66
The classification accuracy of steganalysis is close 50%, as shown T indicating that stego texts and cover texts cannot be reliably distinguished. The experimental results demonstrate that StegoZip maintains comparable security level to scenarios without using StegoZip. This further validates the consistency of the security of steganographic systems equipped with StegoZip with that of existing underlying steganographic algorithms.
5 Limitations
While StegoZip significantly enhances the payload of linguistic steganographie systems, its reliance on LLMs for message compression and reconstruction inevitably introduces additional computational overhead, even if the overall steganographic processing time remains comparable, Furthermore, its dependency on high-precision LLMs limits its applicability in resource-constrained environments or scenarios lacking advanced computational infrastructure [46]. Future research could aim to optimize StegoZip's computational efficiency, making it more adaptable to diverse operational contexts.
6
Conclusion
In this paper, introduce StegoZip, novel framework that leverages large language models for dynamic semantic redundancy pruning and index-based compression coding. By incorporating into advanced steganographic systems, achieve payload that is 2.5 times the original size while maintaining comparable steganographic processing time. This advancement not only enhances the efficiency of the steganographic embedding process but also reduces the frequency of communication between parties, significantly lowering the risk of suspicion by adversaries. StegoZip paves the way for secure and efficient covert communication, demonstrating the transformative potential of advanced processing techniques in modern steganographic frameworks.
Acknowledgements
This work was supported in part by the National Natural Science Foundation of China under Grant 62472398, Grant U2336206, Grant U2436601, and Grant 62402469.
References
[1] David Kahn. The history of steganography. In International workshop on information hiding, pages 1-5. Springer, 1996.
[2] Niels Provos and Peter Honeyman. Hide and seek: An introduction to steganography. IEEE security & privacy, 1(3):32 44, 2003.
[3] Shashikala Channalli and Ajay Jadhav. arXiv:0912.2319, 2009.
Steganography an art of hiding data. arXiv preprint
[4] Neil F Johnson and Sushil Jajodia. Steganalysis: The investigation of hidden information. In 1998 IEEE Information Technology Conference, Information Environment for the Future (Cat. No. 98EX228), pages 113-116. IEEE, 1998.
[5] Christian Cachin. An informationtthoreeti model for steganography. In International Workshop on Information Hiding, pages 306 -18. Springer, 1998.
10

---

[6] Nicholas J Hopper. John Langford, and Luis Von Ahn. Provably secure steganography. In Advunces in Cryptology-CEE CRYPTO 2002: 22nd Annual International Cryptology Conference Santa Barbara, California. USA, August 18-22, 2002 Proceedings 22. pages 77-92. Springer, 2002.
[7] Neha Rani and Jyoti Chaudhary. Text steganography techniques: A review. International Journal of Engineering Trends and Technology (LJET)). 307):30133301,, 2013.
[8] R Bala Krishnan, Prasanth Kumar Thandra, and M Sai Baba. An overview of text steganography. In 2017 fourth international conference on signal processing, communication and networking (ICSCN), pages 1-6, IEEE, 2017.
[9] Mohammed Abdul Majeed, Rossilawati Sulaiman, Zarina Shukur, and Mohammad Kamrul Hasan. review on text steganography techniques. Mathematics, 9(21):2829, 2021.
[10] Tomá Filler, Jan Judas. and Jessica Fridrich. Minimizing additive distortion in steganography using syndrome-trellis codes. IEFF Transactions on Information Forensics and Security, 6(3):920-935, 2011.
[11] Weixiang Li, Weiming Zhang. Li Li, Hang Zhou, and Nenghai Yu. Designing near-optimal steganographic codes in practice based on polar codes. IEEE Transactions on Communications, (948).3948,,92, 2020.
[12] Jinshuai Yang. Zhongliang Yang, Siyu Zhang, Haoqin Tu, and Yongfeng Huang. Sesy: Linguistic steganalysis framework integrating semantic and syntactic features. IEEE Signal Processing Letters, 29:31-35, 2021.
[13] Jinshuai Yang, Zhongliang Yang, Jiajun Zou, Haoqin Tu, and Yongfeng Huang. Linguistic steganalysis toward social network. IEEE Transactions on Information Forensics and Security, 18:859-871, 2022.
[14] Hanzhou Wu, Tianyu Yang. Xiaoyan Zheng, and Yurun Fang. Linguistic steganography and linguistic steganalysis. In Adversarial Multimedia Forensics, pages 163-190. Springer, 2023.
[15] Ziwei Zhang, Juan Wen, Liting Gao, Wanli Peng, and Yiming Xue. Linguistic steganalysis based on few-shot adversarial training. IEEE Transactions on Dependable and Secure Computing, 2025.
[16] Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners. Advances in neural information processing systems, 33:1877-1990 1901, 2020.
[17] Kejiang Chen, Hang Zhou, Hanqing Zhao, Dongdong Chen, Weiming Zhang, and Nenghai Yu. When provably secure steganography meets generative models. arXiv preprint arXiv:181 1.0373,, 1(3)4, 2018.
[18] Kuan Yang, Kejiang Chen, Weiming Zhang, and Nenghai Yu. Provably secure generative steganography based on autoregressive model. In International Workshop on Digital Watermarking, pages 55 68. Springer, 2018.
[19] Kejiang Chen, Hang Zhou, Hanqing Zhao, Dongdong Chen, Weiming Zhang, and Nenghai Yu. Distribution- preserving steganography based on text-to-speede generative models. IEEE Transactions on Dependable and Secure Computing, 19(5):334333356 2021.
[20] Siyu Zhang, Zhongliang Yang, Jinshuai Yang, and Yongfeng Huang. Provably secure generative linguistic steganography. Findings of the Association for Computational Linguistics: ACL-IJCNLP 2021, pages 3046-3055, Association for Computational Linguistics, August 2021.
[21] Gabriel Kaptchuk, Tushar M Jois, Matthew Green, and Aviel D Rubin. Meteor: Cryptographically secure steganography for realistic distributions. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Commanications Security, pages 1529-1548, 2021.
[22] Christian Schroeder de Witt, Samuel Sokota, Zico Kolter, Jakob Foerster, and Martin Strohmeier. Perfectly secure steganography using minimum entropy coupling. arXiv preprint arXiv:2210. 14889, 2022.
[23] Jinyang Ding, Kejiang Chen, Yaofei Wang. Na Zhao, Weiming Zhang, and Nenghai Yu. Discop: Provably secure steganography in practice based on" distribution copies". In 2023 IEEE Symposium on Security and Privacy (SP), pages 2238 2255. IEEE, 2023.
[24] Yaofei Wang, Gang Pei, Kejiang Chen, Jinyang Ding, Chao Pan, Weilong Pang. Donghui Hu, and Weiming Zhang Sparsamp: Efficient provably secure steganography based sparse sampling. arXiv preprint a50iv:2503. / 19499, 2025.
[25] YuiShin Huang, Peter Just, Krishna Narayanan, and Chao Tian. Od-stega: Llm-based near ceaeripppree steganography via optimized distributions. arXiv preprint arX1v:2410.0422,,00 2024.
11

---

[26] Kaiyi Pang. Frestega: A plug-and-plan method for boosting imperceptibility and capacity in generative linguistic steganography for real-world scenarios. arXiv preprint arXiv:2412.19652. 2024.
[27] Chao Pan, Donghui Hu, Yaofei Wang. Kejiang Chen, Yinyin Peng. Xianjin Rong. Chen Gu, and Meng Li. Rethinking prefix-basek steganography for enhanced security and efficiency. IEEE Transactions on Information Forensics and Security, 2025.
[28] Claude E. Shannon, Prediction and entropy of printed english. Bell system technical journnal 30(1):50-64 1951.
[29] Chandra Shekhara Kaushik Valmeekam, Krishna Narayanan, Dileep Kalathil, Jean-Francois Chamberland, and Srinivas Shakkottai. Llmzip: Lossless text compression using large language models. arXiv preprint 27X1v2336.004000 2023.
[30] Xuejing Zhou, Wanli Peng, Boya Yang, Juan Wen, Yiming Xue, and Ping Zhong. Linguistic steganography based on adaptive probability distribution. IEEE Transactions on Dependable and Secure Computing. 19(5): 2982-2997, 2022.
[31] Daniel J Bernstein et al. Chacha, variant of salsa20. In Workshop record of SASC, volume 8, pages 3-5, Citeseer, 2008.
[32] An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, et al. Qwen2. 5 technical report. arXiv preprint 1rXiv:24/2.15115 2024.
[33] Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruayu Zhang, Runxin Xu, Qihan Zhu, Shirong Ma, Peiyi Wang. Xiao Bi, et al. Deepseek-rl: Incentivizing reasoning capability in Ilms via reinforcement learning. arXiv preprint arXiv:2501. 12948, 2025.
[34] Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava. Shruti Bhosale, et al. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint 2.307 23077.9288, 2023.
[35] Edward Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen- Zhu, Yuanzhi Li, Shean Wang, Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models. arXiv preprint 0xXiv:2166.0966 2021.
[36] Andrew Maas, Raymond E Daly, Peter T Pham, Dan Huang, Andrew Y Ng. and Christopher Potts. Learning word vectors for sentiment analysis. In Proceedings the 49th annual meeting of the association for computational linguistics: Human language technologies, pages 142-150, 2011.
[37] Xiang Zhang, Junbo Zhao, and Yann LeCun. Character-level convolutional networks for text classification. Advances in neural information processing systems, 28, 2015.
[38] Stephen Merity, Caiming Xiong, James Bradbury, and Richard Socher. Pointer sentinel mixture models. arXiv preprint arXiv: 07843, 2016.
[39] Philip Gage. new algorithm for data compression. The C Users Journal, 12(2):23-38, 1994.
[40] Luke A Bauer, James K Howes, Sam A Markelon, Vincent Bindschaedler, and Thomas Shrimpton. I Leveraging generative models for covert messaging: Challenges and tradeoffs for" dead-drop" deployments. In Proceedings of the Fourteenth ACM Conference on Data and Application Security and Privacy, pages 67-78, 2024.
[41] Yuang Qi, Kejiang Chen, Kai Zeng, Weiming Zhang, and Nenghai Yu. Provably secure disambiguating neural linguistic steganography. IEEE Transactions Dependable and Secure Computing, 2024.
[42] Chin- Yew Lin. Rouge: A package for automatic evaluation of summarics. In Text summarization branches out, pages 74- 81, 2004.
[43] Tianyi Zhang, Varsha Kishore, Felix Wu, Kilian Weinberger, and Yoav Artzi. Bertscore: Evaluating text generation with bert. arXiv preprint (9Xiv:1904.090 2019.
[44] Zhongliang Yang, Yongfeng Huang, and Yu-Jin Zhang, A fast and efficient text steganalysis method. IEFE Signal Processing Letters, 26(4):627-631, 2019.
[45] Jiajun Zou, Zhongliang Yang. Siyu Zhang, Sadagat ur Rehman, and Yongfeng Huang. High-performance linguistic steganalysis. capacity estimation and steganographic positioning. In International Workshop on Digital Watermarking, pages 80-93, Springer. 2020.
[46] Minhao Bai, Jinshuai Yang, Kaiyi Pang, Xin Xu, Zhen Yang. and Yongfeng Huang. Provably robust and secure steganography in asymmetric resource scenarios. In 2025 IEEE Symposium on Security and Privacy (SP). pages 1 1400. IEEE Computer Society, 2025.
12

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The key contributions and scope are outlined in both the section abstract and the introduction (Section DT We introduce StegoZip, a framework that boosts payload in steganographic systems by 2.5x while preserving security and efficient processing, ad- dressing communication risks from payload limitations, and enabling practical real-world deployment.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine include aspirational goals motivation as long as it clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: The limitations of our method are discussed in the fifth section of the paper, Limitations (Section 5). Inevitably, StegoZip introduces new processing times and requires sufficient computational resources to run LLM.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those not discussed in the paper.
The authors are encouraged create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or speech-to-tex system might not be used reliably provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations their approach to address problems of privacy and fairesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
13

---

Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. the case 3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
Justification: The experimental part of the paper confirms the significant increase in payload for the same processing time (Section 4.2) and gives proof of security in the appendix (Section
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged provide a short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided not)?
Answer: [Yes]
Justification: We will disclose the source code and dataset processing methodology upon acceptance of the paper, and the datasets used are all public datasets. In addition, the main experimental setups in the paper are described in detail in Section 4.1 of the main text and Section[iin in the appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible verifiable.
of large language model), releasing of model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution a new model (e.g., large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
14

---

(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of coosee- models, it may be that access to the model is limited in some way (e.g.. to registered users), but it should be possible for other researchers have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: We will disclose the source code and dataset processing methodology upon acceptance of the paper, and the datasets used are all public datasets, In addition, the main
experimental setups in the paper are described in detail in Section 4.1 of the main text and Section in the appendix.
Guidelines:
The answer NA means that paper does include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.. cc/ public/ http://idcc/ceseuueeee
onsssicy for more details.
While encourage the release of code and data, we understand that this might be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this central the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to reproduce the results. See the NeurIPS code and data submission guidelines (https
wwtpbbmmsisioooooocooocii for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts reproduce all experimental results for the proposed method and baselines. If only a subset of experiments are reproducible, they should state which
omitted from the script and why.
submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: We describe the main configurations in the Implementation Details (Sec- tion 4.1) and give more detailed setup in the Appendix (Section C). For the selection
some parameters, we also conduct experiments in Section 4.3 Parameter Tuning and Resultant Impact.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
15

---

Answer:
[No]
Justification:
Error bars are not reported because it would be too computationally expensive.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e-g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
It is OK to report I-sigma error bars, but one should state it The authors should preferably report 2-sigma error bar than state that they have a 96% CI, the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
We describe the computer resources in the Implementation Details (Section and our experiments report the time needed (Section 4.2
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported the paper (e.g., preliminary or failed experiments that didn't make it into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics httpppppp/..aarrp....opoo///aaaa
Answer: [Yes]
Justification: The intent of this paper is to secure covert communications maintain public privacy, without deviation from moral principles.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., if there is special considera- tion due to laws regulations in their jurisdiction).
16

---

10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: The abstract and introduction sections (Section D of the paper discuss the potential positive societal impacts of this paper. The intent of this paper is secure covert communications to maintain public privacy.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address socictal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), faimesss considerations (e.g.. deployment of technologies that could make decisions that unfairly impact specific groups). privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications. let alone deployments. However, there a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mecha- nisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Does the paper deseribe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: This paper presents a processing method aimed at ensuring secure covert communication. And the datasets and models used were all publicly released.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
17

---

Justification:
All assets are open source and are properly cited.
Guidelines:
The answer NA means that the paper does not existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset used and, if possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi wwoode. com datasets has curated licenses for some datasets. Their licensing guide can help determine the license of
dataset.
For existing datasets that are re-packaged, both the original license and the license the derived asset (if it has changed) should be provided.
If this information is not available online, the authors encouraged reach out the asset's creators.
13. New Assets
Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Question:
Answer: [NA]
Justification: If the code considered as a new asset, it will be open-sourced after the paper is accepted.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/codeemmodll as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Including this information the supplemental material fine, but if the main contribution of the paper involves human subjects, then much detail as possible should be included in the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, other labor should be paid least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
18

---

Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with
human subjects.
Depending on the country which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, originality of the research, declaration is not required.
Answer: [Yes]
Justification: For paper writing, we strictly adhere to the principle of using LLMs only for minor language editing tasks, such grammar correction and word choice refinement. For the development our proposed framework, StegoZip, we have harnessed the capabilities of LLMSs to efficiently perform critical tasks related to recovery, text compression, and stego text generation.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non-standard components.
for Please refer to our L.M policy htttps///aaariieecc///oooeerrrrs what should or should not be described.
A Proof of the Security of StegoZip
A.1 Provably Secure Steganography
Empirical steganographic schemes (c.g., STC [10 and SPC (II) inherently permit an adversary to distinguish between cover and stego texts with non-negligible advantage. undermining their security. In contrast, provably secure steganography aims to either climinate this advantage completely, achieving -nformation-theoretiic security (5) or reduce
negligible level within the framework
of computational security 66]
Let the cover channel, denoted Ch represent the conditional probability distribution of cover signals C' given the history H. Assuming access to a perfect sampler M that precisely adheres to the distribution Ch, we define Mf" as the process that samples a segment of the cover output of length b. A steganographic system (stegosystem) is formally described triple of algorithms (KGen, Embed, Extract), corresponding to key generation, embedding, and extraction, respectively. The key generation algorithm produces key as follows:
K +- KGen(n)))
where x is a security parameter. Given a secret message m, a history H. and access to the sampler M, the embedding algorithm generates sequence:
$1 $2 ... |s f- Embed ((C, H)),
(7)
where the sequence length is s. The extraction algorithm, which uses the negoriated key IC and history H. reconstructs the hidden message from the stego text:
m f Extract (KC. Embed As (K, m, H), H
(8)
19

---

Within computational security, the notion of a distinguishing game is employed, wherein an adversary W attempts differentiate the cover distribution C' from the stego distribution S. Specifically, the adversary seeks to distinguish between (i) samples generated through secret-message-rrine emhedding Embed and (ii) samples generated by a standard random sampling process consistent with the cover distribution. The adversary's 's distinguishing advantage is defined as:
ASS
W
Pr KC, M, Embed
W. (.brd =1
Pr M, 0
W.M. OC.)) =
(9)
where the probabilities computed over the randomness of IC, M, Embed, and O. A stegosystem is deemed computationally secure if, for every probabilistic polynomial-tmme adversary W, this advantage remains negligible in the security parameter K:
(W) negl(k))
(10)
A.2 StegoZip Maintains the Security of the Underlying Steganographic Algorithm
To ensure that the bitstream processed by StegoZip can be securely embedded using established provably secure steganographic embedding methods, the bitstream must first undergo pseudo- randomization. This is typically achieved through an XOR operation with a pseudo-randon binary keystream generated by secure stream encryption algorithm, e.g., CHACHA20 (31]. Below, we provide a proof that this process maintains the security of the underlying steganographic algorithm.
The proof proceeds by contradiction. Assume that the stego text x, generated by the StegoZip framework and the normally generated cover text ze are distinguishable, that is:
Pr [AA((s)) -1) Pr((p( 1] 2 8,
(11)
where is non-negligible with respect to the key K. For tokens w generated at each step under history H. this assumption implies the following:
Pr [Arx (w,)= = =1] -Prr(AAr = 1] 2 6.
(12)
In generative provably secure steganographic embedding algorithm, the addition of token to the stego sequence involves two sampling stages. The first stage, which controlled by the stegano- graphic embedding algorithm and driven by message bits, determines the region of sampling. For example, ADG [20] selects a cluster, Discop [23] determines which distribution copies to access, offset. The second stage occurs within Ustega driven by pseudo-randos numbers r generated by a cryptographically secure pseudo-random number generator (CSPRNG). For simplicity, we let S(r, P) denote sampling from P via r, and let El E(m, P) represent the steganographic embedding algorithm, where m is the secret message encrypted via the cryptographic algorithm mentioned before.
and SparSamp 24 decides whether to apply
Using the law of total probability, the adversary's 's decision on ws can be expressed as:
Pr [Apx (wa) 1| Pr [Ap, (wa) Ap s (Valegga) 1] Pr [Apx (VStega)) 1] + Pr [Apx (Wa) = Apx (Uglega) o] Pr [Apx, (Viiega) = 0].
(13)
where W, = ((tg.)) and Vitego E(m, P). Similarly, since the probabilities of tokens remain unchanged before and after steganographic embedding, single normal generation of samples is equivalent two independent sampling processes using random numbers. For the normal cover text, the adversary's 's decision w. can be expressed as:
Pr [Ar (we) = 1] = Pr [Ap ( (we) = Arx (n 1] Pr [Arx (u 1]
(14)
+ Pr Ap, (we) = App (1 = 0] Pr [Aps, (e = 0],
where U = S(r, , P) and u: = ((overr) Here, rn and r2 are independent random variables corresponding to the two-stage sampling process, each of which is uniformly distributed as r1,72 U(0, 1).
iid.
20

---

To satisfy Eq. 12 the adversary must be able to distinguish between Emm, P) and S(ri, P) in polynomial time, or between S(r, Pistega) and S(12, Prover). However, since CSPRNG is used in our synchronous sampling function, the generated is indistinguishable from truly random sequence in polynomial time. Thus, the latter condition cannot hold.
Regarding the former condition, the bitstream m generated by StegoZip is pseudo-randomized. rendering indistinguishable from a uniform random bitstream within polynomial time. Moreover, the employed provably secure steganographic algorithm guarantees that the adversary cannot achieve a non non-negligible advantage 8' in distinguishing between {m, P) and S(r1, P) in polynomial time:
Pr [Ap,, (M = 1] Pr [Apx (v 11 < negl(x).
(15)
Since neither condition can be satisfied, Eq. 12 invalid, contradicting the assumption in Eq. Therefore, StegoZip, when integrated with any computationally secure steganographic algorithm, constitutes a computationally secure steganographic system.
B Ethics Considerations
In this paper, we propose the StegoZip framework to enhance the payload of linguistic steganography, specifically for scientific research and educational purposes. We strictly adhere established scientific research regulations to ensure data privacy and security throughout the experimental process, and we rigorously avoid any violation of personal privacy engagement in illegal activities. We are committed to responsibly advancing academic research in information security and ensuring that our contributions positively impact society.
C
More Experiment Settings
C.1 Model Fine-tuning
The restorer is fine-tuned to help small-scale LLMs grasp the restoration task effectively. To maintain consistency across multiple runs, random seed of 42 is employed. The training process adopts micro-batch size of 32 and an overall batch size of 64, necessitating the use of gradient accumulation steps computed as the ratio of the overall batch size to the micro-batch size. The model is trained for 2 epochs, with the learning rate set at 3 x 10-5
For the IMDb dataset, the sequence length is cut or filled 512 tokens, while for the AGNews dataset, the sequence length is limited to 256 tokens. The LoRA (Low-Rank Adaptation) parameters are care- fully configured with LORA R 16, LORA ALPHA 32, and dropout rate of 0.05. Fine-tuning targets specific modules, including {4_proj k k_proj, e_projj o_proj, gate_proo. up_ pr_jr down__rwwneee _ooi__ To optimize computational efficiency while maintaining model performance, the model is loaded in int8 precision. The dataset is split into training and validation sets in a ratio of 4:1.
The instruction used for fine-tuning, illustrated in Figure 3 is crafted to guide the model in performing text restoration tasks. Specifically, the instruction reads: "You are a text restoration specialist. Your task is ONLY fill in the missing content within square brackets [] in the inpul lext. Requirements: I. Strictly preserve all existing text and punctuation outside brackets. 2. Maintain original lext structure and formatting." To ensure stable fine-tuning and prevent the model from altering content outside the "[]", 10% of the fine-tuning dataset is constructed with inputs and outputs that remain identical.
To enable the model to reliably identify the conclusion of its response, an "[END]" marker is appended to the end responses in the training dataset. During inference, this "[END]" flag also serves as a termination signal for the model's outputs.
All our experiments are conducted on a hardware platform equipped with an Intel(R) Xeon(R) Gold 61330 CPU operating at 10 GHz, 256 GB of RAM, and NVIDIA A6000 GPU cards. Training the Qwen2.5-7B K2) and DeepSeek-BR DeepSeek-RR-Distillee RI-Distiil--Laaaa---- approximately 6 hours, while training the IMDb dataset takes around 10 hours.
[K] models on the AGNews dataset requires
21

---

C.2 Model Inference
During the model inference phase, the model is loaded in the FP32 format to accommodate the high- precision probabilisticc sorting required by index compression coding. When the restorer is tasked with reconstructing high semantic information, greedy sampling is employed to ensure deterministic and accurate outputs. We do not use the mfain-of-though feature of the DeepSeek-R1-D 8B 33 model, given its status as a widely adopted text-generation model. Its language patterns and knowledge acquired during pre-training remain highly effective even after fine-tuning, particularly for restoration tasks requiring the handling of complex semantics. Furthermore, inference functions other advanced features are be introduced in the future, the model's existing architectural foundation provides an extensible and optimizable framework, facilitating seamless integration and enhancement. After fine-tuning, the model will not initiate its response with "<think>" \n" at the beginning of every output.
C.3 Marker Compression Processing
To manage vacant positions awaiting restoration, we represent them using brackets "[]". However, during the Badex-Based Compressed Coding process, instead of transforming the "[]" into its rank, we replace it with a separator symbol to generate a rank sequence optimized for better compression.
For example, consider the sequence "(x1, 14, (.,o))))))) where 2; represents lexical unit. Initially, the positions of "I]" are recorded, and the sequence is transformed into a rank sequence "39 3 LJ 19 6 L 5 3 L'", 7", which is stored as string with ranks separated by the symbol "L".. Next, the recorded positions of "[ [" are replaced with consecutive separators, resulting a modified sequence "39 L 23 U L L The vacancies are then identified by the successive separators.
This processed sequence is subsequently subjected to Huffiman encoding, yielding a highly com- pressed bit stream. By adopting this method, we ensure accurate localization of vacant positions while significantly improving the compression rate.
C.4 Steganography
Discop. We adhere strictly to the official open-source repository of Discor Specifically, we utilize the Huffman tree-enhanced version to maximize the payload and seamlessly integrate it into our codebase.
SparSamp.
Similarly, we follow the official open-source repository of SparSamp adopting the configuration with block_size = 32 and incorporating it into our codebase.
Stego Texts Generation. During the generation of stego text, random sampling with temperature of 0.9 is applied to introduce controlled variability, while avoiding the use of top-p or top-k sampling techniques to maintain alignment with the original framework.
C.5 Token Ambuguity
rely the precise alignment token paths between the sender and receiver to achieve successful decoding. However, this requirement becomes challenging in LLMs because of token ambiguity caused by byte-pair encoding (BPE) [39]. BPE generates non-prefix-free vocabularies, allowing multiple tokenization paths to represent the same input sequence. To address this issue, alternative strategies such as word-based tokenizers, character-based tokenization, or disambiguation algorithms [40] 41 can be employed reduce token ambiguity. In our main experiments, we ensure fairness by evaluating performance via sentences without token ambiguity.
Mainstream provably secure generative linguistic steganograppic methods 20 24
TThe repository Discop 23 is available at:
'Th repository of SparSamp 24 available at: httppe////annooooog///oooo//////
22

---

Dksp
Baup Diplick
AD Doglict
IME0 Deptott
40
Figure 7: The impact of fine-tuning epochs on the StegoZip payload.
Figure 8: The impact of temperature stego text generation on StegoZip payload.
D More Experiment Results
D.1 Epochs of Fine-tuning
We analyze the impact fine-tuning epochs for R. to understand the core restoration task, as shown in Figure 7 The results of the AGNews (37 and IMDB (36) (Qwen2.5-7B (32) Del/eeeSeek-RR-DeS 1--istil-- Llama-8B 33 models) show that the performance saturates after two epochs, with minimal gains beyond, making two epochs optimal for efficiency and effecttiveness. Moreover, this implies that the task relatively simple for the model to learn.
D.2 Temperature in Generating Stego Texts
We analyze the impact temperature in stego text generation on the payload performance of StegoZip, as illustrated in Figure 8 Lower temperatures (e.g., 0.7) produce more deterministic outputs, which results reduced payload. Conversely, higher temperatures increase the variability the generated text, thereby enhancing the embedding flexibility and improving the steganographic embedding payload capacity. Notably, the integration of StegoZip with Discop significantly boosts payload performance. Specifically, StegoZip in conjunction with Discop [ achieves more than double the payload compared with using Discop alone, highlighting the remarkable effectiveness of StegoZip.
D.3 Visual Quality
Secret Messages:
Treasuries Benefit on Spike in Crude Oil NEW YORK (Reuters) Treasury debt prices climbed on Monday investors bet oil prices near record highs might dent U.S. consumption and force the Federal Reserve to slow the pace of interest rate hikes.
Stego Text generated by Discop:
Ernest William Hornung 7 June 1866 22 March 1921) ) was an English author and poet known for writing the A. J. Raffles series of stories about a gentleman thief in late 19th @-@ century London. Hornung portrait of the city of London and inhabitants one that has since come to be recognised as a classic, similar to Dicken's portrayal of the same area. Other reviewers of the same book describe a delicate, yet entertaining character which only Hornung could have portrayed. Chapter 7 from Raffles of the Pulace Guard by Harry H. Burns, who wrote some historical novels of the Scramble for Africa the 1800s. The return of the Strand and other places of London to Raffles reveals the complex social mix of the city. By the 1890s, London had been transformed into a city for conspicuous consumption, with the rich lording it over the poor. Buildings as Chancery Lane shows where mostly taken over by the middle and upper-class and further alienated the working poor, while a few areas, like Covent Garden, remained as the traditional working- caainngcllas area, with its bars, theatres, and clubs. In terms of the embellishment London, however, Raffles cannot compete with the grand flamboyance of the Victorians. The atmosphere is still dark though, yet reminds us that it is only dark because Raffles is a figure of light. Raffles himself is described the main characters of London, a character who thinks for others, and lives by the block like the other hundreds of bachelors, who all have names and individual personalities, except that they do not have the talent to be herves. Stanley Richards wrote about some of this in his review of Raffles of the Palace Guard: "As
Stego Text generated by Discop+StegoZip:
23

---

Ernest William Hornung 7 June 1866 - 22 March 1921 ) was an English author and poet known for writing the A. J. Raffles series of stories about a gentleman thief late 19th @-@ century London. And much superior man of letters to most of the other popular novelists who now draw their living from the public Hornung published nearly sixty novels and novellas and several short story collections, as well as contributing to some periodicals. His works were internationally popular, and his novels were translated into many languages, including Spanish, , French and German While the origins of the works of Arthur Conan Doyle 's detective Sherlock Holmes have been the subject of some controversy, the background to Hornung 's creation of Raffles has,
24


Reviews:
[{"review_id": "9J2ncTbQc7", "reviewer": "Reviewer_ovAh", "summary": "This paper presents a framework to first compress secret text and then passes the compressed text for linguistic steganographic systems, which achieves better payload. Experiments on two datasets show the effectiveness of StegoZip.", "questions": "1. What is the core technical contribution of this work? It seems to me the steganography algorithm is based on ChaCha20 so the main contribution is a method to compress the secret message?\n\n2. How StegoZip generalizes to secret message with very little or no semantic redundancy? Considering the common application scenario of using steganography, it very likely the secret message is short and contains only key information like \"XXX person at YYY time/location will do ZZZ\", if you keep all the key entities, there are not much thing left to compress.\n\n3. Why we need to train the restorer? Can we simply just use a standard out-of-the-shelf LLM?\n\n4. What is the \"prefix (as prior)\" in Figure 2 Step 2: ICC (and also Step 4 Message Decoding).\n\n5. Have you tried combining StegoZip with those arithmetic coding based stegonagraphic algorithms?", "limitations": "yes", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strengths:\n1. Study a practical and interesting problem.\n2. The proposed framework is overall reasonable.\n\nWeaknesses:\n1. The novelty and core contributions of this framework are limited.\n2. Some paper presentations can be improved.", "was_revised": true, "final_justification": "I have read the author's rebuttal and decided to keep my original score. My main concern is the limited technical contributions and application scope of proposed method.", "rebuttal": "# Responses to Reviewer ovAh\nWe sincerely appreciate your time to reviewing our paper. Your insightful comments have prompted us to thoroughly re-examine every aspect of our work, and we have carefully prepared the following point-by-point responses and will make these changes in the final version:\n\n### Q1: What is the core technical contribution of this work? It seems to me the steganography algorithm is based on ChaCha20 so the main contribution is a method to compress the secret message?\n\n**Response 1:** The core technical contribution of this paper lies in leveraging the advanced comprehension and predictive capabilities of LLMs to design a secret messages compression method for covert communication. Chacha20 serves solely as the pseudo-randomization processing method applied to the compressed messages, with the purpose of enabling compatibility with mainstream provably secure steganography methods. Through the proposed Stegozip framework, the payload of a single transmission is significantly increased (about 2.5× the payload of the baseline methods), effectively mitigating the behavioral abnormalities of frequent transmissions in traditional systems caused by their low payload, while ensuring information integrity.\n\n### Q2: How StegoZip generalizes to secret message with very little or no semantic redundancy? Considering the common application scenario of using steganography, it very likely the secret message is short and contains only key information like \"XXX person at YYY time/location will do ZZZ\", if you keep all the key entities, there are not much thing left to compress. \n\n**Response 2:** On the one hand, our ablation study in Section 4.5 (Table 5, w/o DSRP) demonstrates that StegoZip still achieves a ≈10% increase in payload, even without removing semantic redundancy. This is because the LLM’s predictive capability alone can re-encode the literal content into a more compact bit-stream. On the other hand, the primary design objective of StegoZip is to handle bulk secrets—such as reports, logs, or multimedia metadata—whose size would otherwise necessitate multiple transmissions or suspiciously long stego texts. This is a common application scenario in covert communication. Our information compression ratio is considerable, as demonstrated by achieving 2.5× the payload of the baseline methods while maintaining comparable processing times in practice.\n\n### Q3: Why we need to train the restorer? Can we simply just use a standard out-of-the-shelf LLM?\n\n**Response 3:** Given the specific requirements of covert communication scenarios, using large cloud-based models is not feasible, as we cannot entrust the processing or restoration of secret messages to the cloud. In practical covert communication environments, the hardware’s computing power is often limited, such as on laptops or mobile devices. Under these constraints, we can only utilize models with smaller parameter sizes, such as no larger than 7B models. However, standard models of this size struggle to effectively understand the task of secret message restoration. To address this, we fine-tune a basic LLM, transforming it into a lightweight and privately deployable solution for restoring secret messages. More discussions are shown in Section 3.2 \"Private Restorer in StegoZip Framework\".\n\n### Q4: What is the \"prefix (as prior)\" in Figure 2 Step 2: ICC (and also Step 4 Message Decoding).\n\n**Response 4:** The “prefix” refers to the fixed system instruction used to fine-tune the restorer model (see Figure 3). This identical instruction is prepended to every secret message before it enters the ICC encoder. By doing so, it provides prior knowledge that the subsequent text represents a low-semantic structure, enabling the model to compress it further into compact binary codes. In Section 4.5 (Table 5, w/o instruction in ICC), we ablate this design. When the prefix was omitted, the payload decreased by approximately 3%, highlighting its necessity.\n\n### Q5: Have you tried combining StegoZip with those arithmetic coding based stegonagraphic algorithms? \n\n**Response 5:** Yes. StegoZip is designed as a plug-and-play secret messages compressor that can be integrated with any downstream linguistic steganography scheme as long as that scheme accepts a raw bitstream and returns a stego text. We tried combining StegoZip with two representative arithmetic-coding–based methods: AC [1] and Meteor [2]. The experimental results are as follows:\n\n| Steganography | Payload (%) ↑  | Encoding Time (s) ↓ | Decoding Time (s) ↓ |\n| --- | --- | --- | --- |\n| AC [1] | 20.02 | 17.08 | 17.25 |\n| AC [1] + StegoZip | 45.01 (↑24.99) | 13.17 (↓3.91) | 13.27 (↓3.98) |\n| Meteor [2] | 11.27 | 36.20 | 36.58 |\n| Meteor [2] + StegoZip | 31.49 (↑20.22) | 22.46 (↓13.74) | 22.08 (↓14.50) |\n\nDue to the rebuttal schedule, we only randomly sampled 100 news items from AGNews to serve as the secret messages and, for stego prompts, extracted the first two sentences of 100 randomly chosen samples from WikiText dataset. We use the previously fine-tuned Qwen2.5-7B as the restorer while all other settings are the same as those in the Baselines. When integrated with AC-based steganographic methods under lossless decoding, StegoZip still achieves 2× the payload of the baselines while requiring less processing time in practice.\n\n[1] Ziegler, Zachary, et al. \"Neural Linguistic Steganography.\" *Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP)*. 2019.\n\n[2] Kaptchuk, Gabriel, et al. \"Meteor: Cryptographically secure steganography for realistic distributions.\" *Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security*. 2021.\n\nThank you once again for your invaluable efforts on this paper. We hope that our responses address your concerns, and we would be delighted to continue the discussion if any questions remain. Wishing you all the best in both life and research ^v^."}, {"review_id": "HEuQckcXhx", "reviewer": "Reviewer_jVW7", "summary": "The paper introduces StegoZip, a framework designed to enhance the payload capacity of linguistic steganography using large language models (LLMs). StegoZip addresses the challenge of low secret payload in generative steganography by optimizing secret message processing through two main components: Dynamic Semantic Redundancy Pruning (DSRP) and Index-Based Compression Coding (ICC). DSRP leverages LLMs to remove low-information elements from secret messages, while ICC compresses the pruned content into compact binary codes. The framework integrates with state-of-the-art (SOTA) steganographic methods, achieving a 2.5x increase in payload compared to baselines while maintaining comparable processing times and ensuring lossless message reconstruction. The paper evaluates StegoZip using public datasets (IMDb, AGNews, WikiText-2) and LLMs like Qwen2.5-7B and DeepSeek-R1-DistillLama-8B, demonstrating improvements in efficiency and semantic retention. The work also discusses its potential for secure covert communication, with applications in privacy-preserving scenarios.", "questions": "- The self-checking process in DSRP (Page 5) is described as ensuring lossless reconstruction by replacing unaligned portions with original content. Could the authors provide a more detailed explanation or example of this process, including its computational cost?\n- Robustness to ambiguous tokenization. Please re-run payload/accuracy on sentences that do contain BPE ambiguity or report a mitigation cost when you fall back to character-level tokenizers. A large degradation would cast doubt on practical use.", "limitations": "Yes,", "rating": 4, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strengths:\n- StegoZip uses LLMs for semantic pruning and compression, achieving a significant payload increase (2.5x over baselines).\n- The technical quality is good, with a clear methodology supported by detailed descriptions of DSRP and ICC, including mathematical formulations (e.g., self-information calculation, $\\alpha$-quantile pruning).\n\nWeaknesses:\n- The paper claims broad applicability for covert communication but does not deeply explore domain-specific challenges (e.g., handling technical jargon in medical domains or low-resource languages).\n- Reported 2.5× gain is measured only on English news and movie reviews; no multilingual, chat-style, or code-mixed corpora are tested, limiting external validity", "was_revised": true, "final_justification": "The authors have addressed my concerns.", "rebuttal": "# Responses to Reviewer jVW7\n\nWe sincerely appreciate the time and effort you invested in reviewing our paper. Your insightful comments have prompted us to conduct a comprehensive re-evaluation of every aspect of our work. Below, we have carefully prepared point-by-point responses, which will be incorporated into the final version:\n\n### Q1: The paper claims broad applicability for covert communication but does not deeply explore domain-specific challenges (e.g., handling technical jargon in medical domains or low-resource languages).\n**Response 1:** We would like to clarify that the applicability of StegoZip, as discussed in the paper, specifically refers to its adaptability to integrable text steganography algorithms. We hope this explanation helps to resolve any misunderstanding.\n\nMoreover, we acknowledge the importance of the domain-specific challenges you mentioned on covert communication. To address this, we have added test results on the MedNLI dataset from the medical domain [1]. Specifically, we randomly selected 1,000 test samples and used the previously fine-tuned Qwen2.5-7B model on the English AGNews dataset as the Restorer (i.e., this test evaluates out-of-distribution data) and Discop as the underlying steganographic algorithm. All other settings remain consistent with the baseline descriptions. The experimental results are as follows:\n\n| Dataset & Steganography | Payload (%) ↑ | Encoding Time (s) ↓ | Decoding Time (s) ↓ |\n| --- | --- | --- | --- |\n| MedNLI | 21.51 | 15.21 | 15.07 |\n| MedNLI + Stegozip | 33.79 (↑8.28) | 11.71 (↓3.5) | 11.76 (3.31) |\n\nEven when dealing with out-of-distribution data that includes a lots of technical jargon, StegoZip can still achieve an 8% increase in payload while reducing processing time without re-fine-tuning. Initially, fine-tuning the small-scale LLMs was intended solely to enable them to comprehend the restoration task, without considering the specific domain of the secret messages. However, given the specialized nature of covert communications, interacting parties can often anticipate the domain of the secret messages and apply fine-tuning, as discussed in Section 4.4, “Cross-Domain Transferability Analysis”.\n\n[1] Romanov, Alexey, and Chaitanya Shivade. \"Lessons from natural language inference in the clinical domain.\" arXiv preprint arXiv:1808.06752 (2018).\n\n### Q2: Reported 2.5× gain is measured only on English news and movie reviews; no multilingual, chat-style, or code-mixed corpora are tested, limiting external validity.\n\n**Response 2:** We selected English news and movie reviews as test data because they encompass a broad range of knowledge, making them more representative as secret messages in covert communication scenarios. However, we greatly value the domain-specific challenges you raised and have taken the initiative to explore more challenging tasks.\n\nTo this end, we used the previously fine-tuned Qwen2.5-7B model on the English AGNews dataset as the Restorer and Discop as the underlying steganographic algorithm. For the experiments, we randomly selected 1,000 French dialogue samples from the Claire French Dialogue Dataset (CFDD) [2], using the first two dialogues of each sample as the secret messages. Additionally, we constructed a Code-Mixed dataset by randomly selecting 1,000 code statements across MySQL, Python, C++, and Java. **All test data represent out-of-distribution samples.** Other experimental settings were kept consistent with the baseline descriptions. The experimental results are as follows:\n\n| Dataset & Steganography | Payload (%) ↑  | Encoding Time (s) ↓ | Decoding Time (s) ↓ |\n| --- | --- | --- | --- |\n| CFDD | 18.53 | 46.16 | 46.13 |\n| CFDD + Stegozip | 39.90 (↑21.37) | 34.57 (↓11.59) | 33.17 (↓12.96) |\n| Code | 20.44 | 12.95 | 13.11 |\n| Code + Stegozip | 23.64 (↑3.20) | 11.68 (↓1.27) | 11.00 (↓2.11) |\n\nEven with a Restorer fine-tuned on an English dataset, the system performed exceptionally well on the French test set, achieving **lossless decoding in less time** and more than **doubling the payload**. This aligns with our design goal of fine-tuning the Restorer to understand the restoration task itself, rather than data from a specific domain.\n\nHowever, the performance on the Code-Mixed dataset was less impressive. This is primarily due to the nature of the dataset: code statements are relatively short, with many resembling examples such as `float updateInfo(int val_qliz) { return 84.53f; }`. The average word count in the dataset is only around 15, which limits its compression capacity. It is worth noting that **StegoZip is primarily designed to handle large volumes of secret messages**, such as reports, logs, or multimedia metadata. These types of messages, if left unprocessed, would typically require multiple transmissions or result in suspiciously long stego text. This aligns with common application scenarios in covert communication, where handling substantial payloads is a critical requirement.\n\n[2] Hunter, Julie, et al. \"The claire french dialogue dataset.\" *arXiv preprint arXiv:2311.16840* (2023).\n\n### Q3: The self-checking process in DSRP (Page 5) is described as ensuring lossless reconstruction by replacing unaligned portions with original content. Could the authors provide a more detailed explanation or example of this process, including its computational cost?\n\n**Response 3:** **In Figure 2 of the paper, we illustrate a specific example of this process.** The original secret message, denoted as $m$, undergoes processing through DSRP and is transformed into $m_c$. At this stage, a self-checking mechanism is applied, producing $m_r$. If errors are detected during the reconstruction of the second and third missing words, the corrected words are enclosed in brackets [ ], resulting in $m_c’$. The receiver obtains $m_c’$ without any loss of information and can clearly identify the words enclosed in brackets. This allows $m_c’$ to be split into $m_c$ and an error correction table, which is then used to resolve the errors in the second and third missing words.\n\nSince the restorer and $m_c$ are aligned, the receiver will encounter the same reconstruction errors in the second and third words ($m_r$) when attempting to recreate the original secret message. These errors can subsequently be corrected using the error correction table, ultimately allowing the receiver to fully reconstruct the original secret message, $m$. Specific examples are as follows:\n\n- $m$: Toyota to open south China plant Japan carmaker Toyota enters a joint venture to produce saloon cars in southern China.\n- $m_c$: Toyota [] [] [] China plant Japan carmaker Toyota enters a [] [] to produce saloon cars [] southern China.\n- $m_r$: Toyota [to] **[establish] [a]** China plant Japan carmaker Toyota enters a [joint][venture] to produce saloon cars [in] southern China.\n- $m_c’$: Toyota [] **[open] [south]** China plant Japan carmaker Toyota enters a [] [] to produce saloon cars [] southern China.\n\nIn **Section 4.2: Main Performance of StegoZip**, Figure 4 provides a quantitative analysis of the time cost introduced by the self-checking mechanism. The self-checking process increases StegoZip’s processing time by approximately 15%.\n\n### Q4: Robustness to ambiguous tokenization. Please re-run payload/accuracy on sentences that do contain BPE ambiguity or report a mitigation cost when you fall back to character-level tokenizers. A large degradation would cast doubt on practical use.\n\n**Response 4:** Regarding the robustness issue caused by tokenization ambiguity, we have discussed this in **Appendix C.5: \"Token Ambiguity\"**. First, it is important to note that current mainstream LLMs (e.g., GPT, LLaMA, Qwen, etc.) predominantly use BPE-based tokenizers rather than character-level tokenizers, which are prone to significant semantic loss. However, the vocabulary of BPE-based tokenizers is not prefix-free, meaning that the same input sequence may have multiple tokenization paths.\n\nIt is worth clarifying that this **ambiguity primarily affects the underlying steganographic algorithms integrated into the StegoZip framework, rather than StegoZip itself.** To mitigate information loss caused by such ambiguity, existing steganographic systems commonly employ a \"disambiguation\" strategy [3]. To evaluate the robustness of StegoZip, we tested the disambiguating steganographic algorithm SyncPool [3] under the same experimental settings in the paper. The results are as follow:\n\n| Steganography | Payload (%) ↑  | Encoding Time (s) ↓ | Decoding Time (s) ↓ |\n| --- | --- | --- | --- |\n| SyncPool | 8.27 | 29.31 | 28.77 |\n| SyncPool + StegzoZip | 17.22 (↑8.95) | 23.09 (↓6.22) | 23.51 (↓5.26) |\n\nAlthough there is a slight decline in performance for both the baseline and our approach, the steganographic algorithm integrated into the StegoZip framework still achieves a 2× increase in payload while requiring less processing time compared to the baseline method.\n\n[3] Qi, Yuang, et al. \"Provably secure disambiguating neural linguistic steganography.\" *IEEE Transactions on Dependable and Secure Computing* (2024).\n\nThank you once again for your valuable contributions to this paper. We hope our responses have addressed your concerns and would be happy to continue the discussion should you have any remaining questions. Wishing you success and prosperity in both your research and personal endeavors."}, {"review_id": "S7aUSj2czz", "reviewer": "Reviewer_UhwE", "summary": "This paper introduces a new generative linguistic steganography framework with larger payload than previous methods and faster encoding&decoding speed. In detail, StegoZip consists of two LLM-based components: semantic redundancy pruning and index-based compression coding to achieve the advancing performance. Extensive experiments demonstrate that StegoZip can hide more secret information with faster hiding and decoding efficiency.", "questions": "See Strengths And Weaknesses", "limitations": "yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 4, "strengths_and_weaknesses": "## Strengths\n1. The framework is well-engineered, two components are reasonable and effective w.r.t the results.\n2. The paper is well-written and the figures and tables are clear\n\n## Weaknesses\n1. The paper only considers two linguistic steganography techniques, what about more traditional methods like the one using Huffman/Arithmetic encoding in previous methods [1][2]?\n2. I'm wondering if the LLM's capability would impact the final performance --- i.e., leveraging larger or smaller LLMs under the same setting.\n\n[1] Z. -L. Yang, X. -Q. Guo, Z. -M. Chen, Y. -F. Huang and Y. -J. Zhang, \"RNN-Stega: Linguistic Steganography Based on Recurrent Neural Networks,\" in IEEE Transactions on Information Forensics and Security, vol. 14, no. 5, pp. 1280-1295, May 2019, doi: 10.1109/TIFS.2018.2871746.\n\n[2] Ziegler Z M, Deng Y, Rush A M. Neural linguistic steganography[J]. arXiv preprint arXiv:1909.01496, 2019.", "was_revised": true, "final_justification": "The authors provide additional results, which help address my concerns, I would keep my score of acceptance and increase my confidence", "rebuttal": "# Responses to Reviewer UhwE\n\nWe sincerely appreciate the time and effort you spent to reviewing our paper. Your insightful feedback has motivated us to thoroughly re-evaluate every aspect of our work. Below, we have provided detailed responses and will incorporate these revisions into the final version of the manuscript:\n\n### Q1: The paper only considers two linguistic steganography techniques, what about more traditional methods like the one using Huffman/Arithmetic encoding in previous methods?\n**Response 1:** StegoZip is designed as a plug-and-play secret messages compressor that can be integrated with any downstream linguistic steganography scheme as long as that scheme accepts a raw bitstream and returns a stego text. We tried combining StegoZip with two representative arithmetic-coding–based methods: AC [1] and Meteor [2]. The experimental results are as follows:\n\n| Steganography | Payload (%) ↑  | Encoding Time (s) ↓ | Decoding Time (s) ↓ |\n| --- | --- | --- | --- |\n| AC [1] | 20.02 | 17.08 | 17.25 |\n| AC [1] + StegoZip | 45.01 (↑24.99) | 13.17 (↓3.91) | 13.27 (↓3.98) |\n| Meteor [2] | 11.27 | 36.20 | 36.58 |\n| Meteor [2] + StegoZip | 31.49 (↑20.22) | 22.46 (↓13.74) | 22.08 (↓14.50) |\n\nDue to the rebuttal schedule, we only randomly sampled 100 news items from AGNews to serve as the secret messages and, for stego prompts, extracted the first two sentences of 100 randomly chosen samples from WikiText dataset. We use the previously fine-tuned Qwen2.5-7B as the restorer while all other settings are the same as those in the Baselines. When integrated with AC-based steganographic methods under lossless decoding, StegoZip still achieves 2× the payload of the baselines while requiring less processing time in practice.\n\n[1] Ziegler, Zachary, et al. \"Neural Linguistic Steganography.\" *Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP)*. 2019.\n\n[2] Kaptchuk, Gabriel, et al. \"Meteor: Cryptographically secure steganography for realistic distributions.\" *Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security*. 2021.\n\n### Q2: I'm wondering if the LLM's capability would impact the final performance --- i.e., leveraging larger or smaller LLMs under the same setting. \n\n**Response 2:** We have analyzed this problem in Table 3 (\"Efficiency comparison of LLMs of varying sizes in compression and restoration\"). As the model size increases, the achievable payload consistently rises; however, both encoding and decoding times increase with model size.\n\nThank you once again for your invaluable contributions to this paper. We hope our responses address your concerns fully, and we would be delighted to engage in further discussions should you have any additional questions. Wishing you continued success in both your research and life!"}, {"review_id": "9gqKRx51m7", "reviewer": "Reviewer_ykFF", "summary": "This paper improves the payload efficiency of linguistic steganography by preprocessing the secret message using LLMs before embedding. Unlike previous studies that focus solely on optimizing embedding techniques under entropy constraints, the proposed framework (StegoZip) introduces Dynamic Semantic Redundancy Pruning for removing semantically redundant content based on a learned self-information measure, and Index-Based Compression Coding for transforming the pruned message into compact binary codes by token rank-based Huffman coding. Experiments show that StegoZip achieves up to 2.5x higher payload efficiency while maintaining semantic fidelity and steganographic security.", "questions": "See Weaknesses.", "limitations": "Yes.", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strengths:\n\n* Leveraging LLMs for semantic pruning and compression is intuitive and makes sense, since LLMs are good at identifying redundant parts and preserving important meanings in a message.\n* A formal argument is provided to prove that the security guarantees of the underlying steganographic methods are preserved after integrating StegoZip.\n* Extensive evaluations on the commonly used datasets with two SOTA steganographic methods show consistent gains in payload and processing efficiency of StegoZip.\n\nWeaknesses:\n\n* Although the paper evaluates steganalysis performance using three models, these models largely rely on feature extraction or simple architectures. They are insufficient to capture the subtle, high-level distributional patterns potentially introduced by LLM-based generation. To convincingly demonstrate that StegoZip does not introduce detectable AIGC-specific artifacts, the authors should consider training more powerful neural steganalysis models, or simply use GPT as the detector.\n* The proposed framework includes a self-checking mechanism where parts of the message that cannot be reliably reconstructed are retained in square brackets. However, the semantic or compression cost introduced by this fallback is not clearly quantified. For example, under default settings, what percentage of content typically requires fallback? How does this affect the effective payload and restoration complexity?\n* DSRP claims to preserve key entities through entity detection by assigning them infinite self-information. However, the paper does not clarify how this detection is implemented, nor does it provide any evaluation of its accuracy. If critical entities are missed, important content could be pruned inadvertently, affecting message fidelity.", "was_revised": true, "final_justification": "Since the authors addressed most of our concerns, I decided to raise the rating to 4. However, the authors did not demonstrate that StegoZip does not introduce detectable AIGC-specific artifacts. I hope the authors will consider this in future versions.", "rebuttal": "# Responses to Reviewer ykFF\n\nWe would like to express our heartfelt gratitude for the time and effort you dedicated to reviewing our paper. Your insightful remarks have prompted us to thoroughly re-examine every aspect of our work. In response, we have carefully prepared the following point-by-point replies, which will be incorporated into the final version:\n\n### Q1: Although the paper evaluates steganalysis performance using three models, these models largely rely on feature extraction or simple architectures. They are insufficient to capture the subtle, high-level distributional patterns potentially introduced by LLM-based generation. To convincingly demonstrate that StegoZip does not introduce detectable AIGC-specific artifacts, the authors should consider training more powerful neural steganalysis models, or simply use GPT as the detector.\n\n**Response 1:** By leveraging the pseudo-randomization method based on CHACHA20, our method seamlessly integrates with provable secure steganography, inheriting its security guarantees. We have also demonstrated this theoretically (see **Appendix A.2, \"StegoZip Maintains the Security of the Underlying Steganographic Algorithm\"**). It is important to note that the provable security here refers to being indistinguishable from normal generated text, not from human-written text. Provably secure steganography involves disguising steganographic behavior as normal generated text, as detailed in **Appendix A.1, “Provably Secure Steganography”, and in previous paper [1-5]**.\n\nThus, for a detector, the challenge lies in distinguishing whether the text is normal generated cover text or stego text generated by embedding secret messages. To evaluate this, we followed prior studies [4-5] and selected three specialized text steganographic analyzer. The classification accuracies of these analyzers were all close to 50%, indicating that the stego text generated under the StegoZip framework is difficult to distinguish, rendering the classifiers equivalent to random guessing.\n\n[1] Ziegler, Zachary, et al. \"Neural Linguistic Steganography.\" *Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP)*. 2019.\n\n[2] Yang, Kuan, et al. \"Provably secure generative steganography based on autoregressive model.\" *International Workshop on Digital Watermarking*. Cham: Springer International Publishing, 2018.\n\n[3] Zhang, Siyu, et al. \"Provably Secure Generative Linguistic Steganography.\" *Findings of the Association for Computational Linguistics: ACL-IJCNLP 2021*. 2021.\n\n[3] Ding, Jinyang, et al. \"Discop: Provably secure steganography in practice based on\" distribution copies\".\" *2023 IEEE Symposium on Security and Privacy (SP)*. IEEE, 2023.\n\n[4] Wang, Yaofei, et al. \"SparSamp: Efficient Provably Secure Steganography Based on Sparse Sampling.\" *34th USENIX Security Symposium (USENIX Security 25)*. 2025.\n\n### Q2: The proposed framework includes a self-checking mechanism where parts of the message that cannot be reliably reconstructed are retained in square brackets. However, the semantic or compression cost introduced by this fallback is not clearly quantified. For example, under default settings, what percentage of content typically requires fallback? How does this affect the effective payload and restoration complexity?\n\n**Response 2:** In **Section 4.2: Main Performance of StegoZip, Figure 4** provides a quantitative analysis of the time cost introduced by the self-checking mechanism (i.e., **restoration complexity**). The self-checking process increases StegoZip’s processing time by approximately 15%.\n\nTo complement this, we conducted additional experiments under the same settings using the previously fine-tuned Qwen2.5-7B as the restorer, without employing the self-checking mechanism, and 40% of the semantic information was pruned. The results are summarized as follows:\n\n| Dataset | Payload | Rouge_1 (R / C) | BERTScore (R / C) | Fallback Ratio | Missing Ratio |\n| --- | --- | --- | --- | --- | --- |\n| AGNews w/o self-checking | 53.73 | 0.8821 / 0.7833 | 0.9681 / 0.9421 | \\ | 0.3239 |\n| AGNews + self-checking | 45.23 | **1.0000** / 0.8485 | **1.0000** / 0.9633 | 0.4945 | 0.1637 |\n| IMDb w/o self-checking | 57.61 | 0.9077 / 0.8465 | 0.9697 / 0.9535 | \\ | 0.3634 |\n| IMDb + self-checking | 49.64 | **1.0000** / 0.9445 | **1.0000** / 0.9835 | 0.7238 | 0.1044 |\n\nHere, R / C represents the semantic retention of the restored/compressed secret messages relative to the original. **Fallback Ratio indicates the percentage of content requiring fallback**, while Missing Ratio represents the percentage of missing content per sample.\n\nThe results show that while **not using the self-checking mechanism improves the effective payload by 8%, the receiver experiences semantic loss, which is unacceptable in covert communication scenarios.** Thus, a trade-off between the effective payload and restoration complexity is necessary.\n\nWith the self-checking mechanism enabled, the AGNews dataset requires recording approximately 50% of missing words on average, while the IMDb dataset requires recording around 72% when 40% of the semantic information is pruned. For context, the average number of words per sample in the AGNews dataset (short text) is 37.63, while in the IMDb dataset (long text) it is 223.56. Thus, even when 16% of words are missing in short texts or 10% in long texts, lossless reconstruction can still be achieved.\n\n### Q3: DSRP claims to preserve key entities through entity detection by assigning them infinite self-information. However, the paper does not clarify how this detection is implemented, nor does it provide any evaluation of its accuracy. If critical entities are missed, important content could be pruned inadvertently, affecting message fidelity.\n\n**Response 3:** As detailed in **Section 3.3 (Dynamic Semantic Redundancy Pruning)**, to ensure that critical information—such as names, numbers, or other key entities—is preserved and does not compromise the effectiveness of the restoration process, entity detection is performed prior to pruning. This involves a relatively straightforward Named Entity Recognition (NER) task, requiring the training of an entity detector on annotated corpus data.\n\nIn our experiments, we utilized the built-in NER pipeline provided by the python-spacy library to detect and tag entities (**approximately 84% accuracy**). The additional time required for this step is minimal (<1%) and is included in the DSRP time shown in Figure 4.\n\nImportantly, even if errors occur during entity detection, the subsequent self-checking mechanism ensures the integrity of the secret message. As we discussed in Question-2 above, when pruning removes certain information, the secret can still be fully reconstructed at the receiving end without any loss, achieving **100% Rouge and BERTScore metrics**. This is demonstrated in Table 2 of Section 4.2: Main Performance of StegoZip.\n\nThank you once again for your invaluable contributions to this paper. We hope our responses have fully addressed your concerns, and we would be happy to continue the discussion should you have any remaining questions. Wishing you success and fulfillment in both your research and personal endeavors!"}]

Author rebuttal:

Meta-review: The paper introduces StegoZip, a framework designed to enhance the payload capacity of linguistic steganography using large language models (LLMs). StegoZip consists of two main components: Dynamic Semantic Redundancy Pruning (DSRP) and Index-Based Compression Coding (ICC). DSRP remove slow-information elements from secret messages, and ICC compresses the pruned content into compact binary codes. The framework achieves a 2.5x increase in payload compared to baselines.

Strengths:
Strong experiment results (2x payload increase).

Weaknesses:
The experiments can be conducted on more diverse scenarios to further illustrate its broad usability and generality (e.g., domain-specific, multilingual, code-mixed, conversational, etc)
Decision: Accept (poster)