STEAD: Robust Provably Secure Linguistic Steganography with Diffusion Language Model
Authors: Yuang Qi
Na Zhao
Qiyi Yao
Benlong Wu
Weiming Zhang
Nenghai Yu
Kejiang Chen
Venue: NeurIPS 2025 poster ()
Keywords: provably secure
steganography
robust
diffusion model
Primary area: social_and_economic_aspects_of_machine_learning

Abstract: Recent provably secure linguistic steganography (PSLS) methods rely on mainstream autoregressive language models (ARMs) to address historically challenging tasks, that is, to disguise covert communication as ``innocuous'' natural language communication.
However, due to the characteristic of sequential generation of ARMs, the stegotext generated by ARM-based PSLS methods will produce serious error propagation once it changes, making existing methods unavailable under an active tampering attack.
To address this, we propose a robust, provably secure linguistic steganography with diffusion language models (DLMs). Unlike ARMs, DLMs can generate text in a partially parallel manner, allowing us to find robust positions for steganographic embedding that can be combined with error-correcting codes.
Furthermore, we introduce error correction strategies, including pseudo-random error correction and neighborhood search correction, during steganographic extraction.
Theoretical proof and experimental results demonstrate that our method is secure and robust. It can resist token ambiguity in stegotext segmentation and, to some extent, withstand token-level attacks of insertion, deletion, and substitution.

STEAD: Robust Provably Secure Linguistic Steganography with Diffusion Language Model
Yuang Qi!, Na Zhao', Qiyi Yao, Benlong Wu, Weiming Zhang, Nenghai Yu, Kejiang Chen
University of Science and Technology of China Anhui Province Key Laboratory of Digital Security
Kqiyuangdmail., zmzhaona@mail., chenkj@Justc, edu.
Codes: hhttps://iithhn htttps///ttaab..ccm////aaa/a// wwm.7-yaya/STTa....
Abstract
Recent provably secure linguistic steganography (PSLS) methods rely on main- stream autoregressive language models (ARMs) to address historically challenging tasks, that is, to disguise covert communication as "innocuous" natural language communication. However, due to the characteristic of sequential generation of ARMs, the stegotext generated by ARM- PSLS methods will produce serious error propagation once it changes, making existing methods unavailable under an active tampering attack. To address this, we propose a robust provably secure linguistic steganography with diffusion language models (DLMs). Unlike ARMs, DL.Ms can generate text partial parallel manner, allowing us to find robust po- sitions for steganographic embedding that can be combined with coror-corre codes. Furthermore, we introduce an error correction strategies, including pseudo- random error correction and neighborhood search correction, during steganographic extraction. Theoretical proof and experimental results demonstrate that our method is secure and robust. It can resist token ambiguity in stegotext segmentation and, to some extent, withstand token-leva attacks of insertion, deletion, and substitution.
Introduction
In the increasingly digital world, the relevance of linguistic steganography has grown significantly. It offers discreet method for covert communication across various applications, including intelligence operations, secure corporate communications, and privacy preservation [1]. Furthermore, in regions with strict censorship policies, linguistic steganography can serve as a means to bypass content restrictions, enabling individuals to share and access information discreetly. Traditional linguistic steganography methods typically embed secret messages directly into existing text by modifica- tion 2 by training specialized text generation model to produce steganographic text 5). However, these methods' security cannot be guaranteed, and they remain susceptible to detection by sophisticated steganalysis techniques 66 2]. Alternatively, provably secure steganography (PSS) methods [10
theoretically guarantee the indistinguishability the stego (the carrier containing hidden data) and the cover (the original unaltered carrier).
In recent years, the progress of generative artificial intelligence has underscored the potential of autoregressive models (ARMs) in the field of provably secure linguistic steganography [3 14| 15]
16 [7]. ARMs [88 19 20 generate text sequentially by predicting the next token based on the preceding context. They have played particularly significant role in advancing provably secure steganography due to the precise sampling they provide, a capability that is unattainable in natural language environments (21).
CCorresponding author; t: equal contribution
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

However, despite the high quality of text generated by ARMs, their sequential generation characteristic makes previous provably secure steganography methods highly vulnerable [22 23 25] 26]. In ARMs, the probability of each token being generated is conditional on all previously generated tokens, meaning that once a stego token is altered, not only interferes with the message of the current token but also impacts all messages of subsequent tokens due to the change in the conditional distribution. In a strictly regulated environment, adversaries may tamper with the text transmitted over public channels, causing significant disruption to message extraction. Additionally, the ambiguity in the segmentation of stegotext further increases the likelihood of errors during
message extraction [27 28 29 30].
Recently, the rapid development of discrete diffusion language models (DLMs) B2 33 34 35 36
has presented an opportunity to address the vulnerabilities in provably secure linguistic steganography. DL.Ms have gained considerable attention since their introduction to the field of text generation, emerging as a promising alternative for sequential generation. Unlike ARMs, which generate tokens sequentially, DL.Ms begin from a completely noisy state and dynamically refine the entire sequence in a parallel manner. This different generation paradigm can, to some extent, mitigate the error propagation caused by sequential generation, thereby enhancing provably secure linguistic steganography and addressing its lack of robustness. Furthermore, the growing popularity of diffusion language models also provides an ideal camouflage environment for steganography.
However, directly bringing the DLM into PSS will not solve the problem of error propagation. Specifically, the advantages brought by DLM's parallel sampling can only be realized within single denoising step. The model distribution for the next step still depends on the previously sampled tokens. Directly deploying PSS to DLM does not bring the expected robustness, and, due to the strong binding between the distributions and the token positions, it will be more fragile than the PSS method based on ARM when faced with possible position offsets (such as additions, deletions, or token ambiguity). Therefore, correcting potential errors within each step is crucial for achieving robust steganography based on DLM.
In this paper. we propose provably secure and robust linguistic SoggAnogyaphy method using Diffusion language model, namely STEAD (serving as an acronym for the technique while metaphorically highlighting its "steady" nature). To achieve error- correccoree message embedding within a single-step denoising process, we introduce a message-driven pseudo-random number sampling algorithm with a fixed embedding capacity, based on the trade-off between robustness and embedding capacity. The message embedded only at denoising positions which satisfies the encoding conditions of repetition error-correcting coding. We refer robust position embedding with repetitive error correction coding. During extraction, in addition to decoding ECC, we also introduce a neighborhood search strategy to address position offsets caused by insertions and deletions.
Contributions: (1) we propose a provably secure and robust linguistic steganography framework based on discrete diffusion language models; (2) we design robust position embedding with repetitive error correction coding and neighborhood search strategy enhance the robustness steganography; and (3) theoretical proof and experimental results demonstrate the superiority of STEAD in terms of security and robustness.
2 Background
2.1 Preliminaries
Definition 2.1 (Stegosystem). A symmetric key steganographic system (stegosystem) is triple = D),, where (1) IC(A) - k is probabilistic key generation algorithm that takes the security parameter À and outputs symmetric key k; (2) a probabilistic encoding algorithm E(k, h, m) - st takes a key k, a channel history h and a message m as inputs, and outputs a stegotext st; and (3) deterministic decoding algorithm D(k, h, st) - takes key k, channel history h, and stegotext st, and outputs a decoded message I..
Definition 2.2 (Computational Security). A stegosystem S (K,E.D) is computationally secure under chosing hidden-text attack if. for any probabilistic polynomial-tine time adversary A, the advantage of A in distinguishing between the output stegotext of the steganographic encoding algorithm & and the output of random sampler O is negligible. Formally, if
|r ( (st, 12 = 1] Pr (((h)) (12) = 11] < negl(A))
(1)

---

for all sufficiently large À E N, where negl(X) is funntion that correlates to the security parameter X, the stegosystem is computationally secure. Definition 2.3 (Correctness), A stegosystem S = (K, E, D) is correct for any message m and any history h, there exists a negligible function such that & and 'D satisfy the relationship:
function
Pr [D(k, E(k, m, h); h) # m] < 6,
where ó is a correctness parameter, which is typically very close to O.
Under the threat model of limited tampering capability, robustness ensures that the secret message can be successfully extracted even if the stegotext is under attack by adversaries.
Definition 2.4 (ō-Robustness against Fa.B:---aam -Tamperigg. A stegosystem S = (K., E, D) is said to be 8-robust if. for all probabilistic polynomial-iime adversaries A who have the (o.8.--boundee tampering ability, for any ft E Fa.3. there exists a negligible function such that
Pr [r((k, f(((k, m, mn.)),,) h) + m] < 66
(3)
Definition 2.5 (Pseudo-Random Random Number Generator). A pseudo-randon number generator (PRNG)
is a deterministic polynomial-tin algorithm such that takes a X-bit seed k E {0,1}A A as input, and ouputs a m(X)-bit string, where m(X) > x. There exists negligible function negl( (X) for any probabilistic polynomial time distinguisher A, such that
Pr (0,10,1AA (A(PRNG(K) =1] Pr
(A
=1] negl(X);
(4)
ue m0.1)
where the seed k is randomly selected 13*, and u is uniformly chosen from {0, 13 ())(
2.2 Related Works
Masked diffusion language models. Unlike autoregressive models, diffusion language models support parallel generation. They mask the original tokens with special symbols M with a certain probability during the forward diffusion process, and learn the denoising distribution during the reverse process, thereby generate complete text. The original sequence of tokens Xo = [xp..... x5] of length L. Define a forward Markov process at time steps s to t,
L
q(x x2)
(x. M) + (1 [x) x(),,
(5)
where each token at position i E (l,.... L} is replaced with the mask symbol M with probability 3,. 1(+) is the indicator function. The reverse process given by a parameterized model po (xx (x,)
I po xg, t). In practice, po (x, is learned through a masked language model (such as BERT Transformer encoder), and categorical distribution is output for each masked position.
Provably secure steganography with autoregressive models. Recently, researchers have proposed several provably secure linguistic steganography methods based on ARMs. These methods are dedicated to designing message embedding algorithms that are indistinguishable from the normal generation process, i.e., random sampling. Kaptchuk et al. [5] introduced the Meteor method based on interval reversibility using random sampling process akin to arithmetic encoding. Ding et al. [66 utilized the concept of "sampled distribution" to express information and presented the Discop method based on distribution copies. This method defines a probability distribution, from which multiple distribution copies are created, and then uses the index values of distribution copies to express messages. Wang et al. [7 proposed SparSamp. achieving unambiguous message embedding and extraction with high embedding rate and added complexity of only O(1). The above methods can achieve provably secure linguistic steganography based on ARMs. None of them alter the probability distribution of words to be generated by the model during the process of embedding secret messages. But at the same time, none of them are robust to any form of stego tampering.
Comparision to Works Done Concurrently The works conducted concurrently with this paper have also noted the lack of robustness linguistic steganography. Perry et al. [22] have fully discussed the robust steganography of LLMs but have ignored the concern for steganographic security. Wu et al. (25). who also propose a DLM-based robust linguistic steganography, adopt a coverless paradigm, leading to inconsistent research scope with ours. Bai et al. (23 proposed a provably secure steganographic method focused on asymmetric resource scenarios (PSARS), which achieves certain robustness while achieving provable security.
3

---

3
Threat Model
In this section, we define the adversary's goals and capabilities in robust steganographic scenarios.
3.1 Adversary Motivation
We consider probabilistic polynomial-time (PPT) adversary operating in highly regulated environ- ment, responsible for detecting and disrupting covert communication behaviors that may be present text publications. This involves two key capabilities: first, the ability to detect steganographic text, corresponding to the well-established field of steganalysis. which is concerned with the security of stoganography; second, the ability to prevent the stcganographic recipient from extracting the secret message, which relates to the robustness of steganography. Since steganographic texts are often transmitted over public channels, this can be achieved through a Man-in-the-mie middle attack. In this attack, the adversary intercepts the text that the steganographic sender attempts to publish, alters it, and then republishes it, with the receiver only able to access the tampered message. In real-world Internet scenarios, a potential Man-in-the-mmn middle adversary could be social media operator or email service provider that is subject to governmental policy requirements.
However, the adversary's s ability to modify the text provided by the sender is not without limitations. Excessive regulation or censorship may provoke strong public opposition, and overly stringent policies are often difficult to enforce at low cost. Internet service providers, driven by business interests, also need to respect users and cannot engage in unlimited alteration of uploaded content. Therefore, the adversary is not aiming to fundamentally alter the content of the text, which creates trade-off in its ability to interfere with the extraction process.
3.2 Adversary Capabilities
Detection ability. In a generative linguistic steganography scenario, the ability of a PPT adversary to detect can be defined as the advantage in distinguishing between the output of a steganographic embedding algorithm (stegotext) and the original output of the model (covertext).
Tampering ability. The ability of an adversary tamper with stegotexts can be defined tampering function ft which ensures that for any stegotext x as input, the tampered text fx() satisfies that the extent of substitution, insertion, and deletion of words does not exceed a, 3, 7 respectively. Formally, let V be the vocabulary and let x = _x? x²) E V be the input text of length L. Define the tampering function : V². + V and denote output by y = fx( V*, where V is with an uncertain length. Let Naub, Nins, Nacl be the number of substitutions, insertions, and deletions, respectively. Then for given parameters S 0,,3, S 1, ft required to satisfy Naub( y) < <aI,, Nins y) < ,L,, Nx. y) I LL. The tampering function is required to satisfied ft. &Fa,B.y: where F Fa,B.y is feasible set of functions,
Fa.),(() = {y EyEVV EV
S aL, Nin(xx,)) S SBL, Na)(xx S S74].
(6)
4 STEAD Methodology
In this section, we will first define the concept of a secure and robust steganographic system and introduce how to utilize the different characteristics of diffusion language models and autoregressive models to find the robust positions for steganographic embedding. Then, we will introduce a provably secure linguistic steganographic method, STEAD, that can achieve robustness against insertion, delction, substitution, as well as token ambiguity. In this paper, we focus on symmetric key steganographic systems: the sender and receiver share the same settings, including an exact same diffusion language model, an initialized prompt, a pre-negotiated key (seed) of pscudo-random number generator, and a set of sampling parameters.
Figure [ shows the embedding and extraction process of steganography using STEAD. Specifically, in the embedding stage, we proposed "robust position embedding with error correction coding" for DLM. We only embed messages at positions that are simultaneously and independently denoised to avoid cumulative errors. In each step, we select fixed embedding capacity based on the minimum entropy of the distribution and use repetitive codes as error correction codes (ECC) to correct errors while minimizing interference between different embedding positions, In the extraction process, in

---

Steganographic Embedding
Steganographic Extracting
Missuge
Basslon Teansfer MASX
0
Diffusion Language Model
Robrstt Position 0
(0)
+ (0)
Negghartooa
Rimbeddiigg
Search Extraction
with BDC
Predict Disuibution
MASK
MASK
MASK
MASK
0
The
shopped
at
The
bus
stopped
at
p-hoggherhood
stopped at
Temper
The bus stopped a
Figure 1: An overview of the proposed STEAD stegosystem.
addition to decoding ECC, also introduce neighborhood search strategy to address the position offset caused by insertion and deletion.
4.1 Diffusion Sampling Process
To achieve robustness in linguistic steganography, innovatively refer to the multiple positions of tokens that can be synchronously independently sampled in one single timestep of the DLM as a batch of robust positions suitable for steganography, which is significantly different from the generation process of the ARM. To generate a token sequence of length L, the reverse diffusion process starts with the sequence x==1 where xi=1 fully masked by special token M for all {l..... L). For timestep t to with 0 S 8 < S 1, the conditional distribution for the reverse process is factorized as /xx,/x)) I[ x xx), where the conditional distribution for each token is:
x M. x x
p(x]/x;)
8/2 - (x(x)x))
x M, x M,
x M, x 7 M.
From the above distribution, it can seen that during the normal generation process, when x! / M, that is, the current position has been denoised in previous steps, the token no longer changes, x² x/; when x; M, the model uses two pseudo-random numbers r'M and r generated by the PRNG to determine x":
M.
r < % TM 2 %/1
(8)
Sample pe( (xx,)
(rt),
where riv is used to determine whether the state the current position is "keep mask" or "remove mask", while ra is used decide whether sample specific text token from the category distribution Pe provided by the model. We denote the pseudo-random sampling process of sampling a token x from the discrete distribution pa using the pseudo-random number as Sample po (r)
Let the number of tokens been unmasked step of the reverse denoising process as N Nummask.r
can be calculated as N Nummask. = D' 1 [x] = M] - [ris 2 s/t] These tokens will be converted
parallel and independently from masks to specific linguistic tokens within single time step, and can be denoted as:
Sample (-(lx) (r.))
be seen that the sampling process of the aforementioned diffusion language model can be divided into two stages, each controlled by sequence of pseudo-random numbers. The first stage is determined by IM to identify which positions will be denoised the current time step, while the second stage is controlled by r., which determines which specific text tokens the masked positions will be predicted
4.2 Message-driven Pseudo-random Number Sampling
5

---

During steganographic embedding, we keep the first part of pseudo-random- uunoosiing unchanged, and adopt a message-driven PRN sampling with a fixed embedding capacity to substitute the sampling function in Formula (9). Formally, for distribution (x(x][x,) for a posi- lion j that will be unmasked during this step, where j 1J......NNmaal J. in step & to s, if the embedding capacity is f, given message bits m {O, 1} for this po- sition, the steganographically sampled token (stegotoken) driven by the message is:
OBK
6.1
014
k00)
1
011
0.5
06
1000) k010)
[(00)
Figure 2: An example of message-driven PRN sampling with different capacity. Tokens that are not selected under the given PRN are marked in gray.
x Sample po(-) (rr()))),
(10)
where r3(m)) [r] + dec(m²) 1 mod 1, which is message-driven PRN, dec(m) denotes for the decimal representation of m. Especially, when E = O, message-driven PRN sampling equivalent to direct pseudo-random sampling. The algorithm for determining sampled tokens based on message-driven PRNs is presented in Algorithm | The corresponding algorithm for extracting secret messages based on distribution and given tokens Algorithm Both are shown in Appendix A
2
Figure 2 shows how to use the embedding algorithm to embed messages into distributions with different capacities. Taking the distribution in the third row as an example, given an origin pseudo- random number, if the message be embedded is "01", ", the token "e" will be selected. Similarly, during the extraction process, the message can be obtained based on the token and the PRN.
It is noteworthy that the marks that can be selected by the message after the given random number are limited. If an attempt is made to extract a message from a mark that cannot be selected, the extraction will fail. For example, the mark "d" in the third row of the figure does not correspond to any message. We call the characteristic of steganography based on message-driven pseudo-random number sampling that can only extract messages from specific tokens its error localization property.
4.3 Robust Position Embedding with Repetitive Error Correction Coding
In robust provable security steganography, token tampering differs from traditional bit flipping: each token may carry multiple bits, and tampering may cause all bits carried by the token to appear as random errors. Moreover, due to the dependence of the embedding and extraction algorithms on the model-predicted categorical distribution, incomplete token recovery will interfere with the subsequent sampling distribution, thereby invalidating message extraction.
Due to the independence of the denoising positions at the same time step, we have the opportunity to apply an error-correcting code (ECC) during the embedding process. When choosing an ECC, we hope to maintain the independence of the distribution as much as possible reduce the entanglement between simultancously sampled tokens; in addition, since the capacity of the secure steganography method is limited by information entropy, the code length is quite short. Formally, during the reverse denoising process from time t to s, where positions f1,..., - JNums.. are unmasked, a message of length f, is embedded into these positions using the message driven sseudo-random steganography algorithm. We must select E, for all these positions in each denoising step.
Firstly, any stegosystem must meet the requirement of correctness. It can be seen from Figure that 2-bit messages are embedded the distribution of the first row based on the given pesudo-random number, the same token "c" will be sampled using messages "00" and "01". As a result, conflicts will occur when extracting the messages. For each independent distribution pa, the maximum capacity that can be embedded in a distribution without causing message conflicts depends on the negative logarithm of the probability of the most likely outcome, i.c., the min-entropy. Discop [6]] and SparSamp [17] respectively provided solutions to the decoding uniqueness problem in message- driven random number sampling steganography systems, while also striving to maximize entropy utilization. However, their embedding schemes all require the use of multi-step joint distributions, which conflicts with our original intention of error correction for independent embedding.
Therefore, considering the trade-off between error-correcing capability and embedding capacity, to prioritize the strongest robustness, a repetition code was chosen in our method, that is, a same message E {0, 1 is embedded for all j E , JNums... } with the same length e, for step s.

---

For j E .. ) the maximum embedding capacity is determined by the minimum & value corresponding all these positions' distributions to satisfy the min-entropy constraint. Besides, due to the requirement of repetition codes, we only embed secret messages in steps that meet the According to the aforementioned conditions, set.
condition N Nummusk, 2
l. (i...... (1- log2 (max (po(x]
N Nunmask, 2 3,
(11)
N Nunmask, < 3.
which means that, for steps where N is insufficient or the minimum entropy is not enough, no message is involved in the generation of tokens.
We refer to positions that meet these two conditions as robust positions. Robust positions are subset of denoising positions and satisfy the following: (1) The number of such positions in each step is at least 3: (2) The minimum entropy of the distribution allows each position to embed at least I bit. When the denoising position set of denoising step meets the above conditions, STEAD will embed the same message bits at these positions. We denote the number of robust positions as Neobus.s abbreviated as N, (used distinguish from the number of general denoising locations, Nunmask,s)
For non-robust positions, sampling is entirely guided by PRNs r,, Since the sender and receiver can fully synchronize the pseudo-random number generator and the diffusion language model, the pseudo-random numbers here can serve as pseudo-random crror-correcting codes [37] to cope with possible token substitutions at these non-robust positions.
4.4 Pseudo-random Error Correction and Neighborhood Search Extraction
During extraction, since the receiver shares the same model, PRNG, sampling settings, and key with the sender, the denoising process in the extraction process can be fully synchronized with the embedding process. For the receiver, all text positions can be divided into two categories: one is the robust position that embeds the message, and the other is the non-robust position that uses pseudo-random number sampling without embedding the message. Although the message is only embedded in the robust position, due to the distribution dependency between the preceding and succeeding time steps. the receiver needs to recover from all possible errors at all positions, rather just dealing with the robust positions.
Firstly, we only consider token substitution as the tampering, that is, each token maintains its position in the tampered sequence as it was during generation. For each batch of robust positions, the receiver first applies the message-driven pseudo-random sampling algorithm to each position to extract the message embedded within the tokens. The intended message bits are then obtained by decoding the result with the repetition code. Correct message recovery is guaranteed as long as the number of tampered tokens in the batch does not exceed half. Subsequently, the receiver can re-run the message embedding process using the recovered message to restore any altered tokens. For non- robust positions, the pscudo-random numbers used for sampling are shared between the sender and receiver, allowing them function as a rscudo-random error-correcting code. Consequently, the receiver can detect if non-robust position has been tampered with by observing the outcome of the pseudo-random sampling and can readily restore the original token.
However, if errors such as insertion or deletion occur, it may cause the position of the stegoto- ken to be misaligned with its original sampling position during embedding. In severe cases, may affect the message extraction of all tokens in batch of robust positions. As shown in Fig- ure 33 an inserted token "little" causes the orig- inal tokens at the denoising positions to shift certain distance from their supposed positions. To address this, we have designed a ju-eearest neighbor search mechanism to handle the ex- traction difficulties caused by the increase or decrease in token quantity. In particular, when an error occurs during extraction, we search the p-neighborhood corresponding to the current position, attempting to use neighborhood tokens to correct the offset of the current position. The window size adjusts dynamically according to the
Fodtien
Orignaa Suguress (L+5)
The
CAT
Pnspeed
Trrpprre Sequince
(1:00)
The
stpppd
The
Intle
Auppel
Meighooraad
Figure 3: An example of positional misalignment due to an inserted token.
7

---

length of the tampered text: μ m L'),, where L represents the length of the original sequence, and L' represents the length after tampering. This strategy adapts to different attack strengths while avoiding excessive computational complexity.
4.5 Proof of Security and Robustness
The security of STEAD comes from the fact that it only replaces the sampling function within each timestep of the diffusion language model during the steganographic embedding, without damaging the model's predicted probability distribution. Below, prove that the stegotext output by the steganographic embedding algorithm and the original output randomly sampled by the model are computationally indistinguishable.
Theorem 4.1. For any polynomial-tine distinguisher A, it computationally infeasible distinguish between the stegotext of the steganographic encoding algorithm & and the output of the original model sampler O.
Lemma 4.2. For any polynomial time distinguisher A, its advantage in distinguishing between the output of & and O can be reduced to an advantage in distinguishing between r (m) and r.
Proof. From Formula (9) and Formula (10), it follows that at each timestep the only difference between an original sampled token and one from the steganographic encoding algorithm is the pseudo-random number used: rá versus rg (m). Since both procedures use the same PRNG as the original diffusion model, we derive Lemma 4.2
Suppose, for contradiction, that there exists a PPT distinguisher A that can distinguish be- tween PRNs after "offset" and pure PRNs with non-negligible advantage c(A) such that [Pr[A(r(m)) = 1] Pr(A(r)= = 1]l = e(A), we use A to construct new algorithm A', which can distinguish between PRNG outputs and truly uniform bits. On input challenge X E {0, (0,1) 1)mm(A),
A' answers A's oracle queries by = X
dec(m) mod 1, and outputs whatever A outputs.
2
If the challenge is X PRNG((). then A' gives A exactly r(m), at this time Pr[A'' 1 PRNG(K)) Pr(A(r(m)) 1]. If the challenge X is uniformly random, then x doc(m) mod 1 is still uniformly random (constant offset does not change the uniform distribution), and Pr A'A 1|x < (n) Pr[A(r) = 1]. Then we have (r(A((PRNG(K) = Pr[AA(() = 1] [Pr[A(r(m)) = 1] Pr(A(r) = 1]] = c(A), so A' distinguishes PRNG(() from uniform u <- (m( with non negligiiee advantage e c()), contradicting the definition of PRNG.
Therefore, the stegotext output by the steganographic embedding algorithm and the original output randomly sampled by the model are computationally indistinguishable.
Theorem 4.3 ( Fa, Robustness). Let the stego length be L. For every step 0 < < <
if the adversary's tampering capabilities are bounded by Fa.3.y that satisfy 2(a + + < min, , 7 < t. where N, is the number of robust positions in time 8, a STEAD stegosystem S= EX, D) with a denoising probability I- and p-neighborhood searching is robust.
Proof of Theorem 4.3 is given in Appendix It is worth noting that all the discussions about tampering above are conducted at token-level. Other advanced forms of perturbation, such as tokenization ambiguity (see Appendix C) or synonym substitution, can ultimately be reduced to combinations of token-level substitution, insertion, and deletion.
Experiments
Detailed experimental settings are provided Appendix D
Capacity. In [ we have calculated the effective embedding capacity of STEAD under differ- ent top-p settings while also displaying the model's average entropy. We compared the embedding capacity with the latest secure robust linguistic steganography method, PSARS (23], which is based on ARM. It can be seen that under the same sampling parameters, the steganographic embedding capacity of STEAD still significantly higher than that of PSARS (whose secure parameter is set to 32 due to a trade-off between capacity and robustness).

---

Table I: Comparison of capacity and overhead of provably secure robust steganography methods
Embedding capacity (bit / 10 token)
Encoding rate (s bit)
Decoding
Entropy (hit token)
Method
Model
Temperature
TTop-p
rate
(s / bit)
PSARS 23
QWEN2
1.0
1.00
13.81
3.48
1.6583
1.5893
1.00
84.08
7.78
0,9859
1.0712
0.98
58.31
6.54
1.4431
1.4949
STEAD
DREAM
1.0
0.92
36.33
4.59
2.3471
2.2642
0,90
33.23
4.20
2.6030
2.3012
Corra
Lost
Lec:
Loc
Gomaa
Woog
40
(a)
0.01
(b) α 0.05
(c)
0.1
(d) 0.15
(e)
Wing
Wrog
4. 10 1o
6 fo
3
(g) 3
(h) 3 6
(1) 3 8
(i) 1 10
4e fo (10 =
4/
(17
(m)
(n)
(0) 10
Figure 4: Robustness against token substitution, insertion and deletion. a represents the proportion of random substitutions, 8 and 7- represent the number of random insertions and deletions. Error bars represent the standard deviation of the correct rate.
Linguistic quality. Figure 5 shows the average perplexity (PPL. values stegotexts generated by STEAD and covertexts randomly sampled by the same DLM, and can be seen that under different top-p truncation settings, the PPL of the stegotexts remains consistent with the covertext.
Statistical security. We conducted steganalysis tests using various ONN-based steganalyzers. These tests are designed to distinguish between covertext generated from the DLM via random sampling and stegotext generated by STEAD. We generated 1000 pairs of covertext and stegotext with p 0.9 under two datasets. We adopted three steganalysis methods based on deep learning: FCN 66. R-
PPLS
Table 2: Steganalysis results for STEAD
Method
PYL.
Datasel
FCN
R-BiLSTM-C
LSTMATT
IMDB
50.67+0.88 82%
19.00
49.50+ 1.27%
p-Uyy
p=0.3
C4
49.92+2,795
49 49.08+2.66%
50.25+0.54%
Figure 5: Comparison of PPL.

---

BiLSTM--C 77 and LSTMATT 38 2 shows that the detection error rate PE approaches 50%. This indicates that steganalysis methods cannot perform better than random guessing in detecting stegotext generated by STEAD, which demonstrates the security of our stegosystem.
Robustness against token-level attacks. We apply ran- dom token-level substitution, insertion, and deletion to stegotexts, each with various intensities. The results are shown in Figure 4 Then we define mixed token-level attacks as attacks that simultaneously apply token-level substitution, insertion, and deletion. We define two at- tack intensities, weak and strong, using the parameter sets (a 0.01, 3 = =,,7* 1) and (a 001, = 3, 7 >²= 3). respectively, as shown in Figure 6 can be seen that at the token level, STEAD is more resistant to various attacks than the comparison methods, whether against a single type of attack mixed attacks.
(a) Weak
(b) Strong
Figure 6: Robustness against mixed to- ken attacks under two intensities.
La
84 84 1. 4
(a) 0.01
(b) 0.05
(c)
(d) 0.2
(c) 0.3
Figure 7: Robustness against semantic attacks. From left to right, substitute the synonyms of words (not tokens) in the text with proportions of 0.01, 0.05, 0.1, 0.2, and 0.3 respectively.
Robustness against realistic attack scenarios. Figure shows the robustness evaluation more challenging scenarios. There is a semantic synonym substitution attack at word-level based on TextAttack [39]. With word substitution rate of 0.1, non-robust methods are rendered almost entirely ineffective, whereas STEAD sustains an extraction correction rate above 80%.
Ablation study. Our method comprises three key components: message-driven PRN sampling algorithm, robust position embedding with eтror correction coding (RPE+ECC), and neighborhood search traction (NSE) strategy. The ablation study for these components presented in Fig- ure g We evaluated robustness against to- ken substitution (using a 0.2), token in- sertion (with 3* = 10), and token deletion (with >-' 10). The baseline steganographic algorithm (i.c., without RPE, ECC, and NSE) performs embedding and extraction directly on the DLM. Its robustness is comparable to that of the ARM-based method, indicating that the advantages of STEAD are not derived solely from the DLM itself. The integration of RPE and ECC confers resistance to substitution by leveraging the DLM's parallel characteristic specific, limited positions a key innovation of STEAD. Furthermore, the inclusion of NSE enables STEAD to handle insertion and deletion.
8
(a)
0.2
(b) 3 10
10
Figure 8: Ablation study.
6 Conclusion
We propose STEAD, novel, robust, and provably secure linguistic steganography method utilizing Diffusion Language Model (DLM). STEAD employs the random synchronous sampling characteristic of the DLM, combined with error correction codes and a neighbor search extraction strategy, to achieve robustness against substitution, insertion, deletion, and token ambiguity. We demonstrate the performance of STEAD through theoretical proofs and extensive experiments. Results indicate that STEAD exhibits higher embedding capacity and enhanced robustness over comparable methods.
STEAD
10

---

Acknolegment
This work was supported in part by the National Natural Science Foundation of China under Grant U2336206, Grant 62472398, Grant U2436601, and Grant 62402469. We are grateful to Bai et al., the authors of (23), for generously providing the code associated with their work and offering valuable guidance.
References
[1] Y. Lin and Z. Wang. "A novel method for linguistic steganography by english translation using attention mcchanism and probability distribution theory," Plos one, vol. 19, no. p. c0295207, 2024.
[2] T. Yang, H. Wu, B. Yi, G. Feng, and X. Zhang. "Senmatic-preserving linguistic steganography by pivot translation and semantic-aware bins coding," IEEE Trunsactions on Dependable and Secure Computing. vol. 21, no. 1, pp. 139-152,10 2023.
[3] C.-C. Chang, "Reversible linguistic steganography with bayesian masked language modeling," IEEE Transactions on Computational Social Systems, vol. 10, no. pp. 714-723, 2022.
[4] Z.-L. Yang. X.-. Guo, Z.-M. Chen, Y.-F. Huang, and Y.J. Zhang, "Rnn-stega: Linguistic steganography based recurrent neural networks," TEEE Transactions on Information Forensics and Security, vol. 14, no. 5, pp. 1280-1295, 2018
7.-I.. Yang, S.-Y. Zhang, Y.-T. Hu, 7.-W. Hu, and Y.-F Huang. "Vac-stega: based on variational auto-encoder," IEFE Transactions on Information Forensics and Security, vol. 16, pp- 880-895, 2020.
linguistic steganography
[6] Z. Yang, Y. Huang, and Y.-J. Zhang, "A fast and efficient text steganalysis method," IEEE Signal Processing Letters, vol. 26, no. 4, pp. 627-631, 2019.
[7] Y. Niu, J. Wen, P. Zhong, and Y. Xue, "A hybrid r-bilstm-- neural network based text steganalysis," IEEE Signal Processing Letters, vol. 26, no. 12, pp. 1911, 2019.
[8] H. Yang, Y. Bao, Z. Yang. S. Liu, Y. Huang, and S. Jiao, "Linguistic steganalysis via densely connected Istm with feature pyramid," in Proceedings of the 2020 ACM Workshop on Information Hiding and Multimedia Security, 2020, pp. 5-10.
[9] S. Li, J. Wang, and P. Liu, "Detection of generative linguistic steganegraphy based explicit and latent text word relation mining using deep learning," " IEEE Transactions on Dependable and Secure Computing. vol. 20, no. pp. 1476-1487, 1487, 2022.
[10] N. Hopper, Langford, and I.. Von Ahn, "Provably secure steganography," in Annual International Cryptology Conference. Springer, 2002, pp. 77-92.
[11] N. Hopper, von Ahn, and Langford, "Provably secure steganography," IEEE Transactions on Comput- ers, vol. 58, no. 5, pp. 662-676, 2008.
[12] K. Solanki, K. Sullivan, U. Madhow, B. Manjunath, and Chandrasekaran, "Provably secure steganog- raphy: Achicving zero kl divergence using statistical restoration," in 2006 International Conference on Image Processing. IEEE, 2006, pp. 125 128.
[13] Z. Ziegler, Y. Deng, and A. M. Rush, "Neural linguistic steganography." in Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference Natural Language Processing (EMNLP-IJCNLA) 2019, pp. 1210-1215.
[14] S. Zhang, 7., Yang, J. Yang, and Y. Huang, "Provably secure generative linguistic steganography." in Findings of the Association for Computational Linguistics: ACL-IJCNLP 2021, 2021, pp. 9046-3055.
[15] G. Kaptchuk, T. M. Jois, M. Green, and A. D. Rubin, "Meteor: Cryptographically secure steganography for realistic distributions," in Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, 2021, pp. 1558.
[16] Ding, K. Chen, Wang, N. Zhao, Zhang, and N. Yu, "Discop: Provably secure steganography in practice based on" distribution copics"." " in 2023 IEEE Symposiun on Security and Privacy (SP). IEEE, 2023, pp. 2238-2255.
[17] Y. Wang, G. Pei, K. Chen, J. Ding, C. Pan, W. Pang, D. Hu, and W. Zhang, "Sparsamp: efficient provably secure steganography based on sparse sampling," in Proceedings of the 34th USENIX Conference on Security Symposium, ser. SEC '25. USA: USENIX Association, 2025.
[18] A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, I. Sutskever et al., "Language models are unsupervised multitask learners." OpenAl blog, vol. no. 8, p. 2019.

---

[19] T. Brown, B. Mann. N. Ryder, M. Subbiah, J. D. Kaplan, P. Dhariwal, A. Neelakantan, P. Shyam, G. Sastry. A. Askell et al., "Language models few-shot learners," " Advances neural information processing systems, vol. 33, pp. 1877-1901, 2020.
[20] H. Touvron, T. Lavril, G. Izacard, X. Martinet, M.-A. Lachaux, T. Lacroix, B. Rozière, N. Goyal, E. Hambro,
F. Azhar et al., "Llama: Open and efficient foundation language models," arXiv preprint 139777,, 2023.
[21] K. Chen, H. Zhou, H. Zhao, D. Chen, W. 7.7ang and N. Yu, "When provably secure steganography meets generative models," " arXiv preprint arXiv: vol. 1, no. 3, p. 4, 2018.
[22] N. Perry, S. Gupte, N. Pitta, and L. Rotem, "Robust steganography from large language models," arXiv preprint 2504,02900.897 2025.
[23] M. Bai, J. Yang, K. Pang. X. Xu, Z. Yang, and Y. Huang, "Provably robust and secure steganography in asymmetric resource scenarios," in 2025 IEEE Symposium on Security and Privacy (SP). IEEE Computer Society, 2025, pp. 1382-1400.
[24] J. Wu, Z. Wu, Y. Xue, J. Wen, and W. Peng. "Generative text steganography with large language model," in Proceedings of the 32nd ACM International Conference on Multimedia, 2024, pp. 10 145-10353,
[25] Z. Wu, Wen, Y. Xue, Z. Zhang, and Y. Zhou, "Gtsd: Generative text stoganography based on diffusion model," arXiv preprint arXiv:2504. 19433, 2025.
[26] C. Pan, Hu, Y. Wang, K. Chen, Y. Peng. X. Rong. C. Gu, and M. Li, "Rethinking prefix-based based steganography for enhanced security and efficiency." IEEE Transactions on Information Forensics and Security, vol. 20, pp. 3287-3301, 2025.
[27] J. Nozaki and Y. Murawaki, "Addressing segmentation ambiguity neural linguistic steganography," arXiv preprint Xiiv:2211.06662: 2022.
[28] Y. Qi, K. Chen, K. Zeng, W. Zhang, and N. Yu, "Provably secure disambiguating neural linguistic steganography," IEEE Transactions on Dependable and Secure Computing, 2024.
[29] R. Yan, Y. Yang. and T. Song. "A secure and disambiguating approach for generative linguistic steganogra- phy," TEEE Signal Processing Letters, vol. 30, pp. 1047-1051, 2023.
[30] R. Yan. T. Song. and Y. Yang. "A near- near-impercepuble disambiguating approach via verification for generative linguistic steganography," in 2024 IEEE International Conference Systems, Man, and Cybernetics (SMC). IEHE, 2024, pp. 1638-1643.
[31] J. Austin, D. D. Johnson, J. Ho, D. Tarlow, and R. Van Den Berg. "Structured denoising diffusion models in discrete state-spaces," Advances in neural information processing systems, vol. 34, pp. 17 981 993, 2021.
[32] S. S. Sahoo, M. Arriola, Y. Schiff, A. Gokaslan, F. M. Marroquin, J. T. Chiu, A. M. Rush, and V. Kuleshov, "Simple and effective masked diffusion language models," in The Thirty-eighth Annual Conference on Neural Information Processing Systems.
[33] J. Shi, K. Han, Z. Wang, A. Doucet, and M. Titsias, "Simplified and generalized masked diffusion for discrete data," Advances in neural information processing systems, vol. 37, pp. 103 131-103 167, 2024.
[34] X. Han, S. Kumar, and Y. Tsvetkov, "Ssd-Im: sutieeuutoeeresssvve simplex-based diffusion language model for text generation and modular control," in Proceedings of the st Annual Meeting of the Association for Computational Linguistics (Volume I: Long Papers), 2023, pp. 11 575-11 596.
[35] M. Arriola, A. Gokaslan, J. T. Chiu, Z. Yang. Z. Qi, J. Han. S. S. Sahoo, and V. Kuleshov, "Block diffusion: Interpolating hetween autoregressive and diffusion language models," arXiv preprint arX5v22503.09573 2025.
[36] J. Ye, Z. Xie. L. Zheng, J. Gao, Z. Wu, X. Jiang, Z. Li, and L. Kong. "Dream 7b," 2025. [Online]. Available:
[37] M. Christ and S. Gunn, "Pseudorandom enror-correcingg codes." in Annual International Cryptology Conference. Springer, 2024, pp. 325-347.
[38] J. Zou, 7. Yang. S. Zhang, S. u. Rehman, and Y. Huang, "Hrfh-performance linguistic steganalysis, capacity estimation and steganographic positioning," in International Workshop on Digital Watermarking Springer, 2020, pp. 80-93.
[39] J. Morris, E. Lifland, J. Y. Yoo, J. Grigsby, D. Jin, and Y. Qi, "Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in nlp." in Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstrations, 2020, pp.
[40] L. A. Bauer, J. K. Howes, S. A. Markelon, V. Bindschaedler, and T. Shrimpton, "Leveraging generative models for covert messaging: Challenges and tradeoff's for" dead drop" deployments," in Proceedings of the Fourteenth ACM Conference Data and Application Security and Privacy, 2024, pp. 67-78.
12

---

[41] Qwen, :, A. Yang. B. Yang, B. Zhang, B. Hui, B. Zheng. B. Yu, C. Li, D. Liu, F. Huang, H. Wei, H. Lin,
J. Yang, J. Tu, J. Zhang, J. Yang, J. Yang, J. Zhou. J. Lin. K. Dang, K. Lu, K. Bao, K. Yang. L. Yu, M. Li, Xue, P. Zhang. Q. Zhu, R. Men, R. Lin. T. Li, T. Tang. Xia, Ren, X. Ren, Fan, Su, Y. Zhang. Y. Wan, Liu, Cui, Z. Zhang, and Z. Qiu, "Qwen2.5 technical report," 2025. [Online]. Available:
http://ariv..rr/abs2212.2.
[42] DeepSeck-Al, "Deepseek Ilm: Scaling open-source language models with longtermism." arXiv preprint arXiv:2401. 029444 2024. [Ouline]. Available: http://eiiuub..comdeeeesee
WeDDeeepSek-LLM..
[43] A. Maas, E. Daly, T. Pham, Huang, A. Ng, and C. Potts, "I "Leeariig word vectors for sentiment analysis," in Proceedings of the 49th annual meeting of the association for computational linguistics: Human language lechnologies. 2011. pp. 142-150.
[44] C. Cachin, "An information thhorretic model stcganography," in International Workshop on Information Hiding. Springer, 1998, pp. 306-318.
NeurIPS Paper Checklist
1. Claims
Question:
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The key contributions and scope are outlined both the section abstract and the introduction (Section
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: The limitations of our method are discussed in Experiments and Conclusion (See Section 5 and Section 6).
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested few datasets with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
13

---

The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
Justification: The paper provides the full set of assumptions for each theoretical result and includes detailed and correct proofs in Section 4.5 and Appendix B
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
Justification: We will disclose the source code and dataset processing methodology upon acceptance of the paper, and the datasets used are all public datasets.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that appropriate to the research performed.
also be provided via detailed
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
14

---

(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm.
(b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g.. a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reprodueibility may be tricky in some cases, in which authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g.. to registered users), but it should possible for other researchers have some path reproducing verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: We will disclose the source code and dataset processing methodology upon acceptance of the paper, and the datasets used are all public datasets.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.co cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" an acceptable answer. Papers cannot be rejected simply for including code, unless this is central to the contribution (e.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https
/mips.cc/pput httpp//////ii//gggiidd////eeeee CCoeee/mddSSubeeeee itttssammmssiooPooooo asssonooiccyyy for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data,
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Does the paper specify all the training and test details (c.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Question:
Answer: [Yes]
Justification: We describe the main experiment in Section and give more detailed setup in Appendix(D D
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can provided either with the code, appendix, or as supplemental material.
15

---

7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [No]
Justification: This experiment does not involve statistical significance, and error bars are not reported because would too computationally expensive.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
OK to report 1-sigma error bars, but one should state The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that out of range (e.g. negative етгог rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: We describe the computer resources in the Implementation Details (Ap- pendix D) and our experiments report the time needed (Section ??).
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).
9. Code of ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics httppp////aaappp..c//////////act
Answer: [Yes]
Justification:
The intent of this paper is to secure covert communications to maintain public
privacy.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
16

---

If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. there special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: The abstract and introduction sections (Section I of the paper discuss the potential positive societal impacts of this paper.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative socictal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deploymeett of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied partieular applications, let alone deployments. However, if there is direct path any negative applications, the authors should point it out. For example, it is legitimate to point that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
Safeguards
Does the paper deseribe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, scraped datasets)?
Question:
Answer: [NA]
Justification:
The paper poses no such risks.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
17

---

Answer: [Yes]
Justification: The paper properly credits all existing assets used, providing appropriate citations and acknowledging the creators. The version each asset is clearly stated, and the license names and terms of use are provided. Additionally, the sources for all code packages and datasets are correctly cited, and the corresponding licenses and copyright terms are respected.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset. For scraped data from a particular source (e.g.. website), the copyright and terms of service of that source should be provided.
If assets released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, pwwpssppppeeseeeeeeeeeseepp thcode com datasets has curated licenses for some datasets. Their licensing guide can help determine the license dataset.
For existing datasets that are re- re-packaged, both the original license and the license of the derived asset (if has changed) should be provided.
this information is not available online, the authors are encouraged to reach out to the asset's is creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification:
The paper does not release new assets.
Guidelines:
The answer NA means that the paper does release new assets.
Researchers should communicate the details the datasct/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and sereenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
18

---

15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country institution) were obtained?
Answer: [NA]
Justification: The paper does not involve crowdsoureing or research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with
human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if' applicable), such the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, originality of the research, declaration is not required.
Answer: [Yes]
Justification: The paper clearly describes the usage of LLMs (Large Language Models) as important component in the core methods and explains their role and significance in the research. The LLM is used as a key element and impacts the innovation and scientific rigor of the methodology. Therefore, the authors have made the appropriate declaration to ensure transparency and compliance.
Guidelines:
The answer NA means that the method development in this research does not involve L.LMs as any important, original, or non-standard components.
Please refer to our LLM policy for what should or should not be described.
A Algorithms of STEAD
A.1
Message-Driven Seeudo-Randon Number Sampling
See the Algorithm
A.2
The Main Process of Message Extraction
In this section, we describe the main process of message extraction for the receiver in the STEAD stegosystem. Also, give in detail the error correction and y-neighborhood search strategy.
For each stego, the receiver initializes an offset vector o1:L with all zeros, 0 0. During the extraction process at each time step t + the receiver first checks the denoising positions (Ji....,JN. } by FM- Then the receiver finds the corresponding stegotokens st.h.....,,, Calculate the corresponding stego capacity f at the denoising positions by Formula [1] based on the predicted distribution po (x{ (.)) If 0, the receiver can directly check whether stegotoken st' each denoising position has been tampered with using the PRN r.. If tampered, the corrected token can be obtained by Formula (9). If > 0, for each denoising position j. the receiver attempts to extract the secret message m. using the distribution pe (x' xx,), the corresponding stegotoken st', and the
19

---

Algorithm EMBED((PrT m): an message embedding algorithm based message-driven pseudo- random number sampling
Input: A distribution P, pseudo-random number r, optional (-bit message m
1: cumuul <- 0
2: if 0 then
3:
T
(m)) 2
mod 1
4: end if
5: for & (0.1..... P|) do
6:
cumuul < curuul + P(k)
7: if cumul then
8:
4- token corresponding to P(k)
9: break
end end for Output: sampled token v
11:
Algorithm 2 EXTRACT((, r; æ): an message extracting algorithm based on message-driven pseudo-
random number sampling
Input: A distribution P, pseudo-random number sampled token
1: currel,, Tleft, Fright <-
2: for k {0, 1, .... P|} do
3: cumuul + currul + P(k)
4: if corresponds P(k) then
5: Fleft < cumuul P(k)
6: Fright curral
7: break
8: end if
9: end for
for m {0, I,..., 2 do
11: if rieft r+ 2
deo(m)
mod Fright then
12:
m +- bin(m) return
Succeed to extract
14:
end if
15:
end for
16: return m +-"x"
P. Fail to extract
Output: Extracted message m
PRN r using Algorithm 2 Since the secret messages embedded all denoising positions of step t + are encoded using a repetition code, the receiver can decode the most likely embedded secret message fragment at the current time step through voting and identify which positions may have been tampered with. The receiver can then correct the erroneous positions using the decoded message.
However, due to the possible increase and deletion of tokens, there may be situation where all the stegotokens at the denoising positions are shifted, making it impossible to extract correct message from any of the positions.
For all positions where extraction fails, the receiver checks whether they can be corrected using the existing offset. If the correction is successful, the stego is updated, and the process proceeds to the next position. If the offset correction ineffective, or the offset value the current position zero, the receiver performs neighborhood search. This involves scanning for tokens within the range of i around the current position of the stegotoken in the stego sequence. For each neighboring token, an attempt is made to extract the information. If a token that can be successfully extracted is found during the neighborhood search, it considered that the correct stego position has been found. The offset relative to the original denoising position is calculated, and the offset vector is updated from the current position to the next mask position. Finally, the correction of the generation process completed.
20

---

B Proof of Robustness
Proof. We divide failure into two independent cases and bound each probability separately.
(1) Since the repetitive code has minimum distance N,. up to [N, token substitution can be corrected. The adversary can replace at most aL tokens total. In one step, N₂ tokens out of denoised, chosen uniformly at random. By a Chernoff bound,
Pr(substitutions in step > N./2) S exp( (N./2 aL)²
(12)
2al.
Since 2a < N, this exponent grows with L, making the probability negligible. Over polynomially many diffusion steps, the total remains negligible.
(2) Insertions deletions shift stego positions by most (33 + T. During extraction, for each expected position i, we search within its ju-neighborhood {i 14;-..,& + } for the most likely token under the original distribution. If (33 7) 14, then every remaining stego token remains within the search window. Thus, all positions can be realigned correctly. Since addition and deletion also mean that the token at position i changes. Therefore, is also necessary to add 33 and to the previously calculated ECC boundaries.
after insertions and deletions,
Combining these results, the STEAD stegosystem can achieve robustness against Fa,8,y- -bouuded adversaries, when 2(a + 3 + 7) < min,(N,/L), and + F.
C Deal with Tokenization Ambiguity
Stego Tokens
Steganography Embeiding
1100
any", "thing""
0001
Language Model
Tolenization Ambiguity
anything..
Decode Error!!!
Stegotest
Steganography Extraction
0110
"Lanything"
1011
decoded message
Language Model
Retakenized
Probabiiity changes.
Tokens
Figure 9: An example of tokenization ambiguity given by (28] The sender generates a token sequence corresponding subwords "_any" and "thing" during steganography embedding. During transmission, the stego-tokens are decoded into the text "anything", Unfortunately. the receiver may retokenize "anything" single token "_anything", This can lead to errors steganography extraction.
or segmentation ambiguity, refers to a phenomenon that tokenizer may not re-decode token sequence into the same tokens. Figure gives an example. It can be seen that the appearance of TA is basically accompanied by the increase or decrease in the total number of tokens, as well as changes in specific tokens. Although there existing methods that do not harm the distribution to eliminate token ambiguity in steganography. such as backtracking with checkpoints [40) and SyncPool (28). these methods do not constitute a competitive relationship with the method proposed in this paper. The impact of TA will not exceed the limited threat model of substitution, insertion, and deletion discussed Section 3.2 Therefore,
Tokenization ambiguity (TA) [27 29 30 28
proposed provably secure robust steganography method in this paper can naturally handle most token ambiguity cases, unless the ambiguity phenomenon occurs too frequently. However, the method aiming at simply eliminating ambiguity cannot counter the active tampering of the adversary.
21

---

D Experimental Settings
D.1 Models and datasets.
We adopt the latest advanced text diffusion model Dream 36 the stego generator. For the autoregressive model, we choose two popular models, Qwen2.5-7B [1 and Deepseek-7B, -B-base (42, with similar performance to Dream to fairly compare the performance of steganographic methods. We randomly select 200 text from the IMDb dataset [43] as input for the text generation task. Each text is truncated to the first two sentences for context. The model generates 512 tokens for each context as stego or cover under specific sampling settings.
D.2 Configs.
In the text sampling process of generating text by language models, text quality is influenced by three sampling parameters: temperature, top-p. and top-k. The temperature controls the randomness of the output. The lower the temperature, the more deterministic the text (which usually leads better quality): versa, the more diverse it is. Top-p sampling (a.k.a. Nucleus Sampling) dynamically selects the smallest set of words with cumulative probability exceeding the threshold p. Top-k sampling samples from the highest probability k words at each step. The three together adjust the deterministic and diversity of the generated text. test our method under various temperature, top-p, and top-k settings.
D.3 Metries.
There are four evaluation aspects in the experiment, namely capacity, security, and robustness.
Capacity includes effective capacity and theoretical limit capacity, respectively represented as embedding capacity and entropy. The embedding capacity is calculated as the average number of bits per stego token embedded. We calculate the of the entropy of the probability distribution of denoised tokens at each step in the process of generating the complete token sequence by the model. The sum of the entropy divided by the total number of tokens is the theoretical limit of the embedding bit number per token.
Security is evaluated through three metrics: Bullback-Leeibee divergence (KLD), Pp. and perplex- ity (PPL). KLD measures the distribution difference between cover and stego from the perspective of information theory [44. It is calculated the relative entropy between the probability distribution of generating cover and that of generating stego. PE represents the detection error rate of a steganalyzer, which is calculated the proportion of samples misclassified to the total number of samples. It is used to empirically demonstrate the ability of the stego bypass a detector. PPL reflects the uncertainty of the model in text prediction. The lower the PPL, the better the model. By comparing the PPL changes of the stego and cover generated by the model, it can also reflect the degree of influence of the steganographic methodon the statistical distribution of the generated text.
Robustness is evaluated through: (1) a searse-grained metric, success rate of message extraction which is calculated as the proportion of samples where the message is completely correctly extracted (binary outcome), and (2) a set fine- fine-grained metric, the recovery rate of message denoted as a triplet (correct rate, wrong rate, lost rate). Specially, when stego is perturbed, the extraction algorithm may not be able to extract a message of the same length as the embedded message, which means that the message after certain bit has been lost. We calculate the lost rate where gest and gemb are the length of extracted message and embedded message. Correspondingly, the correct rate and wrong rate represent the proportion of correct bits (of non-lost message) and wrong bits (of non-lost message), respectively, among the total embedded message bits.
min(e gemb) gemb
22

---

E
Additional Experiments
E.1
Migration and Redundancy Experiments
E.1.1 Failure of Migrating Existing Methods Diffusion Models
Although text diffusion models provide opportunities for designing robustness in provably secure linguistic steganography, simply migrating existing methods based the autoregressive model to diffusion models is still infeasible. We directly replace the random sampling algorithm in the generation process of the diffusion model with the existing steganographic algorithm, achieving a simple migration from ARM version to DLM version. Table demonstrates the success rate of message extraction of the ARM version of Discop, the DLM version of Discop, and method STEAD under token ambiguity. The results show that direct migration has seriously damaged the availability of Discop.
Table 3: Results of Migrating Existing ARMs-based Methods to Diffusion Models
Method/ Model
Discop/ Qwen
Discop/ DeepSeek
Discop/ Dream
STEAD/
Dream
Correct rate (%)
96.00
98.82
0.94
99.49
Wrong rate (%)
0.00
0.00
0.65
0.00
Lost rate (%)
4.00
1.17
98.41
0.51
Success rate (%)
95.50
97.50
0.00 +
99.49
E.1.2 Failure of Adding Redundant Encoding to Existing Methods
Adding redundancy codes to existing provably secure steganographic methods based on autoregressive models may seem like a straightforward way to enhance robustness. However, ARMs suffer from eлror ianagation-taapeeee
with one token disrupts the probability distribution of all subsequent sampling steps (see Figure 1). Therefore, using crror-correcting codes (e.g., repetition codes, BCH, or LDPC) cannot make this idea of directly combining non-robust methods with redundancy encoding feasible. To demonstrate this limitation, we take the Qwen model as an example and apply (20, 1) repetition code to the Discop method. The experimental results of robustness agaisnt mix attack (with strong intensity) Table 4 confirm this claim.
Table 4: Results of applying (20,1) repetition code to Discop Qwen.
Method/ Model
Capacity (bit)
Correct rate (%)
Wrong rate (%)
Lost rate (%)
Decoded length (bit)
Discop/ Qwen
59.70
2.55
0.00 0.79
97.45
1.21
STEAD/ Dream
23.93
83.43
15.78
20.06
F,2
Additional Results about Ablation Study
E.2.1
Why Use Repetition Codes
The use of repetition codes in STEAD motivated by the unique characteristics of robust provably secure text steganography:
Scenario-specifie requirements. Unlike traditional bit-flipping in lossy channels, text token tam- pering can corrupt multiple bits simultaneously (since each token carries multiple bits). For provably secure steganography, full token recovery is critical any residual eтror propagates to subsequent extraction steps. This demands a mechanism robust to complete token-level failures.
Constraints on code parameters. STEAD's one-step generation, robust positions support very short code lengths with high error-correction demands. (assuming < 1 token error per step), linear codes degenerate to repetition codes when parameters approach (n, 1).
that under typical conditions
23

---

Trade-off clarification. We acknowledge the trade-off between robustness and embedding capacity. Repetition codes were chosen to prioritize maximum robustness, which is critical for the first DLM- based provably secure method. While algebraic codes (e.g., BCH) offer efficiency in longer codes, they underperform our short-code, high-error scenario.
Table 5: Degeneration of linear codes to repetition codes under short-length constraints.
Dataset
IMDB
C4
Code length
6.28
6.69
Error length
1.92
2.05
E.2.2
Computational Overhead of Neighhorhood Search Strategies
The window size j is dynamically adjusted based on the tampered text length: μ max LL- where L denotes the original sequence length and L' is the length after tampering. This strategy balances udaptability varying attack intensities (e.g., insertion/deletion) while avoiding excessive computational overhead. To validate this setting, we tested decoding performance under different fixed je values using the strong mixed attack scenario. Table 6 shows that the larger p. achieves higher accuracy without significant time overhead per effective bit.
Table 6: Computational overhead of neighborhood search strategies with varying window sizes p.
μ
Total time (s)
Decode time (s/bit)
Correct rate (%)
Wrong rate (%)
Lost rate (%)
1
48.22
2.80
70.99
1.06
27.96
2
59.46
2.78
88.80
0.26
10.94
4
62.12
2.77
92.87
0.33
6.79
E.3
Quantitative Estimation of Provable Robustness Boundaries
We tested the average number of occurrences of different values of N, 512-length token sequence generation under various prompts (using different IMDB datasets and C4 datasets). Due to the repetition code we adopt, embedding is required only when N is greater than 3. As shown Table 7 although the distribution of N, is different, the minimum value of N, is always 3.
The theoretical assumption 2(a + + + < min, (N)) defines the boundary for perfect 100% extraction accuracy. In practice, this boundary is strict and rarely met in complex real-world scenarios. For example, in generating 512-length text, min N₂ is typically leading to theoretical tampering threshold of 0.3% (i.e., 1.5 tokens out of 512). This strict boundary is difficult to satisfy under realistic attacks. However, this does invalidate message extraction beyond the boundary.
Experimental results (Figures 4, 6, 7) show a gradual rather than abrupt decline accuracy: (1)
At low tampering intensities (below the boundary), extraction accuracy remains nearly 100%; (2)
As tampering exceeds the boundary, accuracy decreases stcadily but retains practical utility (e.g.. 82.63% correct extraction even with 10 insertions in 500 samples, as shown prior robustness tests).
This aligns with real-world language environments, where attacks vary in intensity but rarely cause extreme tampering. The theoretical bound serves benchmark for optimal performance, while empirical results demonstrate the method's 's resilience beyond this idealized scenario.
Table 7: Empirical statistics of N₂ supporting the estimation of provable robustness boundaries.
Dataset
N,
N.
N,
N,
IMDB
16.2
3.3
0.6
0.1
C4
13.2
2.8
0.45
0.15
E,4 Results of Robustness under Token Ambiguity
In previous experiments, all attacks were conducted at the token level. the steganography scenario, more general case is that the receiver can only obtain the text. Table 8 shows the extraction success
24

---

rates of different steganography methods when directly extracting the steganographic text. All the compared methods did not add any disambiguation means, only comparing the robustness of the provably secure steganographic methods themselves against TA.
Table 8: Robustness under TA
Method/
Discop/
Discop/ DeepSeek
SparSamp/ Qwen
SparSamp/
ARS/
STEAD/
Model
Qwen
DeepSeek
Qwen
Dream
Success rate 95.50%
97.50%
92.42%
96.00%
89.04%
99.49
F
Visualization of Generated Texts
Example Stegotext 1 I can understand your concern. During pregnancy, watching some sensitive or petentially graphic content, especially content about violence, gore, etc., could certainly be unsettling and disturbing. It's completely normal for watching videos or content that affected you to be cared for. Being aware of your reaction, you're re absolutely not required to watch anything else that can upset you again. That's part of the privilege of under- standing that pregnancy is an emotional journey too, for you.
It's generally wise to be cautious with the types of content you watch information you consume, especially when you' trying to enjoy your pregnancy safely and comfortably. News, documen- taries, and videos that might show harm to others, especially in violent situations, can cause some people severe emotional dis- tress. Moreover, emotional reactions can be highly amplified dur- ing pregnancy, so it's good to take steps to keep your emotions centered and protected.
Here are some other things you might want itive and healthy mental and physical experience during pregnancy: **Regular relaxation and stress management techniques**; This can include activities such as meditation, yoga, or deep breathing exercises.
to ensure pos-
**Healthcare check-upe
Regular visits to healthcare
provider can provide you with support regarding mental health, well as offer guidance about nutrition and exercise, blood pressure or weight need to be on track.
if your
**Create support system**; Let a trusted partner friend know about how you might be feeling. It's okay to ask for help when and if you need it.
**Community of parents and other parents-to-be**: Sometimes, stories and experiences can help normalize the pregnancy journey. Consider a local community group or online support group to find people whose advice and encouragement can be supportive.
You' re not alone in your pregnancy, and it's perfectly alright to acknowledge the need and avoid this kind of content if makes you feel upset or harmful
yourself.
Moreover, if you ever feel persistent symptoms, such as: A change in appetite
Intense crying without a sign of any problem
Irritability or persistent or severe nausea to the point to dis-
turb your day
Persistent, severe headaches
Severe anxiety
25

---

Then it's appropriate to reach out for support. A doctor or healthcare professionals are ready to assist and guide you, don't let you suffer through it.
Remember, your health and happiness during pregnancy is very im- portant, and you can take the necessary steps to make your own pregnancy experience a safe and positive one. Every pregnancy is unique, so are our needs and preferences. Good luck!
Example Stegotext 2 It's great to hear that you've found movie that you can really enjoy. In the future, I hope you'll be more care- ful in the future when you're in the process of reviewing movies. I'm an AI and don't t keep up with trends or watch movies, but I can give you some guidance and tips on how write good review.
Let's s imagine movie review and pretend that it's from movie by director named Madsen. A major fan of Madsen films might think that this would be the type of movie you might want to avoid, if I've been recommending Madsen movies to you. In fact, I'm not sure if the movie has a Madsen movie in (they probably don't). This might cause some of you to avoid this movie. I'll give you a tip in the description what it's about:
know you probably love Madsen's s films too. I'm a fan his movies and I have a lot of his movies in collection. But trust movie that you want to watch. It's
me, this is not the type terrible movie that's bad for every reason in existence. Hor- rible plct holes, terrible actors, and horrendous writing. It's tough watch that will make you sad for Madsen's 8 movies. It's shame, but I have to warn you, that it's not possible for you to enjoy it. However, the film has small amount of humor of irony, that makes it funny at times. I can assure you, if you are a Mad- sen fan, you will not care one bit. So, please, avoid that movie. You've ve been warned.
When writing a review for any other movie from Madsen, take note of what feels right to you. If it's funny, dramatic, mention some of those things in it. Don't forget to give your honest opinion and why. If there's anything that you have about cer- tain genre, or about a particular director, don't be afraid to point it out, but be general. Don't single out a Madsen movie or a genre. Think of a target audience for which you might be or might not be the target audience wanting to see it. This way, you'll 11 be giving a review that will be helpful to potential view- ers who share your interests. This will make your review more helpful to others who might or might not appreciate the movie as well as you found the experience be.
26


Reviews:
[{"review_id": "AtCBKQesK5", "reviewer": "Reviewer_jzKv", "summary": "This paper proposes a language steganography framework named STEAD, aiming to address the poor robustness of existing PSLS methods based on ARMs when facing active attacks (such as substitution, insertion, and deletion). STEAD employs a DM as its generator, independently embedding information at multiple positions at specific time steps. It combines repetition codes as simple ECC, and introduces a neighborhood search strategy to handle token position shifts caused by insertions and deletions. The paper experimentally compares it with existing ARM-based methods, claiming advantages in terms of capacity, security, and robustness.", "questions": "In Weaknesses.", "limitations": "Yes.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n\nThe core contribution of this paper lies in identifying and leveraging the inherent parallelism advantage of DMs over ARMs in their generation mechanism, thereby providing a theoretical foundation for building robust steganography systems capable of resisting error propagation. Building upon this, the authors designed a systematic solution comprising \"robust position selection,\" repetition error correction codes, and neighborhood search decoding, aimed at simultaneously addressing multiple attack types such as substitution, insertion, and deletion. Experimental results demonstrate the advantages of the proposed method over existing approaches.\n\nWeaknesses:\n\nThe depth and breadth of the paper's experimental validation are insufficient. Firstly, the baseline comparisons in the experiments are unfair. Comparing the new DM-based method with older ARM-based methods in terms of robustness largely reflects the inherent differences between the two generative paradigms (DM vs. ARM), rather than the superiority of the STEAD method itself within the DM framework. Comparisons should instead include other potential robust steganography baseline methods that are also based on DMs. Secondly, the attack models employed for robustness evaluation are overly simplistic, testing different attack types independently only under uniformly random attack patterns. There is a lack of performance evaluation in more challenging, semantically aware, or hybrid attack scenarios. Finally, the experimental scale (200 text samples) is relatively small, and the security analysis is not comprehensive enough, which limits the statistical significance and generalizability of the experimental conclusions.\n\nThe paper lacks sufficient justification for some key design choices. For instance, the paper uses the simplest repetition codes as the error correction mechanism but does not explain why more efficient algebraic codes (e.g., BCH codes) were not chosen, nor does it analyze the potential trade-offs that different error correction codes might introduce for embedding capacity and error correction performance. Similarly, for the key component on the decoding end—neighborhood search—the strategy for setting its window size μ is unclear. This parameter directly affects decoding complexity and accuracy, yet the paper does not discuss in detail its selection rationale or dynamic adjustment mechanism, leaving a core aspect of the method lacking transparency and reproducibility.\n\nAre there gaps between the assumptions of the paper's theoretical proofs (e.g., 2(α + β + γ) < mins(Ns/L)) and real-world attack scenarios? To what extent do these theoretical premises hold true in complex real-world language environments?", "was_revised": true, "final_justification": "The authors addressed my concerns through additional experiments in their response, including the addition of baseline comparisons and ablation studies, expanded robustness evaluations across more scenarios, a larger-scale experimental setup, and the inclusion of new datasets. I appreciate their efforts and the way they responded to the issues I raised. I have decided to maintain my original score.", "rebuttal": "Thank you for your valuable comments. Here are our responses.\n\n1. **Weakness 1:** The depth and breadth of the paper's experimental validation are insufficient.\n    \n    **W1.1 Unfair baseline comparisons**\n    \n    **Response:** \n    \n    We acknowledge the concern about baseline fairness. However, **STEAD is the first DM-based linguistic steganography method with provable security and robustness**—to date, no other DM-based methods with these dual properties exist for direct comparison.\n    \n    To address this, we supplemented comparisons by migrating a representative ARM-based provably secure method (Discop) to the DM framework (see Appendix E.1). Results show that simply adapting ARM methods to DMs fails to achieve robustness (success rate = 0.0% vs. STEAD’s 99.49% under token segmentation ambiguity, as shown below).\n    \n    |  | Discop+DM | STEAD |\n    | --- | --- | --- |\n    | Correct | 0.82 | 98.89 |\n    | Wrong | 0.76 | 0.50 |\n    | Lost | 98.42 | 0.61 |\n    | succeed rate | 0.0 | 99.49 |\n    \n    Ablation studies further validate that STEAD’s robustness stems from DM-specific innovations: robust position selection (RPS) + error-correcting codes (ECC), and neighborhood search extraction (NSE) collectively contribute to its superiority, rather than relying solely on the DM paradigm.\n    \n    |  | Replacement 0.2 | Insertion 10 | Deletion 10 |\n    | --- | --- | --- | --- |\n    | w/o RPS+ECC, NSE | 31.03/30.27/38.70 | 7.73/7.67/84.60 | 7.67/7.72/84.61 |\n    | w/o NSE | 95.22/1.77/3.01 | 6.85/8.89/84.26 | 4.96/8.47/86.57 |\n    | STEAD | 94.87/1.07/4.06 | 78.31/8.76/12.92 | 88.11/6.10/5.79 |\n    \n    **W1.2 Overly simplistic attack models**\n    \n    **Response:** \n    \n    We appreciate the insight regarding attack model complexity. To address this, we have extended the robustness evaluation to include two more challenging scenarios:\n    \n    1. **Hybrid attacks** (combining token-level replacement, addition, and deletion) with both weak and strong intensity;\n    2. **Semantic-aware attacks** (synonym replacement) with perturbation rates of 0.01 and 0.05.\n    \n    New results confirm that STEAD maintains superior robustness under these realistic scenarios, significantly outperforming other provably secure methods (discop+qw, ars+qw) across all metrics:\n    \n    | Weak Mixed Attack | discop+qw | ars+qw | stead+diff |\n    | --- | --- | --- | --- |\n    | Correct | 16.92 | 34.99 | 97.59 |\n    | Wrong | 0.34 | 13.63 | 0.83 |\n    | Lost | 82.73 | 51.38 | 1.58 |\n    \n    | Strong Mixed Attack | discop+qw | ars+qw | stead+diff |\n    | --- | --- | --- | --- |\n    | Correct | 2.57 | 12.65 | 75.14 |\n    | Wrong | 0.34 | 14.43 | 8.68 |\n    | Lost | 97.09 | 72.93 | 16.18 |\n    \n    | Semantic-aware (0.01) | discop+qw | ars+qw | stead+diff |\n    | --- | --- | --- | --- |\n    | Correct | 43.60 | 50.44 | 99.43 |\n    | Wrong | 0.42 | 9.97 | 0.40 |\n    | Lost | 55.98 | 39.59 | 0.17 |\n    \n    | Semantic-aware (0.05) | discop+qw | ars+qw | stead+diff |\n    | --- | --- | --- | --- |\n    | Correct | 10.27 | 22.60 | 89.16 |\n    | Wrong | 0.59 | 15.54 | 4.36 |\n    | Lost | 89.13 | 61.86 | 6.48 |\n    \n    We will add a dedicated subsection \"Real-World Attack Scenarios\" in the Experiments section to detail these evaluations, further strengthening the validity of our findings.\n    \n    **W1.3 Small experimental scale and incomplete security analysis**\n    \n    **Response:** \n    \n    We appreciate the feedback on experimental scale and security analysis. To address this, we have taken the following steps:\n    \n    1. **Expanded experimental scale**: We increased the sample size for robustness testing under random insertion to 500 stegotexts. Results (shown below) are consistent with the original findings, confirming statistical stability:\n        \n        \n        | Insertion | 2 | 4 | 6 | 8 | 10 |\n        | --- | --- | --- | --- | --- | --- |\n        | Correct | 99.48 | 94.82 | 92.29 | 79.61 | 74.69 |\n        | Wrong | 0.15 | 2.42 | 3.10 | 6.92 | 9.23 |\n        | Lost | 0.36 | 2.76 | 4.61 | 13.47 | 16.08 |\n    2. **Enhanced security analysis**: Beyond the theoretical proof of computational indistinguishability and 0 KLD (preserving linguistic quality via PPL distribution), we supplemented steganalysis experiments. Trained detectors (FCN, R-BiLSTM-C, LSTMATT) show near-random accuracy (~50%) on distinguishing STEAD stegotexts from covertexts, validating security.\n    3. **Improved generalizability**: We tested on a new dataset (C4) with 2000 cover-stego pairs. Results confirm consistent performance, with steganalyzers achieving accuracy close to random guessing:\n        \n        | C4 dataset | FCN | R-BiLSTM-C | LSTMATT |\n        | --- | --- | --- | --- |\n        | accuracy | 49.92±2.79 | 49.08±2.66 | 50.25±0.54 |\n    \n    These extensions strengthen the statistical significance and generalizability of our conclusions.\n    \n2. **Weakness 2:** The paper lacks sufficient justification for some key design choices.\n    \n    **W2.1 Use of repetition codes over algebraic codes** \n    \n    **Response:**\n    \n    The use of repetition codes in STEAD is motivated by the unique characteristics of robust provably secure text steganography:\n    \n    1. **Scenario-specific requirements**: Unlike traditional bit-flipping in lossy channels, text token tampering can corrupt multiple bits simultaneously (since each token carries multiple bits). For provably secure steganography, full token recovery is critical—any residual error propagates to subsequent extraction steps. This demands a mechanism robust to complete token-level failures.\n    2. **Constraints on code parameters**: In STEAD’s one-step generation, robust positions support very short code lengths with high error-correction demands. Supplementary data (below) shows that under typical conditions (assuming ≤1 token error per step), linear codes degenerate to repetition codes when parameters approach (n, 1):\n        \n        \n        | Dataset | IMDB | C4 |\n        | --- | --- | --- |\n        | Code Length | 6.28 | 6.69 |\n        | Error Length | 1.92 | 2.05 |\n    3. **Trade-off clarification**: We acknowledge the trade-off between robustness and embedding capacity. Repetition codes were chosen to prioritize maximum robustness, which is critical for the first DM-based provably secure method. While algebraic codes (e.g., BCH) offer efficiency in longer codes, they underperform in our short-code, high-error scenario.\n    \n    We will expand this analysis in the revised paper and note that exploring adaptive coding schemes for varied attack intensities is a key direction for future work.\n    \n    **W2.2 Neighborhood search window size (μ)**\n    \n    **Response:**\n    \n    The window size μ is dynamically adjusted based on the tampered text length: μ = max(2, |L - L'|), where L denotes the original sequence length and L' is the length after tampering. This strategy balances adaptability to varying attack intensities (e.g., insertion/deletion) while avoiding excessive computational overhead.\n    \n    To validate this setting, we tested decoding performance under different fixed μ values using the strong mixed attack scenario. Results (below) show that the larger μ achieves higher accuracy without significant time overhead per effective bit:\n    \n    |  | mu=1 | mu=2 | mu=4 |\n    | --- | --- | --- | --- |\n    | decode time（s） | 48.22 | 59.46 | 62.12 |\n    | decode time（s/bit) | 2.80 | 2.78 | 2.77 |\n    | Correct | 56.85 | 82.58 | 90.58 |\n    | Wrong | 15.05 | 6.19 | 2.77 |\n    | Lost | 28.10 | 11.23 | 6.65 |\n    \n    We will include this dynamic adjustment logic and parameter analysis in the revised manuscript, along with implementation details to ensure reproducibility.\n    \n3. **Weakness 3: Gaps between theoretical assumptions and real-world scenarios**\n    \n    **Response:** \n    \n    The theoretical assumption 2(α + β + γ) < mins(Ns/L)) defines the boundary for **perfect 100% extraction accuracy**. In practice, this boundary is strict and rarely met in complex real-world scenarios. For example, in generating 512-length text, minN*s* is typically 3, leading to a theoretical tampering threshold of ~0.3% (i.e., 1.5 tokens out of 512). This strict boundary is difficult to satisfy under realistic attacks. However, this does not invalidate message extraction beyond the boundary. Experimental results (Figures 5, 7, 8) show a **gradual rather than abrupt decline** in accuracy:\n    \n    - At low tampering intensities (below the boundary), extraction accuracy remains nearly 100%.\n    - As tampering exceeds the boundary, accuracy decreases steadily but retains practical utility (e.g., 74.69% correct rate even with 10 insertions, as shown in prior robustness tests).\n    \n    This aligns with real-world language environments, where attacks vary in intensity but rarely cause extreme tampering. The theoretical bound serves as a benchmark for optimal performance, while empirical results demonstrate the method’s resilience beyond this idealized scenario. We will clarify this distinction between theoretical guarantees and practical performance in the revised paper."}, {"review_id": "WhlapEqsXD", "reviewer": "Reviewer_7ApW", "summary": "The paper targets a long-standing challenge in linguistic steganography: embedding secret messages in generated text so that\n1. the stegotext is computationally indistinguishable from ordinary model output (provable security) and\n2. the hidden message can still be recovered even if an adversary inserts, deletes, or substitutes tokens (robustness).\nExisting provably secure techniques rely on autoregressive language models (ARMs). Because ARMs generate tokens strictly left-to-right, any tampering with one token disrupts the conditional distribution of all subsequent tokens, causing catastrophic error propagation during decoding. As a result, prior ARM-based systems are fragile under active attacks.\nTo overcome this, the authors leverage the different generation paradigm of discrete diffusion language models (DMs), which denoise many token positions in parallel. They introduce STEAD, a stegosystem that embeds information only in those sets of tokens that are denoised simultaneously, thereby avoiding the cascading-error problem.\nKey components and contributions:\n1. Robust Position Selection\nAt each reverse-diffusion step, STEAD identifies the subset of positions that are unmasked and denoised in parallel. These positions are statistically independent of one another, making them suitable for isolated, error-tolerant embedding.\n2. Message-Driven Pseudo-Random Sampling\nSecret bits are conveyed by adding a small, message-dependent offset to the pseudo-random number that drives sampling within each token distribution. Because the underlying distribution is unaltered, the stegotext remains provably indistinguishable from ordinary DM output.\n3. Built-in Error Correction\nThe same message fragment is embedded redundantly across all denoised positions of a step (a repetition code), enabling correction of up to half the substitutions in that batch.\n4. Pseudo-Random and Neighborhood Corrections\nPositions without payload serve as pseudo-random parity checks that can self-correct single-token substitutions. A µ-neighborhood search strategy realigns the decoding process when global offsets arise from insertions or deletions.\nCollectively, the work demonstrates that diffusion language models enable a practical stegosystem that is simultaneously provably secure and markedly more robust to active text tampering than prior autoregressive approaches.", "questions": "1. Have you ever calculated the empirical distribution of Ns/L on test corpus?  In addition, how does the message-recovery rate behave in instances where the condition 2(α+β+γ)<Ns/L2 is not satisfied?\n2. Have you evaluated the proposed method on diffusion language models with additional parameter scales or alternative architectures, and have you repeated the experiments under multiple random seeds to demonstrate the statistical robustness of your results?\n3. What motivated your choice of a repetition code instead of a BCH code in the implementation? This decision seems to impose a capacity penalty.", "limitations": "yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths\n1. Fresh Perspective: Diffusion + Provable Security + Robustness in a Single Framework\n - Earlier work had to pick two of the three:\n   -   ARM-based methods → provably secure but extremely brittle.\n   -   Robust-LLM methods → sturdy but offer no formal security.\n - STEAD exploits the parallel denoising property of discrete diffusion models, proving that both guarantees can coexist. This insight is likely to inspire follow-ups in steganography and in other security uses of diffusion models (watermarking, fingerprinting, etc.).\n2. Large and Intuitive Empirical Gains\nOutperforms best ARM baseline by large margins on capacity and robustness while leaving perceptual quality and detectability unchanged.\n  - Capacity: 84 bit / 1 k tokens vs. 14 bit for the strongest ARM baseline (≈ 6×).\n  - Robustness: 10 % random substitutions → 99 % full recovery, while three ARM baselines collapse; same story for insertions/deletions.\n Provides both formal guarantees and empirical evidence that the method is secure and resilient to common active attacks.\n3.  Low Integration Cost\n - Requires no model retraining—just swap the sampling function; applicable to any discrete diffusion LM.\n - Core code amounts to two concise algorithms (embed/extract), which makes community reproduction and extension easy.\n\nWeaknesses\n1. Generality of Experiments Is Unclear\n -   All results are obtained with a single diffusion model (Dream-7B).  It remains unclear whether the claimed advantages persist across architectures scales, and masking schedules.\n-   No repeated runs or error bars—stability is unknown.\n2. Coarse Capacity–Efficiency Trade-off\n      The system relies on naive repetition coding, which, while analytically convenient, is bandwidth-inefficient; sophisticated short block codes (BCH, LDPC, Polar) could yield substantially better rates.  The computational footprint of decoding with a wide µ-neighbourhood search and of multi-step diffusion sampling is not quantified (latency, GPU-hours), casting doubt on practical deployability.\n3. Some Theoretical Assumptions Lack Empirical Support\n   The robustness bound depends on the inequality 2(α+β+γ)<Ns/L.  The manuscript does not provide statistics on Ns  across prompts, leaving open whether the condition routinely holds.  \n4. Potentially Incomplete Baseline Comparison\n All baselines are autoregressive.  Although Appendix A notes that Discop ported to diffusion fails catastrophically, no quantitative results or analysis are provided.  A head-to-head comparison with contemporary robust-but-insecure diffusion methods (e.g., Wu et al.) on a combined robustness and detectability axis is missing, which may raise fairness concerns.", "was_revised": true, "final_justification": "4: Borderline accept", "rebuttal": "Thank you for your detailed comments. We strongly agree with your view that **\"this insight is likely to inspire follow-ups in steganography and in other security uses of diffusion models (watermarking, fingerprinting, etc.).\"** Our responses are list below:\n\n1. **Weakness 1 & Question 2:** Generality of Experiments Is Unclear. \n    \n    **W1.1 All results are obtained with a single diffusion model (Dream-7B). It remains unclear whether the claimed advantages persist across architectures scales, and masking schedules.**\n    \n    **Response:** \n    \n    - **Regarding architectures scales:** The use of Dream-7B stems from the current landscape of diffusion language models—large-scale pre-trained alternatives remain limited, and Dream-7B is a state-of-the-art (SOTA) model with publicly available 7B-scale weights.\n        \n        Our steganographic method operates by modifying only the model’s **sampling process**, making it largely independent of parameter scale. Thus, the core advantages (robustness and security) are not tied to specific model sizes. If larger diffusion models are released, we will extend our research to analyze how model type and weight size impact embedding time and capacity.\n        \n    - **Regarding masking schedules:** Our method retains the diffusion model’s native denoising strategy (random denoising based on specific probabilities). This design ensures compatibility across different diffusion architectures and aligns with the security requirements of provably secure steganography.\n    \n    **W1.2  No repeated runs or error bars—stability is unknown.**\n    \n    **Response:**\n    \n    We acknowledge the concern about result stability. All reported metrics—embedding capacity, extraction time, and robustness—**are averaged over multiple repeated experiments** on the IMDB dataset.\n    To ensure consistency, each comparison method used a fixed initial random seed, with seeds updated per prompt across repeated runs. Text generation for each prompt and the random attacks applied were fully independent. The results in the paper reflect statistical averages of these independent experiments.\n    we will explicitly state this experimental design in the revised version and add error bars to clarify result stability, enhancing reproducibility.\n    \n2. **Weakness 2 & Question 3: Coarse Capacity–Efficiency Trade-off**\n    \n    **Weakness 2.1 The system relies on naive repetition coding, which, while analytically convenient, is bandwidth-inefficient; sophisticated short block codes (BCH, LDPC, Polar) could yield substantially better rates.**\n    \n    **Response:** \n    \n    As the first work implementing provably secure steganography on DM architectures, our choice of repetition codes is driven by the unique challenges of robust text steganography rather than analytical convenience.\n    \n    In robust provably secure steganography, text token tampering differs from traditional bit flipping: each token may carry multiple bits, and tampering can cause random errors across all bits in the token. Moreover, due to the dependency on predicted distributions in provably secure designs, incomplete token restoration disrupts subsequent sampling distributions, invalidating message extraction.\n    \n    The scenario here involves **short code lengths with high error-correction demands**, as shown in our supplementary data:\n    \n    | Dataset | IMDB | C4 |\n    | --- | --- | --- |\n    | Code Length | 6.28 | 6.69 |\n    | Error Length | 1.92 | 2.05 |\n    \n    Assuming at most one token error per generation step (a low-intensity attack), the required error-correcting bits relative to code length make linear codes (BCH, LDPC, Polar) degenerate to repetition codes under (n,1) parameters. This prioritizes robustness, which is critical for maintaining distribution consistency in sampling.\n    \n    We will clarify this reasoning in the paper and note that future work will explore efficient encoding methods tailored to robust text steganography, balancing capacity and error correction.\n    \n    **Weakness 2.2 The computational footprint of decoding with a wide µ-neighbourhood search and of multi-step diffusion sampling is not quantified (latency, GPU-hours), casting doubt on practical deployability.**\n    \n    **Response:** \n    \n    We appreciate the focus on computational efficiency for practical deployment. Regarding the decoding process with µ-neighbourhood search, we tested the time consumption and accuracy under different µ sizes under a strong mixed attack (token replacement, addition, deletion with intensity 0.1,+3,-3), as shown in the table below:\n    \n    | **Strong Mixed Attack（0.1,+3,-3）** | mu=1 | mu=2 | mu=4 |\n    | --- | --- | --- | --- |\n    | total time (s) | 48.22 | 59.46 | 62.12 |\n    | decode time (s/bit) | 2.80 | 2.78 | 2.77 |\n    | Correct | 56.85 | 82.58 | 90.58 |\n    | Wrong | 15.05 | 6.19 | 2.77 |\n    | Lost | 28.10 | 11.23 | 6.65 |\n    \n    Notably, while larger µ improves accuracy, the time per effective bit remains stable (even slightly decreases).\n    \n    For multi-step diffusion sampling, we measured the computational footprint using a single NVIDIA 4090 GPU. The average sampling time per 512-token stegotext is 38.22 seconds. The average time cost of embedding algorithm is 1.93 seconds. The results show that most of the time consumed in generating stego comes from the multi-step inference process of the model itself, making actual deployment feasible.\n    \n3. **Weakness 3 & Question 1: Some Theoretical Assumptions Lack Empirical Support The robustness bound depends on the inequality 2(α+β+γ)<Ns/L. The manuscript does not provide statistics on Ns across prompts, leaving open whether the condition routinely holds.**\n    \n    **Response:**\n    \n    We tested the average number of occurrences of different values of Ns in a 512-length token sequence generation under various prompts (using different IMDB datasets and C4 datasets). Due to the repetition code we adopt, embedding is required only when N is greater than 3. It can be seen that although the distribution of Ns is different, the minimum value of Ns is always 3.\n    \n    | Dataset | Ns=3 | Ns=4 | Ns=5 | Ns=6 |\n    | --- | --- | --- | --- | --- |\n    | IMDB | 16.2 | 3.3 | 0.6 | 0.1 |\n    | C4 | 13.2 | 2.8 | 0.45 | 0.15 |\n    \n    The theoretical assumption 2(α + β + γ) < mins(Ns/L)) defines the boundary for **perfect 100% extraction accuracy**. In practice, this boundary is strict and rarely met in complex real-world scenarios. For example, in generating 512-length text, minN*s* is typically 3, leading to a theoretical tampering threshold of ~0.3% (i.e., 1.5 tokens out of 512). This strict boundary is difficult to satisfy under realistic attacks. However, this does not invalidate message extraction beyond the boundary. Experimental results (Figures 5, 7, 8) show a **gradual rather than abrupt decline** in accuracy:\n    \n    - At low tampering intensities (below the boundary), extraction accuracy remains nearly 100%.\n    - As tampering exceeds the boundary, accuracy decreases steadily but retains practical utility (e.g., 74.69% correct extraction even with 10 insertions in 500 samples, as shown in prior robustness tests).\n    \n    This aligns with real-world language environments, where attacks vary in intensity but rarely cause extreme tampering. The theoretical bound serves as a benchmark for optimal performance, while empirical results demonstrate the method’s resilience beyond this idealized scenario. We will clarify this distinction between theoretical guarantees and practical performance in the revised manuscript.\n    \n4. **Weakness 4: Potentially Incomplete Baseline Comparison All baselines are autoregressive. A head-to-head comparison with contemporary robust-but-insecure diffusion methods (e.g., Wu et al.) on a combined robustness and detectability axis is missing.**\n    \n    **Response:**\n    \n    We recognize the importance of comprehensive baseline comparisons. As **the first diffusion model (DM)-based linguistic steganography method with both provable security and robustness**, STEAD currently lacks direct peers—no other DM-based methods with these dual properties exist for comparison.\n    \n    To address this, we supplemented experiments by adapting Discop (a representative autoregressive model (ARM)-based provably secure method) to the DM framework (see Appendix E.1). Results confirm that naive migration of ARM methods to DMs fails to achieve robustness, as shown in the table below:\n    \n    |  | Discop+DM | STEAD |\n    | --- | --- | --- |\n    | Correct | 0.82 | 98.89 |\n    | Wrong | 0.76 | 0.50 |\n    | Lost | 98.42 | 0.61 |\n    | Success rate | 0.0 | 99.49 |\n    \n    Regarding GTSD (Wu et al., submitted to arXiv on 28 Apr 2025), it is our **contemporaneous work**. To ensure the sufficiency of the current situation described in this paper, we added relevant references, and the paper was officially published after our submission (24 June 2025), so we did not conduct a comparison. Notably, GTSD and our method (STEAD) differ fundamentally:\n\n    - GTSD is **empirically secure**. Its diffusion model requires dataset-specific training, and the embedding process introduces non-zero KL divergence, leading to detectable distribution differences (as reported, steganalysis detectors achieve ~10% accuracy above random guessing). This leaves it vulnerable to evolving steganalysis techniques.\n\n    - In contrast, STEAD is **provably secure**, theoretically guaranteeing indistinguishability between stego and cover data, eliminating detection risks—a key focus in current steganography research.\n\n    They are two types of methods: **empirically secure** and **theoretically secure**. So a direct quantitative comparison is not appropriate. We will add the above qualitative analysis to our revised paper."}, {"review_id": "2uhqXkbcPL", "reviewer": "Reviewer_QWsN", "summary": "This paper introduces a novel method for linguistic steganography that leverages diffusion language models (DMs) to achieve robustness and provable security. The contributions are:\n\n1. **Robust Steganographic Framework**: The authors present a robust and provably secure linguistic steganography framework, STEAD,  using discrete diffusion language models. Besides the robustness, STEAD can use the parallel generation capabilities of DMs to mitigate error propagation issues.\n\n2. **Error Correction Strategies**: To further improve the robustness, the authors employ error correction codes (ECC) and neighborhood search strategies during extraction to correct errors and handle position offsets.\n\n3.  **Theoretical and Experimental Validation**: The authors provide extensive theoretical proofs and experimental results to demonstrate the security and robustness of STEAD.", "questions": "1. Can you introduce how to determine the denoising positions more clearly?\n\n2. Lines 304-307, the authors stated the KLD of STEAD because STEAD will not modify the distribution. However, the way of sampling may affect the real `distribution`.  The authors need to explain if the sampling of STEAD will affect this.", "limitations": "yes", "rating": 4, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "**Strengths**\n1. Compared to the existing works, this work has discarded the traditional auto-regressive decoding paradigm, bringing higher efficiency and less error propagation.\n2. Using the Diffusion Language Model is quite novel in this field.\n3. The proposed STEAD is theoretically sound in robustness and security.\n4. Nice Steganalysis results, where most results are near the golden line 50\\%.\n5. Nice efficiency results.\n\n\n**Weaknesses**\n\n1. Maybe due to my background, this work is not easy to follow.  The core idea and methodology were not introduced clearly.\n2. How to select embedding (denoising） positions is crucial; however, this work lacks enough discussion about this. I can find the relevant part in Lines 216-232, but it seems incomplete.\n3.  Limited comparison to standard methods. The embedding capacity of the proposed STEAD is still far behind the non-robust methods (typically $2-3\\times 10^3$ per  $10^3$ tokens).  The authors should discuss (and conduct experiments) to compare `non-robust methods`  + `redundancy encoding`  vs 'robust methods', where the former adds a lot of redundancy/error correction codes to improve the robustness.\n4. The Robustness against xxx results are impressive.  However, the settings of baselines are not clear. Hence, I am not sure if the comparison is fair.\n5. The attack methods are also limited. The authors should compare more attack types.", "was_revised": true, "final_justification": "I have provided my final justification.", "rebuttal": "Thank you for your valuable comments. Here are our responses.\n\n1. **Weakness 1: Maybe due to my background, this work is not easy to follow. The core idea and methodology were not introduced clearly.**\n    \n    Response: \n    \n    We would like to clarify that our method is composed of the following parts:\n    \n    - Message-Driven Pseudo-Random Sampling: Secret bits are conveyed by adding a small, message-dependent offset to the pseudo-random number that drives sampling within each token distribution. Because the underlying distribution is unaltered, the stegotext remains provably indistinguishable from ordinary output.\n    - Robust Position Selection: At each reverse-diffusion step, STEAD identifies the subset of positions that are unmasked in parallel. These positions are independent of one another, making them suitable for isolated, error-tolerant embedding. When they are capable to carry enough bits, they are selected as robust positions.\n    - Error Correction Coding: Repetition codes are used to repetitively embed message across robust positions of a step, enabling correction of up to half the substitutions in that batch. Positions without payload serve as pseudo-random checks that can self-correct single-token substitutions.\n    - Neighborhood Search Extraction: A µ-neighborhood search strategy realigns the decoding process when global offsets arise from insertions or deletions.\n    \n    In summary, we proposed a  stegosystem based on diffusion language models, which is simultaneously provably secure and robust. We will integrate this above explanation into Section 4 to explicitly illustrate the steganographic embedding and extraction process on DMs, ensuring full clarity.\n    \n2. **Weakness 2 & Question 1: How to select embedding (denoising） positions is crucial; however, this work lacks enough discussion about this. I can find the relevant part in Lines 216-232, but it seems incomplete.**\n    \n    **Response:** \n    \n    We would like to clarify the definition of the robust positions (for embedding) and denoising position.\n    \n    - **Denoised positions (lines 194-196):** At each reverse-diffusion step, STEAD identifies the subset of positions that are denoised (unmasked) in parallel. These positions are selected independently via conditional probabilities (formula 7) during each step (consistent across cover and stego generation).\n    - **Robust positions (lines 224-232):** Robust positions are a subset of denoised positions that meet two criteria (formula 12):\n        1. The number of such positions in each step is at least 3 (to support repetition codes).\n        2. The minimum entropy of their distribution allows embedding at least 1 bit per position.\n        \n        When the set of denoised positions at a certain step meets the above conditions, STEAD embeds the encoded message bits at these positions, making them robust embedding locations. We will modify the original text to make the above explanation clearer.\n        \n3. **Weakness 3: Limited comparison to standard methods. The embedding capacity of the proposed STEAD is still far behind the non-robust methods. The authors should discuss (and conduct experiments) to compare `non-robust methods` + `redundancy encoding` vs 'robust methods', where the former adds a lot of redundancy/error correction codes to improve the robustness.**\n    \n    **Response:** \n    \n    We acknowledge that STEAD’s embedding capacity lags behind non-robust methods. This aligns with the inherent trade-off in robust steganography: under provable security constraints (bound by information entropy), robust methods cannot exceed the capacity of non-robust counterparts.\n    \n    Regarding \"non-robust methods + redundancy coding\" vs. \"robust methods,\" we note a critical limitation: redundancy coding fails to make standard provably secure non-robust methods robust. Generative models (especially autoregressive ones) suffer from error propagation—tampering with one token disrupts the probability distribution of all subsequent sampling steps, as illustrated in Figure 1.\n    \n    Experimental results with Discop (a standard non-robust method) + (20,1) repetition codes vs. STEAD confirm this:\n    \n    | Method | Capacity (bit) | Correct (%) | Wrong (%) | Loss (%) | Decoded length (bit) |\n    | --- | --- | --- | --- | --- | --- |\n    | Discop + (20,1) Code | 59.70 | 1.14 | 0.89 | 97.97 | 1.21 |\n    | STEAD | 23.93 | 75.14 | 8.68 | 16.18 | **20.06** |\n    \n    Using other error-correcting codes (e.g. BCH, LDPC) will not make this idea of directly combining non-robust methods with redundancy encoding feasible. We will add the above discussion to the revised paper.\n    \n4. **Weakness 4: The Robustness against xxx results are impressive. However, the settings of baselines are not clear. Hence, I am not sure if the comparison is fair.**\n    \n    **Response:**\n    \n    We appreciate the concern about the fairness of baseline comparisons. \n    \n    To ensure consistency, we uniformly adopted advanced ARM models with identical parameter scales: Qwen2.5-7B and Deepseek-7B-base. For the generation process, **prompts and sampling settings** (temperature=1.0, top-p=0.95 for main experiments) were strictly aligned across all compared methods, including our STEAD. Additionally, the **attack settings (types and intensity)** in robustness experiments were standardized for all methods. The embedding capacity, embedding extraction time, and robustness results reported in our paper are all based on the average results of multiple repeated experiments in the IMDB dataset. We used the same fixed starting random seed for each comparison method, then updated the seed for each prompt and conducted multiple experiments in generation. Detailed information on these settings will be supplemented in Appendix D.\n    \n5. **Weakness 5: The attack methods are also limited. The authors should compare more attack types.**\n    \n    **Response:**\n    \n    To address this, we have extended the robustness evaluation to include two more challenging scenarios:\n    \n    1. **Hybrid attacks** (combining token-level substitution, addition, and deletion) with both weak and strong intensity;\n    2. **Semantic-aware attacks** (synonym replacement) with perturbation rates of 0.01 and 0.05.\n    \n    New results confirm that STEAD maintains superior robustness under these realistic scenarios, significantly outperforming other provably secure methods (discop+qw, ars+qw) across all metrics:\n    \n    | Weak Mixed Attack | discop+qw | ars+qw | stead+diff |\n    | --- | --- | --- | --- |\n    | Correct | 16.92 | 34.99 | 97.59 |\n    | Wrong | 0.34 | 13.63 | 0.83 |\n    | Lost | 82.73 | 51.38 | 1.58 |\n    \n    | Strong Mixed Attack | discop+qw | ars+qw | stead+diff |\n    | --- | --- | --- | --- |\n    | Correct | 2.57 | 12.65 | 75.14 |\n    | Wrong | 0.34 | 14.43 | 8.68 |\n    | Lost | 97.09 | 72.93 | 16.18 |\n    \n    | Semantic-aware (0.01) | discop+qw | ars+qw | stead+diff |\n    | --- | --- | --- | --- |\n    | Correct | 43.60 | 50.44 | 99.43 |\n    | Wrong | 0.42 | 9.97 | 0.40 |\n    | Lost | 55.98 | 39.59 | 0.17 |\n    \n    | Semantic-aware (0.05) | discop+qw | ars+qw | stead+diff |\n    | --- | --- | --- | --- |\n    | Correct | 10.27 | 22.60 | 89.16 |\n    | Wrong | 0.59 | 15.54 | 4.36 |\n    | Lost | 89.13 | 61.86 | 6.48 |\n    \n    We will add a dedicated subsection \"Real-World Attack Scenarios\" in the Experiments section to detail these evaluations, further strengthening the validity of our experiments.\n    \n6. **Question 2: Lines 304-307, the authors stated the KLD of STEAD because STEAD will not modify the distribution. However, the way of sampling may affect the real `distribution`. The authors need to explain if the sampling of STEAD will affect this.**\n    \n    Response:\n    \n    While STEAD’s embedding algorithm does adjust the sampling process (as is standard in this field), it is designed to preserve the original token distribution.\n    \n    In provably secure linguistic steganography, \"covertext\" refers to text generated via standard pseudo-random sampling from the language model, and \"stegotext\" to text generated through the steganographic embedding process. Security requires that the token distribution of stegotext (selected based on the hidden message) matches that of covertext (selected via random sampling).\n    \n    As detailed in lines 255–281, we **formally prove** that for any polynomial-time distinguisher, the stego tokens chosen via STEAD’s message-driven sampling are **computationally indistinguishable** from cover tokens chosen via random sampling. This ensures that STEAD’s sampling method does not alter the underlying token distribution, maintaining consistency with random sampling.\n    \n    Beyond the theoretical proof of computational indistinguishability and 0 KLD (preserving linguistic quality via PPL distribution), we supplemented steganalysis experiments. Trained detectors (FCN, R-BiLSTM-C, LSTMATT) show near-random accuracy (~50%) on distinguishing STEAD stegotexts from covertexts, validating security. We tested on a new dataset (C4) with 2000 cover-stego pairs. Results confirm consistent performance, with steganalyzers achieving accuracy close to random guessing:\n\n    | C4 dataset | FCN | R-BiLSTM-C | LSTMATT |\n    | --- | --- | --- | --- |\n    | accuracy | 49.92±2.79 | 49.08±2.66 | 50.25±0.54 |"}, {"review_id": "wLgCMgD8Hx", "reviewer": "Reviewer_JQ4Y", "summary": "Previous works on provably secure linguistic steganography have used autoregressive language models, which are not robust against tampering attacks. This paper proposes using diffusion language models instead, as they allow for identifying robust positions for steganographic embedding. Combined with the introduced error correction strategies, the proposed method improves robustness while maintaining security.", "questions": "1. What is the error positioning characteristics of message-driven PRN sampling and how to use it to judge the extraction error for replacement, insertion, and deletion?\n\n2. What is the computational cost of neighborhood search extraction?", "limitations": "Not see limitations being discussed in the paper.", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 2, "originality": 2, "strengths_and_weaknesses": "**Strengths**\n\n1. The paper achieves both secure and robust linguistic steganography.\n\n2. It considers a wide range of tampering attacks, including substitution, insertion, deletion, and token ambiguity.\n\n**Weaknesses**\n\n1. No ablation studies are provided to demonstrate the effectiveness of the proposed components, such as robust position selection, error correction coding (ECC), or Neighborhood Search Extraction.\n\n2. The figures lack sufficient descriptions and explanations, which hinders understanding of the methodology.\n\n3. The methodology section lacks clarity. Specifically, it is unclear how robust positions are selected for embedding.\n\n4. As noted in line 104, GTSD is another work that leverages diffusion models to enhance robustness in linguistic steganography (which also demonstrates to be secure), but no experimental comparison is provided.", "was_revised": true, "final_justification": "The authors make detailed plan to improve clarity and presentation. While NSE enhances robustness, it also results in significant decoding latency overhead. Therefore, I am increasing my rating to a 4, but not higher.", "rebuttal": "Thank you for your valuable comments. Here are our responses.\n\n1. **Weakness1: No ablation studies are provided to demonstrate the effectiveness of the proposed components, such as robust position selection, error correction coding (ECC), or Neighborhood Search Extraction.**\n    \n    **Response:** \n    \n    We have added ablation studies for the proposed components as suggested. Our framework is composed of a message-driven PRN sampling algorithm, **robust position selection (RPS)** and **error correction coding (ECC)**, and the **neighborhood search extraction (NSE)** strategy. \n    \n    The basic steganographic algorithm (w/o RPS, ECC, NSE) directly performs steganographic embedding/extraction on the DM model. Its robustness is similar to that of the ARM-based method. Adding RPS and ECC enables resistance to token substitution tampering by leveraging DM's parallel denoising capability on limited positions—a key innovation of STEAD. Further adding NSE enhances adaptation to token offset tampering, allowing STEAD to robustly handle substitution, insertion, and deletion (see Table below).\n    \n    | temperature=1.0, p=0.95 | Replacement 0.2 | Insertion 10 | Deletion 10 |\n    | --- | --- | --- | --- |\n    | w/o RPS, ECC, NSE | 31.03/30.27/38.70 | 7.73/7.67/84.60 | 7.67/7.72/84.61 |\n    | w/o NSE | 95.22/1.77/3.01 | 6.85/8.89/84.26 | 4.96/8.47/86.57 |\n    | STEAD | 94.87/1.07/4.06 | 78.31/8.76/12.92 | 88.11/6.10/5.79 |\n2. **Weakness2: The figures lack sufficient descriptions and explanations, which hinders understanding of the methodology.**\n    \n    **Response:**\n    \n    Thank you for your suggestion; we will thoroughly revise all figures with more detailed descriptions and explanations to enhance methodological clarity:\n    \n    1. For Figure 1, we will elaborate on error propagation mechanisms. Specifically, using the formula in Line 77, we will explicitly illustrate how corruption of a preceding word alters the probability distribution of the next word in the ARM model.\n    2. For Figure 2, a comprehensive explanation of the STEAD stegosystem will be added: STEAD is composed with message-driven Pseudo-Random sampling, Robust Position Selection (RPS), Error Correction Coding (ECC), and Neighborhood Search Extraction (NSE).\n    3. For Figure 3, three examples of distributions are given from top to bottom, corresponding to embedding 0, 1, and 2 bits of message. $r_i$ represents the initial random number, and $r_i(X)$ represents the random number corresponding to the message X.\n    4. For Figure 4, when mu=1, if the extraction of \"little\" fails, then traverse the two tokens \"The\" and \"car\" to try to extract valid message bits.\n    5. **Experimental figures**: Captions will explicitly state sampling parameters (temperature=1.0, p=0.95). Experimental analysis will include quantitative descriptions of trends (e.g., \"compared to ARS, the correct extraction ratio of token replacement with STEAD's strength of 0.1 has increased by more than 80\").\n3. **Weakness3: The methodology section lacks clarity. Specifically, it is unclear how robust positions are selected for embedding.**\n    \n    **Response:** \n    \n    We would like to clarify that our method is composed of the following parts:\n    \n    - Message-Driven Pseudo-Random Sampling: Secret bits are conveyed by adding a small, message-dependent offset to the pseudo-random number that drives sampling within each token distribution. Because the underlying distribution is unaltered, the stegotext remains provably indistinguishable from ordinary output.\n    - Robust Position Selection: At each reverse-diffusion step, STEAD identifies the subset of positions that are unmasked in parallel. These positions are independent of one another, making them suitable for isolated, error-tolerant embedding. When they are capable to carry enough bits, they are selected as robust positions.\n    - Error Correction Coding: Repetition codes are used to repetitively embed message across robust positions of a step, enabling correction of up to half the substitutions in that batch. Positions without payload serve as pseudo-random checks that can self-correct single-token substitutions.\n    - Neighborhood Search Extraction: A µ-neighborhood search strategy realigns the decoding process when global offsets arise from insertions or deletions.\n    \n    In summary, we proposed a  stegosystem based on diffusion language models, which is simultaneously provably secure and robust.\n    \n    Addressing your specific concern—*\"it is unclear how robust positions are selected for embedding\"*:\n    \n    In order to select robust positions, it is necessary to first determine the denoising positions of each step. As clarified in lines 194–196, **denoised positions** are independently sampled via conditional probabilities (formula 7) during each step (consistent across cover and stego generation), regardless of embedding. \n    \n    **Robust positions are a subset of denoised positions that meet two criteria** (formula 12):\n    \n    1. The number of such positions in each step is at least 3 (to support repetition codes).\n    2. The minimum entropy of their distribution allows embedding at least 1 bit per position.\n    \n    Notably, robust positions are derived from denoised positions but are not identical to them. Only those meeting the two criteria above qualify as robust positions for message embedding.\n    \n    We will integrate this explanation into Section 4 to explicitly illustrate the steganographic embedding process in the diffusion model, ensuring full clarity.\n    \n4. **Weakness4: As noted in line 104, GTSD is another work that leverages diffusion models to enhance robustness in linguistic steganography (which also demonstrates to be secure), but no experimental comparison is provided.**\n    \n    **Response:**\n    \n    GTSD (*Submitted to arXiv on 28 Apr 2025*) is our **Contemporaneous work.** To ensure the sufficiency of the current situation described in this paper, we added relevant references, and the paper was officially published after our submission (*24 June 2025*), so we did not conduct a comparison. \n    \n    Notably, **GTSD and our method (STEAD) differ fundamentally**:\n    \n    - GTSD is **not provably secure (empirically secure)**. Its diffusion model requires dataset-specific training, and the embedding process introduces non-zero KL divergence, leading to detectable distribution differences (as reported, steganalysis detectors achieve ~10% accuracy above random guessing). This leaves it vulnerable to evolving steganalysis techniques.\n    - In contrast, STEAD is **provably secure**, theoretically guaranteeing indistinguishability between stego and cover data, eliminating detection risks—a key focus in current steganography research.\n    \n    They are two types of methods, empirically secure and theoretically secure. So a direct quantitative comparison is not appropriate. We will add the above qualitative analysis to our revised paper.\n    \n5. **Question1: What is the error positioning characteristics of message-driven PRN sampling and how to use it to judge the extraction error for replacement, insertion, and deletion?**\n    \n    **Response:**\n    \n    The error positioning characteristic of message-driven PRN sampling is that the steganographic method can **only extract messages from specific tokens**, as defined in Appendix A.\n    \n    This characteristic is applied to judge extraction errors for replacement, insertion, and deletion as follows:\n    \n    The number of tokens selectable via the message is limited. If an unexpected token appears at a designated position, it directly indicates tampering at that position. For example, in Figure 9, tokens \"a\"\"b\"\"c\"\"e\" correspond to messages \"10\"\"11\"\"00\"\"01\"; the presence of \"d\" at this robust position confirms a token change. This serves as a sufficient (but not necessary) condition for identifying tampering.\n    \n    Additionally, repetition codes play a key role: positions where the extracted message conflicts with the repetition code decoding (voting result) are flagged as potential tampering sites. Together, these two mechanisms enable the identification of replacement, insertion, and deletion errors.\n    \n6. **Question2: What is the computational cost of neighborhood search extraction?**\n    \n    **Response:** \n    \n    The computational cost of neighborhood search extraction is evaluated via decoding time under different window sizes (μ) against the mixed attack (a stronger attack scheme), as shown in the table below:\n    \n    |  | μ=1 | μ=2 | μ=4 |\n    | --- | --- | --- | --- |\n    | decode time（s） | 48.22 | 59.46 | 62.12 |\n    | decode time（s/bit) | 2.80 | 2.78 | 2.77 |\n    | Correct | 56.85 | 82.58 | 90.58 |\n    | Wrong | 15.05 | 6.19 | 2.77 |\n    | Lost | 28.10 | 11.23 | 6.65 |\n    \n    As μ increases, decoding complexity rises (longer total decode time) but yields higher extraction accuracy. Notably, the time per bit of effective data slightly decreases (from 2.80 s/bit to 2.77 s/bit).\n    \n    In non-lossy environments, neighborhood search extraction is not triggered, resulting in zero additional time consumption. For all attack experiments, we adopt a dynamic window size adjustment strategy: μ is set to $max(2,|L-L'|)$, where $L'$ is the tampered token sequence."}]

Author rebuttal:

Meta-review: This paper presents STEAD, an approach for linguistic steganography that uses the parallel generation abilities of diffusion language models (DMs) to achieve both provable security and robustness against attacks. The core idea is to embed information in independently denoised "robust positions," using error-correction to withstand tampering. This approach aims to solve the error propagation issues that plague prior approaches done on auto-regressive based models.

The reviewers all recognized the idea of using DMs for this problem, and the work has potential to inspire further research. The authors were very committed during the rebuttal, engaging thoroughly with feedback and providing substantial new data and results to address reviewer concerns.

I do have some concerns about the number of changes and new experiments conducted during the rebuttal period suggests the work was not ready for peer review. The authors had to add fundamental components to their evaluation, including ablation studies to validate their own contributions, new baselines (porting an ARM method to a DM), tests against more realistic hybrid and semantic attacks, and security analysis on an entirely new (and much larger) dataset. That is a lot of changes, and I hope that all of these will make it into the next version of the paper. I would also strongly recommend a comparison with GTSD as pointed out in the reviews, even if it does not have all the same properties as STEAD, a comparison is still useful. I realize this is concurrent work, but would strengthen the paper and address the concern about how much of the gains are from using a DM model and how much are from STEAD.
Decision: Accept (poster)