## 1 Introduction  
Steganography is a way of concealing sensitive information within multimedia carriers such as images [1, 2], videos [3, 4], text [5, 6], and audio [7, 8], allowing for clandestine communication. However, its dual-use nature poses major threats, including possible misuse in cybercrime [9, 10]. To combat these dangers, the development of steganalysis techniques--which determine whether a given carrier contains hidden information--has become increasingly important. As a result, research on various steganalysis approaches has received significant interest in recent years [9, 10]. Voice-over-IP (VoIP) technologies have experienced widespread global adoption in recent years, as evidenced by the continuous expansion of the global VoIP market. According to industry forecasts, the market size is projected to reach USD 108.5 billion by 2032, with a compound annual growth rate (CAGR) of 10.4%. This large-scale deployment and the growing volume of voice traffic over IP-based networks provide considerable covert bandwidth and payload capacity, making VoIP streams well-suited for steganographic communication. However, steganalysis in VoIP-based speech faces distinct challenges, primarily due to the need for real-time processing. Detection systems must analyze speech data frame by frame with low latency, which limits the use of complex or heavy models. This strict timing constraint sets VoIP steganalysis apart from other modalities (images, videos, texts, and audio) and calls for lightweight, efficient methods tailored to streaming speech. Among the various codecs employed in VoIP systems, adaptive multi-rate (AMR) speech coding--standardized by the 3 rd Generation Partnership Project (3 GPP) [11]--is a widely used low-bit-rate compression technique recognized for its coding efficiency and robustness in wireless transmission environments. AMR is extensively utilized not only in real-time voice communication but also as a speech file format for storing audio data. Its integration into mainstream messaging platforms such as WeChat and iMessage further underscores its relevance in modern voice-centric media. Owing to its prevalence in both real-time and stored speech applications, AMR-encoded speech streams have become important steganographic carriers and have attracted considerable attention in the domains of information hiding and steganalysis [12, 13, 14, 15, 16, 17, 18]. The cornerstone of these steganographic approaches is based on exploiting redundancies in the AMR encoding process. AMR, a common voice encoding system based on algebraic code-excited linear prediction (ACELP), provides three types of coding parameters for data embedding: pitch delay [12, 13], linear prediction coefficients (LPCs) [14, 15, 16], and fixed-codebook (FCB) parameters [17, 18]. FCB characteristics are particularly prominent, accounting for a significant chunk of the encoding process. For example, in the AMR-Narrowband (AMR-NB) codec running at 12.2 kbps, each 20 ms speech frame has 244 encoded bits, 140 of which (57.38%) correspond to FCB parameters [17, 18], making them ideal for steganography. Furthermore, the depth-first search approach for determining pulse positions in FCB parameters frequently produces unsatisfactory results. This feature allows for the replacement of original pulse positions with other candidates, allowing hidden messages to be placed in the FCB domain without drastically affecting speech quality. Steganographic techniques for AMR voice streams have mostly addressed the FCB domain [17, 18]. [PERSON] and [PERSON] [17] adapted the FCB parameter encoding procedure to embed secret information into AMR-based streams, obtaining a ten-bit embedding capacity per frame. [PERSON] et al. [18] expanded on this notion by proposing an adaptive technique to improve the transparency of updated streams. Unlike previous methods, this system dynamically modified the embedding capacity with an embedding factor, allowing for a balance of transparency and capacity.