Generative Text Steganography with Large Language Model

Venue: acmmm_org_ACMMM_2024_Conference
Published: 2024-03-26 07:41:11

Abstract: Recent advances in large language models (LLMs) have blurred the boundary of high-quality text generation between humans and machines, which is favorable for generative text steganography.
While, current advanced steganographic mapping is not suitable for LLMs since most users are restricted to accessing only the black-box API or user interface of the LLMs, thereby lacking access to the training vocabulary and its sampling probabilities. 
In this paper, we explore a black-box generative text steganographic method based on the user interfaces of large language models, which is called LLM-Stega.
The main goal of LLM-Stega is that the secure covert communication between Alice (sender) and Bob (receiver) is conducted by using the user interfaces of LLMs. Specifically,
We first construct a keyword set and design a new encrypted steganographic mapping to embed secret messages.
Furthermore, to guarantee accurate extraction of secret messages and rich semantics of generated stego texts, an optimization mechanism based on reject sampling is proposed.
Comprehensive experiments demonstrate that the proposed LLM-Stega outperforms current state-of-the-art methods.

Main paper: 
 introduction: 
 Steganography is the science and art of embedding secret information into cover media, aiming to covertly transmit secret information through public channels. [2, 6, 23] . The principle of steganography can be illustrated by Simmons' "prisoner problem" [28] : There are two prisoners Alice (sender) and Bob (receiver) in jail who are trying to hatch an escape plan. The only way they can communicate is carefully censored by warden Eve (steganalyzer). Therefore, they must find some way to embed the secret messages into a normal digital carrier (recalled cover) to obtain an "innocent-looking" medium with secret messages (called stego). According to the types of digital carrier, steganography can be divided into image steganography [15, 29, 40, 42] , video steganography [11, 16, 19, 20] , audio steganography [1, 12, 35] and text steganography [7, 8, 21, 38, 44, Figure 1 : (a) previous methods rely on a language model and steganographic mapping, which is a white-box method; (b) the proposed LLM-Stega generates stego texts by using large language models. The LLM-Stega directly uses the UIs of LLMs to embed and extract secret messages, which is a blackbox method.Recently, text steganography has become a popular research topic in the information security field since text has high universality and robustness when transmitted through public channels.Early text steganography methods are mainly achieved by modifying content, such as embedding secret information through synonym replacement [13, 24, 36] or spelling conversion [27] . Although these methods can effectively maintain the semantic imperceptibility of stego text, they have low embedding capacity and significant differences in statistical distribution characteristics [44] . Recent advancements in deep neural networks (DNNs) and natural language processing (NLP) have catalyzed a paradigm shift in text steganography, propelling it towards generative text steganography with high embedding capacity and security. [8, 9, 21, 38, [44] [45] [46] .As shown in Figure .1(a), existing generative text steganographic methods typically involve training a language model on a corpus. Subsequently, secret messages are embedded by establishing a steganographic mapping between specific binary bits representing the secret messages and the sampling probability of words within the training vocabulary. These methods have demonstrated commendable performance in terms of security and text quality. However, these methods still have two limitations: (1) These are white-box methods and require that Alice and Bob share the same language model and training vocabulary. Constrained by the language model and training corpus, the generated texts have a significant gap in fluency, logic, and diversity compared to natural texts. (2) the embedding paradigm, building a steganographic mapping between secret messages and sampling probabilities of the off-the-shelf language model, inevitably changes the sampling probability distribution, resulting in security risk. The first limitation can be resolved by using a superior language model. For example, both Zigegler et al. [46] and Dai et al. [7] leverage GPT-2 as the language model to generate stego text. Recently, Wang et al. [33] use LLaMA [31] to generate stego texts, which is the first attempt for generative text steganography based on LLM. Although these attempts improve the text quality of generated stego text, they cannot achieve satisfied embedding capacity and security since they still use the white-box steganographic mapping to embed secret messages. Some experimental results of these attempts demonstrate the aforementioned second limitation.In order to address the above questions and fully leverage the generation ability of LLMs, as shown in Figure 1 (b), we explore a black-box generative text steganography based on the UIs (user interfaces) of large language models. The contributions of this paper as the following:(1) It is the first exploration using the UIs of LLMs to implement a black-box generative text steganography, which generates stego texts and extracts secret messages by using some elaborated prompts. (2) We construct a keyword set and design an encrypted steganographic mapping to embed secret messages. Meanwhile, an optimization mechanism based on reject sampling is proposed to ensure the accurate extraction of secret messages and the rich semantics of generated stego texts. (3) Comprehensive experiments are conducted to evaluate the superiority of the proposed LLM-stega over the state-ofthe-art methods in terms of embedding capacity and security, including Arithmetic codding [46] , ADG [44] and Discop [8] . 
related works 2.1 generative text steganography: 
 The main trait of generative text steganography is that an off-theshelf language model is directly used to generate stego texts under the control of steganographic mapping. Thus, both language model and steganographic mapping play important roles in generative text steganography.Recently, with the emergence of language models based on DNNs, generative text steganography has continuously made breakthroughs in quality and security. Fang et al. [9] proposed a preliminary idea for generative text steganography. They first randomly divided the vocabulary 𝑉 into 2 𝑏 groups 𝑉 1 , 𝑉 2 , . . . 𝑉 2 𝑏 to map the 𝑏-bit secret messages. Then the highest probability token in a group is selected during generation. Yang et al. [38, 39] indicated that using a better language model can generate more fluent and secure stego texts. Both Ziegler et al [46] and Dai et al. [7] use GPT-2 as a language model to generate stego texts. Meanwhile, they designed a different steganographic mapping to embed secret messages. Their findings show that good steganographic mapping is also beneficial for the security of generative text steganography. From the perspective of provably secure steganography, Zhang et al. [44] proposed an Adaptive Dynamic Grouping (ADG) steganography, which recursively embeds secret information by the adaptive dynamic grouping of the vocabulary tokens. Ding et al. [8] proposed a novel steganographic mapping based on "Distribution Copies" (Discop). Since the steganographic behavior does not destroy the original distribution, this method has state-of-the-art security.LLMs have achieved excellent performance on multiple tasks, and researchers have sought ways to utilize LLMs as task-specific data generators. For example, using LLMs to generate tabular data [3] , relational triples [5] , sentence pairs [26] , and instruction data [28] . In these methods, LLMs have a satisfied generation quality for specific subject categories in zero-shot learning. However, existing methods often use simple class condition prompts and some researchers explore ways to improve the quality of the generated data without improving prompt conditions. For example, SuperGen [17] and ZeroGen [41] used LLMs to generate text classification data and used noise robust learning techniques [32] to deal with the quality of the generated data. SunGen [10] used the learned data quality weights to re-weight the data generated in the training process to obtain more excellent data.Notably, some researchers have begun to explore the use of prompt engineering to tune LLMs and LLMs-API to generate data. Chen et al. [4] explored using soft prompts to tune the data generated by LLMs when white box LLMs and seed samples are used. Yu et al. [43] further proposed a method suitable for black box LLMs and even LLMs-API (for example, ChatGPT) to generate the required data without relying on any labeled samples.From the above review, it is obvious that existing generative text steganographic methods are the white-box paradigm, i.e., both embedding and extracting secret messages require the off-the-shelf language model and sampling probability distribution of vocabulary on all generation steps. In addition, due to the expensive training and excellent performance, the off-the-shelf large language models have high commercial value. Users hardly access the sampling distribution and rely more on the black-box APIs and UIs to leverage LLMs. Therefore, existing white-box methods are not suitable for LLMs. How to design a black-box generative text steganography with large language models, has become an interesting problem. 
the proposed methodology: 
 As shown in Figure . 2, the proposed LLM-Stega aims to generate stego texts and extracting secret messages by using the UI of LLMs. The LLM-Stega is composed of four parts, including keyword construction, encrypted steganographic mapping, steganographic text generation, and secret message extraction. We will elaborate on each of them in the rest of this section.Due to the black-box, we do not have access to the training vocabulary of LLM and its distribution at each step to encode secret messages. Thus, a keyword set is constructed to encode the secret messages, where the keywords are the important components of generated stego texts. In this paper, we select the subject, predicate, object, and emotion as the keywords of each generated sentence. We first design a keyword prompt to induce the LLMs to generate four keyword subsets, containing subject set, predicate set, object set, and emotion set. Apart from the emotion set with 3 different words (negative, positive, and neutral) and their sampling probabilities, others contain 16 different high-probability words and corresponding sampling probabilities.Notably, randomly selecting keywords from the four subsets appear with unclear logic and semantic blur, which brings difficulties to the satisfied stego text generation. In order to mitigate the question, the LLM, induced by an evaluation prompt, is used to evaluate the superiority of the randomly selected keywords and optimize their probabilities. Compared with existing white-box methods, using the constructed keyword set to encode secret messages has three significant advantages: (1) the keyword set is separated from the generation process of LLM, users do not require accessing the sampling distribution of LLMs. Meanwhile, the steganographic behavior does not change the sampling distribution of LLM, which improves the security of the generated stego texts. (2) since the sampling probabilities of the keywords are optimized by using the potential knowledge of LLM, the generated stego text based on these keywords can achieve high text quality. ( 3) in an ideal situation, the keyword set can encode massive secret messages as long as the set is large enough.In practice, the number of commonly used keywords is limited and their sampling distribution does not obey uniform distribution. If these subsets are directly used to encode the secret messages, the embedding capacity and security of the generated stego could not be satisfied. To resolve these problems, we first augment the keyword set. Specifically, we perform repeated sampling to expand the keyword set according to the optimized sampling probabilities. Then, the location indices of keywords in the augmentation set are directly used to encode secret messages. In this part, for a good trade-off between time cost and embedding capacity, we expand the capacity of three subsets (subject, predicate and object) from 16 to 2 18 words and that of emotion subset from 3 to 2 10 which can encode 3 * 18 + 10 = 64 bits secret messages.In the augmentation keyword set, the more common keyword has a higher sampling probability, encoding more secret messages. The augmentation strategy not only enhances the embedding capacity but also maintains the real sampling probabilities of the keywords encoded secret messages.Moreover, we notice that the location indices of the keywords are fixed, which leads to the potential exposure risk of the steganographic behavior. To further improve the security of steganographic mapping, an encryption strategy is designed. Concretely, we use a One-Time Password mechanism to implement the encryption. XOR operation is performed using the number of the keyword repetitions and the release time of stego text on online social networks Anon.(OSNs)., which is formulated as follows:EQUATIONwhere 𝐵 𝑅𝑒 -𝐼𝑑𝑥 and 𝐵 𝑅𝑒𝑎𝑙 -𝑇 𝑖𝑚𝑒 denote the binary of the number of the keyword repetition and that of the release time whose components consist of six numbers, containing date, hour, and minute. ⊕ is the XOR operation. The computation result is regarded as a private key shared by Alice and Bob. Although Eve intercepts the augmentation keyword set, he(or she) still cannot correctly decode secret messages.Compared with existing steganographic mappings, the proposed encrypted steganographic mapping does not destroy the sampling distribution of LLM in the generation process since the steganographic mapping is independent of the generation process of LLM. Because of this trait, the proposed mapping applies to various LLMs with user interfaces. Due to the page limitation, in this paper, we only leverage the UIs of GPT-4 to evaluate the superiority of the proposed encrypted steganographic mapping.The main goal of the proposed LLM-Stega is that using the user interfaces of LLMs implements steganographic text generation and secret message extraction. After selecting keywords by using the proposed encrypted steganographic mapping, we use an embedding prompt to induce LLMs to generate stego texts. Unlike an explicit extraction algorithm, the extraction based on the LLM cannot ensure a perfectly accurate extraction. Thus, we proposed a feedback optimization mechanism based on reject sampling.In the generation process, under the guidance of an designed extraction prompt, LLM attempts to output the keywords encoded in the secret messages. If the output keywords have errors, the LLM could return the main reason for these errors and optimize the embedding, generation, and extraction prompts until there are no extraction errors. The feedback optimization mechanism based on reject sampling is shown in Algorithm.1 in detail. In our experiments, making two rejecting sampling ensure the accurate extraction of secret messages embedded into each stego sentence. It is noteworthy that there is a generation prompt behind the reject sampling module shown in Figure . 2. The main reason is that during iterative optimization, the generated stego texts tend to be simple sentences merely containing keywords, so as to ensure accurate extraction. While, the sentence diversity and semantic richness of the generated stego texts are diminished, resulting in secure risk. Therefore, we design and optimize the embedding and generation prompts to ensure rich semantic and accurate extraction, respectively. The optimization mechanism based on reject sampling is shown in Algorithm.1 in detail.After Bob gains the generated stego texts from OSNs, he (or she) leverages the extraction prompt to extract keywords of the generated stego texts using the UIs of LLM. Finally, according to the shared side information, containing the keyword set, private-key, One-Time-Password mechanism, and the release times of stego texts on OSNs, Bob perfectly decodes the secret messages.  
experiment: 
 In this section, we evaluate the performance of LLM-Stega in terms of text quality, embedding capacity, anti-steganalysis ability, and human evaluation. The details of the experimental setup and result analysis are described in the following sections.(1) LLM and Theme information selection. In the experiments, we select the UI of GPT-4 to implement block-box generative text steganography since the GPT-4 is an advanced and widely used LLM. Due to the vivid topics and popularity, the Entertainment News is selected as the theme information to constrain the semantics and context of the generated stego texts.(2) Baselines. Three advanced generative steganographic methods are rebuilt, including Arithmetic [46] , ADG [44] , and Discop [8] . Due our computation and memory limitation, we use the LSTM model trained on News [30] data as an off-the-shelf language model. For the Arithmetic-based algorithm, we choose the steganography text generated under the different embedding capacities of 1.39 bit per word (bpw) (AC-2) and 3.99 bpw (AC-6) to compare.(1) Text Quality. We select the Perplexity (PPL) and semantic similarity (SS) to evaluate the text quality of generated stego texts. For the PPL, it is a general quantitative metric in the other text generation tasks [18] . The PPL is defined as follows:EQUATIONwhere 𝑁 is the length of the text, 𝑤 𝑖 is the 𝑖-th token in text, and 𝑝 (𝑤 𝑖 |𝑤 1 , . . . , 𝑤 𝑖 -1 ) is the probability assigned by the language model to the 𝑖-th word given the preceding words. In this experiment, we choose the GPT-2 model of huggingface to calculate the PPL values of different steganographic texts. For the semantic similarity, We choose the Sentence-bert [25] method and use the roberta-base-nli-mean-tokens [14] model to extract sentence vectors, to calculate the cosine similarity between steganographic text and cover text.(2) Embedding Capacity (EC). It is the average number of secret messages embedded into one token, which is represented as bits per word (bpw). It can be calculated as:EQUATION)where 𝑁 is the total number of bits in the embedded secret messages, and 𝑊 is the total number of words in the generated steganographic text. Since steganography is a key technology for covert communication, embedding capacity is an important metric.(3) Anti-steganalysis Ability. The ability is an important metric for security. In this experiment, we leverage three advanced steganalysis methods, containing LS-CNN (LC) [34] , BiLSTM-Dense (BD) [37] , and Bert-FT (BF) [22] . The steganalysis accuracy is described below:𝐴𝑐𝑐 = 𝑇 𝑃 + 𝑇 𝑁 𝑇 𝑃 + 𝐹 𝑁 + 𝐹 𝑃 + 𝑇 𝑁 (4)where 𝑇 𝑃 is true positives, 𝑇 𝑁 is true negatives, 𝐹 𝑃 is false positives, and 𝐹 𝑁 is false negatives, and we assume the stego texts are positive samples.(4) Statistical Imperceptibility. The Kullback-Leibler Divergence (KLD) serves as an evaluation metric to measure the imperceptibility of steganographic algorithms by comparing the distribution of the generated stego-texts against the distribution of the original cover texts. In our experiment, we select the KLD proposed by Zhang et al. [44] to evaluate the statistical imperceptibility of the tested methods. It is formulated as follows: (5) Human Evaluation. For the human evaluation, we focus on evaluating three key aspects of the generated texts: fluency, coherence, and relevance. These criteria are chosen to reflect the intrasentence linguistic quality, inter-sentence relatedness and causal dependency, and consistency of the generated texts, respectively. We construct a dataset comprising 100 instances of steganographic and non-steganographic texts generated by each algorithm. Three qualified NLP researchers, proficient in English and with a solid understanding of steganography, are employed as annotators. Each annotator independently rates the texts on a five-point scale (ranging from 'very poor' to 'very good') for fluency, coherence, and relevance. The higher evaluation score denotes the better generated stego texts.𝐾𝐿𝐷 (𝜇 𝑥 , 𝜎 𝑥 , 𝜇 𝑦 , 𝜎 𝑦 ) = ∑︁ log 𝜎 𝑦 𝜎 𝑥 + 𝜎 2 𝑥 + (𝜇 𝑥 -𝜇 𝑦 ) 2 2𝜎 2 𝑦 - 1 2 (5)(1) Embedding Capacity and Text Quality. The experimental results of length and EC of generated stego texts are listed in Table 2. To The best of our knowledge, the average length of the News dataset [30] is about 15 words. The Arithmetic and the proposed LLM-Stega have more similar lengths with natural News than ADG and Discop. Meanwhile, the proposed LLM-Stega can achieve the highest embedding capacity. Since the proposed encrypted steganographic mapping is independent of the generation process of LLM, the embedding capacity is not constrained by the distribution entropy of each time step. Table 1 demonstrates the results of text quality of the generated stego texts. In the exploration of literature [39] , it is found that texts on public social networks are written by people of different ages and backgrounds in different ways of expression. This leads to the fact that most of the human-written sentences may not obey the optimal language model and form a large variance. From the security, if the generated stego texts have more similar PPL values with normal sentences, their security is higher. In addition, the higher similarity represents the more similarity between cover and stego sentences, namely, higher security. In our experiments, the average PPL of the normal sentence in the News dataset is 185.64. The "AC-2" can achieve the most similar PPL value and the lowest SS. In addition, the "Discop" algorithm gains the best SS and the maximum gap of PPL. While the proposed LLM-Stega can make the best trade-off between PPL and SS.(2)Anti-steganalysis Ability. In the experiment, the training dataset consists of 10,000 cover sentences generated by an offthe-shelf language model without embedding secret messages and band-praise-song-neutral The band's praise of their latest song was received with neutrality, a calm before the potential storm of fan reactions.The beloved band joyfully released an immersive exhibition, transporting fans through their rich musical journey, sparking waves of nostalgic happiness across the community. (3)Statistical Imperceptibility. The KLD thus quantifies the entropy difference between the cover and stego-text distributions, assessing the degree to which the proposed algorithm ensures the stego-texts remain statistically similar to the cover texts.In this part, we choose the pre-trained BERT to represent the latent feature of cover and stego texts, which is different from the KLD in Zhang et al. [44] . In our experiments, as shown in Figure 4 , we find that the probability distributions of the latent features normalized by the softmax activation function obey a normal distribution. We take the logarithm of the experimental results to more clearly compare the differences in statistical imperceptibility between the different algorithms. Among them, the KLD value for the AC algorithm is significantly higher than the other three algorithms, indicating the AC algorithm's poorer statistical imperceptibility, which also aligns with its inferior performance in resisting steganalysis compared to the other algorithms. The experimental data confirms that our LLM-Stega method excels in statistical imperceptibility compared to other algorithms, ensuring that the stego-texts are semantically consistent with the cover texts and exhibit similar distributional characteristics.(4) Human Evaluation. In order to further evaluate the effectiveness of the proposed LLM-Stega, we implement the human evaluation experiment. The details of evaluation scores are illustrated in Figure . 4. The experimental results indicate that the LLM-Stega outperformed the other three algorithms. This suggests that LLM-Stega is more effective in generating steganographic texts that are contextually relevant and less detectable. The results demonstrate LLM-Stega's superior performance in generating steganographic texts that are fluent, coherent, and relevant. This finding is significant in the context of text steganography, highlighting the potential of LLM-Stega in applications where the imperceptibility of the embedded message is crucial. Besides, we also illustrate some examples of stego text generated by LLM-Stega in Table 3 for qualitative analysis. We find that the stego text is fluent enough, with correct grammar and coherent semantics.As the crux of the proposed LLM-Stega is these elaborated prompts, we carry out the ablation study to verify the effectiveness of prompt optimization. In the experiment, PPL 1 denotes the Perplexity score for the initially generated text, serving as a baseline measure of text complexity. Reject rate denotes the rate of one rejection sampling, and PPL 2 reflects the Perplexity score of the steganographic text following rejection sampling. Furthermore, the Bert-score is utilized to quantify the semantic similarity between the steganographic text and the original cover text.We adopt a structured approach to optimize embedding and extraction prompts, specifically focusing on applications within the steganographic domain. This process is segmented into three phases: an initial optimization phase (denoted as ✓), followed by further optimization phase (denoted as ✓✓), and concluding with a deep optimization phase (denoted as ✓✓✓). "Initial optimization" involved designing the basic structure of text prompts, including theme and a maximum length of generated stego sentences, etc. Based on the initial optimization, "Further optimization" is used to improve text prompts according to the feedback from LLMs. Finally, "deep optimization" consisted of iterative improvements to the prompt details through continuous feedback, further refining the prompt to achieve the task objectives.The experimental results are shown in Table ??. We notice that using "Initial optimization" increases the PPL value and decreases BERT scores, namely, the text quality is reduced. This is because the main goal of "Initial optimization" is to ensure accurately extracting secret messages. In subsequent optimization phases, we aim to improve text quality on the condition that the secret information is extracted accurately, achieving high imperceptibility for the stegotext. Thus, both the PPL and the reject rate have decreased. Besides, the single instance of rejection sampling rate is due to the tuned prompt's ability to produce text that allows for 100% extraction of the secret information in just one attempt. The experimental results show that the "further optimization" process meets expectations. After "deep iterations", the probability of rejection sampling drops to its lowest, while the quality of the text is enhanced to its highest. The experimental results demonstrated that the proposed prompt optimization based on reject sampling significantly improved the quality of the generated stego texts. 
conclusion: 
 Previous works of generative linguistic steganography inevitably introduce distortions to the distribution estimated by off-the-shelf language models. In this paper, we attempted to use the user interfaces of large language models for generative-linguistic steganography. Firstly, an encrypted steganographic mapping is proposed to map the secret messages into the words of four keyword sets. These keyword sets are constructed and optimized for the potential knowledge of LLMs. Then, we propose an optimization mechanism based on reject sampling to improve the effectiveness of the prompts. Finally, comprehensive experimental results evaluate the superiority of the proposed LLMs over other tested methods in terms of text quality, embedding capacity, and anti-steganalysis.The LLM-Stega is the first attempt at generative text steganography based on the UIs of LLM. It is a preliminary method. Meanwhile, steganographic mapping is a simple method to encode secret messages and does not fully leverage the powerful generation ability for text steganography. In future work, we will research a special fine-tuning strategy to further leverage the potential knowledge and generation ability of LMMs for improving the performance of generative text steganography. 
 
 Appendix:  


Decision: This paper received interesting reviews. Three reviewers gave positive recommendations, one very strong too. One reviewer also conveyed strong concerns about the merit of the paper with a strong negative rating. After reading the paper, the rebuttal, and the reviewers comments and discussions, AC thinks that the paper is among many other recent endeavors to use LLM to improve various tasks. However, although AC does not have a problem with the novelty and methodology of the paper, AC is not sure whether the topic of the paper matches with the theme of MM. This is about text steganography, and the approach is purely on the text side, with no other types of input information (e.g., visual, audio, etc.). AC will give a temporary suggestion, and will leave it for senior AC and program chairs to make a final decision.

Reviews: review: paper_summary: paper_summary: The paper proposed a novel method for generative text steganography, LLM-Stega, that leverages the user interfaces of large language models (LLMs). This is the first study to utilize the user interfaces of LLMs for implementing black-box generative text steganography. The method generates stego texts and extracts secret messages using specially crafted prompts. It introduces an encrypted steganographic mapping and an optimization mechanism to ensure secure and semantically rich covert communication. The method's superiority is validated through extensive experiments, marking a notable improvement over existing techniques.
strength_weakness: strength_weakness: This paper proposed LLM-stega, an interesting steganographic methods via black box large language model. The proposed method is clearly explained. The experimental methodology and results are also well-presented.
This method utilizes words from a LLM-constructed candidate set and employs prompts to leverage LLM for text steganography. This approach simplifies the steganographic process by directly using the user interfaces of existing large models in a black-box manner.
Compared to existing steganographic methods, this approach better ensures the perplexity and fluency of the stego text, making the hidden messages more difficult to detect.
Experimental results show that, compared to the current state-of-the-art steganographic methods, this approach not only ensures the highest level of secrecy but also offers the greatest embedding capacity.
limitations: limitations: 1.	From the perspective of motivation, this paper does not provide a detailed analysis of the benefits brought by using black-box LLMs for steganography. The comparison with existing state-of-the-art methods is not entirely fair. For instance, the steganographic process in [8] is provable steganography method, whereas the method proposed in this paper is not provable.
2.	In section 3.3, the reversibility of steganographic information is not detailed. The paper does not explain how the information embedded by embedding prompt can be accurately recovered using the extraction prompt.
3.	The experimental section of this paper primarily focuses on discussing the security of the proposed steganographic method, specifically its ability to avoid detection. It would be beneficial to include some discussion on the time efficiency of this method.
4.	Black-box LLM models, such as GPT-4 used in this paper, introduce randomness when accessed via user interfaces, where the same input might generate different outputs. I am curious whether this phenomenon affects the steganographic embedding and extraction processes. Using an API for steganography might offer more control.
5.	Compared to existing methods, the steganographic approach in this paper leverages more powerful LLM models to enhance the concealment effect of the steganographic text. In comparison, the method in [8], which achieves similar results, only uses GPT-2 as the steganographic tool. Authors may also consider discussing whether employing a more robust white-box model, such as LLAMA 3, in existing steganography methods could potentially yield results more close to those of the black-box GPT-4, while still satisfying provable.
paper_summary: paper_summary: This work proposes a novel out-of-the-box LLM application for text steganography. The stego-text is first encrypted as sets of keywords. The LLMs are then instructed to generate text with covert messages using the keywords. Also, the authors propose reject sampling so that the stego-text can be correctly extracted from the generated text.
strength_weakness: strength_weakness: * The application of LLMs for linguistic steganography is not well-developed and promising. This work provides a valid method of achieving steganography in the era of LLM.
* The proposed method achieves greater sentence quality and imperceptibility than the previous method.
limitations: limitations: a) The proposed methods are highly limited in their capacity by the keyword sets. The total number of secret bits that could be embedded depends on the size of the keyword set, i.e. $18\times 4 = 72$ bits, as stated in Section 3. As compared with previous works, this is a degradation since they were theoretically capable of attaining an unlimited bit capacity, although in practice, the size may be only a few hundred bits. Also, forcing the keywords to be like *(subject, predicate, object, emotion)* may not be applicable to every scenario.

b) **More experiments on other datasets are required.** Currently, the proposed method has only been tested on one dataset, which raises concerns about its generalizability. It would be better to test the method on more complex datasets, such as IMDB, Twitter and other C4 datasets. Although such dirty datasets may fail the keyword design to some degree, exploring the failure case of the proposed method would also be of value.

c) It is unclear how the KLD is computed in the Supplementary Materials. What is the selected dataset for computing the KLD from the stego-text generated by LLM-stega?

Typos:
* L769, “Table ?? -> Table 4”.
paper_summary: paper_summary: The paper proposes the "LLM-Stega," a novel approach to generative text steganography that leverages the capabilities of Large Language Models (LLMs) in a black-box setting, contrasting with previous methodologies that operated under white-box assumptions. This is noted as the first work to propose a black-box generative text steganography method, effectively utilizing LLMs through their user interface (UI) to generate steganographic text and extract hidden messages. The proposed method first constructs a keyword set and design a new encrypted steganographic mapping to embed secret messages. Furthermore, to guarantee accurate extraction of secret messages and rich semantics of generated stego texts, an optimization mechanism based on reject sampling is proposed. Comprehensive experiments demonstrate that the proposed LLM-Stega outperforms current state-of-the-art methods, including perplexity, similarity, human evaluation, Kullback-Lebler Divergence (KLD) and anti-steganalysis.
strength_weakness: strength_weakness: 1.	This paper focuses on the important limitation of existing generative text steganography methods, i.e., existing methods cannot be suitable for the popular LLMs, to design a black-box method. To the best of our knowledge, the proposed “LLM-Stega” is first exploration for black-box generative text steganography, which extends a new research field for the text steganography based on the UI of LLMs.
2.	The experiments are conducted comprehensively and demonstrate the performance of “LLM-Stega” are better than those of current SOTA methods, including ADG and Discop, especially, in terms of the KLD and human evaluation. I believe that these experimental results are convinced. Moreover, this method can implement convert communication with high embedding capacity as long as the keyword sets are large enough, which is suitable for the real-world scenarios.
3.	The English writing of the motivation, challenge, and the method details is clear, and the figures greatly help me to further understand the contributions of this paper.
limitations: limitations: I have a question about the usage of language model in the experiment part. Wang et al., 2024 [1]'s use of LLaMA-2 to generate stego text is mentioned in the text, but this method is not selected as a baseline in this paper. Is there a reason why the authors decide not to include this method in the experiments? In addition, the authors selected a LSTM trained on news as their baseline off-the-shelf language model, which seems to be much weaker than GPT-4. Is there a reason why stronger models are not used as baselines?

[1] Wang, Y., Song, R., Zhang, R., Liu, J., & Li, L. (2024). LLsM: Generative Linguistic Steganography with Large Language Model. arXiv preprint arXiv:2401.15656.
paper_summary: paper_summary: This paper proposes a black-box generated text steganography method LLM-Stega based on a large language model user interface. The secret message is embedded by constructing a keyword set and designing a new cryptographic steganographic map. Comprehensive experiments show that the proposed LLM-Stega outperforms the current state-of-the-art methods.
strength_weakness: strength_weakness: LLM-stega claims better than the other methods.
limitations: limitations: Several key weaknesses are brought up in the reviews. This includes the following:
-- It is correct to say in the summary that most users are limited to LLM’s API, but will this make it lower for criminals to pass secret information, making it more difficult to monitor illegal activities and key personnel? In addition, the technical content of keyword mapping and other operations using APIs in the paper is not high, so the practicality of the entire paper is greater than the innovation. Such innovation is difficult to publish in high-level conferences.
-- Although your method has a higher embedding capacity, its perplexity is several times higher than existing methods. Is it reasonable to blindly pursue embedding capacity and give up text quality?
-- The whole work is a bit similar to a codebook, using secret information to find the corresponding keywords, and then letting the API of the large model generate it without going deep into the model. So does this solution itself meet the category of generative? It seems more like a modification.
-- Except for the Discop method, the comparison method is not new enough. Is there no other related work in the past two years? Is the performance of the proposed method brought by LLMs or what? How does the performance compare with work published in the past two years?
-- According to the description in the paper, existing AC and ADG steganography methods can also obtain higher embedding rates by adjusting some parameters. Then the LLM-stega performance claimed by the entire experiment is significantly better than the existing methods, but in fact, there are only 513 lines of “Statistical Imperceptibility” (KLD and human evaluation). This is obviously not enough to support the last sentence in the abstract.
-- In Figure 3, why is the steganographic text obtained by LLM-stega uncharacteristically, and the performance of BERT detection is lower than that of LS-CNN? The reason for this needs to be explained. The detection performance of the LLM-stega method does not seem to be much better than ADG and Discop. So is this result caused by the randomness of deep learning or the superiority of the model structure? This is particularly important.
-- In Figure 4, how are human evaluations performed? Can objectivity be guaranteed?
-- In line 769, appears “Table??”, which seems very unprofessional. In addition, in Table 4, PPL2 is better than PPL1, so rejecting sampling actually reduces the text quality? Can the subsequent operations be completely eliminated and still obtain better results?
-- Is semantic similarity the similarity between texts or the similarity between texts and prompts? The semantic similarity should be very high using LLMs, why is it not shown? Is it because this method of designing keywords is not as good as the methods above in Table 1?
-- The entire architecture seems to make use of LLMs multiple times. Will such a structure lead to extremely high time consumption? In addition, in Figure 2, it seems that LLMs can be used to directly generate Stego Texts, so is the subsequent operation necessary?
If the above questions are adequately answered, I may consider increasing my existing score.