{
  "version": "1.0.0",
  "updated": "2026-10-19",
  "canonical_url": "https://steganography.live/reading-list/",
  "papers": [
    {
      "id": "fang-2017",
      "title": "Generating Steganographic Text with LSTMs",
      "authors": [
        "Tina Fang",
        "Martin Jaggi",
        "Katerina Argyraki"
      ],
      "author_parts": [
        {
          "given": "Tina",
          "family": "Fang"
        },
        {
          "given": "Martin",
          "family": "Jaggi"
        },
        {
          "given": "Katerina",
          "family": "Argyraki"
        }
      ],
      "year": 2017,
      "venue_date": "2017-07",
      "venue": "Proceedings of ACL 2017, Student Research Workshop",
      "venue_short": "ACL 2017 Student Research Workshop",
      "publication_type": "conference",
      "publisher": "Association for Computational Linguistics",
      "pages": "100–106",
      "doi": null,
      "arxiv_id": "1705.10742",
      "relation": "foundation",
      "categories": [
        "Earlier neural methods",
        "Language-model steganography"
      ],
      "summary": "Uses an LSTM language model and vocabulary bins to generate text carrying a secret bitstream. Experiments on tweets and email explore the trade-off between embedding capacity and text quality.",
      "relationship": "The 2019 Neural Linguistic Steganography paper cites this earlier neural method and reimplements its block-based encoding with GPT-2 as a baseline.",
      "limitation": "The paper leaves formal evaluation against human judges and steganalysis methods to future work; its qualitative examples alone do not establish statistical undetectability.",
      "sources": [
        {
          "url": "https://aclanthology.org/P17-3017/",
          "evidence": "Published author order, title, venue, July 2017, pages; no DOI listed."
        },
        {
          "url": "https://arxiv.org/abs/1705.10742",
          "evidence": "First arXiv submission May 30, 2017."
        },
        {
          "url": "https://aclanthology.org/P17-3017.pdf",
          "evidence": "Sections 3–4 describe LSTM/bin encoding and experiments; section 5 identifies future security evaluation."
        },
        {
          "url": "https://aclanthology.org/D19-1115.pdf",
          "evidence": "Sections 2 and 4 identify Fang et al. as the Block baseline and explain the GPT-2 reimplementation."
        },
        {
          "url": "https://github.com/tbfang/steganography-lstm",
          "evidence": "Author repository explicitly identifies itself as code for this paper."
        }
      ],
      "arxiv_url": "https://arxiv.org/abs/1705.10742",
      "earliest_date": "2017-05-30",
      "earliest_date_label": "First arXiv submission",
      "url": "https://aclanthology.org/P17-3017/",
      "pdf": "https://aclanthology.org/P17-3017.pdf",
      "code": "https://github.com/tbfang/steganography-lstm",
      "category": "foundations",
      "contribution": "Uses an LSTM language model and vocabulary bins to generate text carrying a secret bitstream. Experiments on tweets and email explore the trade-off between embedding capacity and text quality.",
      "canonical_url": "https://steganography.live/reading-list/papers/fang-2017/"
    },
    {
      "id": "rnn-stega",
      "title": "RNN-Stega: Linguistic Steganography Based on Recurrent Neural Networks",
      "authors": [
        "Zhong-Liang Yang",
        "Xiao-Qing Guo",
        "Zi-Ming Chen",
        "Yong-Feng Huang",
        "Yu-Jin Zhang"
      ],
      "author_parts": [
        {
          "given": "Zhong-Liang",
          "family": "Yang"
        },
        {
          "given": "Xiao-Qing",
          "family": "Guo"
        },
        {
          "given": "Zi-Ming",
          "family": "Chen"
        },
        {
          "given": "Yong-Feng",
          "family": "Huang"
        },
        {
          "given": "Yu-Jin",
          "family": "Zhang"
        }
      ],
      "year": 2019,
      "venue_date": "2019-05",
      "venue": "IEEE Transactions on Information Forensics and Security",
      "venue_short": "IEEE TIFS 2019 (online 2018)",
      "publication_type": "journal",
      "publisher": "IEEE",
      "volume": "14",
      "issue": "5",
      "pages": "1280–1295",
      "doi": "10.1109/TIFS.2018.2871746",
      "arxiv_id": null,
      "project_url": "https://github.com/YangzlTHU/Linguistic-Steganography-and-Steganalysis/tree/master/Steganography/RNN-Stega",
      "relation": "foundation",
      "categories": [
        "Earlier neural methods",
        "Huffman coding"
      ],
      "summary": "Generates cover text with a recurrent language model and dynamically encodes candidate words using fixed-length or Huffman variable-length codes. It evaluates generation efficiency, embedding capacity, text quality, and resistance to the tested steganalysis methods.",
      "relationship": "The 2019 Neural Linguistic Steganography paper compares against this work's Huffman approach using the same GPT-2 language model as its own arithmetic method.",
      "limitation": "The paper describes a capacity–quality trade-off and the cost of rebuilding a Huffman tree at each generation step. These empirical results should not be read as a distribution-preservation guarantee.",
      "sources": [
        {
          "url": "https://ieeexplore.ieee.org/document/8470163",
          "evidence": "Publisher record: first online publication on September 24, 2018; May 2019 journal issue, pages, and DOI."
        },
        {
          "url": "https://api.crossref.org/works/10.1109/TIFS.2018.2871746",
          "evidence": "Publisher-deposited complete author spellings, title, May 2019 issue metadata, DOI."
        },
        {
          "url": "https://www.researchgate.net/publication/327852903_RNN-Stega_Linguistic_Steganography_Based_on_Recurrent_Neural_Networks",
          "evidence": "Full manuscript explicitly uploaded by author Zhongliang Yang; section III-B gives FLC/VLC and Huffman rebuilding trade-off; section IV gives evaluations."
        },
        {
          "url": "https://aclanthology.org/D19-1115.pdf",
          "evidence": "Sections 2 and 4 describe the Huffman comparison and shared-model reimplementation."
        },
        {
          "url": "https://raw.githubusercontent.com/YangzlTHU/Linguistic-Steganography-and-Steganalysis/master/Steganography/RNN-Stega/README.md",
          "evidence": "Author-lab description of the RNN-Stega project."
        }
      ],
      "earliest_date": "2018-09-24",
      "earliest_date_label": "First online publication (IEEE)",
      "url": "https://ieeexplore.ieee.org/document/8470163",
      "pdf": null,
      "code": null,
      "category": "foundations",
      "contribution": "Generates cover text with a recurrent language model and dynamically encodes candidate words using fixed-length or Huffman variable-length codes. It evaluates generation efficiency, embedding capacity, text quality, and resistance to the tested steganalysis methods.",
      "canonical_url": "https://steganography.live/reading-list/papers/rnn-stega/"
    },
    {
      "id": "dai-cai-2019",
      "title": "Towards Near-imperceptible Steganographic Text",
      "authors": [
        "Falcon Z. Dai",
        "Zheng Cai"
      ],
      "author_parts": [
        {
          "given": "Falcon Z.",
          "family": "Dai"
        },
        {
          "given": "Zheng",
          "family": "Cai"
        }
      ],
      "year": 2019,
      "venue_date": "2019-07",
      "venue": "Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics",
      "venue_short": "ACL 2019",
      "publication_type": "conference",
      "publisher": "Association for Computational Linguistics",
      "pages": "4303–4308",
      "doi": "10.18653/v1/P19-1422",
      "arxiv_id": "1907.06679",
      "relation": "related",
      "categories": [
        "Contemporary 2019 research",
        "Statistical security",
        "Huffman coding"
      ],
      "summary": "Analyzes how binning and variable-length encoding alter a language model's output distribution. Its patient-Huffman method skips message embedding at steps where the induced distribution would differ too much from the model.",
      "relationship": "Neural Linguistic Steganography explicitly identifies this as concurrent research on distributional analysis and modified Huffman coding, distinct from its arithmetic-coding approach.",
      "limitation": "Tight total-variation bounds require restrictive per-step thresholds, with useful throughput depending on the model's distributions; the paper also identifies vulnerability to an active adversary modifying text.",
      "sources": [
        {
          "url": "https://aclanthology.org/P19-1422/",
          "evidence": "Published title, authors, venue, date, DOI, pages."
        },
        {
          "url": "https://arxiv.org/abs/1907.06679",
          "evidence": "First arXiv submission July 15, 2019."
        },
        {
          "url": "https://aclanthology.org/P19-1422.pdf",
          "evidence": "Section 3.3 gives patient-Huffman and threshold qualification; section 4 identifies active-adversary limitations."
        },
        {
          "url": "https://aclanthology.org/D19-1115.pdf",
          "evidence": "Section 2 calls Dai and Cai concurrent work."
        },
        {
          "url": "https://github.com/falcondai/lm-steganography",
          "evidence": "Author repository explicitly accompanies the paper and implements patient-Huffman."
        }
      ],
      "arxiv_url": "https://arxiv.org/abs/1907.06679",
      "earliest_date": "2019-07-15",
      "earliest_date_label": "First arXiv submission",
      "url": "https://aclanthology.org/P19-1422/",
      "pdf": "https://aclanthology.org/P19-1422.pdf",
      "code": "https://github.com/falcondai/lm-steganography",
      "category": "security",
      "contribution": "Analyzes how binning and variable-length encoding alter a language model's output distribution. Its patient-Huffman method skips message embedding at steps where the induced distribution would differ too much from the model.",
      "canonical_url": "https://steganography.live/reading-list/papers/dai-cai-2019/"
    },
    {
      "id": "neural-linguistic-steganography",
      "title": "Neural Linguistic Steganography",
      "authors": [
        "Zachary M. Ziegler",
        "Yuntian Deng",
        "Alexander M. Rush"
      ],
      "author_parts": [
        {
          "given": "Zachary M.",
          "family": "Ziegler"
        },
        {
          "given": "Yuntian",
          "family": "Deng"
        },
        {
          "given": "Alexander M.",
          "family": "Rush"
        }
      ],
      "equal_contribution": [
        "Zachary M. Ziegler",
        "Yuntian Deng"
      ],
      "year": 2019,
      "venue_date": "2019-11",
      "venue": "Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP)",
      "venue_short": "EMNLP-IJCNLP 2019",
      "publication_type": "conference",
      "publisher": "Association for Computational Linguistics",
      "pages": "1210–1215",
      "doi": "10.18653/v1/D19-1115",
      "arxiv_id": "1909.01496",
      "project_url": "https://steganography.live/",
      "relation": "foundation",
      "is_original_project": true,
      "categories": [
        "Original project",
        "Arithmetic coding",
        "Language-model steganography"
      ],
      "summary": "Combines arithmetic coding with large pretrained language models to encode secret information into generated text while closely matching the model's distribution. GPT-2 experiments evaluate information capacity, statistical divergence, and human judgments of contextual continuations, and demonstrate encoding natural-language messages into unrelated cover text.",
      "relationship": "The original paper associated with this research site and its STEGASURAS implementation. The published paper links steganography.live and the official repository.",
      "limitation": "The statistical experiments measure divergence from the language model, not an inaccessible true human-language distribution. Truncation and temperature choices create a practical trade-off between human plausibility and distribution matching.",
      "sources": [
        {
          "url": "https://aclanthology.org/D19-1115/",
          "evidence": "Publication title, venue, November 2019, DOI and pages."
        },
        {
          "url": "https://aclanthology.org/D19-1115.pdf",
          "evidence": "Title page establishes full author names and equal contribution; sections 3–4 support method, evaluations and limitations; page 2 links site and code."
        },
        {
          "url": "https://arxiv.org/abs/1909.01496",
          "evidence": "Only listed version is v1, September 3, 2019."
        },
        {
          "url": "https://github.com/harvardnlp/NeuralSteganography",
          "evidence": "Official implementation identifies paper and links steganography.live; June 2025 compatibility update is separately credited."
        }
      ],
      "arxiv_url": "https://arxiv.org/abs/1909.01496",
      "earliest_date": "2019-09-03",
      "earliest_date_label": "First arXiv submission",
      "url": "https://aclanthology.org/D19-1115/",
      "pdf": "https://aclanthology.org/D19-1115.pdf",
      "code": "https://github.com/harvardnlp/NeuralSteganography",
      "category": "original",
      "contribution": "Combines arithmetic coding with large pretrained language models to encode secret information into generated text while closely matching the model's distribution. GPT-2 experiments evaluate information capacity, statistical divergence, and human judgments of contextual continuations, and demonstrate encoding natural-language messages into unrelated cover text.",
      "canonical_url": "https://steganography.live/reading-list/papers/neural-linguistic-steganography/"
    },
    {
      "id": "saac",
      "title": "Near-imperceptible Neural Linguistic Steganography via Self-Adjusting Arithmetic Coding",
      "authors": [
        "Jiaming Shen",
        "Heng Ji",
        "Jiawei Han"
      ],
      "author_parts": [
        {
          "given": "Jiaming",
          "family": "Shen"
        },
        {
          "given": "Heng",
          "family": "Ji"
        },
        {
          "given": "Jiawei",
          "family": "Han"
        }
      ],
      "year": 2020,
      "venue_date": "2020-11",
      "venue": "Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP)",
      "venue_short": "EMNLP 2020",
      "publication_type": "conference",
      "publisher": "Association for Computational Linguistics",
      "pages": "303–313",
      "doi": "10.18653/v1/2020.emnlp-main.22",
      "arxiv_id": "2010.00677",
      "relation": "direct-extension",
      "categories": [
        "Arithmetic coding",
        "Statistical security"
      ],
      "summary": "Introduces self-adjusting arithmetic coding, choosing the candidate-set size at each generation step to control divergence from the language model. It supplies an imperceptibility analysis and evaluates capacity, divergence, and human judgments across multiple datasets.",
      "relationship": "The introduction explicitly states that SAAC builds on Ziegler, Deng, and Rush's 2019 arithmetic-coding method, replacing a fixed truncation size with an adaptive one.",
      "limitation": "Its distributional guarantee is relative to the underlying language model; choosing the truncation threshold still trades embedding behavior and computation against divergence.",
      "sources": [
        {
          "url": "https://aclanthology.org/2020.emnlp-main.22/",
          "evidence": "Published bibliographic metadata and DOI."
        },
        {
          "url": "https://arxiv.org/abs/2010.00677",
          "evidence": "First arXiv submission October 1, 2020."
        },
        {
          "url": "https://aclanthology.org/2020.emnlp-main.22.pdf",
          "evidence": "Introduction explicitly identifies extension of 2019 method; sections 2–3 define relative imperceptibility/adaptive K; page 1 links code."
        },
        {
          "url": "https://github.com/mickeysjm/StegaText",
          "evidence": "Official code repository linked by the paper."
        }
      ],
      "arxiv_url": "https://arxiv.org/abs/2010.00677",
      "earliest_date": "2020-10-01",
      "earliest_date_label": "First arXiv submission",
      "url": "https://aclanthology.org/2020.emnlp-main.22/",
      "pdf": "https://aclanthology.org/2020.emnlp-main.22.pdf",
      "code": "https://github.com/mickeysjm/StegaText",
      "category": "direct-extension",
      "contribution": "Introduces self-adjusting arithmetic coding, choosing the candidate-set size at each generation step to control divergence from the language model. It supplies an imperceptibility analysis and evaluates capacity, divergence, and human judgments across multiple datasets.",
      "canonical_url": "https://steganography.live/reading-list/papers/saac/"
    },
    {
      "id": "minimum-entropy-coupling",
      "title": "Perfectly Secure Steganography Using Minimum Entropy Coupling",
      "authors": [
        "Christian Schroeder de Witt",
        "Samuel Sokota",
        "J. Zico Kolter",
        "Jakob Foerster",
        "Martin Strohmeier"
      ],
      "author_parts": [
        {
          "given": "Christian",
          "family": "Schroeder de Witt"
        },
        {
          "given": "Samuel",
          "family": "Sokota"
        },
        {
          "given": "J. Zico",
          "family": "Kolter"
        },
        {
          "given": "Jakob",
          "family": "Foerster"
        },
        {
          "given": "Martin",
          "family": "Strohmeier"
        }
      ],
      "equal_contribution": [
        "Christian Schroeder de Witt",
        "Samuel Sokota"
      ],
      "year": 2023,
      "venue_date": "2023",
      "venue": "International Conference on Learning Representations",
      "venue_short": "ICLR 2023",
      "publication_type": "conference",
      "publisher": null,
      "doi": null,
      "arxiv_id": "2210.14889",
      "relation": "related",
      "categories": [
        "Statistical security",
        "Minimum entropy coupling"
      ],
      "summary": "Characterizes perfect steganographic security through couplings and maximal information throughput through minimum entropy couplings under its information-theoretic model. It develops an iterative method and compares it with arithmetic coding, Meteor, and adaptive dynamic grouping on text, audio, and image-model distributions.",
      "relationship": "Explicitly cites and evaluates the 2019 arithmetic-coding implementation as a baseline, while proposing a different coupling-based construction with a different security guarantee.",
      "limitation": "The guarantee assumes a passive adversary, unmodified transmission, and access to the cover distribution; matching a model does not establish that it exactly models real-world communication.",
      "sources": [
        {
          "url": "https://arxiv.org/abs/2210.14889",
          "evidence": "Full authors and first submission October 24, 2022; version history retained separately from ICLR year."
        },
        {
          "url": "https://arxiv.org/pdf/2210.14889",
          "evidence": "Title page identifies ICLR 2023 and equal contributions; sections 3–5 give coupling characterization and 2019 baseline; section 7 states assumptions/limitations; section 8 links code."
        },
        {
          "url": "https://iclr.cc/virtual/2023/poster/11490",
          "evidence": "Official ICLR 2023 poster record verifies title/authors and directly links the OpenReview forum HQ67mj5rJdR."
        }
      ],
      "arxiv_url": "https://arxiv.org/abs/2210.14889",
      "earliest_date": "2022-10-24",
      "earliest_date_label": "First arXiv submission",
      "url": "https://openreview.net/forum?id=HQ67mj5rJdR",
      "pdf": "https://arxiv.org/pdf/2210.14889",
      "code": "https://github.com/schroederdewitt/perfectly-secure-steganography",
      "category": "security",
      "contribution": "Characterizes perfect steganographic security through couplings and maximal information throughput through minimum entropy couplings under its information-theoretic model. It develops an iterative method and compares it with arithmetic coding, Meteor, and adaptive dynamic grouping on text, audio, and image-model distributions.",
      "canonical_url": "https://steganography.live/reading-list/papers/minimum-entropy-coupling/"
    },
    {
      "id": "llm-watermark",
      "title": "A Watermark for Large Language Models",
      "authors": [
        "John Kirchenbauer",
        "Jonas Geiping",
        "Yuxin Wen",
        "Jonathan Katz",
        "Ian Miers",
        "Tom Goldstein"
      ],
      "author_parts": [
        {
          "given": "John",
          "family": "Kirchenbauer"
        },
        {
          "given": "Jonas",
          "family": "Geiping"
        },
        {
          "given": "Yuxin",
          "family": "Wen"
        },
        {
          "given": "Jonathan",
          "family": "Katz"
        },
        {
          "given": "Ian",
          "family": "Miers"
        },
        {
          "given": "Tom",
          "family": "Goldstein"
        }
      ],
      "equal_contribution": [
        "John Kirchenbauer",
        "Jonas Geiping"
      ],
      "year": 2023,
      "venue_date": "2023-07",
      "venue": "Proceedings of the 40th International Conference on Machine Learning",
      "venue_short": "ICML 2023",
      "publication_type": "conference",
      "publisher": "PMLR",
      "series": "Proceedings of Machine Learning Research",
      "volume": "202",
      "pages": "17061–17084",
      "doi": null,
      "arxiv_id": "2301.10226",
      "relation": "related",
      "categories": [
        "Watermarking",
        "Detection"
      ],
      "summary": "Embeds a statistical watermark by softly favoring a pseudorandom set of tokens during generation. It develops a detection test that does not require the language model and analyzes how the token distribution affects detection strength.",
      "relationship": "Its related-work section cites Neural Linguistic Steganography among earlier neural information-hiding methods. Its provenance-detection objective differs from concealing the existence of an arbitrary message.",
      "limitation": "Low-entropy text offers less freedom to embed a detectable signal without affecting quality; detection and robustness depend on text length, entropy, and adversarial modifications.",
      "sources": [
        {
          "url": "https://proceedings.mlr.press/v202/kirchenbauer23a.html",
          "evidence": "Full authors, ICML venue, July 23–29 2023, PMLR volume and pages; no publication DOI listed."
        },
        {
          "url": "https://arxiv.org/abs/2301.10226",
          "evidence": "First submission January 24, 2023; later revised versions distinguished."
        },
        {
          "url": "https://proceedings.mlr.press/v202/kirchenbauer23a/kirchenbauer23a.pdf",
          "evidence": "Title-page equal contributions/code; sections 1.2–5 cover entropy and robustness; related work cites Ziegler et al. 2019."
        }
      ],
      "arxiv_url": "https://arxiv.org/abs/2301.10226",
      "earliest_date": "2023-01-24",
      "earliest_date_label": "First arXiv submission",
      "url": "https://proceedings.mlr.press/v202/kirchenbauer23a.html",
      "pdf": "https://proceedings.mlr.press/v202/kirchenbauer23a/kirchenbauer23a.pdf",
      "code": "https://github.com/jwkirchenbauer/lm-watermarking",
      "category": "watermarking",
      "contribution": "Embeds a statistical watermark by softly favoring a pseudorandom set of tokens during generation. It develops a detection test that does not require the language model and analyzes how the token distribution affects detection strength.",
      "canonical_url": "https://steganography.live/reading-list/papers/llm-watermark/"
    },
    {
      "id": "secret-collusion",
      "title": "Secret Collusion among AI Agents: Multi-Agent Deception via Steganography",
      "authors": [
        "Sumeet Ramesh Motwani",
        "Mikhail Baranchuk",
        "Martin Strohmeier",
        "Vijay Bolina",
        "Philip H.S. Torr",
        "Lewis Hammond",
        "Christian Schroeder de Witt"
      ],
      "author_parts": [
        {
          "given": "Sumeet Ramesh",
          "family": "Motwani"
        },
        {
          "given": "Mikhail",
          "family": "Baranchuk"
        },
        {
          "given": "Martin",
          "family": "Strohmeier"
        },
        {
          "given": "Vijay",
          "family": "Bolina"
        },
        {
          "given": "Philip H.S.",
          "family": "Torr"
        },
        {
          "given": "Lewis",
          "family": "Hammond"
        },
        {
          "given": "Christian",
          "family": "Schroeder de Witt"
        }
      ],
      "year": 2024,
      "venue_date": "2024",
      "venue": "Advances in Neural Information Processing Systems",
      "venue_short": "NeurIPS 2024",
      "publication_type": "conference",
      "publisher": null,
      "volume": "37",
      "doi": "10.52202/079017-2336",
      "arxiv_id": "2402.07510",
      "relation": "related",
      "categories": [
        "AI agents",
        "Covert communication",
        "Evaluation"
      ],
      "summary": "Formalizes secret collusion among generative AI agents and develops capability evaluations for covert communication and coordination. It studies individual and multi-agent settings alongside the assumptions and limitations of monitoring and other mitigations.",
      "relationship": "Section 2 identifies Ziegler et al. 2019 as an early AI-generated steganography approach using arithmetic coding; the paper studies the broader agent-security setting rather than extending the STEGASURAS implementation.",
      "limitation": "Its evaluated models show limited advanced steganographic capabilities, and the authors call for more complex multi-agent and real-world evaluations; the results are not evidence that every agent autonomously uses covert channels.",
      "sources": [
        {
          "url": "https://proceedings.neurips.cc/paper_files/paper/2024/hash/861f7dad098aec1c3560fb7add468d41-Abstract-Conference.html",
          "evidence": "Published title, complete authors, NeurIPS 2024 volume 37 and DOI."
        },
        {
          "url": "https://arxiv.org/abs/2402.07510",
          "evidence": "First submission February 12, 2024 and subsequent version dates."
        },
        {
          "url": "https://arxiv.org/html/2402.07510v3",
          "evidence": "Conference-era full text; section 2 links original arithmetic work, sections 5–6 describe evaluations, section 8 states current capability limits and evaluation needs."
        },
        {
          "url": "https://arxiv.org/abs/2402.07510v1",
          "evidence": "Version-specific record verifies original title and February 12, 2024 submission date."
        }
      ],
      "arxiv_url": "https://arxiv.org/abs/2402.07510",
      "earliest_title": "Secret Collusion Among Generative AI Agents",
      "earliest_date": "2024-02-12",
      "earliest_date_label": "First arXiv submission",
      "url": "https://proceedings.neurips.cc/paper_files/paper/2024/hash/861f7dad098aec1c3560fb7add468d41-Abstract-Conference.html",
      "pdf": "https://proceedings.nips.cc/paper_files/paper/2024/file/861f7dad098aec1c3560fb7add468d41-Paper-Conference.pdf",
      "code": null,
      "category": "agents",
      "contribution": "Formalizes secret collusion among generative AI agents and develops capability evaluations for covert communication and coordination. It studies individual and multi-agent settings alongside the assumptions and limitations of monitoring and other mitigations.",
      "canonical_url": "https://steganography.live/reading-list/papers/secret-collusion/"
    },
    {
      "id": "syncpool",
      "title": "Provably Secure Disambiguating Neural Linguistic Steganography",
      "authors": [
        "Yuang Qi",
        "Kejiang Chen",
        "Kai Zeng",
        "Weiming Zhang",
        "Nenghai Yu"
      ],
      "author_parts": [
        {
          "given": "Yuang",
          "family": "Qi"
        },
        {
          "given": "Kejiang",
          "family": "Chen"
        },
        {
          "given": "Kai",
          "family": "Zeng"
        },
        {
          "given": "Weiming",
          "family": "Zhang"
        },
        {
          "given": "Nenghai",
          "family": "Yu"
        }
      ],
      "year": 2025,
      "venue_date": "2025-05",
      "venue": "IEEE Transactions on Dependable and Secure Computing",
      "venue_short": "IEEE TDSC 2025 (preprint 2024)",
      "publication_type": "journal",
      "publisher": "IEEE",
      "volume": "22",
      "issue": "3",
      "pages": "2430–2442",
      "doi": "10.1109/TDSC.2024.3519322",
      "arxiv_id": "2403.17524",
      "relation": "related",
      "categories": [
        "Tokenization",
        "Reliability",
        "Statistical security"
      ],
      "summary": "Introduces SyncPool to resolve subword segmentation ambiguity while preserving the model's token distribution. It groups prefix-related tokens and uses synchronized pseudorandom sampling so a receiver can recover token choices from detokenized text.",
      "relationship": "Cites Neural Linguistic Steganography within neural generation-based methods and addresses a shared implementation issue for modern token-based steganography; it is not presented here as a direct arithmetic-coder replacement.",
      "limitation": "Grouping ambiguous tokens sacrifices some usable entropy and reduces embedding rate; the paper explicitly analyzes this reliability–capacity trade-off.",
      "sources": [
        {
          "url": "https://arxiv.org/abs/2403.17524",
          "evidence": "Full authors, March 26 2024 first submission; December 2024 version says accepted at TDSC."
        },
        {
          "url": "https://api.crossref.org/works/10.1109/TDSC.2024.3519322",
          "evidence": "Publisher-deposited journal title, full authors, May 2025 volume 22 issue 3, pages and DOI."
        },
        {
          "url": "https://arxiv.org/html/2403.17524v2",
          "evidence": "Sections III and IV give construction/evaluations; section V explicitly states embedding-rate loss; introduction links official SyncPool code; reference 4 is NLS."
        }
      ],
      "arxiv_url": "https://arxiv.org/abs/2403.17524",
      "earliest_date": "2024-03-26",
      "earliest_date_label": "First arXiv submission",
      "url": "https://ieeexplore.ieee.org/document/10804596",
      "pdf": "https://arxiv.org/pdf/2403.17524",
      "code": "https://github.com/7-yaya/SyncPool",
      "category": "direct-extension",
      "contribution": "Introduces SyncPool to resolve subword segmentation ambiguity while preserving the model's token distribution. It groups prefix-related tokens and uses synchronized pseudorandom sampling so a receiver can recover token choices from detokenized text.",
      "canonical_url": "https://steganography.live/reading-list/papers/syncpool/"
    },
    {
      "id": "tokenization",
      "title": "Addressing Tokenization Inconsistency in Steganography and Watermarking Based on Large Language Models",
      "authors": [
        "Ruiyi Yan",
        "Yugo Murawaki"
      ],
      "author_parts": [
        {
          "given": "Ruiyi",
          "family": "Yan"
        },
        {
          "given": "Yugo",
          "family": "Murawaki"
        }
      ],
      "year": 2025,
      "venue_date": "2025-11",
      "venue": "Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing",
      "venue_short": "EMNLP 2025",
      "publication_type": "conference",
      "publisher": "Association for Computational Linguistics",
      "pages": "7076–7098",
      "doi": "10.18653/v1/2025.emnlp-main.361",
      "arxiv_id": "2508.20718",
      "relation": "direct-extension",
      "categories": [
        "Tokenization",
        "Reliability",
        "Watermarking"
      ],
      "summary": "Studies tokenization inconsistencies between generated token sequences and the text a receiver retokenizes. It proposes stepwise verification for steganography and post-hoc rollback for watermark detection, evaluating how these changes affect reliability, text quality, and detection.",
      "relationship": "Section 4.1 explicitly uses Ziegler et al.'s arithmetic coding in all steganography experiments, extending the reliability layer around the 2019 approach rather than replacing its coding principle.",
      "limitation": "Steganographic extraction assumes an attacker does not modify the text. The authors report smaller watermarking gains because inconsistent tokens are infrequent and note that a complete theory of the inconsistency mechanism remains open.",
      "sources": [
        {
          "url": "https://aclanthology.org/2025.emnlp-main.361/",
          "evidence": "Full authors, November 2025 venue metadata, pages and DOI."
        },
        {
          "url": "https://arxiv.org/abs/2508.20718",
          "evidence": "First submission August 28, 2025."
        },
        {
          "url": "https://aclanthology.org/2025.emnlp-main.361.pdf",
          "evidence": "Page 1 links code; sections 2–4 describe methods; section 4.1 explicitly uses Ziegler et al. arithmetic coding; Limitations states threat model and scope of improvement."
        }
      ],
      "arxiv_url": "https://arxiv.org/abs/2508.20718",
      "earliest_date": "2025-08-28",
      "earliest_date_label": "First arXiv submission",
      "url": "https://aclanthology.org/2025.emnlp-main.361/",
      "pdf": "https://aclanthology.org/2025.emnlp-main.361.pdf",
      "code": "https://github.com/ryehr/Consistency",
      "category": "direct-extension",
      "contribution": "Studies tokenization inconsistencies between generated token sequences and the text a receiver retokenizes. It proposes stepwise verification for steganography and post-hoc rollback for watermark detection, evaluating how these changes affect reliability, text quality, and detection.",
      "canonical_url": "https://steganography.live/reading-list/papers/tokenization/"
    }
  ]
}